{ "Event": { "published": true, "date": "2021-06-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-06-16", "timestamp": 1623888181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "df30b283-1738-410d-9e27-4ad9f1e16d7e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ab72bf-ce88-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623837131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837131, "uuid": "d08f80c8-91f3-4803-b2b4-50068c0cfdd8", "comment": "Malware payload", "value": "51a19560ad005f1dfaf49d959c2dbe7a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837131, "uuid": "bfe38bf5-9237-47d4-9699-aba10a057912", "comment": "Malware payload", "value": "00175c704e4d534a072f8d777bbb5413dfa32d51fd6b922e88e980c02357b0f1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837131, "uuid": "1ab06cc8-2600-4734-8a2d-57dceae29f2e", "comment": "Malware payload", "value": "660adab2960c1e726e610223e3032595f49f7e74", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837131, "uuid": "60910122-25ae-48ee-a9bb-1137857eb1c6", "comment": "Malware payload", "value": "586d8c6f4e3154cc0690542c5d2bfb21142af2e54c69f785366bc5f76fcd821bc901f5fae02740eda84915fc5455d87e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837131, "uuid": "ad399cf7-15fd-4b6e-9249-8c78d3dd12e9", "value": "1F7567F0AD01D8C1F57E5F6AF2FD3A48A1343227EBC94A4A00E5A5551EF6A11F90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837131, "uuid": "3727ba0d-ad1e-4b67-af20-80043b4b26b7", "value": "12288:ZZ2nkYR5UxLEpyI28DpDwHVfsDpEq3EnCpug3P:akYR5UwyI9pg5Y2q38Cz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837131, "uuid": "58527e81-ba37-4658-b51b-84cf84bb1410", "value": 1613819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837131, "uuid": "1cad14df-dfdf-469b-8b97-b7f4c0f7b47a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837131, "uuid": "e6e8cfb3-2828-4269-92ba-8f78c8b7f226", "value": "DOC0798.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e313a63-cea3-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623848527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848527, "uuid": "a8487d0b-a27a-418a-a0bc-39f50de245af", "comment": "Malware payload (RedLineStealer)", "value": "5121f178170d71a5abadcd2acdd6a2ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848527, "uuid": "38ac8f72-8b2f-4639-a78a-8905c6d790b9", "comment": "Malware payload (RedLineStealer)", "value": "006aebdb520b6ed01cad55e601614775757c72e116eccdbc316ae0422d59a5e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848527, "uuid": "e2292819-cd94-4af6-80e6-96d3086cf579", "comment": "Malware payload (RedLineStealer)", "value": "1ad02afdbcb4d6d0cc387f81598c6c53dd2dd85b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848527, "uuid": "81d1c978-4dea-4705-9cbc-81b20e039b2c", "comment": "Malware payload (RedLineStealer)", "value": "6a6e3f7b7f5fec7dc9a63d2c70ccba23daa5e95e3fd31bc0c2d5bae11f82770e93f23bf173a864495995993c47d6fa20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848527, "uuid": "fe814817-900d-4c19-85c1-04bc92635aa9", "value": "4184462864BFC05985E3EEA22DDCA8FBD99A55E3640C703701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848527, "uuid": "e97ab92c-2e7f-4d8a-9db3-50fbec248424", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848527, "uuid": "280e6edb-6b94-466f-a920-48718f3c99bc", "value": "6144:hbpdMDalvensf2tlnwc9flPY0JRqPj9BdkXdFQUXTfYIwTrV7RofcN:hEalvesf2tlwc9flY0JRqPj9BdkXdFQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848527, "uuid": "3bbaeba6-9038-4b03-bef8-5e95e3babe62", "value": 383856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848527, "uuid": "d7d09ab8-5c38-4eee-8593-42db9c809956", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848527, "uuid": "e39bfcca-bedf-4bb0-98be-4cdfe3584310", "value": "file6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df391d8b-cea1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623848019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848019, "uuid": "bf511159-f34d-44f5-837d-d2b2a199f9c1", "comment": "Malware payload (AgentTesla)", "value": "9cd55e17e1bdc301f1a4ff74860106b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848019, "uuid": "4f361750-6f39-4fbb-98c8-505c07078b73", "comment": "Malware payload (AgentTesla)", "value": "011ed51cc9d788dd0fdb9f1f2ba5ed659503ef771efd4f7f8dd58a9fa07681b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848019, "uuid": "3609c24e-1b02-418d-b79f-1beaea0bc71e", "comment": "Malware payload (AgentTesla)", "value": "9dd53ddeba3b2e027e7a9814b333da8c4305d312", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848019, "uuid": "b6e37c9f-90fb-4da1-b35b-b30db8cc52ad", "comment": "Malware payload (AgentTesla)", "value": "e196bc682df6f4cc3109e197facb505813a6ecf12d6fe8f00e849db4301d7efeb9283170da678edd1a43fc702d48a75d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848019, "uuid": "cc63f595-0e53-48da-a502-d0a7bc4de469", "value": "1B15D4303FB867D6E07AEAA185ABB447C9ED61FA260DC8CD5C5007C157325CB4AF2D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848019, "uuid": "a3c8093e-7d70-45de-a491-7e7789aea7cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848019, "uuid": "e53b09c3-65f7-4ad7-a5f1-c7601c01250b", "value": "24576:p0uY3SWEeqsvsDsS37pfZFvHURt2qUa4P:p0uY3xqsvsx31Hvkt2qUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848019, "uuid": "0e4a057a-22f9-4f53-a330-e1ef1038d124", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848019, "uuid": "8da4659f-0d09-46f9-91c2-7fa4d9b25af0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848019, "uuid": "f968797b-c59c-471b-81e6-cf9bdd47b966", "value": "DOC 202910982722.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d4af7a-cee2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623875869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875869, "uuid": "d18adfe7-f23b-4e5f-b2eb-76c8a5c5a382", "comment": "Malware payload", "value": "ae2cdd1e9a10c9a0d01e697cf2ea9439", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875869, "uuid": "d57f66aa-ffe5-42cd-92c2-f5c249f11ba2", "comment": "Malware payload", "value": "01dbdba0560d1e88a0a0ec3f87d5d8f80bbf6f31cdfb0ca94a5c1f12e11fc37a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875869, "uuid": "df1eb023-c3cd-4b77-ab90-f71bf02e7d1d", "comment": "Malware payload", "value": "fc9343ec91a18ca23dd6441e96f26681c3f1f633", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875869, "uuid": "0bf06061-aebf-4a33-b5a7-a820c70d2c25", "comment": "Malware payload", "value": "1513b78b31289b43e8ba246079045a809ba0d5729275be7e32bb039e40767c206917cc1926f98ec6e882fc95b54ea4aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875869, "uuid": "2981bfa3-860a-4e03-bf75-99df2f7cb955", "value": "9A15DF55BA155CCCD02872B986A3CDE426EC3D20B951C7A379EEFD9A7EE4342494FC02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875869, "uuid": "032fabc8-6dcb-48ca-8acb-6699afe58d10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875869, "uuid": "f4f3d280-6042-4bda-a706-404993238b4d", "value": "12288:ZQBWcenklPVjXhIm5duVet+qWgYC8qCCCLQqIBuV80iqWx3S0lRujGm1nYa//syS:K5UUt+qWDC8qCnUqIBaiziym1nyVTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623875869, "uuid": "7614a513-2c66-45b6-bd11-aa079fdc5a1e", "value": 930304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623875869, "uuid": "ff3e12b2-bcb6-4868-a4ec-8e6c32a6c238", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875869, "uuid": "a4350e76-2156-47f0-9c33-faf53dc9496d", "value": "invoice and packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdfb790-cea7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623850295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850295, "uuid": "ac0e1bb1-cd00-45f0-b336-91f374a4a05a", "comment": "Malware payload (RedLineStealer)", "value": "2411bc67c557e6698bae2b49280de476", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850295, "uuid": "fd11233b-6042-4d67-a4c1-d0b2c63eef89", "comment": "Malware payload (RedLineStealer)", "value": "035f9b824d15f117bf6fa12cc2eda762c11c8288c3c479d8c792f0527ce52740", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850295, "uuid": "3ee8476e-36e1-4301-bc83-84fd2177a722", "comment": "Malware payload (RedLineStealer)", "value": "6668c95fbae789fb2f51854bb642c78fd15c2f34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850295, "uuid": "ae8c379e-5c84-400c-8d30-b51e10ddb3a5", "comment": "Malware payload (RedLineStealer)", "value": "718ecb0c3b61498d6587f6962ed8ccc5222aba64f5cbf948552fa847c56fd50a3daefa73710affc7249906c15910a845", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850295, "uuid": "20ce2adf-669d-44fe-a381-03de03d40096", "value": "8184AE10E7A0C038F1F316F95A7A93F9E92D79B16B3850CB52E526EA56346E0EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850295, "uuid": "c3863bbe-1a8b-4700-9c60-2aed5c377137", "value": "2ab857f73c9912dee0698f559b75c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850295, "uuid": "bd4d648d-77a3-4247-bf0b-f84318d4adb6", "value": "6144:E76vL3ESjObeF+5ZvVrCbTiMSQMlpJborVXp:E76vL3TObeAzkbOrQMPJsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623850295, "uuid": "006d663c-39c7-4014-9eca-79eda610c43b", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623850295, "uuid": "4e3bd894-6e0a-421c-bec6-04275effa638", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850295, "uuid": "1c91ce23-c48c-425d-a973-ea54ff26008e", "value": "2411bc67c557e6698bae2b49280de476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ab86eb-ceb5-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623856593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623856593, "uuid": "f6c29db3-39d3-44ce-bef0-89f2405b0511", "comment": "Malware payload (Quakbot)", "value": "52e0590f1e46fcbdd452a5bc87932841", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623856593, "uuid": "e13f466f-13b5-40b7-a948-a87f24981452", "comment": "Malware payload (Quakbot)", "value": "04398f4485e899edb59413af1fb8befe33b8d7666a1ff6088ae67658b7e5a1ed", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623856593, "uuid": "a39d58ca-2d07-434c-b932-6538fb2e5df1", "comment": "Malware payload (Quakbot)", "value": "cd31e659ee5163efe2d2dc46dd224c28d8ed0a21", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623856593, "uuid": "ac277554-530f-4ad3-8773-58da8116e500", "comment": "Malware payload (Quakbot)", "value": "5a9a25c92efe388016517ee466bf9feae6cedbb53fb26e22d857aa85fd908787e070f773f18c57d2909b158edd5e7e4f", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623856593, "uuid": "e87d949d-66af-4681-9528-3b9d8c3a252b", "value": "0D74127EE74199B8C3398C3EC240A1E48119E2D150A7B71E06DC391CAB533EBDB5D2DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623856593, "uuid": "0e43e511-0265-4da7-9a53-ea465bf76175", "value": "6144:dRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNG:dRMmEv2Bc/nvm8IKABfsYOmauFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623856593, "uuid": "8a173408-cfd3-4453-9733-1cd865664d01", "value": 357044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623856593, "uuid": "c0a3310f-ebeb-406a-bbc7-1998b49d14e5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623856593, "uuid": "f127c5e2-782f-414f-b5e4-64312d88f592", "value": "Rebate_612426110_06142021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842bb7d3-ce8d-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623839276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839276, "uuid": "edf845f5-1498-4e9c-b82d-b41c8ef3086e", "comment": "Malware payload (RemcosRAT)", "value": "d97ed15b1b777c081d862f3ebe900106", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839276, "uuid": "53991adf-7617-45c8-a15a-031150ae6a7d", "comment": "Malware payload (RemcosRAT)", "value": "0514bdf7007b0936e3527bfdae8a7e6f6abf00c0f00281ad37e7ba84a1127e68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839276, "uuid": "23146091-4a76-4017-8ac0-a09b5df859c5", "comment": "Malware payload (RemcosRAT)", "value": "ba637c78461e961c1f07dcb168968ff036e3da8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839276, "uuid": "f752c307-7f00-4f52-a018-609cce2eceec", "comment": "Malware payload (RemcosRAT)", "value": "aa147aebb892948abd1a3d46061acb9907af6fd7c85f7480ccbb416919965a8567d3783c939a9124740aa8523ff90797", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839276, "uuid": "3673948f-19af-4d82-8424-d9f1411bbdaf", "value": "A035D02036F5A148D5FA1B318DBA819403BABE667B54CF2E154A334C9D33393DB11AE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839276, "uuid": "cd00916e-447d-43f7-b75c-1b2ccd9d2946", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839276, "uuid": "c3839fbe-7472-459b-8fb0-2b6f21a72707", "value": "24576:oBquPHp/tNqwbl2H0/aye9IIe++9N7PH9fCmk:oBLtpbK1ye9ne++9hpCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623839276, "uuid": "5b0f3f61-1ca2-4b71-8698-749988b7ecbb", "value": 1080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623839276, "uuid": "d8263824-4b02-47a5-8a08-6cf0955ef17d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839276, "uuid": "a5be500e-781b-45c4-b0bf-cf61f3464910", "value": "Urgent Contract Order GH7856648,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb55633f-cec4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623863018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623863018, "uuid": "f966c184-2394-48ea-9f49-8c6821df2bbe", "comment": "Malware payload", "value": "200cc8caf0725b7a5ccf6c9d20c404d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623863018, "uuid": "19076d9e-944d-44d6-80ea-d2c7c4de59b4", "comment": "Malware payload", "value": "05771ebe7aced89d11a1c750f7b7317214993f8f2b95f400746f0cf82a6ca24f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623863018, "uuid": "e266dbed-05d6-4344-868a-6d7dd5b2d90a", "comment": "Malware payload", "value": "64e835a40aadadd99f7aa0ea4d733390a2781f39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623863018, "uuid": "18ca22d4-154c-4f18-9792-c650e0d78a0e", "comment": "Malware payload", "value": "18e7f28e1efae893c3488af6a43bca6a639edff4c5df12b7c8476db27916c0d54441c8024c245e217dafd66a30a2ce42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623863018, "uuid": "fdfe103b-ca9a-4766-a90f-e74d0d1ab8db", "value": "F6D65C13B2C86539C06A0A7A883F9A58A93F7E316A13CC5767F43D8C8F355407B35A5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623863018, "uuid": "fcf0cf46-6a08-4c00-838e-6640ffad7b52", "value": "98304:AB9rulM5g2Y8rklf5ok5vE2Be/Vc0p7qdMoRmIQG95cpcU8XgAlqi2WoGYEA:AoTJtP8VXqdMosclU8XgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623863018, "uuid": "fcb56888-00d4-439b-9816-e9bd77419c85", "value": 13502976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623863018, "uuid": "e607cbf6-e494-49c6-9239-e0754e116ab7", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623863018, "uuid": "17d52384-d87c-4b2d-bd3a-2846ead17006", "value": "Descargar_Recibo413305079.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33005667-cea0-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623847301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847301, "uuid": "d642939d-6842-4b43-bd0e-d9c43b4074de", "comment": "Malware payload (Formbook)", "value": "ac54ee9ff97927110482c42f8927ee49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847301, "uuid": "9687ca39-e598-4d76-ad19-8221e0bfbedb", "comment": "Malware payload (Formbook)", "value": "05b852b7d9c198bc7bb2937263726a9dd55b1001fce28890b86efc23d764a938", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847301, "uuid": "032739f4-0175-4062-a0d4-36cc71d87a05", "comment": "Malware payload (Formbook)", "value": "f3c7333efe94226db431822abc583cfa90404f79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847301, "uuid": "ef7804b6-478c-4865-96b4-c9c44d9fbba3", "comment": "Malware payload (Formbook)", "value": "1f1df3ff496d23c17659783c5716c8680c08d8929f0cb20a896681542c668efb3f5952018d1f782d70adbad10145bb45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847301, "uuid": "3d510962-fc93-4835-a75f-cb07af3fe3ff", "value": "6715C3303FB867D6E07AEAA145ABB447C9ED61FA260DC8CD5C5007C157326CB4AF2D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847301, "uuid": "4dce498b-b18f-47ee-b9d1-068eae8a7a5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847301, "uuid": "43ee2f3b-b6db-43ac-8893-fb2cbc3cb104", "value": "12288:R3ll/tq0dShlm4S4F3M9ynJzSYAtP9tLBR6MP3xcmXieLJcJ5r:hTtq0dGWoIRtFNx9LJcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623847301, "uuid": "1758d46a-147c-4b08-90fb-6a334b555d2f", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623847301, "uuid": "82db30de-95d5-48b6-9a01-54768285758a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847301, "uuid": "4d8b767c-3742-47fd-9a78-ac1c983ba132", "value": "chems.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08844845-ce68-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623823177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823177, "uuid": "613abd27-440f-46fb-84bc-d4ef91e511dd", "comment": "Malware payload", "value": "4abb7b1456fc4c9aab4a5443a24180ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823177, "uuid": "ee7b8a71-0df7-453b-a45e-60b7266c9346", "comment": "Malware payload", "value": "0788c25a1be555972b8641ff7f475ae8e0f9cd83a05a62a00061c2e5ef597244", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823177, "uuid": "c7dc7732-3877-409b-b66b-808fa76bcfe6", "comment": "Malware payload", "value": "47587ef670a13a352aea769448d6342cfb158cd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823177, "uuid": "0b232277-2404-4ecc-adce-0031710d7702", "comment": "Malware payload", "value": "f307edc612e1657eff35f17282d40e3ca07fba58888a88c71535369bf5fad12610e51dc4bd9bcb1aec2474a750403f98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823177, "uuid": "7638e6e3-2578-435f-b8d1-52c913e02f10", "value": "2215A06977239C18C554B2FC8A52DDF837ED2E10B814DB96BAF17C8A7EA86035CC6047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823177, "uuid": "4a035408-02e5-4129-b972-4f474917d1f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823177, "uuid": "feb385e2-6aa2-444a-9dc6-7c58ca5b2dd3", "value": "12288:tURC02jotn1TUFch5duf2m1yeVZ7j+J5mSHHi5XYJvI3Y5/tJwCFpJ4m9V5e:85Uft1yGm5mcC5XYJh/3DV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623823177, "uuid": "910d0a9c-91f3-493f-ae39-7db26b64fcfa", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623823177, "uuid": "19b35b5a-77e5-4954-b79b-83142a27be90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823177, "uuid": "6b2821ce-9d37-4d2f-83f9-471c5e101ea9", "value": "Inv1198827.pdf(145KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a445f7e-ced5-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623870049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623870049, "uuid": "57e7d030-41f6-49c2-945c-06dd4e0deb2b", "comment": "Malware payload (AsyncRAT)", "value": "4a7f983fea68a6c70e25ec7b87887396", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623870049, "uuid": "44d74816-d8c7-420d-916e-155d4301e286", "comment": "Malware payload (AsyncRAT)", "value": "079b0af0def608e920a3d86730b92bec3635c778e29359725f58eb36701f2ac2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623870049, "uuid": "2b21a534-079c-4467-9d86-d967bfd77511", "comment": "Malware payload (AsyncRAT)", "value": "01dafd5a18505a37b4e95e066480eaf955941fbf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623870049, "uuid": "4866ba80-d90d-4c99-b4bf-84bd81efe95b", "comment": "Malware payload (AsyncRAT)", "value": "7293279514c3e3b11b03bdc84e82c7333608991ed50d3e28a91041b60991e8df7d54c166d1aad64fcf17e23d9ebd7a13", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623870049, "uuid": "ec6c667d-5636-4504-9c58-379ade3f4e72", "value": "2A74BF187FE8E90BC6EC17BA7465079587F3BE117203DBEBA06116E92B13352D91360B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623870049, "uuid": "edc7c1a3-d5f2-4f32-8082-38b081d20295", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623870049, "uuid": "724eea48-8e32-41f4-8a09-8663e0a4bb1f", "value": "6144:e+5tZqSEYjLsC/cLdjI4OWadcjK67HtvGxsusb2hw6jtudCm9SqRDru:e+7ZqrCELtI4O8pHtvGxUKhweuIWSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623870049, "uuid": "1a5aaa43-90e8-4c74-9a4a-5a08d8965e56", "value": 353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623870049, "uuid": "612f9459-15ce-4b64-a97d-6d47ff57d039", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623870049, "uuid": "0262f5e3-6fa7-47b4-8ef1-c96b05c9733f", "value": "4A7F983FEA68A6C70E25EC7B87887396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31864a58-ceac-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623852452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623852452, "uuid": "bf15fe11-6b40-4e68-9660-325489bb2962", "comment": "Malware payload (NanoCore)", "value": "ba603a12a994379fe4425aa9bdccb035", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623852452, "uuid": "762066af-f212-4f32-b6c2-fe9fc091ce11", "comment": "Malware payload (NanoCore)", "value": "08917521a4c3c8956f7f662ed7fc7f9eb45e2d41ffd74cb98ce4b69775403002", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623852452, "uuid": "9d3526a3-36bf-4c07-afac-7605581fad2c", "comment": "Malware payload (NanoCore)", "value": "2504c01499f8fa9447b6c0cc9181156bddfcd024", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623852452, "uuid": "e48d30a7-5e3b-4071-8c4d-5ac35a8903ee", "comment": "Malware payload (NanoCore)", "value": "cebb24162503fac8592150819b78e15349bda740052459d86b99a833d18444f6b232ca625ae88057f68de8f98156f770", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623852452, "uuid": "be8ecbbd-607c-4938-a946-c21c5aaeae31", "value": "3D15E4303FB867D6E57AEAA145AAB447CDED61FA260DC8CD1C5007C117326CB4AF2D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623852452, "uuid": "ce592048-9f89-473e-9373-90fd73f9d739", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623852452, "uuid": "4aa5f6ce-4fed-4c33-a2ac-39c13e3b6c5a", "value": "12288:xql0aoE4Lhlm4S4F3M9yhQQTCnv6KZ6DiLjtOIJZ2dzZFk7FpQcXaH:85oE4dWKISbDiPtl2dQDQcKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623852452, "uuid": "6e58e37a-00b3-438b-a6c3-dabf05ae065d", "value": 942592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623852452, "uuid": "5f7fb917-4979-46fd-a35a-af8558e6cfac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623852452, "uuid": "dc1cabac-1a87-457b-884a-ae9c85cbd57e", "value": "transfer copy tt6911pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e8d970-cea2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623848138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848138, "uuid": "23272280-909a-4166-bf2a-bac63751f976", "comment": "Malware payload (AgentTesla)", "value": "386c7df2266a906ed8cb9ed1b2bbd0b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848138, "uuid": "edce65e2-3528-4738-b255-f5a293fcc1b6", "comment": "Malware payload (AgentTesla)", "value": "0b284e4b0f1f90f8435bef1c4280cb4e60111734566bccc83f009b13673870b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848138, "uuid": "a92c6c8d-c42f-4c0d-a5d1-3a64387f986b", "comment": "Malware payload (AgentTesla)", "value": "a7fb0f05d4db653373e569a94ad246b15468a6f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848138, "uuid": "a214c45b-b0ad-4436-8f1f-2fc82bcab802", "comment": "Malware payload (AgentTesla)", "value": "bd17bd8698a3bffd50414991294ad51c34e5e5d13dd1890e8412e443b5caa5cb8f1d280e5879187dd071763a31cc5372", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848138, "uuid": "6cdf84f9-41c6-4803-93a9-51ec7665aafa", "value": "8515071DBC840B14F179DA319BEE2813A1FA67DA128BD8E91C60D1C163B27DBDF58D11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848138, "uuid": "4e21f1c3-0f89-46fb-9fe3-50fa4155ecff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848138, "uuid": "00619057-32c3-4dde-8733-7608b965f355", "value": "12288:NATZMV6ioKYFWE+7jAKeb7uopEoXl3HelS3x7RUg/rietvK51w2L312JEstRsIUh:F6tIj5eb7npE6ulSXUgfK5v52e8dUfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848138, "uuid": "d1a44c74-9cab-4455-864e-72651f83f036", "value": 933376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848138, "uuid": "0789f552-3f71-4472-83f0-039e4f5e3cd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848138, "uuid": "555559d6-c636-49e8-ae3b-82d91eee42dd", "value": "MInvoice Packing List CORP Invoice R-CONM012 2021-04-26 - large shipment tools (1)2021.05.26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f2f7cc-ce89-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1623837484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837484, "uuid": "de14d75b-a060-40d0-a32e-61408ab8341f", "comment": "Malware payload (Vjw0rm)", "value": "abb769d734f8212d96ea432da12cbc15", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837484, "uuid": "dc29042a-6abb-4eec-9644-f286aca3543e", "comment": "Malware payload (Vjw0rm)", "value": "0b471b1080ff4600483e4459e88aae2bb54f4ba84416b614d58f72bfa24b35a9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837484, "uuid": "ea7ed00f-a0d0-46da-aebd-656cce80d7c0", "comment": "Malware payload (Vjw0rm)", "value": "186d2abc93687bfa9036319641b7fa6f3245b798", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837484, "uuid": "875f0ccf-4523-45f1-b0da-4bc844de4efa", "comment": "Malware payload (Vjw0rm)", "value": "33e89cb6f4df06819e67bb4680fdb9aec0663f25fb489b16ad6d680f099de007198a18e6e4c724b4324844ee293738cf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837484, "uuid": "3be22643-3e1e-43ff-8846-74ac028acbd0", "value": "A581209C284B863C43D23B8B802DD14DCDF548B47E28D2B6148DDAC5360E97987B69BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837484, "uuid": "81fb4924-ccce-4789-9672-ebfc253392fb", "value": "96:SABNo5DCk2c24ZRMHXE6/BIf+Ys+fJgDdQqR7bJyKhhOS4UK:zSb2c24ZRMlBIGYs+fJmfRfGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837484, "uuid": "7156cb1c-7a16-49d8-a5ee-b8cb86802baa", "value": 3877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837484, "uuid": "30b825f5-bdbd-4791-8474-68ca30bf5230", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837484, "uuid": "63b81f71-7c82-45b5-b78d-cf945b0f7e3f", "value": "Invoice #3381.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e64af44-ce5f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623819402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819402, "uuid": "9d8e490b-8765-44d5-a10e-bc03efd257ef", "comment": "Malware payload (AgentTesla)", "value": "0b1df03de941e6e97af337a6e0aa7caf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819402, "uuid": "77baa175-79b2-4cf4-8b01-9973c68b82fb", "comment": "Malware payload (AgentTesla)", "value": "0b65750c9e2f6b01aa32b9871b007186e2675acba3927e74a94e983e5839c7c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819402, "uuid": "cf4f21f5-b23b-429e-b4d4-520f174d20ae", "comment": "Malware payload (AgentTesla)", "value": "f2885a37a492e43305f7e5adc33cf99245c2ee7c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819402, "uuid": "90bc974d-82be-4ee9-bd3b-4f256216b064", "comment": "Malware payload (AgentTesla)", "value": "8468d82449e6bd2807b1e40ca3b83c18706127cf5dfd1747f7bf4279222b81cc1ab793a32bcaa0420de27744574e331c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819402, "uuid": "7f686f6c-bf7e-4b36-a0f4-2dba76276546", "value": "53D42370EF99B7F8CEDB3D407DF56869189A8C05923C9603858ED6A4BE340E85395F83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819402, "uuid": "9f0ab246-9398-4109-bf79-019ce89f3ce9", "value": "12288:DrgUqoEZT8FRscF+hVY9nUTOvlHQX/B74LgFiQg5npbu44dE:DrgUqoEN8F0V3QwJ74x5GE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623819402, "uuid": "3e206cde-8571-4cb5-afdb-dd15ace7a27c", "value": 610784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623819402, "uuid": "8bbcfdec-0b1c-4bf6-a37c-fbaa67175ede", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819402, "uuid": "928e4bf6-e56a-4704-b27a-c58eaa440ddd", "value": "70654 SSEBACT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7696cc1-cea0-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623847523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847523, "uuid": "536eb0b8-6ce0-4cb7-9456-7aace2aa056e", "comment": "Malware payload (Formbook)", "value": "49ac682f029c7c62a38cc9ae2141061d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847523, "uuid": "b18de55e-9d6d-4e8d-b2c4-a33e6b7aa9c4", "comment": "Malware payload (Formbook)", "value": "0b79991d57a301d4cdf1d4cf7234d2ad5afe5a3895e75b9c12d4bd16a385389a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847523, "uuid": "87903b1e-17fb-4c4e-aa3f-0b00ec9b708d", "comment": "Malware payload (Formbook)", "value": "8d900dda0a5003e791119c22c997a4a808dc99f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847523, "uuid": "1bea92e5-cc19-4a29-ac0a-ae24a1206d8e", "comment": "Malware payload (Formbook)", "value": "30dc0b4f0c9f0e16e1170344fd5eb036876eb4b342718041e03efc4fd474154654ea8f56846a12c9cc12887932e34b43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847523, "uuid": "b2e8f722-e66a-43ec-861f-eef812d4722a", "value": "5494D062BAC0AD2BC536D7B4147AD23116FBEE180641D80BB7E4BF6F6B31786E910354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847523, "uuid": "2ecd2058-ee9d-4988-88de-82e573047f7e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847523, "uuid": "4cda5fd2-a753-49f6-b20c-6a0050c81eee", "value": "6144:NQqFb5mFCQcGNYpmUIfvlQdJ2BB0MZP+rWhK1/MiCZSATSitXQPRenl9Ft:J5mFvcyYQhfvig7+1/MBxrhEReld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623847523, "uuid": "a130aae0-e48d-4ab5-b372-89d333d173fe", "value": 431955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623847523, "uuid": "70a74a22-5249-4e57-acbc-ad91dc7e8dc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847523, "uuid": "8c919ed0-622d-48a6-9f27-8d6a4e7583a9", "value": "SKMBT69150632L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db6ee74-ce89-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623837521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837521, "uuid": "71846515-4718-4a02-ac58-8c9158a07fac", "comment": "Malware payload (OskiStealer)", "value": "e945793d12eed13611c7285bf7850367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837521, "uuid": "252ac843-eafd-45cd-84e0-99a609c176a2", "comment": "Malware payload (OskiStealer)", "value": "0bcf1b8bd8da1a53bdfceb847d1d18c10a087460f0ae6f079c57cad7f191e280", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837521, "uuid": "3da9efa8-dfe8-41c8-8902-fa97df476f2d", "comment": "Malware payload (OskiStealer)", "value": "4230e80f360f07385c146c4f26b98a937e10b1df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837521, "uuid": "2a2f1c87-b7e2-4b49-8b41-e94b873e59b4", "comment": "Malware payload (OskiStealer)", "value": "0144b7f5d200903a07a02411550108ba83d853a2f25c6f3c9375716656dcd0b5fe83302e8d60ecc756ddce7646e36f5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837521, "uuid": "d06949e1-4658-44fe-b270-cb627bf9defb", "value": "E664235B61E2DEBBDC6155726F936B1DCE784A0205A141AF63321ECD2C00797363A3EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837521, "uuid": "35b62cbf-0fc3-48db-a986-de301571414a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837521, "uuid": "ea26d49e-b6fd-4dc7-b553-f777dd8ec72d", "value": "6144:xQqTXDiFachVUGeMC6lMBdbDMBMTBd1ALjt3Q2OGgc5w/xCdIOU876tonivE0t:juFxhSGeMC68bDMmTBdOLjO2Bgc5wgh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837521, "uuid": "84616abe-8be4-4d6e-82cf-7b6219452324", "value": 324324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837521, "uuid": "73521c96-c423-4835-8386-3575cc09fd22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837521, "uuid": "53312cf2-99f5-43a0-bffd-57f317b32445", "value": "Quotation Mitchell_RFQ_36496.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b5d121-ceaa-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner)", "timestamp": 1623851525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851525, "uuid": "8465a774-2ad1-494a-87a2-0b9e3797c052", "comment": "Malware payload (CoinMiner)", "value": "0354106169a96da1c91aec1ebf8a8272", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851525, "uuid": "e4246bbb-bf34-438f-9e11-327a185b9734", "comment": "Malware payload (CoinMiner)", "value": "0ef6caf3c70fc49ff21794f2b5e4252ae31180c440154174b8991ccdee940649", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851525, "uuid": "04e17d07-c248-40f7-9d41-9caff532d1fd", "comment": "Malware payload (CoinMiner)", "value": "d0be471c4f90953561cafc3beefcbe2bb7d1b5b3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851525, "uuid": "accd912d-5aa6-471d-b585-186f10747fbd", "comment": "Malware payload (CoinMiner)", "value": "e8bb9ff23690246f58e0bb921b3c61bd8cb9329d5fb69e250e9eb35df2b74052154c162d7ca51b1144c73cee59bf0a76", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851525, "uuid": "473cb3aa-1ea2-49ce-a377-a345f9290180", "value": "43C4235F2EBF4302CC94BE22F9995D453B63D9613B84583DE32AF0268B8571F264631E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851525, "uuid": "bd4c8385-875f-4421-a675-c6f50c7b7832", "value": "12288:R00qHtsdPvqKBxHkKY3CQM/v5GPn2hUo6GUqAkckYLwMYrodo:0qPvzxEWv/hN6rqFckYLwRrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623851525, "uuid": "07e72e14-2f26-4b5b-934e-00da5dd7c018", "value": 576493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623851525, "uuid": "d35effad-b25f-4ac7-9f2b-d913bb8e5c8f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851525, "uuid": "147e10d0-5fe9-4c5e-8555-29e80dd90ac6", "value": "SOA,may 2021.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b821d12c-cee2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623875871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875871, "uuid": "0f87b852-a42e-4d3b-8d74-f9ecc25ec1fc", "comment": "Malware payload", "value": "6e067f84e4f57ec863ca4f194a5b2bd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875871, "uuid": "a8865821-46eb-4845-aec6-8df0c129e408", "comment": "Malware payload", "value": "0f124796fd12d3953bd6bdbc90bbbe5ec76bf9d7e81f4076d35bbbcad0252cbe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875871, "uuid": "0428600c-a8af-4bae-82eb-f2adb7fbba6c", "comment": "Malware payload", "value": "b6f2b4c0999e3eb1cf1e4681fbfbcaf760ac6631", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875871, "uuid": "f841e363-f73a-4c08-b4a0-7166004ed63f", "comment": "Malware payload", "value": "887b741ba9066aaa95a1303a239a33d43cb2538fcb022b88c663083debe913474a568e735f511fef5eb2f69b4dee58c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875871, "uuid": "52997de7-badc-4a29-b325-124c91491ca0", "value": "6E933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875871, "uuid": "6fb40d9e-fa5a-4bf5-a84f-a8b7069e4eae", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8Ml4umXxVqDrstKfz9e:Q97vk51RcG7ACl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623875871, "uuid": "c9291e0e-80e3-4eb4-8c64-9e3fb32c0c00", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623875871, "uuid": "e1b729c7-6c18-422b-b43b-bbe748722ebe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875871, "uuid": "0b8150c8-4e87-4824-9332-0bf62c042dc9", "value": "6e067f84e4f57ec863ca4f194a5b2bd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d367cb-cea3-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623848520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848520, "uuid": "a57bfa05-ef6b-4517-b5c9-ea9abf1dd825", "comment": "Malware payload (RedLineStealer)", "value": "3e75183903c2d281e86841eff0460602", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848520, "uuid": "428d2371-6890-4b67-ad45-e3408e4b291f", "comment": "Malware payload (RedLineStealer)", "value": "0f46d6e5d68bc545730ec2ac05d6ecde721437e0fb4dad8be97ddcdced1b50e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848520, "uuid": "6d92fa5c-66c9-44b0-af9b-aa3f7d6de0ae", "comment": "Malware payload (RedLineStealer)", "value": "974e4ba0719a8127e5087cd7edfa98b5350d2801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848520, "uuid": "1fd1c34b-f7e0-4314-bae3-520869248440", "comment": "Malware payload (RedLineStealer)", "value": "fae499a7c9d82ff35f633bebbb8b57047f0735c6d2c1f81f52ba2c6f9b5f603e571a0180691de447282806590d4f7952", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848520, "uuid": "6bc34495-e9fa-49f7-84f0-a488085f2fec", "value": "10D41E1825BFD019C4A7EEB12DDC98BAD99994E3A50E723311B4633B4B51788DE0F1BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848520, "uuid": "7a0c7382-6704-4748-9bad-a0a8ffa41c76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848520, "uuid": "e742b8c0-e4bc-44a4-b993-63dee65c78e0", "value": "12288:gG1lxZEkEkEkERMXSealveEh2f7Ac9f2m0J32byg5lXU7ff0YIwvn2OVKT:DbEkEkEkEvUTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848520, "uuid": "53fa7b11-3a99-47b8-8dee-350994cc988b", "value": 620400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848520, "uuid": "4eacbcdd-1f18-49c8-b4dd-79206d7803a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848520, "uuid": "ae7f46d1-0044-49c1-b836-307cccbbe7de", "value": "file2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5505f7c-ce5f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623819602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819602, "uuid": "e9c37518-f107-4fce-a574-1fe80be99e2d", "comment": "Malware payload (SnakeKeylogger)", "value": "c84f0a4bb73d02377c035ef18bf05467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819602, "uuid": "2f933ad9-aff1-49a9-b300-f329dc77b410", "comment": "Malware payload (SnakeKeylogger)", "value": "0ff8a0051138905969d6c762ab6bfb707348312de90884d4647c4168a501edbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819602, "uuid": "2739098d-22b1-44d4-a1a6-c3c1f90dda97", "comment": "Malware payload (SnakeKeylogger)", "value": "984a3aa9949e2412fdc212b87ae9fb0071beedeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819602, "uuid": "85dec98d-88df-412d-bfca-84ffec173ce6", "comment": "Malware payload (SnakeKeylogger)", "value": "0cc8be4a952ca6b83c37516f9857ab5b1578849cab53c668b114c2998c9c452f3716063e8da2ce01ec2c32845142165d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819602, "uuid": "b0a45d2f-9eaf-4519-a2f4-1d2b9233a838", "value": "46F4AF3036EA9148D5FE1B318DBA819403BABE267B50CB1E654A324C9D33753DB11BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819602, "uuid": "2d9227d0-9b68-4753-8c8a-28a188c24ced", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819602, "uuid": "5691dc0b-3304-4e53-aa84-1226c5a3f107", "value": "12288:1kWiFvquwaHpVbn3XB06V36eQhF+/nzOKyaZJS7AqEhMB10L+P:CquPHpV7R06V36eiF+/nSkJS7AqE410K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623819602, "uuid": "47c847b9-3ad5-4924-b5f9-73b7b7d7fc1d", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623819602, "uuid": "4ea76678-eb60-43c3-ad8c-0fc9e46de3a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819602, "uuid": "14bf336f-5b76-450b-88cd-b7dfbd07b363", "value": "\u65b0\u8a02\u55ae_WJO-001.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb026cdf-cee2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623875876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875876, "uuid": "61046335-070f-4d74-8ca6-3f95d1095141", "comment": "Malware payload", "value": "af78e31830ca42c04e00f9a670885a4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875876, "uuid": "2feba9f6-eb3c-414a-820f-da7613d4c2d6", "comment": "Malware payload", "value": "1099830d9a44f69fdf96bb8a37a3e17c410c1965a2cb4aadc9cc7c035d8d83e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875876, "uuid": "c17602bf-32d0-47e2-a1e0-755e118095db", "comment": "Malware payload", "value": "a7f8a51b2ee6a5bdec895ae8a375f9ddbe0edf02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875876, "uuid": "8d178f82-bf06-427a-9315-19b3c371a501", "comment": "Malware payload", "value": "b4a12e6ca85c5a1da0de50be69c1bbf57ecbb0076c80dd3cee106963cf9f37091bf60f51c0f8b09eac97cfb4fd4b8c20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875876, "uuid": "cb0b1586-f7cb-4f2e-a82b-6208706a3233", "value": "97B31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875876, "uuid": "db8c7788-ccd6-4689-8cdb-c572891c7aa1", "value": "3072:MSY+46m1qOzssLFPPKNy+AmkZrQAhPDCXFke:06mgOzJLFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623875876, "uuid": "f742e3e6-5102-45af-b129-751645020d18", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623875876, "uuid": "bf1d995b-ce3b-41e7-b8ce-f7207e1a3e97", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875876, "uuid": "f6168c77-6624-470b-83f0-b894c70d2625", "value": "af78e31830ca42c04e00f9a670885a4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27da219-ceea-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623879378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623879378, "uuid": "e14bf995-ad89-4f5c-9448-977148178e71", "comment": "Malware payload (DCRat)", "value": "8c52f4ee7657a8e63c9436185ec8c33a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623879378, "uuid": "ee63cbad-9d18-4dcf-b39e-f01d831e9993", "comment": "Malware payload (DCRat)", "value": "1122eb896f02c22a4ed1a896b55c47846115dfb5a84846ca73455801040a150c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623879378, "uuid": "d36da0e5-d5b6-4fc3-9467-384588327a0d", "comment": "Malware payload (DCRat)", "value": "7894dd5b945d5ef85f0ae64ebb8cff5cc9516188", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623879378, "uuid": "0ce1f63b-8ef5-43b7-a29c-710b7f7c98cc", "comment": "Malware payload (DCRat)", "value": "9a6cfe7d7b91e0323eba9b41d350d71e5956f71709f86fecf7e254402a6dc2049da923a61b99e96ed13a87aedb38142c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623879378, "uuid": "8856fcb4-2a73-4b9e-8114-4945c17fe177", "value": "0CE522065FEDDE54D1EEC7F428EF081267B6A243F6A697191DB080E07E833165B8A05F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623879378, "uuid": "d358f2db-c2c0-405e-bb36-625a2ea35ddf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623879378, "uuid": "b3c97848-a489-4310-bee3-06858edb7b9e", "value": "49152:QpscACmckMmwI9dCorvlDgA0rV6CIpBKhk75O44RY4X2r31LmxoDB5M1jG/F2ZMk:JFsLI9RNQrkxav4n4XG31q5jOMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623879378, "uuid": "dd950eaf-7135-4682-affc-df48bd70e992", "value": 3231744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623879378, "uuid": "1761f4dd-33ae-4200-9040-ba6651ea9032", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623879378, "uuid": "6c62d066-74ee-46e2-b49e-059f90e31b47", "value": "1122EB896F02C22A4ED1A896B55C47846115DFB5A8484.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47563a3-ce9b-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623845370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623845370, "uuid": "292c1ff0-3527-4a5c-9339-94876e96bb5b", "comment": "Malware payload (Quakbot)", "value": "7101d7323759a9a42961f71688c606ea", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623845370, "uuid": "be574264-38d6-40bc-950b-e1109967df98", "comment": "Malware payload (Quakbot)", "value": "1211cef85d22e4b7206ff68dfa8de50089ee4ea713840030e81ebbb422e9cb58", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623845370, "uuid": "ff04022c-869e-4907-9d95-4acdbb86b024", "comment": "Malware payload (Quakbot)", "value": "dac3cb6f4f52e131f4b159c4ccfb5f1fed4ddd5c", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623845370, "uuid": "2f7947de-0f3f-453c-baf8-eaa6433aee2d", "comment": "Malware payload (Quakbot)", "value": "faf28be2991cf4201a34831ac3106017d17f00a65a3a77338d07e3b67505c1b30feb5a7337798216747e120620a61360", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623845370, "uuid": "e16496a6-7b75-4889-a4d0-0625472f6c47", "value": "D2F3124F60A160FCCF11203556429DF05E1A702BA782FD8F1EE12F8A6A625D733DD79A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623845370, "uuid": "98adca05-5473-4f13-8d20-19a660fb9a58", "value": "3072:SxVymd1xXPMU9VlUBWA6CFvA7bRCxAVIKwh9vajtC1gBbZuqc:SxVyWxfMU3liWA6FsYQQegBbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623845370, "uuid": "65f48f47-c7e1-4217-8dcf-6bb34d44975d", "value": 160060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623845370, "uuid": "fdd2345b-d5ee-4897-947a-09a8641da7dd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623845370, "uuid": "967cd17c-799a-424c-9d3a-b510c81a3337", "value": "aim-1138041565.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "118dbb2e-cea3-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1623848533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848533, "uuid": "b38edbe1-ec3c-45ec-b11a-cdbf0693163e", "comment": "Malware payload (Smoke Loader)", "value": "b07fbe440c97f27a19b30db39559e7c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848533, "uuid": "66bb9c03-d800-4a19-a72b-9921f9d383fd", "comment": "Malware payload (Smoke Loader)", "value": "13cb7156b54db1b9d8ff5c405e9324899cd7ef801bdff04b1155dd9b104f7cdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848533, "uuid": "9dc3dbd3-d13f-48ac-9279-6ea9dbb0a94a", "comment": "Malware payload (Smoke Loader)", "value": "c24fba1ba6abcd2f1ddc11b9ee4f4509d4af2798", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848533, "uuid": "c0093584-021b-4507-a80b-34b66aaf4a2f", "comment": "Malware payload (Smoke Loader)", "value": "8a3b653d4374700d257792276b5c739d3011e13c6785a729e51b65bbdf423ce8f0a8392d86ca5690e97a0af6719a898d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848533, "uuid": "0c9025fe-20cf-463b-8c19-fd9ff91bae70", "value": "15748E00A7A0C034F7B312F859BA9379A93E7A71AB7490CF56D11AEE46746E0EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848533, "uuid": "e6903c88-d8d6-4955-b42d-3a3a2a482a96", "value": "f15a946d6e0659432dc9b8c464554438", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848533, "uuid": "4e2b8ce6-e82b-4e19-af7b-045fefaac946", "value": "3072:eO1I9MOaQ0rqbmqXcvGCF9BcYExlcXKb5pNI2QY9Gq5Ixxd1at0CESXHcfBNHxkf:eOS9zr9XcvZTexlDnNge5KdCcZ4S7Pe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848533, "uuid": "6c1d8b52-ae79-4850-b785-5e2d521b1487", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848533, "uuid": "0303c092-7989-40b2-8c50-01ab6df11149", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848533, "uuid": "427b87b0-183c-4c1a-abb7-f2060836b0ea", "value": "toolspab2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a52e976-cee3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623876197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623876197, "uuid": "5760af04-d9cc-4051-8f0b-dc1b1499885c", "comment": "Malware payload", "value": "b121274892741daa830fad70ae19d20c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623876197, "uuid": "ff417dce-b99a-4bb1-a72b-d367517e9ea7", "comment": "Malware payload", "value": "1427056d7ba04bf926cf69d5f1355a2ff4e380b8530d31f7914afc9cd24d8096", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623876197, "uuid": "d5db4250-220d-4b7f-b111-7b925b07ef5d", "comment": "Malware payload", "value": "06f24aa139bdef2e685aa01b522727995a82f313", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623876197, "uuid": "9f96f634-6faf-43de-96e4-90c138593687", "comment": "Malware payload", "value": "caa475f70e2a1e938afe7cb095ce42e24ad908a35fcf7e40a4c8fcbaeea1401dbb4bf55599b423184b1dca065afe4d89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623876197, "uuid": "2e4e895e-95a9-4d16-af61-5703471c3bcd", "value": "3FA31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623876197, "uuid": "dd95efef-2260-4897-a049-9b702a62af96", "value": "3072:VSx+i6mqaObhNSnPNKV+qKmZuqQ4DPwXXtse:y6mRObnSnP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623876197, "uuid": "a888584d-f59b-4aba-ba38-2cf97874df34", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623876197, "uuid": "896a09a8-3a15-4cdc-b8a0-4a4dafa7da57", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623876197, "uuid": "6ce73e01-e911-4605-a792-91d20e1f043b", "value": "b121274892741daa830fad70ae19d20c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd77429-ce69-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623823695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823695, "uuid": "5a9ac73d-689f-4893-ab08-7bc8236afb91", "comment": "Malware payload", "value": "f6f27a534d477f6c03c7c747da3b72cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823695, "uuid": "424a8ab7-1963-4108-bd89-abe909444f68", "comment": "Malware payload", "value": "144ebe8ca6e8ac9e13eb3c10fdc21e79da1b0ad5148312ee7f9fd015efcdf6f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823695, "uuid": "4ef775ba-a65e-4aba-81e3-c85373c16453", "comment": "Malware payload", "value": "ba370d52f3c2b7bb0ca2db9a15922166bb9d8d07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823695, "uuid": "8aaae8a1-a495-43c3-8486-6472407371e2", "comment": "Malware payload", "value": "693896fe810efb38bcdf6e6fc18fa50451db63ca15d1f839f3251189239b69c0d8a23332ba6af6cd2c7485bceb8ecb96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823695, "uuid": "635ead21-7a7f-499b-abac-c0ba871986a8", "value": "0FF4CF303AFA524DE5BA1B30097582C512F77B6B7B14CA2E2959520CAE73743CB21B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823695, "uuid": "41a31997-bf99-4cc6-9890-fc1aa4dc1bf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823695, "uuid": "fab755cb-c4f4-4934-ae37-1d258382d4b4", "value": "12288:xs2gFbvquwaHp2tGzTa/UR0Bdrj9pdi5VMRmzms2CNYgW3tzlLeY3fD2ZtN7:wFLquPHpjR0Bdrhji5VM2DvNLWTKYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623823695, "uuid": "53424a97-54d2-4a7b-aa26-327152521325", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623823695, "uuid": "1d07c7b9-1601-46a7-9944-fb3e545cfe58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823695, "uuid": "20031b20-9109-48a0-925e-9d91f09f865a", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431bc87a-ceab-11eb-875b-42010a9c0053", "comment": "Malware payload (Glupteba)", "timestamp": 1623852052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623852052, "uuid": "e6d7ba23-1293-41e4-b8c6-f63a336f3d5b", "comment": "Malware payload (Glupteba)", "value": "10f74ec5669234291d6b5f2ad02ccc46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623852052, "uuid": "a44e3b57-9cea-49dc-93e7-23ccfba1205e", "comment": "Malware payload (Glupteba)", "value": "146f903893804a1301d94cd7a0c391f4d49b04e0d166a53f08eb99eb79b2fed8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623852052, "uuid": "87f2cdd9-1da2-433f-b2b0-5636709c1d6c", "comment": "Malware payload (Glupteba)", "value": "c756b0a9c8051906ed47f798e42a8ef56b676f12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623852052, "uuid": "69b2731e-4311-4de3-ade0-fb3316b2c7b8", "comment": "Malware payload (Glupteba)", "value": "5d8082c46cd893f53d5fe893eda8635becbf73ab591c16513e09341c42e6ab14eab0eeeeb57f7b6a8d7b0d486423d86d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623852052, "uuid": "2a82b659-eb0c-4816-abd5-9a7e78d6b4f0", "value": "BC26330066B1C024F4F752F996FB53B4A13AFA311B6DD1CB66E516E6E3202D2AC70727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623852052, "uuid": "7ce6cff7-f011-41aa-b6d5-f1b968d773ab", "value": "9b6cb8fb7864152f2c65c8441d386700", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623852052, "uuid": "02b7d0d1-2d3f-42f3-b8d8-9db7c2d8f284", "value": "49152:nABULXYvDkMcnZSYgLMBQBDHjWz0Kt8fdqEzFooD4dudQd7Do7B8uT8op6jJIsUv:ABUgoMcngYkM+JsxAI4zdQ1OOoYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623852052, "uuid": "a65e5efb-6c4e-42a2-9181-bafa807fe390", "value": 4726824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623852052, "uuid": "70a4f2f1-7a55-4549-99c7-8fdafccea666", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623852052, "uuid": "a6c6b19e-be0b-4732-b5d9-be22a6e840d0", "value": "unk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf86986-cea5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623849411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849411, "uuid": "0ca637e2-6426-4917-81a0-5dc47e1b0b21", "comment": "Malware payload", "value": "08e02983bf912205efca8487bb62107f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849411, "uuid": "1a767d2a-264e-464a-bc3d-74df4cfe475b", "comment": "Malware payload", "value": "14b59820da7ad7abfb536b1303d7480c459bded64d0444f275a24168f90a4e53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849411, "uuid": "e82ef568-fe5e-4b61-99b2-9efa5bf1e1a4", "comment": "Malware payload", "value": "cfe6e8397409dac32ba08eb3d2d281604f6f3629", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849411, "uuid": "f7d8b8b7-b640-459a-97e3-7d29caa9f146", "comment": "Malware payload", "value": "a7d0558b55dd53291bc29a53fd32abe116f54e3a3ef1394c3e7df5548e9a373fedafed0bf0ac3fde04539f7e2b6f9ea4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849411, "uuid": "6a66391a-cbaf-4761-b6e9-0cb824731e21", "value": "AE657D21F642D037F9E200B2C5FE877F89387631071494D7A3D419AD9A61AE27A3F627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849411, "uuid": "22dbb958-298d-48f1-87ba-dae6bf8e8acf", "value": "4f0608b5638c60342069764638589dcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849411, "uuid": "bbcc7705-087c-4a24-9c71-c2c8e34fd2f9", "value": "24576:0tG3Cprsr3Q1DLwfZVnff7gi41jCAmi+F3GwxUQdiJxSuafLNlOIFLE:z3Cp8QdLeVnX7z4lzK3jUQwDSuaTNlOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623849411, "uuid": "8e4b4c9d-0336-4f7b-a2e0-0a914b9412a4", "value": 1449984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623849411, "uuid": "ad15a8fb-9a83-450c-9909-4ca3c165af7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849411, "uuid": "35a68068-1f0d-4d0a-96a3-d660ecbd28c1", "value": "askinstall46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc42f72b-cec2-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623862187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623862187, "uuid": "b95074e0-3519-4dfa-9efe-f61e4a5638e6", "comment": "Malware payload (Quakbot)", "value": "c5c22867d434a8a8b57356c04d8dc78d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama60", "colour": "#DEE56F", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623862187, "uuid": "88ad21ea-5de1-465e-a513-f84fc39681ab", "comment": "Malware payload (Quakbot)", "value": "1507546bc27652090971bbe5c661030092c57d966d0bb38fc8444f96c669fe2c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama60", "colour": "#DEE56F", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623862187, "uuid": "92ec1aa1-b249-4600-bc1e-94604ae11af1", "comment": "Malware payload (Quakbot)", "value": "29824678f9b02c7fabfc06fda7809cd87331e433", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama60", "colour": "#DEE56F", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623862187, "uuid": "0fa04456-60b0-4e79-a772-d55207a16c79", "comment": "Malware payload (Quakbot)", "value": "dc0bf1cdb454f9d575bf5231b86d5815eb96985fb6d8c7389d1306792cd9d560b77346d4a8f2f7ed9d1f2e5069d84d30", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama60", "colour": "#DEE56F", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623862187, "uuid": "0ef79d69-6477-4e82-a4b2-369d9a389c5d", "value": "2D454A00B651A024F9B606F54FAEE1985B3C7DD11B2490DF72D06EEF5E29AE3AC30716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623862187, "uuid": "72c4891f-fe73-453c-9428-9af790db8c8c", "value": "9ad8fb29ab5ef670bcc1e861d3d4e6e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623862187, "uuid": "21bfa50a-d14b-4c5b-b10e-f6c7148c515a", "value": "12288:SCP8r0VppTDIPZ3yFjNi8GOwFgzM50SyW/XGNsXtNQ0NAb0cRm4cw5aGwYocvSMP:SCPoPVyFjU8VwFGkIb0ck4cwM9/kSMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623862187, "uuid": "c1f67a17-02ef-4805-b110-7934505592c0", "value": 1211392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623862187, "uuid": "e6e87170-f5e5-42b1-a02d-0f2d463d7047", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623862187, "uuid": "382435d3-70ce-4cc1-9227-a654bc98c030", "value": "44363.57011875.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0486f922-ce60-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623819735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819735, "uuid": "81d858f4-a474-42d1-a167-91c0f1e41087", "comment": "Malware payload (AgentTesla)", "value": "189f751060c06e1f314e66caa6fe863f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819735, "uuid": "d7967e8d-f226-4e0f-9df0-12d6ea9e7dca", "comment": "Malware payload (AgentTesla)", "value": "15e4b7a4a7ca443ebbcda9380409bdf0bfeac547c7bc71b040ef8d4b26402b8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819735, "uuid": "c7929027-5874-43e1-bb66-69ad038b81d2", "comment": "Malware payload (AgentTesla)", "value": "1773a39aae74af10283f1f25978c1eb1afc37d69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819735, "uuid": "5dc90d43-0884-4486-babc-68609a9c9ac7", "comment": "Malware payload (AgentTesla)", "value": "d1a01380009e47dc118e6f877c9cf83da709a87966e4ce143a0654a0e6f6dada54ce3395a2abf6606482f74db8dc4883", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819735, "uuid": "4adb3199-d56e-433a-b6f8-989176e9c774", "value": "ACD4F11433AC1124C6B74B7F98B0E211C77DA133BA5ADB09365512AE0AD3F81DE53A7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819735, "uuid": "2ffa351a-c3cb-423b-b519-8ed886b46653", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819735, "uuid": "71c2e19e-6cc9-4200-94a5-7435f9dfb9d9", "value": "12288:eMKDtd8xMwkVeagNsHHvEnHeJOPfhE5EpPpI4fYJ9KuHJo6Wtj:PK0kkagm8nHeJkfe5cp/uHJo6Wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623819735, "uuid": "b64bf3cc-8b62-4f43-93ef-7cb1aefd5fb6", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623819735, "uuid": "98081fa6-0485-475d-ac68-bd81c82202e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819735, "uuid": "9ec9a022-b8ec-4085-bccd-330b189c53d3", "value": "P.O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f6da8c-cea3-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623848748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848748, "uuid": "17696cd8-1623-440e-9d91-aaf56d3f4723", "comment": "Malware payload (RedLineStealer)", "value": "5999beb30e0ac5e3ce77c696c7da2f42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848748, "uuid": "d7018e2e-a5bb-4a16-8e46-2aadd237dba9", "comment": "Malware payload (RedLineStealer)", "value": "1700128c1e187e227586ce4e900b7a1e12d89a2c6098341c16d55940e2efe818", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848748, "uuid": "3ac0deba-78f7-4f3e-b1a4-4e43fab8a546", "comment": "Malware payload (RedLineStealer)", "value": "065bcd4848a0adc4e53a046a866a6ca6dc27d3bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848748, "uuid": "e2e30f1f-974a-4d3d-95f8-ace7ff1da56b", "comment": "Malware payload (RedLineStealer)", "value": "3df43ac9b6a268c0dc6e3f507533189272ab112c56ab5b0cf207674cfa6ac1fb7403e5609a39eade2bf42fec35772f76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848748, "uuid": "783d0b65-2985-4c4f-a644-214f617bc090", "value": "05E4F100B7A2C035F5F352F459B6A379A92E7EB16B3990CF12D61AFA46345E0AC70317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848748, "uuid": "c043efa4-8b6c-473e-95c4-468ea8019b5e", "value": "22d54580109f0c9a62e58d52129bb603", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848748, "uuid": "0f6c6efe-2c32-4051-8bda-fbc841687b1b", "value": "12288:9X50jNucUktElGsC/1KZTJQ6b0FqMR0lnnfX//P/3gef:9p0hHGc/G1QaCR0hnfvBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848748, "uuid": "75d6274a-ff30-48db-ba9e-4a5574c9af0c", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848748, "uuid": "0a5e2fbb-6e54-4f86-ba95-eb2e02ce6df6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848748, "uuid": "33e29a18-06d8-466c-a9a6-93de316098c5", "value": "5999beb30e0ac5e3ce77c696c7da2f42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5944ba-ce71-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623827127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623827127, "uuid": "43af74e2-8711-40c6-9f8b-4d103caacc82", "comment": "Malware payload (RedLineStealer)", "value": "d1bcf0f42f1ad5bacc8f3eaa39369a6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623827127, "uuid": "45e3158e-83bd-4e03-ac21-eb049a1e863c", "comment": "Malware payload (RedLineStealer)", "value": "1783f2bfd5814d592a2c85e83cb508f1ea12df3634122c45abc8e766d57a5080", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623827127, "uuid": "ac4822f5-3086-41a9-bbed-9969248262ed", "comment": "Malware payload (RedLineStealer)", "value": "5632a52e56c39624cca38e526c04be458b55e593", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623827127, "uuid": "55f62908-0182-4d39-bfdc-b7e4cec483f3", "comment": "Malware payload (RedLineStealer)", "value": "02fcc17055ae7df42d6c75d13d272e599f3c9e388f87d2fde41bdce025e6686ae8b65a8eefb4c5b57dac631849ffb0df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623827127, "uuid": "978dae9e-c16a-4831-acbc-ed0ea05795ce", "value": "5784AF01A7A0C039F0F356F95A7A93B9A93D7AB0673890CF52D526EE56346E0EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623827127, "uuid": "459d88d4-0550-45d3-8180-db7e9adb4509", "value": "22d54580109f0c9a62e58d52129bb603", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623827127, "uuid": "858c6870-cf25-4e16-98ed-f15b249dce62", "value": "6144:fHItLHgCT+Wk5gYn6/rZ0CuJkE24yriGEZ4Z2NwWjXQG:fHItLHH+WkigO2C3PE+swq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623827127, "uuid": "cb319f7c-e56c-4c6d-b262-5a12c8ec111f", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623827127, "uuid": "b0e13ccb-e7f0-4cc5-9cec-b1cb140c6906", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623827127, "uuid": "c59db645-e84c-4d95-b950-8c4b82d80b00", "value": "d1bcf0f42f1ad5bacc8f3eaa39369a6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f77110-ce89-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623837449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837449, "uuid": "9ed0d10e-7220-4d31-b1b3-bf5529aa88e9", "comment": "Malware payload (Loki)", "value": "35a97a96938a58ff6042e9d89889b3eb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837449, "uuid": "f49a5184-0236-4f99-8165-84b4d04be3eb", "comment": "Malware payload (Loki)", "value": "189a67f95b513ce1d2c0ca103b9db6471d816bfe8be798a9e6b16d7eae4de551", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837449, "uuid": "432ae890-b64e-441c-8543-3e7405a0ea72", "comment": "Malware payload (Loki)", "value": "e8cbddded9d32009dc2a549fe5a7aa024cd8cf31", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837449, "uuid": "4c6631be-6d15-46bb-b7c5-b8b1f09b1ff8", "comment": "Malware payload (Loki)", "value": "1d52f76715e2ffc57639901a48c9d62b4b0624d5e902dc08b464b337c3690ed8cf02fcdf795c7f500b617e3fea47cc66", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837449, "uuid": "d0542e98-8dd7-4a23-8876-2eca3a1c8a1a", "value": "4B9423D97217B3D04E33FE6298F54BF0459D4193882A4237E64959880FE0BF4A1EBE5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837449, "uuid": "8a8e4d27-eed9-402b-8591-2bba3eb10da1", "value": "12288:tFZHgtsaNGuoNjenseY8cxsOzSfQ29j9G:TlgpNGusLpnGt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837449, "uuid": "d765d2ba-8bbb-4fc3-b6fe-2d766a9ff55f", "value": 423045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837449, "uuid": "4289a447-2700-4e44-a21e-5a52ee2bcd5f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837449, "uuid": "137d052c-2e5f-4244-85a8-5c3f0bf5e3aa", "value": "PROFORMA REQUEST.PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece8e30c-ced6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623870805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623870805, "uuid": "bd83053b-3a41-4b04-ad84-ab2525320be4", "comment": "Malware payload", "value": "608d89a9afafdce353965d9ee16bd433", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623870805, "uuid": "1eed4f1e-198b-47d9-9ac5-002bea94da31", "comment": "Malware payload", "value": "192c127cfb5e8ba572cda74b035db1b7cceaff14b218bac1dfd75f8e85fca5b5", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623870805, "uuid": "c7e2503d-fe6c-472e-81fd-3f71a91a671b", "comment": "Malware payload", "value": "054131aafa87bdd7a624a39a2ff6161bdf29ced1", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623870805, "uuid": "25c2f39e-98fd-47c7-a592-9bfa653e7756", "comment": "Malware payload", "value": "52083ca8f2932c1506f9ca1871aaccdf89fb1cd0bfa6f91c735fc7fd27634d8a369e214b5223da670bf76a832672e6a6", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623870805, "uuid": "c63284a8-673f-4a28-a58d-507bf6137578", "value": "1D24BE12F294D85BC55503714DD3C6E92B39FC53DE228B0B3384BB2E2E72AC4DA17666", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623870805, "uuid": "28fcfdbe-d2db-4422-80de-84a448ac7746", "value": "6144:dxEtjPOtioVjDGUU1qfDlavx+W2QnWxuXksb4dlBTNMO57imHK002LR+:Jj2MzqsLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623870805, "uuid": "fdd810e6-62f3-44d9-8304-2742b2ac15f1", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623870805, "uuid": "2e5045c7-fc05-45bf-a88b-cae689116dd2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623870805, "uuid": "b6c960c5-35f4-45c7-ae7b-ecd8ae4a58b1", "value": "608d89a9afafdce353965d9ee16bd433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774ab2c1-cebb-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1623859012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859012, "uuid": "9bb3940a-b2da-4cdc-a952-b595362039d8", "comment": "Malware payload (Hancitor)", "value": "492f1fe921434e0b0d0ab47b4c999cf1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859012, "uuid": "cb4ab21f-ea9a-48b6-9cd9-e1295915f8d9", "comment": "Malware payload (Hancitor)", "value": "1a6deb22c9fe9c9be6788420b341588de1083d3c0ae7411bf5bf231b1172fcc6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859012, "uuid": "0ec05f7b-9c53-4069-87d1-a22dd273fabd", "comment": "Malware payload (Hancitor)", "value": "9699d9c0c2334a83222c3d2fbf151d85dfaa3b65", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859012, "uuid": "4b0481bc-90bd-4e76-9e4d-ef9547aa36a8", "comment": "Malware payload (Hancitor)", "value": "650b7f267f070109a507bc703a1b6261b382067ccb5a4853bd77d66e90bad4dec78c7025aaa13c7057fe82dd22022bcb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859012, "uuid": "e8cb8b3f-ac7b-4218-b579-891f8b327204", "value": "6EC46B00FA51C039F4F741BA47BB9668AB3879706B2841CF73D56A9E5E249E39C31B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859012, "uuid": "7707baaf-28b0-4729-a89f-5c0d13268b41", "value": "37fafb473194256b2b713a1bfe22a425", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859012, "uuid": "ce027470-49e4-4376-b0a9-dd4f5a6a91f6", "value": "12288:AZf+1ahU6QgtvG29kDGlBkJI6hxuee4LK2pFKkTRb+J:AZf+UAgtv8DGDiIwkePe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623859012, "uuid": "a243eb1a-5927-4cf0-85fa-35f70517a4b9", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623859012, "uuid": "a2aa063a-0697-4cc9-bdb5-1901f0507ca1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859012, "uuid": "0f29a160-a4c9-4fc8-8287-6a5f96e49fa5", "value": "omsh_.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee384c4-cea4-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623848958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848958, "uuid": "face96db-64e3-4713-ad24-b10cb578aece", "comment": "Malware payload (RedLineStealer)", "value": "e7184f19706ec317eaa1cb76a2a40024", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848958, "uuid": "83a81e6d-d144-4a2f-a34a-a27a2dd4a945", "comment": "Malware payload (RedLineStealer)", "value": "1acdc6ee685e2e74f5ceb833ea760d886f2f042b3443c3a053e0d31b515393ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848958, "uuid": "a69aad04-cb51-4f80-8a38-b7bea1fb3255", "comment": "Malware payload (RedLineStealer)", "value": "d19a16f5323acf184e4c910544036a809f09ce44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848958, "uuid": "44c210d1-c0ee-4b5b-8392-e76255c2cba0", "comment": "Malware payload (RedLineStealer)", "value": "23926af0f78127d8b48df0f55c01774449ce48e4f77dd337a5195626d1fcc0ad7d3aa8f32e2325c12882dd8209cdf87b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848958, "uuid": "298c9d03-81e5-42aa-ad84-a47a58080f11", "value": "9894AE10F790C034F5B612F85AB693B9A5297AB1A73450CFA3D51AFA57386E0EC32317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848958, "uuid": "372780a7-78eb-45e3-829b-5038ee311458", "value": "f15a946d6e0659432dc9b8c464554438", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848958, "uuid": "d42c07f6-6f84-4d7e-909c-1a692a22473c", "value": "6144:fOMjahQEiauXlU3q1m6/uBC5ubcb2L/nD8GU4zM6:fTjaWEiaui3q1O7b+g8aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848958, "uuid": "3cf4940a-b308-4540-bfeb-d9b5e777d7ba", "value": 428032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848958, "uuid": "a8469bd8-4893-4fca-b540-87b8f441de94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848958, "uuid": "edb5aec0-960d-4459-b5b3-a66c1d9ac23a", "value": "e7184f19706ec317eaa1cb76a2a40024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5357d94-cea3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623848915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848915, "uuid": "8b718ddd-216b-4e83-a445-bd61e573056b", "comment": "Malware payload (Formbook)", "value": "ff34b92fe897f13e422b67f5cbc9740c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848915, "uuid": "efbd609d-729a-4223-a6cd-2e335cd4d011", "comment": "Malware payload (Formbook)", "value": "1bb79d3f58130c38c2d1c54737aaa69bfdf5693cf6177efaac78377020b86ad6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848915, "uuid": "b464e2b7-ac3b-4515-8890-3a0efe928513", "comment": "Malware payload (Formbook)", "value": "b145bda9579274c1648829df1e37e9500976e271", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848915, "uuid": "bc9dc8cf-e8cc-486a-b286-e0454fff468c", "comment": "Malware payload (Formbook)", "value": "48b3bcb4fcd3c95436efe0e9539de1beee1a395e0e81f3d22d07828839b23bfb948d7fed049bf135c7dcb9ed3aee4c94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848915, "uuid": "eea2bedf-fa47-45f1-812f-b6597921f513", "value": "9305BF3437ED9108FBBA0B3158B9C1C452BFFE276A55CA1E2414221CAD5368BE7137A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848915, "uuid": "654ee43e-0306-4216-8988-283761e79559", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848915, "uuid": "084a58fe-4a30-48f7-89f3-10407005703c", "value": "24576:PquPHpdPsaTH7ZSFSFYeUtKckniLXBlVm:P5TdSTk63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848915, "uuid": "e7b80c9a-1650-4117-ac52-b7297266f6b9", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848915, "uuid": "ff817c4a-f4e0-4b42-8980-4dda48fae894", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848915, "uuid": "b8257510-d76f-44b6-9384-99cf6d39ee47", "value": "ff34b92fe897f13e422b67f5cbc9740c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a5ddb3-cee1-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623875137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875137, "uuid": "df08b631-298e-4e76-8b6d-c2067c563f83", "comment": "Malware payload (CryptBot)", "value": "09634fc320a841c03969036e6b348a2f", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875137, "uuid": "03177868-8f1c-4632-83b0-8ca1e16efb9e", "comment": "Malware payload (CryptBot)", "value": "1c5bcf31d6b2317de8b0df15fca469681a26845ff6f7e7810c37743af816d4b7", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875137, "uuid": "291bd20e-667d-40ad-a7ee-afec4fb3cde0", "comment": "Malware payload (CryptBot)", "value": "93fbdadd98ce78bb0989a7dd51e9fa8c4673708f", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875137, "uuid": "f8220757-5ecb-41dd-9447-b4745f3c160c", "comment": "Malware payload (CryptBot)", "value": "0e8ab5600270b34b8aeeddc65d0a91de4b72cdee4246976c51bd7338bf9aeae7626fc2d684daee406d6573eb585dae52", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875137, "uuid": "d0ac362a-0e13-4455-bca4-e5a59546c86c", "value": "12F4F110BA41C036F5F351F825BAA36CA52E3A71577850CB62E61BEE53786E0EC31B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875137, "uuid": "229b33fc-4bcd-483d-b307-6ac46f63169f", "value": "adc2d74ad17b69fb3b2dcb922692a07d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875137, "uuid": "7f8bc3b5-2d61-4257-9a82-56a7d4287295", "value": "12288:rfYQCO0bo8dhiZZDsVUDOLRrNGntv67Yq5UqNJ1qmjQV7MI9QMrJk/thtmtpUQmy:nCO0bTssVUDOLqtv67Yq5UGnqmMV7P9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623875137, "uuid": "463158ed-69cb-4440-a778-8948c275b494", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623875137, "uuid": "02849cfb-5758-49ec-97d6-49789bd50577", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875137, "uuid": "55cafb70-600a-4d4f-bedc-54fca10ad987", "value": "09634fc320a841c03969036e6b348a2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5764b557-ce43-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623807418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623807418, "uuid": "7936b150-9599-4736-92cd-8a23d1fc9c2c", "comment": "Malware payload (RedLineStealer)", "value": "bf95b580579e69616b73eb2677238450", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623807418, "uuid": "8cc09995-b5e1-4aae-aedc-45c8dcd3634c", "comment": "Malware payload (RedLineStealer)", "value": "1c81b540419ff3df10d7de183205394f51e60d5e31b06b3687fa97755dd49adc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623807418, "uuid": "6995078a-16b6-4ae0-8409-a544661bd7ce", "comment": "Malware payload (RedLineStealer)", "value": "0e796c5cb3666aeeb058ae88aa9888cb408e2ac5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623807418, "uuid": "7d7fc78c-331f-4392-ada7-ca100fc03cfa", "comment": "Malware payload (RedLineStealer)", "value": "3b37ab2decaac07846c14cb6b27776fd46c6a73de4a5a77db0226e74e8db7a913ec0573968310796ad6bc83c9ade187c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623807418, "uuid": "43bafbe0-2aaa-4024-9bfa-1998fb04fe66", "value": "A5F48B0F3AF3FD8FD18D647280A885845761DA156E76C3E2F8D8F2BC57C23B26A0515A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623807418, "uuid": "c595e5c3-6182-4ceb-aa99-bd3d15883f30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623807418, "uuid": "fcd2836b-c0d3-4c3f-b9f9-8ed301a909ad", "value": "12288:4b4C5v4J7qeGioGSzG8N6zF+EvCeWatMG2KS:H+rGSzVRdq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623807418, "uuid": "914750cb-8c61-466e-9261-02d1b729b68b", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623807418, "uuid": "812ac8ab-b221-44ae-96fc-16dc3579f968", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623807418, "uuid": "53774316-6534-4eeb-86b3-fcdf344a7707", "value": "SecuriteInfo.com.MachineLearning.Anomalous.100.7906.14462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6131a7f-ce8b-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1623838582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838582, "uuid": "f33038fb-5ec9-470a-9dc8-4eabd48d6379", "comment": "Malware payload (Smoke Loader)", "value": "e3686e4e0ed04a1fd38bb5060cb2441e", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838582, "uuid": "cdc3b5c6-9a08-4fdf-bf4d-8d09923e8cdd", "comment": "Malware payload (Smoke Loader)", "value": "1d1dbabc1c905c7153847c6bb5b88905942d414c4dbf39e3784dc9a62e1120db", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838582, "uuid": "a213c587-3e3d-4200-b144-f6018c8ddd3d", "comment": "Malware payload (Smoke Loader)", "value": "7a6e59e6c01135ab4ec685dc8c6bf7835429c916", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838582, "uuid": "4f046971-ea4c-4272-9652-190db1da1df5", "comment": "Malware payload (Smoke Loader)", "value": "dc4fb81ceee8f9eb08e1b4b9bc4061c52afb55c7cbf643d127fd80e53dc4a8fa6624c9679b9348bde409fed67127cfc9", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838582, "uuid": "8a5397f9-9e7e-4510-9bf6-99602c02f7fb", "value": "57547D20A7A0C434F1F712F899B69379B92E7EB15B3490CF52C51AEA56346E4EC30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838582, "uuid": "175f7663-681f-4346-aa09-451aff4734ea", "value": "2ab857f73c9912dee0698f559b75c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838582, "uuid": "4ea3a651-bee3-4e78-85c7-dc67f54c3b33", "value": "3072:sZCIbJFbQUyeB5cq3Dey3GLtXWxQokuWaPrKrQ1xZB0YWi8y94rMtQiSrX3:sZCYGUyeB57iy3MloRrtxhjtQiSrX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623838582, "uuid": "f0d5be58-e4f3-4c27-a941-4c8e87ff0bf3", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623838582, "uuid": "c171e339-d553-4844-996c-467554053958", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838582, "uuid": "04d2f728-b959-4824-8c0a-845ae890080f", "value": "e3686e4e0ed04a1fd38bb5060cb2441e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563e3dbc-cefc-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623886873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623886873, "uuid": "86743606-d9eb-4be3-a07d-f46e7371ffa6", "comment": "Malware payload (RedLineStealer)", "value": "a7d7e720cddc823900c060dfd6bef50c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623886873, "uuid": "6f7c6501-63c8-4254-9d4b-5b848e5e2a2c", "comment": "Malware payload (RedLineStealer)", "value": "1e41907a6b90a81df34fedb2bf65bd3f434b26fdf5b4b9356d0e9b992d6b0340", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623886873, "uuid": "ae2dc6ce-54d2-403a-b2c4-501f0bd8dfb3", "comment": "Malware payload (RedLineStealer)", "value": "f171de5e4591a54edb9462e548acec70242f0b38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623886873, "uuid": "d3b7ff4f-96df-49dd-90a5-bde08e55d068", "comment": "Malware payload (RedLineStealer)", "value": "30398704e4592916e4fd5c202a0b58f9b35c888ac9d91d33a1845db82360d78edcbeea9205527eada970f3221db36f2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623886873, "uuid": "66b01524-0e64-4f4b-8cc1-302f1dfc18f3", "value": "ED84BF10FA90C035F5F612F84ABA93B8B53C3AB0572491CF62E51AEE5634AE1ED31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623886873, "uuid": "4649ead7-1476-4111-bc9e-8c6ee0f38ffa", "value": "364098e961c6433a5f030e6d84a48050", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623886873, "uuid": "16ac862f-2662-4872-82c2-44b68145a3a5", "value": "6144:F1c2sIzkOPrP2DA8m6rY1Z8B7H69IExNqeuTUfd+w8jG+TF4MtxDs:AWoOPrP2DAOrY1Kalyeugl+G+F9fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623886873, "uuid": "98352609-0850-4278-8b9a-9b7dd2685836", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623886873, "uuid": "7e5c8448-c5aa-4b55-a310-1ed19ca60ba3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623886873, "uuid": "799bb5a0-ec9a-4466-9feb-b9d15a13ddf7", "value": "a7d7e720cddc823900c060dfd6bef50c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6d2d9a-ceb5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623856472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623856472, "uuid": "f15360f9-1cd4-4a16-b44d-0765e0fe23a5", "comment": "Malware payload", "value": "c64202fc6e89fc1c49cde536894ed99d", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623856472, "uuid": "f9dc269f-c6c7-499b-9af2-82c3b88acff3", "comment": "Malware payload", "value": "1e993ef7ee5f21b9f815ebf853b0bd40d3328a1bd6d680ffc3ace55e4bf73a89", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623856472, "uuid": "9be15e9a-8214-479a-a16e-a5346241bc8e", "comment": "Malware payload", "value": "23910d0cc03cfef9acd0cf08b0f19852e7d10c87", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623856472, "uuid": "5c0409d1-962f-4bd1-931e-f1afdb4f6822", "comment": "Malware payload", "value": "db33d747db1924f32650f5a769c4f81ab02edfd523e418fb3ae4ad8ef6742836ee185c05b34226613a19b0606e26d6a2", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623856472, "uuid": "a333f8cc-1630-4ba5-9697-e66d4b6d2152", "value": "CD24CE52F284D91BC55207364DD3C6D92735FC52EE224B4B3385B72F2E71AC0EE26A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623856472, "uuid": "1e2c35bc-1d19-4686-81d6-f152df6ba609", "value": "6144:wxEtjPOtioVjDGUU1qfDlavx+W2QnWxuX+Fayp3oITIvuTUFSW3EUvNx:wlFaMYITITIW06Nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623856472, "uuid": "af489574-4650-4f7c-ab48-cfb773266110", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623856472, "uuid": "6cdb494a-ab98-4bb2-9f93-070f11766058", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623856472, "uuid": "c1907dff-29c6-4bba-a883-c9320fd8f978", "value": "c64202fc6e89fc1c49cde536894ed99d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892299cd-ce70-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623826829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623826829, "uuid": "18deea20-5769-4201-81b4-460189887035", "comment": "Malware payload (RedLineStealer)", "value": "28b2d0e1a660e228566929c2e4993b8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623826829, "uuid": "9b951ee4-7d95-41ad-a0c8-f2f55698fccd", "comment": "Malware payload (RedLineStealer)", "value": "1fae4803db7da4d39e6ba97239cffc7f6987e307fd00c7751581394c25985067", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623826829, "uuid": "42bfd2ce-3c25-4eb4-9c8c-a9a0801bfc4b", "comment": "Malware payload (RedLineStealer)", "value": "8f24975f538d006178a6a52ead12ffbf93b69bec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623826829, "uuid": "560307bd-8e0a-41c8-8a68-72dd659c87b4", "comment": "Malware payload (RedLineStealer)", "value": "8aa07ac7481f6f7ae8dea73fdc7c628c4dab98bb079854883597681ac9f9eaea5defdd10b6a302d2f77797bbe93a28e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623826829, "uuid": "2a84642e-6c49-44ac-8c81-2dafec8588e3", "value": "C7849E00B7A0C038F5F352B45A7A53F9E52D7AB06B7890CF52E52AEA56346E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623826829, "uuid": "88294c0c-dbc9-4ff3-9e4e-f34d40c4da37", "value": "2ab857f73c9912dee0698f559b75c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623826829, "uuid": "d5c97e85-081d-4a00-9056-e11fa5efc4ae", "value": "6144:pQKJL3USjObaMNZHHM2RXP33uxiYlX0RbL/LAq6SAhXx:pQKJL3DOb9JT3eUYlGbL/LApb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623826829, "uuid": "5d8f70cd-477f-4be7-b381-4c9270725092", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623826829, "uuid": "bbb3c116-8147-4bca-be78-64ad2af8339e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623826829, "uuid": "bdb21433-edf5-4350-93f3-a13efd0549ff", "value": "28b2d0e1a660e228566929c2e4993b8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0c2813-ce7e-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623832959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832959, "uuid": "eb176332-2160-4e69-93cb-6eef8235d7de", "comment": "Malware payload (Gafgyt)", "value": "fcb00b50c75919ca2bbc5c3b69d6dfc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832959, "uuid": "cfbfeea1-65be-4a80-a81e-ab0d4a2c397e", "comment": "Malware payload (Gafgyt)", "value": "207a64db581d41cb8432bad614bc6f6277b71fec312e7051458165e4605d1427", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832959, "uuid": "265e647e-269e-4c02-9ff6-79dce4d5d8f7", "comment": "Malware payload (Gafgyt)", "value": "993f3c6a5017ea6d73ffab860ede83bb81470585", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832959, "uuid": "86028d0f-9632-4881-9445-9806c8984720", "comment": "Malware payload (Gafgyt)", "value": "b744bcd85b71fbfd3a570d9d3a698d926f48b95fba20e953fcc771698e3303ba7b5cef3c8d3db4c9973d1cf1926304e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623832959, "uuid": "8dff2658-89e2-4d35-8974-fcf7b2b001ac", "value": "2FC3E6B2B801DEB6F106D63A04C79A147E70ABE74F839166B32A357A9D771C13827F50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623832959, "uuid": "bbb90a5d-3c0c-48d7-b75b-790fe8f68c36", "value": "3072:r9xRGKz/ama7S60alGVmgy7BoVtOuzmz/90zxwZTct8NO:rdZ+B7S60aAy7KXhzmz/90z2ZTct8NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623832959, "uuid": "db06b3b7-6fb2-413a-b9b7-64bf9ddc92a3", "value": 129105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623832959, "uuid": "1fd2e544-9b4e-4d1e-854f-a463a8f357c2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623832959, "uuid": "da51c43f-3ae8-4933-9b05-782ac8a57660", "value": "fcb00b50c75919ca2bbc5c3b69d6dfc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f4bda4-cefc-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623886878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623886878, "uuid": "db50b5db-d430-4f76-9d4b-37de40ccd605", "comment": "Malware payload (RedLineStealer)", "value": "a158121de4d9786bc423fbd44760bf5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623886878, "uuid": "4c9afda3-c60c-4ad9-9f10-ec44bdce99fe", "comment": "Malware payload (RedLineStealer)", "value": "2101ad6add35e59d9571deca1987f617f2e6be9190b75214c662f0f53ee40e80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623886878, "uuid": "9b6f53d1-f6e7-406d-ae00-8761ef2b2514", "comment": "Malware payload (RedLineStealer)", "value": "b6a1dc5bce796cdcc324ea215c56c72b88bd1ce9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623886878, "uuid": "60adeaff-06d8-441a-bdac-c2b90d7bd8bf", "comment": "Malware payload (RedLineStealer)", "value": "96558ca82a4f2d3c7c990bd174c0df17379ed19de7552f380258aaef4524f5e692ec6fccef79afec2da6a3bf6087f392", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623886878, "uuid": "35c54a91-fb75-40b3-9e3b-ca1c61347dd1", "value": "21B481A137E89972C09F4B3057A3C650AF70820BB75EBB1B4D7711AA2D453E35C2D89B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623886878, "uuid": "eec4e744-ba70-4153-b7ac-0196dff71e3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623886878, "uuid": "9e0dc561-ff62-4156-9790-62b80c81f6d8", "value": "6144:OfTu1+OL6Bn6liBBonXBgWMRjZXU9CwiuWLICb44Efm3rL:yuXL6QkSXiWMRFMCrxLZb0m3rL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623886878, "uuid": "c7c6fbe6-7884-44e8-8dfe-9fd9a63275dc", "value": 523088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623886878, "uuid": "beecb850-23e3-4291-ba14-535b41bfe372", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623886878, "uuid": "e8f2c113-e08d-4e3b-a467-895e28009edf", "value": "a158121de4d9786bc423fbd44760bf5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb771fc-ce87-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623836853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836853, "uuid": "b95922ab-299e-4506-8271-52b461c29bbc", "comment": "Malware payload", "value": "d3d5e6cafa8ca89384e56e6374a14203", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836853, "uuid": "afcafaf2-9f49-45d8-8a15-c55bb3f9b06a", "comment": "Malware payload", "value": "214910524a528bab8dae4a704169e20d9f2f92444df6e6a65d19decafd9f69b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836853, "uuid": "8405a511-b3fb-4ef7-a603-ee9da7196863", "comment": "Malware payload", "value": "ba57aa266efd34ec5fe657c13ecda85e97ad5b5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836853, "uuid": "08f87ed0-f17c-4513-8a5d-70a27916b71e", "comment": "Malware payload", "value": "6ac30c404e31f596ae97983e9403ec5414241ba6d568d5d99fcd60ee21d2cac50fd0e799f54eec9d58423ff61409c3a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623836853, "uuid": "7dc92fcd-6630-452e-99fd-ca2bac5d67d4", "value": "C22412A736C4D87BE7450A310AF6E336D67BAB065B20035F9B9A2F356400163DB3B247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623836853, "uuid": "54f2618e-bdea-4456-a743-2bfe5759c5cd", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623836853, "uuid": "bc12a289-f009-40e0-a0b8-6252ebad3ecf", "value": "6144:cQqTvWkaWUhQu2unNCuqToj894c673nHa4c0t:yvWkpUEu/AHYvco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623836853, "uuid": "6aa4c414-433b-418f-ac5a-17525b1dfecd", "value": 222795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623836853, "uuid": "7613739b-9a59-4392-8015-c54d1015911c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623836853, "uuid": "95f0d334-b355-470e-b748-99d34c921203", "value": "RFQ-BCM 03122020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b10436-cebb-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623859058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859058, "uuid": "e4476173-a98d-4f0b-a185-2a218d4d4d74", "comment": "Malware payload (Quakbot)", "value": "61a9cd051ab9488ac32b867204301593", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859058, "uuid": "9f8511d2-6a12-4aeb-99b2-6deb8c5adcd9", "comment": "Malware payload (Quakbot)", "value": "224c62bcaf9e4eb208ea49c9727edc7cadfbd58c6209595a66a636627f43d085", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859058, "uuid": "d1f29cf7-54a9-4c1c-86b6-94241e81e739", "comment": "Malware payload (Quakbot)", "value": "9485475bb304e123f2cf58250ba36ee26706ff26", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859058, "uuid": "67fb1e68-abb4-40cd-a7ce-2859e01eefef", "comment": "Malware payload (Quakbot)", "value": "e38f81f6eb6e19f752f0477b591f740b8ea8a7d4b89be34c94ebbec33eb45be9524c4c779694fd5d372aa60c676c1eba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859058, "uuid": "b6b00ae5-24f9-4ec0-ad1f-9335cb6c636d", "value": "8C158E72B2A38C37D1733A7D4D4B63A4982ABF413E3B69462BE41C4C5F396413925397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859058, "uuid": "ce9bbf68-7a79-4891-bb5a-028b1ebb132e", "value": "299f6f1d2b8a3e164da0e6578d1fa5ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859058, "uuid": "e9831587-8f9d-4921-8f9b-8a0d9db47fd2", "value": "12288:jhFr6SSWqOdUuVAXJaBbWdsrHOYQYpPGFEQ/TYxd3JE3MX/Pu6ULos:jrnemAXJ9+OBPyQ/TYb/yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623859058, "uuid": "aa52d65b-cc0d-4ac8-a753-6c2e7217fcd1", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623859058, "uuid": "e46078ba-d2e5-4d9b-a18d-2671ee4b854e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859058, "uuid": "90ff22bd-b42f-4e19-8932-e6a3ec273fed", "value": "61a9cd051ab9488ac32b867204301593", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725a450f-ce68-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623823355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823355, "uuid": "8fbf4bb5-ab0d-4a2d-91fe-d0a1e1d01968", "comment": "Malware payload", "value": "d5f6173679e5d37e33d0a2353e6e0faf", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823355, "uuid": "40c9fde1-535c-4eb4-83f7-931768be4a51", "comment": "Malware payload", "value": "22e75766915b55e6b036f1993b7f1f8a82eec61261596e29a3965a02fd8d2038", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823355, "uuid": "0a80bbba-78a5-48bc-8765-41e6c9924ccb", "comment": "Malware payload", "value": "8b0aa30a146b83dd300a5dfaa3631c4bb90e7130", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823355, "uuid": "6a1e8119-5786-4151-acb2-c2e73af589f6", "comment": "Malware payload", "value": "60f55dd39015cc0077e9ffd01b94cffaa0dc9f2b29c8faffb938662b66db4578e3c2c297bf32d6c1f9a61a68688fbca9", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823355, "uuid": "b711de5d-896a-4a64-b8e4-82d4b248a3e0", "value": "C1153348B207B5C64CEC7B376D120C51E71B024E25EA70985E576DB26EBAC9FC378D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823355, "uuid": "4767a98a-f052-4538-85b2-7d049cad41a2", "value": "24576:phednhzwlvUezdxGrpi5ydkFo8zf3DAuoIEC:azwpUepxUYydkFo873oBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623823355, "uuid": "498bd6bc-7d02-4f8c-b5fe-7e24620ad327", "value": 934749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623823355, "uuid": "e7640f15-47ed-4e98-b3d3-1ed814832c2e", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823355, "uuid": "c3da5bce-cb4b-4504-9a72-6377a9dba778", "value": "d5f6173679e5d37e33d0a2353e6e0faf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3ecba9-ce88-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623837119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837119, "uuid": "ec19d8be-5afd-466e-a811-96841ce99875", "comment": "Malware payload (NanoCore)", "value": "59f9c2a162cf48fe5819f58b697c107c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837119, "uuid": "25197b80-9b9c-4c78-b9fc-abb45a104651", "comment": "Malware payload (NanoCore)", "value": "23a865d4a1205be496c45012233d96255c90102e3925dab252d30d9a70f82ba9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837119, "uuid": "76fdec06-656e-4cd8-98da-73667636382f", "comment": "Malware payload (NanoCore)", "value": "f8702f19bae3a9f2dd1fca58f6eae3d6e62d4878", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837119, "uuid": "509ad177-4630-48fd-ad33-d1a5e9b169c6", "comment": "Malware payload (NanoCore)", "value": "3e771006b684b4691fb67f1d1a0fe2bd8fa6e519d63a5f05315584a0c3eef510a9f665579cda7a148c4a92b6187ce6dc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837119, "uuid": "192fe6c2-6754-4e75-8f27-ee9cb4030e92", "value": "ABC52DF0AD10D4C1F17A5B6AF2ED3A48A1347227EBC95A4A00F7E5651DF6A01F90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837119, "uuid": "74a796c0-67b6-4c5f-9ccf-0347cf4ce50f", "value": "24576:sBhBhBhBhBhBhBhBhBhBhBhBhBhBhBhBhBhBhBhBhBhBhBhBhB2SdWnK596WRaSm:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837119, "uuid": "a5776c5a-2fed-422f-a173-18551a1a8120", "value": 2676268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837119, "uuid": "36da9633-43b0-4e27-b436-79c0e128e97f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837119, "uuid": "28f26e08-3afd-4f38-9bbf-5a90c617bd0b", "value": "Updated Order COA.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14adae7-cece-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1623867323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867323, "uuid": "72372a3e-cb9f-4acc-9fa5-5d48f2c9ae19", "comment": "Malware payload (AZORult)", "value": "ba1a19754328c35570b76c9c22578cd9", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867323, "uuid": "3e002fd5-a05c-4a9e-b83e-f58dc4c0093f", "comment": "Malware payload (AZORult)", "value": "2412a585a68034bc3f7215b0bb7c764cc0b541d5536feee303cfbd54e4f24ad2", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867323, "uuid": "d2522fb6-1d04-4d27-928e-dc5a5d202a77", "comment": "Malware payload (AZORult)", "value": "074d9a2b5dc6093d58016fb373d3783445c66d64", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867323, "uuid": "cfbd53d3-0131-4782-921d-cf86027e2ec6", "comment": "Malware payload (AZORult)", "value": "4025a2a4fd616181e0c11118ce859e0ccecb10b9596d4fc5723617611dffae0fe1e474938831ce67a278d16918d0231a", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867323, "uuid": "1bd43970-e773-4c4c-8553-0f5a46d15ac0", "value": "6C357B027791C036FEA691736B55F2014EB96D153837B61F1298F9BCABB01B1E32D263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867323, "uuid": "82256a6d-444f-4d40-8cfd-b9a16b33f891", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867323, "uuid": "29043d54-40a0-4823-adc7-c345438c0327", "value": "24576:mAHnh+eWsN3skA4RV1Hom2KXMmHanQNYdOJ7xo52t:Bh+ZkldoPK8YanQNYdMco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623867323, "uuid": "7cf86c1b-684c-4739-8514-24cb8714f5fd", "value": 1131192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623867323, "uuid": "bd173f42-6d52-4ae4-b18c-2b7524433b35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867323, "uuid": "eefc4ef3-da89-43ce-812f-9fa8422c9819", "value": "2412A585A68034BC3F7215B0BB7C764CC0B541D5536FE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b305ac1-ceb1-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623854696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623854696, "uuid": "cedc173f-b1f8-4975-8354-444443189ecb", "comment": "Malware payload (Formbook)", "value": "70c7aafd547e31c6586a06cd78e67112", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623854696, "uuid": "df44b8e5-a6f5-4b0b-885c-d32f539d4cde", "comment": "Malware payload (Formbook)", "value": "2450d5f5fa69393262ee4d935acf867ff537ffaaa0a927823b748d5d77dd9fcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623854696, "uuid": "a01f72cc-fb04-4a2c-8bfa-3d362f05df55", "comment": "Malware payload (Formbook)", "value": "3056416bb759ed568ee33a56ebbad79d9939d617", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623854696, "uuid": "4c0b4d0d-349c-48a7-b54e-1d926f7522b1", "comment": "Malware payload (Formbook)", "value": "ca31307fd90b2c4f3814f7b28c169331862740514a500eee78ebcdc9580f11cdb3be2c798336fa23a79f194e9a11cb7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623854696, "uuid": "0228c0bf-4c67-45d4-abd8-448f05f0dfa0", "value": "F634135925E94D7BE8798E301279AB3AC7BF63422360A94BF3150E5FAD340D3D41A2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623854696, "uuid": "63113cc6-6e9b-41e7-8a6c-2e563fa669b1", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623854696, "uuid": "675a8974-7941-4321-bb68-f12ee9d9a143", "value": "6144:cQqeveGtmF/DcIZwVUngiiT4g0MwULfNQX79Psxd0YkbXuqt:Pv589nZYUnk0gAULf2h0dVkb+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623854696, "uuid": "d484d994-3717-49fc-910d-62af67c98b72", "value": 240930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623854696, "uuid": "d3379517-5b74-447a-832d-3bd2aef24921", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623854696, "uuid": "4a164538-0a68-4fa0-8401-211d5e77006c", "value": "DOC0987654398.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d467d7dc-cea7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623850578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850578, "uuid": "01abbd55-346d-483a-90b7-c9dfa1b8f365", "comment": "Malware payload", "value": "3921e8e22823d5df43ba78d7105c4f58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850578, "uuid": "d9d29e5b-fa7b-4db3-8fb7-c46021972e6f", "comment": "Malware payload", "value": "25115b6ff98fc15efebac2e8f7b83ef62a5b4ccf9c4e84a1777ce6b0df275b86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850578, "uuid": "d16e95cb-92e8-4b10-b800-a1e04a28d7d1", "comment": "Malware payload", "value": "75500fb31771cd039700ae0be770215a17f750bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850578, "uuid": "3d002fbf-07db-49ab-9ea2-d08f14ede1b4", "comment": "Malware payload", "value": "437da47af1d0c2ee86c7b89a9224504b0182a0dbbc484f7a7d9076b676bd314ba8afc1151e4f206e6a45812e568be077", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850578, "uuid": "3d39e867-4aed-4100-b07a-23d407e8e906", "value": "FFC423127FCDC937D2AB06708A716B930AB0BD3518B8DB3BA355FECD76752428508762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850578, "uuid": "3b363fe4-e61e-426f-92e5-65415eced527", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850578, "uuid": "53155b0e-cb3b-4a40-bf64-4a9ec9abca7b", "value": "12288:10gPMefQrUfdyZTg1JUgCpibi6078KfKT35kMtTCBXFgKc8WWSVqQF:SIpF1ZwViu58BT35xtTeXmKtY1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623850578, "uuid": "d3a5fcf5-4d28-46b9-a3ad-a290c9918d84", "value": 581454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623850578, "uuid": "0a345a37-5575-47ad-8a04-6a1677f4c1d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850578, "uuid": "b06ea1e2-1361-49ff-991d-75cd81e37a7c", "value": "3921e8e22823d5df43ba78d7105c4f58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0768636f-ce64-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623821458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623821458, "uuid": "0bc0ee78-8c7d-4449-bf9c-0a7a9dc3513e", "comment": "Malware payload (Formbook)", "value": "5dc5f2545bfd91c046ea5ea030147c93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623821458, "uuid": "cae4e6e8-5417-46b7-9309-2183ebcd547f", "comment": "Malware payload (Formbook)", "value": "257432b5ffbd5ae253f6be351f71f968d407f15e7f5ea78d7b613c7d663eba9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623821458, "uuid": "dac97713-c69f-4160-882e-b6bbfdf0e641", "comment": "Malware payload (Formbook)", "value": "118ea38bcfdd48e38acd33e68f536012f2a9e71e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623821458, "uuid": "05ea44b7-e07f-4364-b527-0364b84c7133", "comment": "Malware payload (Formbook)", "value": "b74ffd9843ec4ac528bcec06510a34ce7bc870463558e5e7cc1f9c3a51f38bfa752c5c1b83e2ccc7d16a809a6f3b4c48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623821458, "uuid": "e416aba2-a792-432d-a1a6-95f179a7987d", "value": "0F2413AD51CCC9BBE29F25731172272ADF3BD7562716594B63682B2E30382C30B16E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623821458, "uuid": "920a2269-b11a-4310-b62e-8c1b953fd6c7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623821458, "uuid": "2e801b4e-905c-4494-827d-6a44d37752ab", "value": "6144:cQqeRseZ3O7WdUH2RIe5vt4x3oDmeVqRIxXP4Wyt:PRsepO7SC2SeNmloDmROxg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623821458, "uuid": "3f15fc08-4574-4a0f-9e37-729606a92c2f", "value": 219649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623821458, "uuid": "9a7ec2c2-36d4-4df9-87d2-fe98c9562763", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623821458, "uuid": "1006e69c-69ff-49e5-b546-67a40486c65b", "value": "SKM_4050210326102400 jpg.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba803a2-ce8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623838779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838779, "uuid": "31502bf1-6386-441c-9bf6-e6c3089c20b0", "comment": "Malware payload (Loki)", "value": "7146b0d2caed6422c289a08f63a5c685", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838779, "uuid": "32fdaf41-c594-48f7-9c1f-5f924e0bc0d0", "comment": "Malware payload (Loki)", "value": "25aa6393cacff94544387cc515f754dfd2af133612a74fd84b64c6e17354d1ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838779, "uuid": "75a64cca-b6af-4875-bc69-01bacf38ec99", "comment": "Malware payload (Loki)", "value": "2666d058ea4e4a2ca5bc6e5ea75594e68fc63f1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838779, "uuid": "6db9f615-2368-478e-ac38-d9a33288c6b3", "comment": "Malware payload (Loki)", "value": "abe5cc271a7fa4f0d01fd06f001108c798ea354cbd43ad962850d6903c34098661fb26113ff514187dbcbcfe50cd6f32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838779, "uuid": "86bf0073-58c9-43ba-bcea-ff7299fe4b03", "value": "51F4AF3036EA9148D6EA1F318DB9C18843BABA273B55CF2E2549234C9D13753DB11BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838779, "uuid": "76a589cc-6b29-4819-93ad-1166617efacf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838779, "uuid": "f9d46fee-92e6-4159-801e-bc41f78fcda5", "value": "12288:88zqLMOeSMxvquwaHpCwQqc6n2R8Uncvc6t8TSx+f5SSruwsr4Z4:zOgfquPHpCwQqRTTt88KSKNsrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623838779, "uuid": "55010930-28de-4bef-8c76-2cc54dab8354", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623838779, "uuid": "a899ae06-fa20-41c4-9169-91a5118fde10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838779, "uuid": "480019e4-b01f-4c36-a5a4-106ea987a753", "value": "7146b0d2caed6422c289a08f63a5c685", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e04b32-ce89-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623837370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837370, "uuid": "395bb07a-f465-4773-be1f-b0d3ac5beb02", "comment": "Malware payload (AgentTesla)", "value": "49c6ef59aee14554120747f88107d608", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837370, "uuid": "c6192551-96fa-4579-8959-e08a6982cb27", "comment": "Malware payload (AgentTesla)", "value": "262f40630c69cfe03ce9e3bb96a9d6e131b0a6a805d61c0223bd73b91e8155ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837370, "uuid": "dc461397-5cd6-4f67-af3c-b676a55c2ef1", "comment": "Malware payload (AgentTesla)", "value": "97c08985fee00a94bca5c54f14eda7dbaad1eb02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837370, "uuid": "3519bcc4-ba15-4e56-9f1a-ecf70aa81007", "comment": "Malware payload (AgentTesla)", "value": "1e4034c2f35a6ce91381d909d66d344a299c9f13003c5ebf00ad1c1c40116e0d405314d0fcd89bc7a519a7888a205308", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837370, "uuid": "19c2ae2b-21de-4807-8ffd-6101e0e2ca83", "value": "70558FDBE68421EDC82559F66A319CAB97221C7A631831507BC9323A4C7F3BB553F807", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837370, "uuid": "a57d1e19-c8f8-4eaa-9f63-1a88702765c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837370, "uuid": "5519919b-725f-4664-b77c-a4a4362e7ee5", "value": "12288:q3oMZJSMPQipP5vcIHPLa+5uvShLPZI5n3v3S/DVaADdEN6/FwMoIx8gkkkkkkkh:yXZIip1caPPuEZI5WVfDdEqi+ND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837370, "uuid": "26ea830a-84e0-4271-9a61-1d2570de5489", "value": 1372160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837370, "uuid": "18d8351e-e99a-45dd-bac6-085e077652f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837370, "uuid": "0cdc28e2-df97-4da0-a351-ce1d050d6df4", "value": "invoice details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0a9d07-ce69-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1623823851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823851, "uuid": "bdd742e1-4632-49fa-b132-9e5c3064e685", "comment": "Malware payload (ArkeiStealer)", "value": "732ee12a12533e7867a657848907dcfc", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823851, "uuid": "a890e7d2-3929-471b-86e4-6b27b797ea25", "comment": "Malware payload (ArkeiStealer)", "value": "265bbbaae97235e71c723bab614dd21fd83dbd32864e9383cd2e89f16095c95a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823851, "uuid": "4212bf54-1d22-49bf-aee6-d1670140695f", "comment": "Malware payload (ArkeiStealer)", "value": "2785c3536e66aaf4b1bc6f222d5c4e9288d612cd", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823851, "uuid": "88bb4397-0949-433d-860c-2fa9eddfe7db", "comment": "Malware payload (ArkeiStealer)", "value": "b5d654d741e5232a7c119267f1bd19f41ff60cde1f3dfb15bd9a7f0ccdfb3a30c55a5767842166952a505d618d67db76", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823851, "uuid": "dcf240ad-80e4-4207-bc7b-1ef239c7e564", "value": "2B64235BA2F0993BFCA28230B9B7942CEA7F8943122350779B711FED5E00482A53D593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823851, "uuid": "cedf66da-f870-48d1-8cd8-92a0df671bc5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823851, "uuid": "3e332333-ebd0-414f-9813-94abaa40e6a2", "value": "6144:BQqjXDiFachVUGeF7FdJ6oM0iqWnbdBZJfFveFn+RQSe2DmGKUzRrt:juFxhSGeF5Lih7ZJtveFn8ZDGej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623823851, "uuid": "b9b41e05-3296-4f79-aee3-e69e50c2de6f", "value": 324540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623823851, "uuid": "744b722d-6b66-4bf4-ab97-ac839030cff5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823851, "uuid": "9f851da6-dcad-4559-b5ab-db857e0f41f7", "value": "PO-006 dtd-15.06.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624d4ae2-ce8b-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1623838360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838360, "uuid": "d9dba333-3175-4c29-a470-cca18f7c591c", "comment": "Malware payload (DanaBot)", "value": "ba59bc12d400c6a35039bc637a93a8db", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838360, "uuid": "3fdd05b6-a86f-466f-9ebd-4008a93a2006", "comment": "Malware payload (DanaBot)", "value": "26e4bbe3bdc2deb3142b952094d6bd3bb27ee0217d7a9b735a0cc2bbdf6bd9b4", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838360, "uuid": "458331b8-f431-4a8c-bfca-f4684d746e12", "comment": "Malware payload (DanaBot)", "value": "1c83bfb5faeab3104cc75d91beebceadb9b8e420", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838360, "uuid": "e78a6a06-479a-445d-b2c2-b5344388bb71", "comment": "Malware payload (DanaBot)", "value": "365682370e4c29d58ecd4bd771a7e8b5021c193eebef9f8ecf4b2c4bf1d9aaea94a2672e7255d6d5b9b6fbb0572e1e5e", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838360, "uuid": "5cc2a73f-3e53-4487-a5b9-9ce602631981", "value": "19350200EAB0D034F4F626F469B6937EB82979F1A76890CB23D526FA47785D4AC71703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838360, "uuid": "1f1905d1-7c96-447d-ba58-e431f74f6bb6", "value": "2ab857f73c9912dee0698f559b75c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838360, "uuid": "dc7c29de-c3dc-418d-863e-bb1f4cf34f2e", "value": "24576:K6wotp9kjtmC+JH7TcjXfqbequM8MuoN3HfnLL3UBay:Raj+BTuPqbeqDXfLLEBay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623838360, "uuid": "7894e5bc-b66d-4cbc-b802-e59788e6aa75", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623838360, "uuid": "bed3f35f-45e8-43d4-ba34-743c30a304eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838360, "uuid": "53fb348e-1d71-4135-80b3-d1c292cde110", "value": "ba59bc12d400c6a35039bc637a93a8db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b84d4a8-ceee-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623880896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880896, "uuid": "b4ce64f9-4e2d-40f1-ab27-6a371e52925f", "comment": "Malware payload (RedLineStealer)", "value": "8eacadb69594a11c945eb06a98990f96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880896, "uuid": "a8dca307-5a66-4b52-9165-b4c480c416ec", "comment": "Malware payload (RedLineStealer)", "value": "272f11a73d3b4df0108860fabd9a915694b21bb893e2a762abbc1c7176e8c095", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880896, "uuid": "6c9874d0-52ac-41ec-81cb-088e5b3df182", "comment": "Malware payload (RedLineStealer)", "value": "6bd6c7c4554464c4667f30b2b8bf3a8033490a17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880896, "uuid": "4d007238-98ff-43ff-b37f-900be103ec1d", "comment": "Malware payload (RedLineStealer)", "value": "2c2ae3fb9ca2bc25881c1187ec350588d1b506e80608c67bdfdd91cf902f89b696e86ce7461809d24c8750bf368f1eaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880896, "uuid": "9a806af4-017f-4f97-a2d2-dd1024c6f4da", "value": "DF557D013E41CE51F44A2337C5DF81489378AD10AAEAE72BBDB9337D58623676D096CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880896, "uuid": "b9499b03-9ce3-4891-82fa-9285434d7263", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880896, "uuid": "f75714fa-4606-48f3-8fb4-92d55bd8e067", "value": "24576:zrc+cTNJYIR7o5PuF8ZMN14kQzomqqsE3G6XL2w19+rL+wJaH1jW:zrc+2IW7o5PuF8J4qsE267z+rLJJa1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623880896, "uuid": "6603d638-9991-48b4-9914-3ab78d2115e6", "value": 1323520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623880896, "uuid": "dfcfaa62-c69b-4759-9201-e59781fbcfbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880896, "uuid": "e2a173e2-c08a-442a-94ca-40eff9e95ae7", "value": "8eacadb69594a11c945eb06a98990f96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b596493-ce82-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623834403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623834403, "uuid": "42f6c062-2512-434d-ba59-de982f5f9cef", "comment": "Malware payload (AgentTesla)", "value": "f336f32964cbb4191fc2da3790fc0692", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623834403, "uuid": "1be1e4a8-9441-4582-a2ae-476a00170ef1", "comment": "Malware payload (AgentTesla)", "value": "27ffeae59c94c45ba5f1ec1422eb5cdcc2743891bc88bbcbfb2c9326216394c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623834403, "uuid": "1b5a9628-456c-4740-8957-c1a2d364be6c", "comment": "Malware payload (AgentTesla)", "value": "675e7553c02705e39f41337460435d5dc0dac71a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623834403, "uuid": "f1e59a54-6959-4e08-bb47-7e74df2c7b67", "comment": "Malware payload (AgentTesla)", "value": "d58966fc130a479b04e16d6ff73e44f33d16cc76925d1ec32213ff4306b6e6c012d918494194068b6948feadf5a5994a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623834403, "uuid": "873eafe9-933f-496d-aebe-37ebb868a07e", "value": "2F05B03036EA9148D6FA5B318DB5C19803BABA677B50CF2E244A134C9D13793DB11BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623834403, "uuid": "359fbae8-793b-4246-aef2-412349d741d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623834403, "uuid": "2f619cbc-d3db-4a23-aa1e-24da8f679447", "value": "12288:9slWvEvquwaHpBqwv6O68YEc38JtvojcC6dDfw+8QqNb/pcTc4zs:QPquPHpBqVQcotwp6dD4p5cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623834403, "uuid": "1cd88867-04f0-4818-9a6f-1198220eb05e", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623834403, "uuid": "c1117ed1-503f-476c-a2bc-48324bb7d17c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623834403, "uuid": "ba129d5c-61e9-4594-8db5-bbff33495e06", "value": "Supplier order data sheet For June Delivery PO 4500101880.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6f45df-ce7f-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1623833408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833408, "uuid": "4a85ca82-a43c-4f0f-a3b9-2d8ae36ec932", "comment": "Malware payload (QuasarRAT)", "value": "0c654cf2865b17e977db556ccde57a34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833408, "uuid": "0099d280-668a-4f9a-82b4-ccec17850d53", "comment": "Malware payload (QuasarRAT)", "value": "28f48693be094f941f42cf263e6089d9bff7631bebfe3b2082a94dbabf306e01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833408, "uuid": "16a46e3a-312a-4c2a-8788-b388bb8a8c0e", "comment": "Malware payload (QuasarRAT)", "value": "ec7d3d70941e7c656207fcdc06cd2a420d5b250e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833408, "uuid": "29e90f29-4e97-4058-9020-8a41cbb0fa36", "comment": "Malware payload (QuasarRAT)", "value": "90d5580b258422e73b04fdc7e385bc3a6abcebb8b71e4f530f1d5c4e70778144fc6ea3ba81ee4c227959ba73cc0352dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833408, "uuid": "a06030e9-c148-4f7e-b8fb-cf48ac77b364", "value": "7A5512527E919B7AC2D333FD398DF1B404A56D3F1B288997ABB07DC21928E85D17D202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833408, "uuid": "5c3e8327-69d4-40c2-aed1-23472ce8d1ce", "value": "011a034751880c1944da3b5ecc18520d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833408, "uuid": "c680a92e-4e14-446d-b3d0-4e345b6c7022", "value": "24576:x9btxEOMdGAe/IoNd8XgU9Qd73K1WcLZeJs0PYZ7Z3HjHjm:xNNse/ITF9QtuWoZrPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623833408, "uuid": "4696b62f-cd81-45c3-8272-2c0a395905f2", "value": 1398757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623833408, "uuid": "4ce0639c-6e52-4931-85eb-3cf316ddf006", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833408, "uuid": "b27b0f0c-6768-4796-bab5-4827ccbf874a", "value": "Trainer v 4.6.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdabe7e9-cee2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623875880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875880, "uuid": "bc0702b8-cd56-486f-b23c-f55d641f1467", "comment": "Malware payload", "value": "80cbf06d635c6d0a099e7ce096078343", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875880, "uuid": "1eba7dc3-cf90-436e-80b2-ba1ea55c52ef", "comment": "Malware payload", "value": "29807bbc5007cc02c93b848c524528c4066cf81b036a4670d33a8e99691b1f0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875880, "uuid": "68914e4e-2560-4313-9764-7f409e9d7aab", "comment": "Malware payload", "value": "0930b785855a5f406d1f7a01ef9bdc67cf5cf4e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875880, "uuid": "7238a554-2804-4748-83c0-546eff5bd655", "comment": "Malware payload", "value": "9bfe074df9bdebb0f97f3c61ec0ab1c248477cb39b089eaeac9b64994defc6221ba278145652fa55d4574a43959c4b84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875880, "uuid": "f697403e-6cb2-4e81-82bb-a565bc4a1124", "value": "1EC3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875880, "uuid": "63f67518-0701-4c1b-ac69-e2e243160af9", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBeNEdWfRZrmW+IFj:Ted0W0MZQHRd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623875880, "uuid": "66217fa3-dc0d-4a61-9d2b-4b30a48ea9c4", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623875880, "uuid": "30c495dc-f9aa-40e0-8a90-b63c5c30a1ba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875880, "uuid": "8584121c-0860-4858-b329-90ff1f3db15f", "value": "80cbf06d635c6d0a099e7ce096078343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f707fc-ce78-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623830069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623830069, "uuid": "8b215385-fa09-4e89-95b0-42c82b02a7ba", "comment": "Malware payload", "value": "3a8f5936443815c2078ad89d1996af54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623830069, "uuid": "3cd228f6-52a9-47d9-b7ca-478a4f4b5017", "comment": "Malware payload", "value": "29923af476f8ca4f77c40bfc36fe5bf4369cd859fe898ed73a514ba83078c167", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623830069, "uuid": "b377fa08-bde7-4253-843f-43e7ec7c3ebc", "comment": "Malware payload", "value": "a435ec13dd3f737669cedfd46c4c155a76285c4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623830069, "uuid": "2e2183c2-3fe2-46f9-8fe6-55d8cc4a2e4b", "comment": "Malware payload", "value": "06570434e926a6d3eda8bb7eb04f376e35f4e460b3daed8ca14cdc4b903949405442399940d4e6469f5ae5404fe3dece", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623830069, "uuid": "db64396e-19b4-488b-83ba-2ae00326a598", "value": "CCD4237EB6E79A8415C6AD70CA02013EF8427ADFF3758C580C3AA58D1D0DED72B5524E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623830069, "uuid": "42e7fb6e-cc17-4fba-8e57-c1ef455ba9ee", "value": "12288:NxMZEF3+5I8X0G8/oP+OXXiZrbAERCnY9Xq4BPbiwpyV6Rfm+Zy:nD3+b4WyZrbAgCZ4BPbBp5m+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623830069, "uuid": "3b7f4dff-2bd6-41af-9a57-6d5f3056a7a9", "value": 623314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623830069, "uuid": "2b7827ff-a956-4900-8d6e-a2001ea9cd74", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623830069, "uuid": "f8cbcf6d-63d3-46a8-9f19-21ff6aad1807", "value": "scan11062020.doc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d32b36-ceaa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623851595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851595, "uuid": "55316285-b853-4901-9be1-28c3c709e86f", "comment": "Malware payload (AgentTesla)", "value": "b9d00a7bb8337c49835bdf80aaab3e93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851595, "uuid": "7b935d72-c2f7-4bf2-89e3-24d0f0ab9112", "comment": "Malware payload (AgentTesla)", "value": "2ad24f2b8f5e23482ddec788a4724603bb460d08d58f81854fa3713074a1cea9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851595, "uuid": "eee530db-8e1d-4616-8365-7e4a31688f8c", "comment": "Malware payload (AgentTesla)", "value": "5d469b1ee1f00c5ec1323cd33306f15619320f98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851595, "uuid": "bfdac5e9-c5d4-4bb2-bed1-abdb980cfdc5", "comment": "Malware payload (AgentTesla)", "value": "647b73e2bcec8dc86c8188d033db5a1cf2f76701d057d26b40487f737a4134e82cc46f9a999da0d6a12b052b2a6351ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851595, "uuid": "b705db67-5be6-49b5-a20e-2f476ae6c445", "value": "93C423748C1C7F75F3252E7E084F1C202E568E491978E64E677A48AE9B4D3287DD32E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851595, "uuid": "0425b101-d479-4bf2-b59a-d6a57d990f1b", "value": "12288:sX94vbvmA78RVrz71OR96knTuf10DJgYjSTuWY4Ub:sNgaAYTrz5OquuN0DJ7QPUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623851595, "uuid": "3b8b3fca-3d3b-41cf-bcc8-29cce04dd9ee", "value": 571023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623851595, "uuid": "371aafbb-f597-42c4-8951-47d68c3acadc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851595, "uuid": "eae251aa-6dd6-41ca-9b3c-e3f586cff095", "value": "BKKIR02524717.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d072b77b-cea3-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1623848853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848853, "uuid": "b6f6ecec-efc7-41f4-97fb-dfc69a1ca700", "comment": "Malware payload (njrat)", "value": "756fc0d2846ba7ee559c03debed29228", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848853, "uuid": "37f1d094-ae69-4ea4-b24f-786d9e551eb2", "comment": "Malware payload (njrat)", "value": "2b4fcba2cacdd48089b43c746a24cda262ee87db830bd9aaf9ee82f5cb900de5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848853, "uuid": "1b57e342-8ed7-4a03-a0be-0c43a4c14b28", "comment": "Malware payload (njrat)", "value": "c33c7b1b72d24ee41de96ccbc58f4d9e1980e2eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848853, "uuid": "e2e41845-4770-4ef2-af98-eb1744600905", "comment": "Malware payload (njrat)", "value": "ee0f27f7ba93fc880b1d8c3a23fe22b1d677076f237c41696ba159999e881a6484af35f05ab6bf179e84f663f3ed3759", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848853, "uuid": "b0552528-e356-4320-9e1b-439e4c9123b4", "value": "B2C2E72D37B68232D1EE067E5562EA5043B5E04BF272FB0E4CD958DD4B5B38A0A41EE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848853, "uuid": "387d50fb-f908-42c2-9e87-871d4256ca01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848853, "uuid": "ec06bc87-a075-4fed-b60b-f95764ae43d6", "value": "384:zLi9fLKCJ1G4APoWqhxolxQmCYPPdR9MZAQk93vmhm7UMKmIEecKdbXTzm9bVhcT:XrUEYwxWZA/vMHTi9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848853, "uuid": "2c1a1925-0744-4cd2-b449-4f6cabe96359", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848853, "uuid": "2d5e3d7c-6c27-41a0-bcb7-3a31eabf6bc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848853, "uuid": "9aad6e99-5b65-453c-b9fc-895986c8cfd4", "value": "756fc0d2846ba7ee559c03debed29228.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac71df6-ce6d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623825463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623825463, "uuid": "18ef4896-ae88-4189-9a70-720f557aaeca", "comment": "Malware payload (AgentTesla)", "value": "4eb59091fee29b4d7681551f401f1169", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623825463, "uuid": "f815decb-a555-4edd-9d53-ce24e94f14c7", "comment": "Malware payload (AgentTesla)", "value": "2c4a0a5d4fcebde6da81bae4fa5bc4481fe74f734d3111e93d8e0d6ee967ff3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623825463, "uuid": "07a8839d-e021-4cf6-a229-d59238da46ac", "comment": "Malware payload (AgentTesla)", "value": "2b18b9da21c58956e8a5df11de320c9c8a21d755", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623825463, "uuid": "67cc3f7c-3174-47fa-b34c-f517573ab34d", "comment": "Malware payload (AgentTesla)", "value": "d1dd8085a60c75e8189ea04746b548932c2719807b807fa0352eb510a62cf7ee6a650f8670faaca7c20f8e1128eb471d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623825463, "uuid": "eb8fd11e-97c7-487c-820d-4f12e1a203fe", "value": "B2D42340135E50868EEB727C3F046FCD1CAC5BE9A52905E8223443EDDD9149DADEFA3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623825463, "uuid": "096e9cfb-0c84-462f-b62a-169ef91df2a2", "value": "12288:6GB47kYWNVUcpwKx7+WfrCwDnkwXeBxljJ0cGbNsXPM:6siUx7FDCwwweBxVJn3fM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623825463, "uuid": "5928daf0-1de4-45b4-baad-8f5c2baba683", "value": 628628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623825463, "uuid": "a00a8005-0b93-4d81-a7ee-ebe85e60d113", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623825463, "uuid": "f6c3ea70-2f9e-4608-abcd-467d4d841e14", "value": "PURCHASE ORDER #PO - 0117224354 2021.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9560ad-ce93-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623841683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623841683, "uuid": "c9b62a11-0d0e-494f-ad23-9f5554ee028e", "comment": "Malware payload (Formbook)", "value": "db508662a19787cd4040d09639e03fec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623841683, "uuid": "eb98efb7-e068-4b40-a597-1df7de1298fe", "comment": "Malware payload (Formbook)", "value": "2cc8b68aff95a623ec9c5b66e691346a4de00145f28a31125ae68442cee44201", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623841683, "uuid": "b37c3439-5ff3-4a8f-ae5d-d36ddc9b7205", "comment": "Malware payload (Formbook)", "value": "3dd1048c8e67c3a07809556b01807271c03a53f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623841683, "uuid": "eb8840fb-709a-473b-a993-8c9ce4e8107c", "comment": "Malware payload (Formbook)", "value": "d31df1cbb5b414506da96a1559006ef6888853abb6cd528d5fd667db2c129f95abd452ff5420d9a7378048a8f54780b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623841683, "uuid": "e681101b-e486-4a9b-8677-2c1170ee127f", "value": "22941247D6B8B312D40721BEAE97E6779F78FD402951808B53DCBE48087331D4BDA68A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623841683, "uuid": "22b6d333-bfe8-4549-a9a8-4b3a03ec6823", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623841683, "uuid": "f860c0b8-c415-4567-bb30-45ecfd64d603", "value": "6144:V/8n9c5PgdWb2biklQPgZlGN4Hgisau7UGwU1:SnKRgdMEiSQgGN4RsaOUGwU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623841683, "uuid": "f49f6446-7723-4b15-a202-4737f6a4b3c1", "value": 408560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623841683, "uuid": "0afd08b9-7cba-4460-85a0-52ef43aa59e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623841683, "uuid": "e6777bef-ea72-417a-8d70-7da9e6b933d5", "value": "db508662a19787cd4040d09639e03fec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158187d8-ce88-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623836943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836943, "uuid": "37ddbbeb-c908-4451-bd31-a385cbe15eb3", "comment": "Malware payload (AgentTesla)", "value": "84c78e6de4ef5f0c45f463953f7974ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836943, "uuid": "530e97cf-6280-4088-bef9-32edd595b9bb", "comment": "Malware payload (AgentTesla)", "value": "2cea67f41e7e4bc7a0d6a29cc9d5ad722e976f51546941abe407a0a9db61e5d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836943, "uuid": "90182ae3-3748-4bdf-ad63-c180972ca1d0", "comment": "Malware payload (AgentTesla)", "value": "3018a8907c25585afb95d899d7e02414c57f87f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836943, "uuid": "1f8043b3-c4ed-4d3d-b99b-d27209460697", "comment": "Malware payload (AgentTesla)", "value": "8a530ca6a4eb407eed7189fba64a716d45da26da4c180e7ea1431ded799e7bf04baf9e3aed96143dfdb16835a249c1b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623836943, "uuid": "59d67a51-bd68-4f12-af3b-5a8bf85ef5fc", "value": "38452310EEE00FC2D34E183D504BE5AD66ADDD8E7202EC1767747A6EB1347309692ADA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623836943, "uuid": "97f3559e-05db-41d7-8baa-23d674731bb6", "value": "24576:rmDlTBR+TU2peSjqH7q5WK9jSNf1jZc1MrA03PzX2ZE9ufOlv3bDVt82j86vR:SDAvwq5W1a2PD2erV3bDVtvjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623836943, "uuid": "0e076229-1467-4085-accf-30fb0b91de49", "value": 1262080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623836943, "uuid": "bb1172b9-87aa-4a33-8396-73d70cdde245", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623836943, "uuid": "6c837235-afea-41d4-bc84-41d574e7fac4", "value": "Request for Quotation (RFQ).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a0da80-ce87-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623836859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836859, "uuid": "182d02d4-d8cc-4a59-8f5c-f4f62e7796ab", "comment": "Malware payload (Loki)", "value": "a33a2def9e16f247a10b149816311db2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836859, "uuid": "1f9e5f31-4907-4681-a454-2c9c88ce000d", "comment": "Malware payload (Loki)", "value": "2cfcdc92bc223c7bdd1a0b69ea31167970bb9fae14c53517682061df89635285", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836859, "uuid": "b3dda612-7abb-4f42-bc59-d193fb153c71", "comment": "Malware payload (Loki)", "value": "4f3f1eb4fc4ae050fc56f72cccece8c7c4cc513e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836859, "uuid": "65eea2c3-fd9e-4ece-96ff-49e3942ce934", "comment": "Malware payload (Loki)", "value": "e375f52ef489285ff7eb9fbdae1b44b5db645b37cc8c3a51636be8a416e44413bfb5a6797afd520311fa83ecb8b8681d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623836859, "uuid": "269ba9ca-9c62-48ca-864f-064a39a4fb77", "value": "49841250B3E8CB63D24721B5CCC2C2DDF621FD62AB46C7873794BB2DA5363584A62348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623836859, "uuid": "72d0ade6-73c7-4e8d-9b9d-070fafe3ba87", "value": "12288:ptOMzOH8ZoFzUOcFvwX9eepPZm4c9Tia:pUMWRFzUwFpPe9Tia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623836859, "uuid": "bb23260f-3dc7-457d-8833-3f17d2da1ab5", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623836859, "uuid": "5cc78b51-02f4-4d96-86f4-9d9dc825d742", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623836859, "uuid": "71a03a1a-72d4-4268-a7a5-a0668276918a", "value": "FLI_0741000.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c54a79c-cea5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623849464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849464, "uuid": "d92065c3-7f65-4c1f-8828-d236874d6bef", "comment": "Malware payload", "value": "521741f76b6ffbcdd9bad3711293f816", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849464, "uuid": "4a5909f8-5454-4368-bf5e-ea195f69a4ad", "comment": "Malware payload", "value": "2d28a4e25477d49243d246e3dd7cb8209397ea5fd5244cc2f8ed1988b390f0e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849464, "uuid": "5dfe011e-438c-48a4-baeb-2dbb98dd82d2", "comment": "Malware payload", "value": "f45744f9eae9d74d42fbade244277e2fd4701488", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849464, "uuid": "4d609b25-fa81-4002-939b-431bce9e6bbd", "comment": "Malware payload", "value": "844cb40ab814b4ef10e492d12eea5a8232911381507f6407767dd2abb4bdc6212bd34ca63cc6422d74a60a1791cd15a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849464, "uuid": "4fc584b2-3464-496a-9d7b-dd70c3b5d0ed", "value": "BB4617D5AA596F9BC70D9274938104BD0DF4CEFE6E832F76A508F69BAC127412B47380", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849464, "uuid": "0f68fd13-bb11-4dcf-9d70-38a6db6e8507", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849464, "uuid": "b69b53f8-4bcb-408f-a387-42e7e253ba2b", "value": "49152:UCQSYRhWiFW63eUtYcsrGlVfZpx3bS8j2VxNKr:FYRhWiFW6OZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623849464, "uuid": "81303a4a-d13e-4389-9cd5-2d2bbd91b8e2", "value": 5637472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623849464, "uuid": "51bf9887-4f75-48f5-bd7b-e8696005ba5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849464, "uuid": "265c7207-6d7b-42b4-825a-4995467b789b", "value": "TrueKey.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a87699-ceee-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623880854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880854, "uuid": "68357c40-9fe2-453c-a997-25c5af0ee246", "comment": "Malware payload (RedLineStealer)", "value": "bd3779bced6f047c9a198b22e508ce78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880854, "uuid": "5baa9198-e259-4186-90d6-7e0a10ae7406", "comment": "Malware payload (RedLineStealer)", "value": "2d9fb04987ca1746f39e6c65f1dab892b1ebfc2ea427d3a8e0a3091d3269fdf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880854, "uuid": "ee9d1560-8c2b-4224-bcb1-acc78deb2a3d", "comment": "Malware payload (RedLineStealer)", "value": "f1074c897527ac265a1e5a70370cb615257ee46e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880854, "uuid": "f2971308-862b-40d4-adcf-990a0a260cbc", "comment": "Malware payload (RedLineStealer)", "value": "325eb557fca2ad90a05787eda564002bf27fb303013f762fc48f20d28b76f43d5600c1485d21e491bcafc4bff6091d33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880854, "uuid": "6e80d785-8cb5-49fc-996e-8b30808e3bab", "value": "6F84BF10FB90C035E0F622F85AB693B9A53D7AB05734A1CB62E51AEE57346E0ED31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880854, "uuid": "674d5cbc-761e-4be9-a383-7529665871e6", "value": "ed103d03110ecdb36297492051b4e917", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880854, "uuid": "dc853b87-9727-4b24-b64a-7daf7eb1ab79", "value": "6144:egXMfsIzq8b20Wj6spWdLmrCtQeI3OJGpSw+7u+XIj0C3O6gc7BzSts2ko:K5e8b20Wj6smLXx4pShc0C3Lj7B2nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623880854, "uuid": "e2db5b92-9f40-417d-a2f9-0bfa0e022243", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623880854, "uuid": "65e8ff03-2b7e-4e35-9a21-3669ff27dcfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880854, "uuid": "3dd2b99d-c35d-4735-b10a-c4996b5d0490", "value": "bd3779bced6f047c9a198b22e508ce78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f5b4a3-ce7e-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623832964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832964, "uuid": "afa5c917-7f45-4f97-882c-4ef9cb482183", "comment": "Malware payload (Gafgyt)", "value": "7aacfa7300151c0cad82adc8cc152ef7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832964, "uuid": "862d632a-8951-4728-8b80-6b26c908b27e", "comment": "Malware payload (Gafgyt)", "value": "30852f46b2837c27116fc106441acfc824bafb529a2f0d82370175a138060352", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832964, "uuid": "2f63652c-2b3c-45a4-994d-19161f1d0a0c", "comment": "Malware payload (Gafgyt)", "value": "c2ba0c4aac97fcd8addde8290d00957d86608710", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832964, "uuid": "03a9cc90-9bf7-4adb-a7c0-b4bb6d6a9668", "comment": "Malware payload (Gafgyt)", "value": "6bf62fa35af69a532b435dc84606987adec4f8d92b01482487268f749c2374235dbe6e89dea803461cc59f3f67c35876", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623832964, "uuid": "f5469b1c-ffa2-4ffd-95ab-4a9458088ccd", "value": "52F30924E0504367C3D3177EF68E925D3F221BFA538B3325AA345A742BC1B992D3A971", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623832964, "uuid": "2fbdf378-1192-45c6-8ac5-00aba99acc52", "value": "3072:Iam5s7ARwX3b3aP4YlzsSs+Ve4iu2oOQEHFkY5ltmKwQfggFiLN3:I5sMQr3aP4YldDiu2oOlvtmKwQfRFiLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623832964, "uuid": "a40e0095-88c2-4060-bd9c-1c10f5faeef8", "value": 160127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623832964, "uuid": "8329b24b-faab-4339-b4e7-449bce433f37", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623832964, "uuid": "7d9f147e-5659-4a5f-a8d5-f1b79246d1cb", "value": "7aacfa7300151c0cad82adc8cc152ef7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d0944c-ced8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623871563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623871563, "uuid": "0842e5ee-45a4-48a1-9efb-151ad83e1e6b", "comment": "Malware payload", "value": "a9bf177967e732e4d2d035b9db24d210", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623871563, "uuid": "312e5d55-5a73-4f3f-aacc-a26db79045e1", "comment": "Malware payload", "value": "30b21dbe9760cc2a285513b5eb161e482d234012697e7ddcdb7ca7a57832d181", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623871563, "uuid": "33537580-74e3-40f8-b62b-bfa2298be1eb", "comment": "Malware payload", "value": "94158023ae66d0b0dc4fe9e988b7fdeb37073456", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623871563, "uuid": "1075274d-c251-4a3d-84ef-a58432f74aa3", "comment": "Malware payload", "value": "404fe679254988f534b1cda2daa2626a6a3835ae052b263daba17e79d6acc1b751e56e76956ca0cfc9c2e6a470d81f39", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623871563, "uuid": "05532f27-251f-4387-86c3-068cc496d684", "value": "2B258D2076DAC536E57E05B02A2CD75E406D7EB00BB998EB63C85E6F09F09C24635F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623871563, "uuid": "8dc77473-3f8b-4cad-bbfc-2856cfa3e24d", "value": "24576:ZEaBqnGIQ5M6DLrVVdWG859GCHrSoUzLyaVtFUl:ZE8lrXVVdWX59GUrSLzeaVtFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623871563, "uuid": "d29c241b-d925-46c3-9ecc-a39d0c814dc1", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623871563, "uuid": "fc483942-0fa4-4d72-898a-7d6ab7dd12dc", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623871563, "uuid": "503bee1e-fca8-4303-a675-1ee38af8f2e6", "value": "a9bf177967e732e4d2d035b9db24d210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae59e60-ceab-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623852065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623852065, "uuid": "ba6a57f6-4129-4063-a205-f423466ced0f", "comment": "Malware payload", "value": "2262dc2d65995ab90eb29107f406c3fa", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623852065, "uuid": "3ad87db5-840e-49aa-90f5-232323d4cfc7", "comment": "Malware payload", "value": "31273fa316dc1ee20fa52329d3283ae09f39238b74c90012366485b90bb037b0", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623852065, "uuid": "0bf991e7-9542-473f-b813-e4eba120b4fe", "comment": "Malware payload", "value": "22f3141bf95d5369ea5d1843f5521318c433a685", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623852065, "uuid": "b2e94bdf-302a-4686-8182-eee5b08fecdb", "comment": "Malware payload", "value": "bbbfa3ee2eebd3a9605d7a6afb3ff3cb902af6cf13e7f8d667547f2d1228d4b086106daf90f74aadba29153388b4d944", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623852065, "uuid": "daf525e5-6555-4db6-92e3-e2d3bef201ba", "value": "8B350210A3B1C039F0FA53F819A5D675B63A3EB0976480CB62D62BFA97245E4EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623852065, "uuid": "c63d80f3-3fa0-4003-80b9-ea59e5f81cf4", "value": "89acf2f0d2a3019760d9233e714933ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623852065, "uuid": "c44dfda3-ff7d-43af-8815-36bb372d79d3", "value": "24576:8KLU7dT87jivsPPBOAhICaKN7r9zI7kvrtjhgq6:M8PbPBFICF1pTtjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623852065, "uuid": "e58da4ee-ba10-454a-b53a-c30b254d3004", "value": 1158656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623852065, "uuid": "c8e4b476-bc5d-4616-ba0a-eb01a0f70859", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623852065, "uuid": "eede2581-947a-4eca-9af7-b7152770d14b", "value": "databot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5cb6dd8-ceba-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623858741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623858741, "uuid": "67113a1b-0048-4401-8dc0-4cc4ad3f1361", "comment": "Malware payload", "value": "55e714e258f29c8fe4589e867b907f85", "object_relation": "md5", "Tag": [ { "name": "PowerShellXMRIGDropper", "colour": "#AD764F", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623858741, "uuid": "da4f7915-3e73-4f8b-9970-45e8fe12813e", "comment": "Malware payload", "value": "31980bcec059ec0c16e6cf35888ca6180e1ca235ee1693c5490e3754595da46e", "object_relation": "sha256", "Tag": [ { "name": "PowerShellXMRIGDropper", "colour": "#AD764F", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623858741, "uuid": "02248330-f2c1-4a12-bf8e-c4cda07b2bd1", "comment": "Malware payload", "value": "044f7d0c4eeb3301d7922b9e8bfb2a872d64830a", "object_relation": "sha1", "Tag": [ { "name": "PowerShellXMRIGDropper", "colour": "#AD764F", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623858741, "uuid": "69f738f4-6e37-4a61-8c06-0dad8004e109", "comment": "Malware payload", "value": "d0667da76bb40e804955b1043ab01e33bf97adca8523100ede14c2e9a0b1a5f814d24c58aba404219378655fefc1c35a", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellXMRIGDropper", "colour": "#AD764F", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623858741, "uuid": "ec782f5e-ff49-4064-8566-e676da5aa120", "value": "DDE0C0224CA7D36CCDE4E1F49076A001CD751203ADD1E49162F8E948C553535D3F4AE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623858741, "uuid": "5550ea01-2834-4a61-95ae-f6741a20b85a", "value": "6:s8qXS1fo+/qOpBRdffVHMGBWrH/VnD+LwxPoHK/ODAztFPtGaVDl:s84S1w+1nR1NHMGBkfQwoHK/Oc4eB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623858741, "uuid": "4e5cd18c-da80-4f98-b251-dd8b32e6f8e5", "value": 383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623858741, "uuid": "171f3dfe-2085-4a2b-a2c6-6de8db785a39", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623858741, "uuid": "e8da7b20-7457-4336-9865-9de900b2c37f", "value": "6JjrWSNL.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f75c90-ce88-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623837189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837189, "uuid": "f6342719-622b-4ae8-9575-9dfec109f320", "comment": "Malware payload (AgentTesla)", "value": "97021239d41dc5efd26c0c26e922f06f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837189, "uuid": "2b5531b2-fdba-43dd-9d01-53e40d85ad7a", "comment": "Malware payload (AgentTesla)", "value": "32269783938f1e9c0b60f92653957b6cbe356a3bd47b5df970f7485c16d327cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837189, "uuid": "9edc974b-d22f-4e59-bcc6-305bdd633ebc", "comment": "Malware payload (AgentTesla)", "value": "1b1faa516a3774fb55f2473b21c9a189fffad8f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837189, "uuid": "07c82dbc-8573-49e1-847c-07d9c820d67c", "comment": "Malware payload (AgentTesla)", "value": "a8523b20e9dc6a9096a57dfc5e7399903442dc9ca55a03a6d63afbb9d10267e1a440ef456595b9121c59a911801e8c1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837189, "uuid": "bc4252b3-ea6b-4235-a553-d9588540abe2", "value": "E255AFF876047DE6266F576BCE96ACED13B617229ACBA4CC40647BC305A3375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837189, "uuid": "bc1a3437-3967-4ba4-a6c0-acb6631b0413", "value": "24576:VBFeohGLeQWeXVJWUqXAVPsq7tuVYoI6RQb22Yy/bM671OY+AUvqHYCJeUTjDlRG:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837189, "uuid": "d7c79561-c59e-492f-a682-4f1b40d693b7", "value": 1323327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837189, "uuid": "17f399f5-ce9b-43c9-8275-7d661c88f0db", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837189, "uuid": "d19c9985-c5bc-4451-9ea1-41866b4d37c4", "value": "Customer-unionroadwaysltd-8754-PO.doc__.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614df80b-ce68-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623823326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823326, "uuid": "6a490922-a870-4845-a91e-f37f70e41b10", "comment": "Malware payload", "value": "44c0c456b6d8394c494927fd09a55d35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823326, "uuid": "8fbd1e14-5213-408d-9bcb-29daab40ebf4", "comment": "Malware payload", "value": "34c088e4ddbd9c1a24e53a74ed24f465c79e8370f7ea55b57dcb6f87cd4ecb7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823326, "uuid": "f068d7b6-e07a-4458-91aa-f242486e3941", "comment": "Malware payload", "value": "8021e88484cbc250b3dfed35659771ac85f9332e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823326, "uuid": "758b047d-7767-4ed6-89d6-d5c9c18c3a2a", "comment": "Malware payload", "value": "625bfdf63f34f244b43d85968564c55b6176817891e0c72fbde01b4d9c7d2b17cb94045819f6be6d61e62779bf506276", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823326, "uuid": "1f0aed58-a73c-4c94-9e15-d9feaafdda33", "value": "E515CE522EA86B89F0F99B34BDE0831603F77D167B27D3DD6E84B1CE5963D808625306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823326, "uuid": "bd0f781d-84a1-4d87-bab8-525b22677a9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823326, "uuid": "dcf330cd-d471-4f05-8952-2934917a74bf", "value": "24576:ji/UB0OqBBo/qvdticVIlswMX+cquPHppaaE:j8s0OqBBfvdQcVIlsw4Vaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623823326, "uuid": "51c78e17-5c24-49cb-9bcd-fdcdc296423f", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623823326, "uuid": "04c3f23c-edba-4f69-8246-c56ce871047f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823326, "uuid": "d1e5adaa-69d8-46b5-9544-1fb095609646", "value": "#RFQ Price List 2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270b6169-cea8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623850716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850716, "uuid": "18cd39e9-083e-4370-8066-91bc665ab2c9", "comment": "Malware payload (AgentTesla)", "value": "51e640d7868650387dacef88f1d14c96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850716, "uuid": "5fecd444-86e8-4703-81e0-b2091365a2e4", "comment": "Malware payload (AgentTesla)", "value": "355264e0bdde768122e4797e12b658ded5235a012aabe250e19dcfdcd984e96f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850716, "uuid": "71ba0ff0-c078-49e3-8870-ca1b97dab035", "comment": "Malware payload (AgentTesla)", "value": "0de407e675ee29c2831652f103567918ace0e389", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850716, "uuid": "d3b469d6-3d06-4e54-90f1-854aed7dbabe", "comment": "Malware payload (AgentTesla)", "value": "9c2c138c4c38cd4a81c847a5ac19bb0d68654da67f1871032f5917029b762f38d263c900b7a892359eb4f68d43f13cd1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850716, "uuid": "7a154b32-5dd6-4694-ad9b-d1c705237c57", "value": "CA15D4303FB867D6E07ADAA185AEB447C9ED61FA260DC8CD5C5007C157326CB4AF2D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850716, "uuid": "960837c0-e210-41f3-ad47-532a8db84e43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850716, "uuid": "c7a0bfa3-bef3-40cc-afce-95dcab4de5ea", "value": "12288:oSCVkAx25hlm4S4F3M9y6qg0bnY8/J2TA+v9nxn6VqSHGyRCK/kDU:oSlAx23WBqg2/JAA+vlpsqSHGXKcDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623850716, "uuid": "a686587e-8fc1-4370-b7b8-9d5955f4111f", "value": 896000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623850716, "uuid": "a7709bce-5b46-41a7-9918-2b7c5e8cf8ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850716, "uuid": "812675bc-b77d-4334-b3cc-c13e9e5493d6", "value": "SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a68c39a-ce6f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623826375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623826375, "uuid": "c9ddce15-0071-41bc-9d36-87108d3232f1", "comment": "Malware payload (Formbook)", "value": "71be617eb316ec9e056c011ceeb4e983", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623826375, "uuid": "4b4bcd31-5fb3-49c7-880a-17903f5d2673", "comment": "Malware payload (Formbook)", "value": "3643c16e7017696ca2809399d3edbf2f7f7298e4ef3246951fac256e86176716", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623826375, "uuid": "d357eb9d-e0b7-4004-add8-04c2afb825f4", "comment": "Malware payload (Formbook)", "value": "cc73b57e968591697b8636da47b011c96620d7cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623826375, "uuid": "c1b1f90d-2c02-4334-a484-4dee1ead5a0c", "comment": "Malware payload (Formbook)", "value": "11a1d2734a80bb1d3634038887b2f0320778b1746c6b9baa03ab97b403b824dd46daeceeb91f4c49ec27afb3b908188a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623826375, "uuid": "41e4aad4-bcfb-43d1-9322-4faf8881f06a", "value": "7EA412763BA09C2BD1B1497915F7D3A8DA3ADD226F610A0BA7587FBD5D3CE81BD08004", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623826375, "uuid": "ef3f4c00-34df-450b-a409-ac0a7defb61d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623826375, "uuid": "08caac57-7d75-41c4-bf8b-40d664b31b30", "value": "6144:nQqt9YoPyPZqXKn1B3oYHsO8e8faFocQjiuCl72rEHCgWZ45V1xp7wmEVvxZf8hL:ryE2eYJ8iFocQmuEsEHC1i5YVFV5YOs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623826375, "uuid": "6b9a23d1-5d05-46c4-bb2f-ac3820760f80", "value": 480930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623826375, "uuid": "6a23465e-2c64-4ef6-947d-ff53401d1af3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623826375, "uuid": "fd7148c1-4c89-49e5-be88-1e9451c91d47", "value": "Poczta Polska Informacje o transakcjach2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5abefc2b-ce81-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623834053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623834053, "uuid": "233e481a-b4b1-43e3-9060-b303295ae367", "comment": "Malware payload (RedLineStealer)", "value": "0c239032e40d231fc4325e3de2e3b2a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623834053, "uuid": "12bff08c-393e-4752-b650-f385f0a9c965", "comment": "Malware payload (RedLineStealer)", "value": "36ccee65e33ae4cd9c27f3396444fd35ca71ab931dd009c1da6abb0c8233e22c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623834053, "uuid": "ed17f618-be71-4978-b0e2-c697193b5509", "comment": "Malware payload (RedLineStealer)", "value": "b2db53fcff16eed023dccc04053bb7b1202f5c20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623834053, "uuid": "0bda17aa-0875-495c-81d8-cc23a4f6ce29", "comment": "Malware payload (RedLineStealer)", "value": "6a2b152bfb144f2d0fcb41e54e080b8a4b2fa240beb34448a769278d8467676b2776d276dad1dd83d2625efb7d67ea6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623834053, "uuid": "2d9c4a60-8929-4127-a901-d433a88e354d", "value": "99166CF13E0BD2EFD31604B4E812D907C85813F69625E541DC6A787C8B83DAA25CBB5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623834053, "uuid": "756ac32f-9cdd-49c8-bce4-87092b0fa6d2", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623834053, "uuid": "baf6412e-29a6-46d8-9751-5f1c9b043f5b", "value": "98304:rhE6Orzwub5JjDuAXJwe/DYcl+CKF69OcC:/OvH1FS0/NltKaxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623834053, "uuid": "91f5f381-2dc2-409b-bd6e-f38676e79d20", "value": 4163584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623834053, "uuid": "46ba24d3-e0b5-4dde-9dbb-e21e03222086", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623834053, "uuid": "a3a1eabe-ad65-49e0-876b-e46acb559945", "value": "Aries.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a93339-ce89-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623837433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837433, "uuid": "3c62fad3-bc2e-4080-bf30-0c70f9813e03", "comment": "Malware payload", "value": "d2b6299fc0d63f3faec30bc522d91e3b", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837433, "uuid": "8a0c495e-5e73-4384-a411-bf19849c9762", "comment": "Malware payload", "value": "3755e47cbc55e87538a9bc96b96355a44c38b78534f5efb939ecca2c29919f3b", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837433, "uuid": "12298884-8791-4f83-be3f-404ed77c1697", "comment": "Malware payload", "value": "f50ad98ca9ddf81b05e92be1490c6a66da53729d", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837433, "uuid": "046877c8-0c4d-4bca-8898-487b48196a1c", "comment": "Malware payload", "value": "20853b878f1f504c5131ef30995d68a38d71dc17a8563743d329371514b3759350f4d502e36699e69f230ea186c6aa4a", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837433, "uuid": "5ace3d51-f94d-48d7-9748-a97d6266897b", "value": "D2F18E79614B350CCF3A3E3E545C252E79EACD19644CDBCA3F5EC63A28616C71B85404", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837433, "uuid": "6b45d7fc-6050-478a-a9bb-bd733449ce85", "value": "192:ZILJZ0AKJjtf60HV/CCrvsjbcxCPSAMjNk5u:mVZpKXHpCCAcYaPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837433, "uuid": "f43f91cc-f645-4930-9b20-3345c84f45cd", "value": 7529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837433, "uuid": "a54ed630-bbd0-417a-9de0-1ee1364d4f62", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837433, "uuid": "cb9b0709-2ddc-4926-96f0-f010b5c3de59", "value": "298374647834.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178da339-cec9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623864864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623864864, "uuid": "aee09743-e07f-4127-9538-7615ef7ec278", "comment": "Malware payload", "value": "960d9db7f7c946809821030f970ee1b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623864864, "uuid": "33b599df-4a83-4371-8481-ff5fc1673a2c", "comment": "Malware payload", "value": "376d455050f120be85fadce239b9280c208b63f07583471cca9416c88f7747e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623864864, "uuid": "fae0b063-702d-42e9-bee2-d3ae889581d2", "comment": "Malware payload", "value": "9a93c164a49da1360e414f48b5659058b14ffcc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623864864, "uuid": "50b7ef40-1640-48a2-8890-cc80929e58b6", "comment": "Malware payload", "value": "727b5b53a0320abf6274a50b92523bf2057d673dfbcb5a6786564ba65acfb24f0e9846484e147f6c461b18eeaacabdbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623864864, "uuid": "356d5ad7-9902-458c-b927-affeacd2d858", "value": "0615C4303FB967D6E07AEAA145ABB447C9ED61FA260DC8CD5C4007C517326CB4AF2D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623864864, "uuid": "3f8f2db9-f4d1-4646-a56f-d83441977b63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623864864, "uuid": "b67c27d7-8e4d-4f4c-9143-1b85c09cc165", "value": "24576:dRLc972fW3ZBdZQ5kxv6HexnIg4UG9wtnQ:dRLc972yrnIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623864864, "uuid": "896e0ee3-bbfd-4460-aa9f-3279f0ab2939", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623864864, "uuid": "510ee018-f8c3-4f75-beba-f2b748d191b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623864864, "uuid": "1865b6c6-0aac-4ece-8b4b-2e7bbacae4c1", "value": "SecuriteInfo.com.Artemis960D9DB7F7C9.7109.16910", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d557fcaa-cece-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623867330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867330, "uuid": "0e152d7e-9362-4431-a2df-66204a981447", "comment": "Malware payload (RedLineStealer)", "value": "eb5164972c1ede500b362d8dc58c6ac4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867330, "uuid": "e8eaeeb6-8486-413d-8ee0-383697187acb", "comment": "Malware payload (RedLineStealer)", "value": "37d0881ab020c1d1401f2f606938968d4ceb60809f5f35fa38d153674c4a6786", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867330, "uuid": "f4030e88-9639-4c9f-9aae-5d6f058a6091", "comment": "Malware payload (RedLineStealer)", "value": "564f4087a5fd92de46212920cc3a770478014918", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867330, "uuid": "e7091a5d-67f2-4645-8fbc-107743c8f2a0", "comment": "Malware payload (RedLineStealer)", "value": "7f65985b303e0eaeaee98b8beec3f450f64175208320ffe919bb68d362976d9e0aa289087f8e4c8dd28f3e2e7414d6f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867330, "uuid": "8bfbe142-c9ee-45ff-af13-74f756bfc24f", "value": "06C4FF2865BFC409C4A7EFB12DDC98BBD99994A3A40E713311B9633B4B52794DE0F078", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867330, "uuid": "ed3ba349-d44c-4e02-bf58-0f27a9f644fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867330, "uuid": "a63731d7-0a35-4e53-8c29-0a84d4a791fd", "value": "12288:qSo0blXiValve0T2lMYc9fcu0JcKpnJW0n2cHwpNYIwtrUhlyD+:hF4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623867330, "uuid": "88c74343-e474-4829-8cf3-637b6349a539", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623867330, "uuid": "a62f8555-72cf-4149-9268-442ca8a5530a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867330, "uuid": "f4b06034-a334-4b08-ab02-a4f2f875e2ff", "value": "564f4087a5fd92de46212920cc3a770478014918.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729f4749-ce9a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623844830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623844830, "uuid": "bf9a9869-58a4-4d05-98df-23a0aa2d6568", "comment": "Malware payload (RedLineStealer)", "value": "e34e907b0f1d87d970d6eb356b7547f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623844830, "uuid": "c9c07fed-9b3b-44e9-b2b8-13e276083147", "comment": "Malware payload (RedLineStealer)", "value": "37d2577e213a70576f2c33b0a22562a4044fd7a8ec07f295148e39e0b7cdb83a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623844830, "uuid": "f3837813-d637-46e3-9e1a-7bad3443c946", "comment": "Malware payload (RedLineStealer)", "value": "b76b41a22d2a486a485d2110fb6d0401de753798", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623844830, "uuid": "8d4c3af5-b095-471e-9754-92bf95c68553", "comment": "Malware payload (RedLineStealer)", "value": "cad703ea8af34fdfc1c091dd227d539395e8af0fa0c2c0934fd336258e3ec8dbde161ed72bf41506bdb6e60d6049960d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623844830, "uuid": "15372c55-81f3-400d-9d79-a1327d0afe3a", "value": "CDA533C00AD6325BF8D60E767178CB13473A8FAC56A4E8EA07353C991FF7B51352942A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623844830, "uuid": "f8d973fb-958c-460e-8391-2df0d969a1a6", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623844830, "uuid": "0269bcbe-1220-466a-aa4c-25d30b0eed84", "value": "49152:75aj+4vOY+3HuHdB/z3mN77pw/OcCVDhN28p+Ewfke3J6I8he:7X4vOYnHfrmxl2OdnpakCJ6If", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623844830, "uuid": "9482c93b-ae1a-419d-8b1a-ad571438c308", "value": 2187648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623844830, "uuid": "8a06419e-d3a3-4ff7-aca2-fd727b249c4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623844830, "uuid": "7905cb24-dfb5-4416-bb84-76904196809a", "value": "E34E907B0F1D87D970D6EB356B7547F4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54df6816-cea2-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623848216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848216, "uuid": "142f3ec6-e7ef-4c71-bacc-433d7434b51b", "comment": "Malware payload (Loki)", "value": "8b17db33f71dfcadcdec4166624d8d8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848216, "uuid": "db5cf582-5f2c-45a2-b336-2a42cd533fb2", "comment": "Malware payload (Loki)", "value": "3832dd7fd3eec27f3bc8c6c05597318610c1688284cf700123b3550216ecf221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848216, "uuid": "713fd59f-d9e9-4b09-8ede-b003fd0a5424", "comment": "Malware payload (Loki)", "value": "9faedd1ac78f9b66919d398d6ac8b308a89ce75b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848216, "uuid": "75a1b426-0a9b-4dd0-87f3-36a661d3e6b3", "comment": "Malware payload (Loki)", "value": "96163d567d26e699c13650304b6062313138a296ffbc7a96e51ffa9347126902c90072389d172bb04d915aeb50b740d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848216, "uuid": "cbedc6de-2b6a-4b33-bf41-ce7f4c85a200", "value": "336412859BF07362DC4755F1E3A2D23046FAEE0A5E8D527F13D8BE0A197B32097D046A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848216, "uuid": "327dccb1-3482-4ec3-92ee-791966b20650", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848216, "uuid": "2e37442c-d678-4d63-8fe5-e3986d536808", "value": "6144:A5h03IVB/v+ezgBvP/1GcgOUz+1WmBln/EaWgFtE4n4U1:khJV1VgBnHf7F/EahXERU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848216, "uuid": "d96517f1-2547-4595-bb89-66ff1156beb3", "value": 330736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848216, "uuid": "b52f3455-de4f-457e-aeaf-5b65ef576328", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848216, "uuid": "874965d0-9156-48f0-b872-d0a3dc1f12dd", "value": "SecuriteInfo.com.Trojan.PackedNET.835.27578.3750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f5f1f9-cece-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623867307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867307, "uuid": "d8221523-7081-452b-a711-c9896d15da31", "comment": "Malware payload (Loki)", "value": "b7417e21d96ffa37302e09fea2092c00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867307, "uuid": "4973079b-0093-49cd-a1f0-767ff69c519c", "comment": "Malware payload (Loki)", "value": "396bb19c29d663f207e9ab5708ad13199968c59e4d4fff0254254d0d74183388", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867307, "uuid": "363df395-41db-4cbc-9e98-6f8c27463098", "comment": "Malware payload (Loki)", "value": "c9e0b7536074ccbc8bb58b38abd79389b47729ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867307, "uuid": "c46e5093-758a-4ab2-b3e8-e6df35462d7e", "comment": "Malware payload (Loki)", "value": "2fd4ea35316d9665e789c235b8476e387c5ce107c246bad1abb638a5f210e32207e1e7f7ce65b7c65cb03ac53029fd05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867307, "uuid": "e672b3ac-d311-4fe1-89dd-77ca6954a63d", "value": "79F4AF3436FA9148E5EA1F318DB9818443BABE163B50CB2E644E224C9D53793DF11BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867307, "uuid": "5b4fdeb8-f066-4201-97e6-54e24d8b9efc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867307, "uuid": "b859f54e-60b5-420a-bdd6-d308d594d215", "value": "12288:ETmO2vquwaHpzJ08BVJ5cb+RFGZFYBKxLtvEWkmdF:dquPHpVBTIZuB2Lt8Wk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623867307, "uuid": "b9fe8e26-cfd9-45c9-8fb9-e658df67090b", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623867307, "uuid": "5681013c-9ae3-4284-877d-bf173f24670b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867307, "uuid": "13e6dca5-ea38-4d87-8d9d-681d99802914", "value": "order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab9e700-ce8b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623838428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838428, "uuid": "2b1b013f-5c6a-49f8-8124-a36ca914d033", "comment": "Malware payload (AgentTesla)", "value": "fda5e2e3c164ba233fea76bdf4bbbbaa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838428, "uuid": "0c9575a9-a3c3-42be-8f33-bc3ec6df8a4b", "comment": "Malware payload (AgentTesla)", "value": "3a2a9cfdbd61a0059dfc842bf5333d9548d205d7c6313ef12be7840df044fc87", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838428, "uuid": "c706631e-d595-403c-8a4f-8a4ebc765cc1", "comment": "Malware payload (AgentTesla)", "value": "631ca5dc850945d00be29efbbd601712ab8e8f27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838428, "uuid": "df50c6f7-f075-4aa8-b920-db3f6260bd58", "comment": "Malware payload (AgentTesla)", "value": "b69af545f0608e81c206c98f1a92c9c2e4d31b31241ca0090ea84cc95ec40a10d07e8c3f2a41095bbaa1e3d625d06df7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838428, "uuid": "cb51d87c-0f34-4abe-9e77-c6355833a6e4", "value": "2425BE166DA97B58E9F90B33FCE0871153BBBC027B22C3ED6894385E6673F948512316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838428, "uuid": "b9e75620-11ee-4f0c-a858-c762b89f3cf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838428, "uuid": "d43ab695-e465-40ab-ad40-7460efb176f6", "value": "12288:uumUJvF4IJ5nk4oykuqJXAQH09NzRsjlFroOXzLxzHS2t16+dykeJjAz0SbQ6dvs:Xoy3qSNQLzLxzFGLbjAuEquPHp+Waf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623838428, "uuid": "bd9421c6-fa85-4375-b8b7-36de23911f8f", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623838428, "uuid": "b1399492-50a0-4954-99b4-2e096b4f016a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838428, "uuid": "5e045c57-2d8d-443b-85bb-568a8a28c946", "value": "Shipping_DocumentsINV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60abe3ce-ce6b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623824614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623824614, "uuid": "841b36b6-03e5-463c-9570-60964de5ad64", "comment": "Malware payload (AgentTesla)", "value": "b03bda671d20ac51e1bf4b73c1a5f03e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623824614, "uuid": "6486c8c0-8f47-4e82-ab99-45fe9f5ed069", "comment": "Malware payload (AgentTesla)", "value": "3a885666925f2a9a54b773fde621b742e80295678167539648c127deeddbaa98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623824614, "uuid": "75a2dfd4-2778-43f9-aef2-a5a37a0043a7", "comment": "Malware payload (AgentTesla)", "value": "de3d6f8076665833973f8753fdf6b153b4cf210b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623824614, "uuid": "1699bfa3-6752-4aaa-a712-6f110c5f57c3", "comment": "Malware payload (AgentTesla)", "value": "a2a53cdc7423367a0e55b473d5319e38d781b233a39c6ef6e52470a08a196666128e2477f63d27de23361b894375574d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623824614, "uuid": "4c9b24b5-9165-421c-9368-1c2f4b129fe8", "value": "BF35AE52FD8E965ED67C8CF54730BDD2C9211E6A1A0BA3862BD230EDC97F0DA9D9D001", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623824614, "uuid": "f98ee80f-d03f-4b55-9b1c-c59bfc0ec61b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623824614, "uuid": "41065294-c624-495f-a879-abef850fbf1f", "value": "24576:xdb9ipZC9Uo9lzQxPbpOoum2NvoVzq7U:xVkC9wHOxNAzq7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623824614, "uuid": "4bc0d9d2-7ed8-4225-8be7-06162476909c", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623824614, "uuid": "188e308b-10a4-41c6-8882-9ad857c6ceb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623824614, "uuid": "4cf5c115-9cec-411a-bfe2-b12fd4ec01ae", "value": "Q88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985826a5-cebb-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623859067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859067, "uuid": "a77eb974-ef11-4108-b045-eaa5ee64031a", "comment": "Malware payload (Quakbot)", "value": "de9aac78d73718b4cb88e046cfdd8113", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859067, "uuid": "33b867d6-65b5-479f-86a8-0ed0f08ea1a4", "comment": "Malware payload (Quakbot)", "value": "3b4d7f8036918c75267ca13980ac17419652c12d968336013808b04151b47455", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859067, "uuid": "f0e6eb32-296c-41e5-ad86-ad0c3609c1f4", "comment": "Malware payload (Quakbot)", "value": "fddc61687e4a8e94a6ca9581979ece4aa7c08f08", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859067, "uuid": "bbf4af3b-9887-4004-b663-90fe95791eaa", "comment": "Malware payload (Quakbot)", "value": "f06ee22bf78df697fc9de2403951149c431943c152e2bdae3cee8dc29a4670bf6b9d1d6adbd58fdaeed4c3980c961c3d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859067, "uuid": "a466281b-3ce6-473b-876f-80ba4c4f3fbd", "value": "8F158E72B2A38C37D1733A7D4D4B63A4982ABF413E3BA9462BE41C4C5F396413925397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859067, "uuid": "f42b8841-7aa7-4e2e-b18e-02b47c87a009", "value": "299f6f1d2b8a3e164da0e6578d1fa5ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859067, "uuid": "9320c4fd-e941-42ec-8ee3-e8a2eb9ad834", "value": "12288:jhFr6SSWqOdUuVAXJaBbWdsrHOYQYpPGFEQTTYxd3JE3MX/Pu6ULos:jrnemAXJ9+OBPyQTTYb/yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623859067, "uuid": "8a369d7f-24ec-48a7-bd45-00a2dc367596", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623859067, "uuid": "01a1bc29-3f42-4eca-bbbe-63712707e7be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859067, "uuid": "d10c642c-157b-44c7-9861-a138092b7c14", "value": "de9aac78d73718b4cb88e046cfdd8113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77678fa0-cee3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623876192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623876192, "uuid": "272ab0ce-6afc-45f8-b319-1743c66facd7", "comment": "Malware payload", "value": "d43338c66b34e2d4e15b090aeb58401c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623876192, "uuid": "3203ca66-4a31-4932-ba76-a2eac30cbcf6", "comment": "Malware payload", "value": "3bc33661eae22696045e7b4b1f29344f4c33e53404ddee2f72fd188beea1d865", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623876192, "uuid": "5033a19f-096d-4d4e-b013-f09d3b34fddf", "comment": "Malware payload", "value": "c0960248bdadcc3081309938eab48eb8002a91ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623876192, "uuid": "c4dff1c6-0520-4bc1-ad31-46f292a332e6", "comment": "Malware payload", "value": "eb158a166a06f25704aed06177e8e4ab0efcd09b8c19890122a5efb2c1f6ff643b4aa7c81f02b9d6dacc31f47c2379e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623876192, "uuid": "be2b9162-8f85-43e5-919d-c23e7f608a8b", "value": "68D48D137FAE8D85D49C64B54C4B46F015A3FC423AC60A77A6827EADEC32B507CA474E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623876192, "uuid": "8257cabb-a785-4c72-b39b-994f5053252e", "value": "145c6039185a48fcd75206f572d72aaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623876192, "uuid": "4b1d672a-2766-49b8-8140-49d951bddad6", "value": "6144:5qyKexVFPv7cWcm1S4GlA9jmHv/VCSY3hw9lMbk6u1QMS0y+lqiHTonWryFDYR3:AyKsIp46A9jmP/uhu/yMS08CkntxYR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623876192, "uuid": "86bc81ce-fc60-48f4-afae-b6c4fd8c775e", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623876192, "uuid": "7b168802-0d08-488f-a8a3-4d882d211847", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623876192, "uuid": "9ef7eefd-f1a3-4f0e-a747-ccc8c142cc94", "value": "d43338c66b34e2d4e15b090aeb58401c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53723393-ceb0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623854227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623854227, "uuid": "84993d3b-a447-47c9-a792-14c8f9ad5317", "comment": "Malware payload (RedLineStealer)", "value": "05189a5bf10ef65d5743cfe6f61b4176", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623854227, "uuid": "e0ed8904-7292-4dfd-bcee-035f10ab9892", "comment": "Malware payload (RedLineStealer)", "value": "3c059aec4e646344229078685a44275b504c0883a9ab97dfabf81dfe9cc9b144", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623854227, "uuid": "9ae07342-acf5-4122-9298-df87d3cb5e38", "comment": "Malware payload (RedLineStealer)", "value": "482e9cea82eac3ea02759d73149e5a897943c025", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623854227, "uuid": "149ccc47-3784-4654-acb4-3b369091d648", "comment": "Malware payload (RedLineStealer)", "value": "9dc08090e1943a7e88c85955a693ee6a31568bf7034ab31e5f6e42ca7d9b0364cf04f952a7867dea41657f0efae8d48a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623854227, "uuid": "032b4af6-2845-4fda-a1b8-f0d06e187d9c", "value": "02F4E120B6A2C035F1B252F419B69378A43E79B16B3C61CB53E51AFE16786E0EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623854227, "uuid": "39cbbbce-d2b2-48f1-94b7-f03473746405", "value": "f15a946d6e0659432dc9b8c464554438", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623854227, "uuid": "3152bd54-9751-412d-a44e-d67ca7dfc862", "value": "12288:5LF9i7XjcnAFFZDW1e06xzyVWXjJ19gpV8z174pPecVtST+dUAkWQeXhZojF1kjz:H07Vf06mWXjJbkVol3+GWQeR6jFyjYA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623854227, "uuid": "c9b97825-6398-4fda-ac79-b1c4ab62509c", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623854227, "uuid": "894a3caf-88d9-49c3-b2b9-8f158eaab9c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623854227, "uuid": "07d54954-369c-4361-8233-782941249ee9", "value": "05189a5bf10ef65d5743cfe6f61b4176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34aca79-cece-11eb-875b-42010a9c0053", "comment": "Malware payload (1xxbot)", "timestamp": 1623867353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867353, "uuid": "0384ade8-9b4c-4691-aec1-2533174dc203", "comment": "Malware payload (1xxbot)", "value": "611c3237e37b5d0a8b3037e695d690a2", "object_relation": "md5", "Tag": [ { "name": "1xxbot", "colour": "#7794E4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867353, "uuid": "758eaa6f-1cc6-452d-883a-0f42b970cce2", "comment": "Malware payload (1xxbot)", "value": "3c3e0c2b6be336aa939ff9c0c9a040d1ef73ab6126e00f9d97f0995719b80229", "object_relation": "sha256", "Tag": [ { "name": "1xxbot", "colour": "#7794E4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867353, "uuid": "35997829-113f-442a-9550-337c31bff3ed", "comment": "Malware payload (1xxbot)", "value": "3dbd8d1487710f268421363d6a4ec0a81c8b30d8", "object_relation": "sha1", "Tag": [ { "name": "1xxbot", "colour": "#7794E4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867353, "uuid": "14a2c5dd-3da7-45c2-8a91-36a0269a98f4", "comment": "Malware payload (1xxbot)", "value": "dbb99651fc3e4e46b31101c9dc6b21b0714d5aa3bae257839db4596703241624aa1db431facbd25030ed5d1dba34490c", "object_relation": "sha3-384", "Tag": [ { "name": "1xxbot", "colour": "#7794E4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867353, "uuid": "a9ff727b-a0a6-44a2-9aea-5a6914368624", "value": "D8B533617E80687FC4461F3818EDAA7943DA3E613BDD2F87061437F769B88612B4970E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867353, "uuid": "33ec7e42-f82e-4e8c-8e41-0758b6038407", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867353, "uuid": "8af56ccf-cc92-40e7-862d-4f67381ce08b", "value": "49152:HYvVeWhd4gWixm9sNZH5kErlIRUQuZdsT69jx9ZfOqAETtmC6:HYvVfHrW0mskErlcUvswxOhWtmC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623867353, "uuid": "3d1c69fc-3f0b-447e-a70a-9a712008c3d7", "value": 2294063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623867353, "uuid": "bce8ff21-e4c3-474a-9a18-96a1c839f1f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867353, "uuid": "9eced8fb-cd41-47f0-a2b2-838ade8ef176", "value": "611c3237e37b5d0a8b3037e695d690a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3337bbd0-ce88-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623836993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836993, "uuid": "c2647d46-2160-47fe-aa8e-ec48c477e35d", "comment": "Malware payload (Loki)", "value": "20e540ed9d02f60f7fb928ed8fe60f1f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836993, "uuid": "6913d41a-2c12-4eeb-ad56-a958d347ec16", "comment": "Malware payload (Loki)", "value": "3c48a312d69b2d72bec8b3dad17e99ee1241afff875e97b73569509d5f8b07ec", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836993, "uuid": "df2acf03-3998-4363-9c5b-b4730b0f9674", "comment": "Malware payload (Loki)", "value": "afa6c289fbeed004fe3a52c666cf32a8ae444e79", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836993, "uuid": "b186137e-eb0c-4c50-a86c-235b78272291", "comment": "Malware payload (Loki)", "value": "1786236465f8bc50fb136a60726ed94780ece2b16f7ecbaaeda1ddd09b15651ba0df2069ac97eec6b29785dd932df80b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623836993, "uuid": "da9e3b49-dac6-4c84-b1ce-837933da6517", "value": "6E55231ABFF28FE2E09F05F56537F51A803D5DE827164D2A761A33896532B7007A13CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623836993, "uuid": "0a2a6865-fd18-4004-87d1-f70167a2e3ee", "value": "24576:dHM2lbcLvEgwCf3okSoDsM0J+MC0MhXWc3zfSl2dz5QEYLiHjlkIh5cM07ZP:d2Lcgws3eooMQ+zNhGaza85Jlk018x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623836993, "uuid": "3212dbd4-5074-4ae1-b6f5-2f2105618934", "value": 1359872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623836993, "uuid": "b2a4c5b4-9a42-465b-a559-7cc1b635a12d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623836993, "uuid": "0af2ceca-daee-4ae8-9f13-e072ef024b75", "value": "Shipping-Documents.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb19c16b-cea9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623851502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851502, "uuid": "5e903760-ac10-45c8-b5ef-f43816b31539", "comment": "Malware payload (AgentTesla)", "value": "0ddf65e539ff267aa0c506b87a4dba3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851502, "uuid": "29d88c98-e1cc-4302-bfc2-4b57946ab5f7", "comment": "Malware payload (AgentTesla)", "value": "3d41cc7c5dca8353622d845db27d5f71b0e9e88830dc5c4f07c0528c4e5310cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851502, "uuid": "d74a45d9-4643-4ddc-86b1-1b934036f86a", "comment": "Malware payload (AgentTesla)", "value": "2b09f6e71fc552ba1e19eadf16abca53078eee76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851502, "uuid": "5612cbd6-c217-49f1-9c20-6d588aafa36a", "comment": "Malware payload (AgentTesla)", "value": "f1606df7d9e07e3a2f33bb0edc0eec18148b699261da8cffa4ca252d52cdf65ca66c9ed8a6c58501e3ad072edd338893", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851502, "uuid": "27a0e1cc-3fa3-4736-9f99-9fe436277738", "value": "92D423C5ECDFC4D094931E01E66D37E44D0E37C84E025593BCA488BAEE1A9ED1BD467A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851502, "uuid": "2a731b3b-23c2-410c-a0c5-77bfccd2d43d", "value": "12288:rLHfFtaptMCz+7+wZ0IsofRv2yvhMUQSXCkBWD9ICrb6u/C+rBjswGCuvdREYk:nDMtDzQ9Z0K/cIWRrRztjswGrvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623851502, "uuid": "7e69bf3f-9f59-46c2-8d5c-42fb92b33f5b", "value": 622437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623851502, "uuid": "3e3b20b3-c90a-4310-baa0-073fe15298d5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851502, "uuid": "aba9fc37-722e-408a-967f-51a82d7aebe8", "value": "price.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dba7caa-ce83-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623834944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623834944, "uuid": "3fa11bf5-6002-4a0d-9abf-d53ddaffb494", "comment": "Malware payload (RedLineStealer)", "value": "16137991d435a8f6c765bace85f53708", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623834944, "uuid": "d2d4858b-e1b4-445c-a818-7a6acc17535a", "comment": "Malware payload (RedLineStealer)", "value": "3dff7650ce306ba4b8a426875224382e5d8cd786915dbeda3785af7d0d6d045c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623834944, "uuid": "69814846-132d-4b84-9097-8f377d59ba1d", "comment": "Malware payload (RedLineStealer)", "value": "3a393bd345c881b3cac5ad576763c2933d7511e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623834944, "uuid": "aa342e6b-dc01-48ba-ad6b-15ca278d12e4", "comment": "Malware payload (RedLineStealer)", "value": "547b2f77f35dfec9cb53cb8df2ede7b6a0732c35f93c5cee88e29601cc5ba6b728c7d9307db7f06c3f14d147ece47b48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623834944, "uuid": "f79567d2-ba99-4975-a6f5-c24741a594db", "value": "B7C4202865BFC009C9E7EAB12DEC98BBD99A94E3544DB17301B4633B4B52794DE0F078", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623834944, "uuid": "826d6a31-ab55-44ce-b157-5bae832d05ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623834944, "uuid": "1012b168-73c5-4a58-9964-ff33ad051776", "value": "12288:ASoaK0uXjw5leeop2nG+EvjrpPvOvLopmMDqdGV5mJ+:rm90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623834944, "uuid": "8d5a5d41-5156-4758-9506-5141508fdd7d", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623834944, "uuid": "128c8550-2103-4112-a2e0-2704929c555b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623834944, "uuid": "72369873-c83b-4536-8dd8-9f624186370b", "value": "steamkeygen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9887de42-cee6-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623877536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623877536, "uuid": "7ae3b74f-9791-4208-b9ba-e96639543df6", "comment": "Malware payload (RedLineStealer)", "value": "e7766a476a396f7c432195033ae01bac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623877536, "uuid": "ff6609d5-ebba-479b-8ce6-7eb90c816784", "comment": "Malware payload (RedLineStealer)", "value": "3ea928be0540e8e8b7ef16eaa237e1ae73239b56f7c11ad7932805ad0e863fe3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623877536, "uuid": "8d9c2eb7-20db-41bc-adda-00cedade100a", "comment": "Malware payload (RedLineStealer)", "value": "c27a35440e4a5b20ba1c54210768dcd4c84d9420", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623877536, "uuid": "f350426f-81cf-4813-bb56-11b5166b76f3", "comment": "Malware payload (RedLineStealer)", "value": "e800f1536b91fe3fa022cf957a758c9ec7a30a8f4a7af7f574e0b77e77e2d35edb9cf40dfde393a05e6b37888a3f5a3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623877536, "uuid": "dfc771ba-03ed-4bfb-bc86-5fbe2e2729e7", "value": "B884BF10F690C034F5F612F85A7AA3B9A53D3AB0672491CF62E51AEE4634AF0ED31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623877536, "uuid": "213ff063-a901-48af-94ac-ec41b247cb5a", "value": "0f54bbcbcd51554020d535d750596e1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623877536, "uuid": "66540944-cb1a-43b6-a812-dc901c3ccc76", "value": "6144:XsK9sIzMSl+ONDXxm9rAWRd5JG2A4NBXfd5rlo8TMM2rFnqtxDf:VjASl+ONDXWrAWhE1YVd5rYMyFqDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623877536, "uuid": "ebc12b12-9d2f-4920-b335-0cb6ead38c0f", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623877536, "uuid": "de14d96d-4e88-47fe-8ddc-fcef1cd11699", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623877536, "uuid": "5c4eb902-5059-48d9-a9a5-b2b09d504164", "value": "e7766a476a396f7c432195033ae01bac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fad271e-cef5-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623883829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623883829, "uuid": "3593e89d-e046-49ff-99e5-88b94d819705", "comment": "Malware payload (RedLineStealer)", "value": "45a54701becfb37882b6d1f0da2699b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623883829, "uuid": "2ce3ec99-aed9-433f-ada6-b1eabafde645", "comment": "Malware payload (RedLineStealer)", "value": "40482afe2e7a9b8ea2c4c2285ec5d3195b2d4a114e5850da976f9cf9894d29fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623883829, "uuid": "c6c0f076-83d6-41af-bfe5-b9cb10f259bd", "comment": "Malware payload (RedLineStealer)", "value": "d86f8d2234e50a0603f64f2114bb7d81376814d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623883829, "uuid": "63fe6322-62f4-4301-9bde-c8202b93fc5c", "comment": "Malware payload (RedLineStealer)", "value": "f2329f9594dcb08ba69ae00b5a3812c811ed83620542a7b3ea7c7f50bc1c3f9bd6a9ff89e329dcfb06279095880b06a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623883829, "uuid": "e9fdd549-1bad-43e4-ba7e-5cac8bf5b5ca", "value": "6384BE10FB90C034F5F722F80ABA9378A52D3AB1572451CF62E51EEA5A746E0ED32717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623883829, "uuid": "06ec2798-dc30-4a96-8679-ac7feff4d743", "value": "364098e961c6433a5f030e6d84a48050", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623883829, "uuid": "90828682-eaaa-4acb-bb1d-cd0486c70453", "value": "12288:ar2IlrP2DdOrBjHVGevBrLhI6+uRhzF4iH:4lrPPHwevJLO6+urrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623883829, "uuid": "2d9fa767-9237-4015-bc9e-b6214ea094d5", "value": 395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623883829, "uuid": "4298c3da-37d8-4145-8edf-4d451e8d430f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623883829, "uuid": "72a422e3-fed0-4acb-ac49-32f8e2ca62af", "value": "45a54701becfb37882b6d1f0da2699b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7ad56a-cea3-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1623848521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848521, "uuid": "70afbb66-227e-4664-b693-e0cb1b790c9d", "comment": "Malware payload (ArkeiStealer)", "value": "a1e26413b7d36496c04ec317085fae56", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848521, "uuid": "1dd6bbb8-45a4-4b05-bb42-eb3dbb00195c", "comment": "Malware payload (ArkeiStealer)", "value": "40d82c0d6cd3eacbe4e2b4c3d83e9ba67ef5953cdcc359e6e083fcb03b613fc0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848521, "uuid": "3fb401ba-a45d-4d63-a0be-2cb5208f5d70", "comment": "Malware payload (ArkeiStealer)", "value": "d2275470c5ee407cb50b278b0a677daffdc1102e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848521, "uuid": "15568519-9c8d-4988-bca4-24c61890674d", "comment": "Malware payload (ArkeiStealer)", "value": "aaf5026a6d57669792fdfbe95e363a587d0ba65a4205d9dd1bf0db5ffc7a7bfeecc865a9fc96235a28301c1d5fdd6553", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848521, "uuid": "2d435614-fd8a-4df1-994c-106397d137dc", "value": "4684AE10A7A1C035F4F212F85A75A3FAA53E3EB1673890CF52D12AEA56746E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848521, "uuid": "b9513527-7cbc-46e7-8fe8-f9ab58a81647", "value": "a88bf0d4e011f8e1919dc00ad8d99f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848521, "uuid": "de271aba-8afa-42a3-a895-b48103182b23", "value": "6144:KcN9VLS4ZthtGbgL6yx/ko64MNmSHhZ/WAH01:KcN9VLNZA8XtMNmMZ/W9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848521, "uuid": "3a6a7576-07f2-44dd-855a-e8b98241e6b0", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848521, "uuid": "24f2726e-7776-49f9-b132-9de854054bc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848521, "uuid": "c552d6f4-0804-4d2a-a817-adb4953b2abb", "value": "file3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2e23a0-ceae-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623853440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853440, "uuid": "d72a1d12-75a0-44ac-b8ee-f7b0f3c3b9ff", "comment": "Malware payload", "value": "25f6274d39c9bb3cfda7b1b2ea88b5e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853440, "uuid": "eb8af777-353c-40d0-bc4e-b1cac84d545f", "comment": "Malware payload", "value": "41043776bf0e47ea57592df163a590bdeaca75f481471102d09ee2b35afc5ec1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853440, "uuid": "e7b0126f-ce74-4b4e-86ab-d3e7a88aa1e2", "comment": "Malware payload", "value": "662ae1525f1050a59cda93b8f5dfdc2de20ab307", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853440, "uuid": "965b1aef-eafc-466c-8c7d-51a91af23a1a", "comment": "Malware payload", "value": "2d0785441656af69920658026e4ed2195c2e0d32330bd6c70a4142152f1c7833583fc129ae4e2a23d41c216f43de486b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853440, "uuid": "a1b3002e-7ac5-4815-b2d1-5cced0467655", "value": "32A30896F900DFB7F40AE67604D34B24B670BBE14E532622731739A6AE762D43823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853440, "uuid": "5014080f-4a1b-4614-8fe6-2d6c37c5863a", "value": "3072:nkrWBIvC/IymEdH8ffA6OKmuxVqDr78fz1e:nkrWBIrym+8Q6OKmuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623853440, "uuid": "4125c9dd-c3f3-4c08-a049-bf865a495dbc", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623853440, "uuid": "121aab87-abb0-45a7-9473-5b5f5714152d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853440, "uuid": "5b6911be-6bb3-4826-8760-51cb1c9cde6e", "value": "25f6274d39c9bb3cfda7b1b2ea88b5e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a3ec42-ce9e-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1623846693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846693, "uuid": "c188307f-8c26-4474-886b-670ddb88689c", "comment": "Malware payload (Vjw0rm)", "value": "e7b6b4fb18ab115e2f55b97830202746", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846693, "uuid": "da0123b4-e836-4d27-b24f-b1d4dcafc38e", "comment": "Malware payload (Vjw0rm)", "value": "410a7f406af3ce89f468bec2eefc1de50f424344019a5395d3b9e2d9429d2c94", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846693, "uuid": "86e3718b-6d6d-4c63-9a53-6643048e6f65", "comment": "Malware payload (Vjw0rm)", "value": "9c25aa6c5cce3445c8a08a84e35eece1a2050ab7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846693, "uuid": "a1858a52-133d-46e9-b19c-7dfa2af651a7", "comment": "Malware payload (Vjw0rm)", "value": "c3338fe9003064cba41dd24daa4ebf3d1b6dc74fbb97c6e78202452004b77b3618524b0c0a430b29eb204cd00981067a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846693, "uuid": "87372698-56cd-45ed-9ce9-9c42a25c1bf8", "value": "2B129E9F23F3F6D4442311680B2DAA8A79B24BB066EF65819076D42DBC60FF0F955530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846693, "uuid": "4e06291a-9790-4a77-aba2-68d6b23aaa12", "value": "192:QYClfv06TvrV7aRs2pzcRl6COd/lGTWIt6wIvTvYlhw//kmOIq:QYClfvzTvkRsVRl6COtQ6IYBwlh+Gp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623846693, "uuid": "98af9143-0e16-4f5a-abcf-0510d36eae38", "value": 9336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623846693, "uuid": "8a5b68ba-5d0d-4b6a-ab98-6624d7cf2460", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846693, "uuid": "0f932343-68d9-4f19-b76e-84bb3130e44d", "value": "ZXOMHSJOPMA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f9fe3d-ce7e-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1623832667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832667, "uuid": "3aa39124-71f7-4c6d-82ee-d4203eeed88a", "comment": "Malware payload (FickerStealer)", "value": "cf90ac8bfcd9f4ba3e9167341ea68e92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832667, "uuid": "1e028a0d-a253-4187-b6d9-8cb05bb170cc", "comment": "Malware payload (FickerStealer)", "value": "42338f271984627fc7e5334f7d39077230b64c119068465e482ae6abdf97a1a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832667, "uuid": "390f1f51-373e-476f-8abf-ffc8a1525597", "comment": "Malware payload (FickerStealer)", "value": "0a4e9d451da2bd48523239e22082f4558fa56a0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832667, "uuid": "ea0c55f4-ead1-42ab-b53a-5f08973147de", "comment": "Malware payload (FickerStealer)", "value": "565b6d3f641f56a388e0b9f7de14d3156c93a594bf46670f089ee2748d533ce8cc79e41245b8c0498a91a53bc4d912d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623832667, "uuid": "52dd6f6a-529e-402b-beb8-36b73b9515ac", "value": "96C49E10A5F45C35FAA222BC49AB936AA73E3EA05B32C3C7417655F5CB635D2EC70342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623832667, "uuid": "7df7d123-a5ea-4894-b60c-648fc798c94b", "value": "2ab857f73c9912dee0698f559b75c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623832667, "uuid": "f7881d91-d2fe-40ed-ae1e-b3adef5c181a", "value": "12288:Gql3I+xq0+n6yvL+E/c5G32wj24MW0rwrsu:G6ZendL+Cc5x4h3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623832667, "uuid": "1d1ebe9b-18fc-4736-89da-a2c65e2dc049", "value": 588980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623832667, "uuid": "8627b81d-3ce8-43ce-b750-d512c0750d90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623832667, "uuid": "c5c1433c-89d6-4cb2-b18f-9991cf899564", "value": "42338f271984627fc7e5334f7d39077230b64c119068465e482ae6abdf97a1a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec8455d-ce62-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623820611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820611, "uuid": "8cd2bdef-9031-4faf-822f-3f341ddd08ad", "comment": "Malware payload (AgentTesla)", "value": "a480cf7bdd4510c52af54233544f71e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820611, "uuid": "afe8c57a-5a7e-4878-a926-0cb8d64ce4f7", "comment": "Malware payload (AgentTesla)", "value": "4342592ebf3e42fedee7b286e575241cff2f026336ff8d77ef0869506f135c06", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820611, "uuid": "a0a6bf9d-38e4-40b9-b5ed-c9a4a411f02f", "comment": "Malware payload (AgentTesla)", "value": "496b7a1db9a709e8164c6283620448ec1f9d1046", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820611, "uuid": "4cc155b9-301b-4c21-8723-32ab29b573f9", "comment": "Malware payload (AgentTesla)", "value": "4b8decfd1c5aa9ee768ca7835526897e7e266cf1456d6bb19c20a9cae4be6cbeb96ca22cc178202a85b6baf3bd0325b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623820611, "uuid": "8cdf99a9-44b1-41e4-8c9e-56f339f0239a", "value": "48B4239B4A32554848CB08DF8C35A783C1B34161A67D1FF89F4724FC20E4C6AB79AF5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623820611, "uuid": "49157af9-2bb6-4515-9122-368e56dc5d37", "value": "12288:HHRFzwuoFQ8GNsH3HKnzeZOPfhi5EnlpI41Yd9Ku/J0yWtH:HTwuoS8GmanzeZofc50p3u/J0yWtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623820611, "uuid": "f604ab52-a6ab-4b44-ba4c-c83d6eb83616", "value": 512539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623820611, "uuid": "97c990b4-d2ea-4df0-a9b0-f66f62581e4f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623820611, "uuid": "cf40c3e4-6dad-4a31-b41f-20b245e0da82", "value": "P.O.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d820d43e-cefa-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623886232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623886232, "uuid": "45bc0ea6-769f-4917-aad4-3c1d463497a3", "comment": "Malware payload", "value": "65b3bcf97047fba408f3e4e5a76bb544", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623886232, "uuid": "a1c9f066-818f-4057-9291-a4408096ff0c", "comment": "Malware payload", "value": "447a0ab1979dfe2b0d3ebd7082dec8ad9fba6c8a34bef39217fa4f2c6073c5d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623886232, "uuid": "3d333158-908a-4b3d-a2d2-23428e90d7e0", "comment": "Malware payload", "value": "9869bad26e3c332bd4a33dbfa7b54a078487cb13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623886232, "uuid": "a1345fb2-01a6-4164-b068-0f6a97bcfc03", "comment": "Malware payload", "value": "f265fa25d4e06f50f471e7604923b458617ef96f6d580cb3953aff6ea74ce18cde10bba415b46a83993e86a5081b55b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623886232, "uuid": "faa20f17-ac50-4202-a4b1-a6ea2251c814", "value": "FB04AE8873DD367FDA748BB80D365E67ABF1BD1B3400675C07A4E7A1222E639B217904", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623886232, "uuid": "53550e7b-9d92-4b14-8c73-1f8f874f3095", "value": "202c02a7af47499f175766540b9f48a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623886232, "uuid": "b543a4b1-6a1d-4e6e-93ff-814ce82dd6ef", "value": "3072:wQnN4jWQg1yJlGLpNb1FxMxRYWtTc9os7fbcfICrG3fp1AeQFakhA:wQnN03g1sApjFixRYW9c9oCcldDFak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623886232, "uuid": "46627dbf-fcfd-4679-ac40-506251920639", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623886232, "uuid": "3c3617c1-0638-44e8-8f35-143e926c2e79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623886232, "uuid": "da0cc5fd-4c6c-4382-a3a3-7c0bbbf30619", "value": "447a0ab1979dfe2b0d3ebd7082dec8ad9fba6c8a34bef39217fa4f2c6073c5d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66db193c-ce9f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623846958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846958, "uuid": "3a130cd9-0f8b-4855-8e42-3a8772936cd7", "comment": "Malware payload (AgentTesla)", "value": "4754dd3516186a2306faabdda6c976e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846958, "uuid": "1a2c1a00-07aa-442d-9e75-47685c1a6b42", "comment": "Malware payload (AgentTesla)", "value": "44fb7ff08e6bc4483494c6cab4d7d54e2ebc532fcea926d41aa8559a0ba9908d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846958, "uuid": "df2e847a-e037-4c74-a163-97b418747e50", "comment": "Malware payload (AgentTesla)", "value": "b037bd3509b2eedd67bba36d6c6fb50fabc7f3e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846958, "uuid": "3832e2af-c98b-4557-ab4f-ecfc73826029", "comment": "Malware payload (AgentTesla)", "value": "9299635783863797fab5b8d71b535e43e23b06a9e374bbd29f5597e73c943856b1fb89fe56716d1fdd9cf7ffc45953b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846958, "uuid": "4f0f3334-67ad-4410-a764-16a986d0aba8", "value": "EB45E5607AB4A6D6E47BCAB198AFB42298EE6DAD241CC08C1C5437C617733C714FBD19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846958, "uuid": "1aeee228-9a18-4941-81f8-f2aa4f65c61b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846958, "uuid": "ee826a58-4b95-4a32-ad02-5f935ee5b52d", "value": "12288:KQ9Nwr5t1dhlm4S4F3M9yk5HTugoTCIGHveMb+vo1epy25Gcni9ucrJbt8hs:KWwr5PTWP5HTt8CIO+vo1ayZ9ucdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623846958, "uuid": "5e3d7ffd-4b28-45de-bf68-40f75bf1d16d", "value": 1204736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623846958, "uuid": "8ea2867c-01e7-42bc-a363-4ac40377c585", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846958, "uuid": "dc07151b-3e7f-4622-87f0-a041f6c27a54", "value": "4754dd3516186a2306faabdda6c976e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c4a9bf-ce5f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623819519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819519, "uuid": "9830a486-940c-4bb3-a8ad-9099f2b37e43", "comment": "Malware payload (AgentTesla)", "value": "dd9d3de396edb2017a13e2c68bc52340", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819519, "uuid": "941b2932-aa79-45b9-bb34-cf0a9f4dd253", "comment": "Malware payload (AgentTesla)", "value": "45e557f4f13503136f3c9a2d3e9a5cab6eca34dcecf3ee527be5e77604b4c970", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819519, "uuid": "8a4d27a3-b75f-4b1f-8c16-753d88338792", "comment": "Malware payload (AgentTesla)", "value": "7e40ae6e691cd2b389797d0a9176f6afd6b1a155", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819519, "uuid": "ffe760ee-e2b5-4693-99e3-420d058bb88d", "comment": "Malware payload (AgentTesla)", "value": "553728f64b5dfd41c572057a1c457285959acf0f3be010cac8eaba51e2fee9d625dc2e25cddc5ec15b507ac15ad9e74c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819519, "uuid": "ed68f11a-e498-4c47-b8e1-069f1066d54d", "value": "0DB4239B4A32554848CB08DF8C35A783C1B34161A67D1FF89F4724FC20E4C6AB79AF5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819519, "uuid": "26aad4e7-bb20-4115-aa05-951486126658", "value": "12288:tHRFzwuoFQ8GNsH3HKnzeZOPfhi5EnlpI41Yd9Ku/J0yWtB:tTwuoS8GmanzeZofc50p3u/J0yWtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623819519, "uuid": "6b20fc74-b743-440d-9924-2d6871d6b922", "value": 512539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623819519, "uuid": "25b6376b-fbb0-422c-b1b4-3dc3b3f0cec0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819519, "uuid": "84faeb4b-f55e-4098-8754-43bfb3e7aff8", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2836c6-ce89-11eb-875b-42010a9c0053", "comment": "Malware payload (STRRAT)", "timestamp": 1623837469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837469, "uuid": "075df6da-e0b3-4758-9926-947c0ff8a64e", "comment": "Malware payload (STRRAT)", "value": "8b2fd98defa1f0ce32ecd352fec5d94b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837469, "uuid": "0e9a1b4a-e21c-4bc8-b608-236cdd773a60", "comment": "Malware payload (STRRAT)", "value": "4669cff262819c2c43770863c111ed2c82ea271812b7f06b0eeaca146e965310", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837469, "uuid": "7d19f4ad-9bf3-4e41-9707-33c99cbfec28", "comment": "Malware payload (STRRAT)", "value": "4e5bddd19a18c8472e0caa801b2af488f7dca90d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837469, "uuid": "a66082d2-6713-4003-a2e8-3ca09d987c34", "comment": "Malware payload (STRRAT)", "value": "8892c7043e4782be254507d43db33f7c5dab655f53d620f2bdd0f0e6b06189d0f143ba78601f2f846a5bd4fb1a258d4a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837469, "uuid": "370562f2-db26-4d49-a254-c2e4f3c5ab5e", "value": "29B3D04B7D8BCBE4D20B543611098177F70D03A9C216A56F62FD696A0C36C7C4A52FEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837469, "uuid": "f0414769-7246-4520-8a70-2f36087ff3e1", "value": "1536:UAcPF3x4zqZE6MPwpzz/tgpuZktrSAPgBZU6nT/z9et2ZsavM:UTIqZHMPwpH/jZktWnnTzoUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837469, "uuid": "cd4fa45a-d301-4e36-8853-5355bd795a33", "value": 108664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837469, "uuid": "14f19f56-da0a-42d9-9cab-fa8d4027b556", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837469, "uuid": "28157455-3ee9-4c76-b1de-565456679a37", "value": "SKM_C258201001130020005057.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a6f07f-cea0-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623847389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847389, "uuid": "e63c40b3-d797-4c52-a71b-f828b3dab06d", "comment": "Malware payload (NanoCore)", "value": "fa79292a3fca555f852e3ecfa10a8bfe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847389, "uuid": "4c91734a-6593-4ab5-b9e4-3ad402dd03dd", "comment": "Malware payload (NanoCore)", "value": "469a84a41bc24b4c4d8026c87f52fac747a88abd78863c18a3922d50ffe51c95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847389, "uuid": "84931218-a1ba-412d-a268-5d1a69d0f006", "comment": "Malware payload (NanoCore)", "value": "c25ec9a7d7bc7e1bea2b520d6c40c75f44a29c3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847389, "uuid": "1b22dcb6-62ba-4ade-8052-61c8d202a23a", "comment": "Malware payload (NanoCore)", "value": "c16b49eb657e77482e4e027fd6083456b6d0958e5c07d3e87276369af9c5c19df8558ab05c77136b8f86eb468d4fadfb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847389, "uuid": "18ec5cae-8599-4e5d-a402-99770461cc8b", "value": "4845E12036F6A148D6FA17318DB9918457BABA273F50CF2E2449234C9D53753CB12BEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847389, "uuid": "0d87a2ff-bbaa-41cf-bdf7-05b88082acb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847389, "uuid": "b6b4eb39-9c78-4d58-b4c0-1d331bd22518", "value": "24576:UUquPHpfh5ciPzpkHEQ8nqip6s1Y9Y30uNNjx4aJWxWhh:NjfVz+kQ8mSY9YxjyaJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623847389, "uuid": "997b8154-e519-406d-827f-edc4ffa7cbb8", "value": 1223168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623847389, "uuid": "78444775-9549-4720-a9ce-b1e1253b8c6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847389, "uuid": "4d27c6d0-e1c3-4014-927f-fd16be0e3b74", "value": "fa79292a3fca555f852e3ecfa10a8bfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c7576d-cece-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623867362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867362, "uuid": "edbc9242-0449-4998-84b2-7b5c38b7bf85", "comment": "Malware payload (RedLineStealer)", "value": "0ab55cd5d1fbf6c3ea904ed1a0590435", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867362, "uuid": "769c97bf-bdb8-4244-ae67-10f1350ac898", "comment": "Malware payload (RedLineStealer)", "value": "48b88580c017ca6823e1aa41264c28d3d27bab5a4a6a32c56d22828cfa13a44c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867362, "uuid": "8178d242-668a-4b89-bfe2-dfa2c0087ffc", "comment": "Malware payload (RedLineStealer)", "value": "41051912fb70364526a64b0531fc08ab93d9de6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867362, "uuid": "9e367c5e-4bea-4b06-a0ee-46ee42027d9b", "comment": "Malware payload (RedLineStealer)", "value": "75dc9f0f73a2b8220b821447f5426e5cf2e675ad68cb11ae843d01ad4c1a163d41a0ccb01ce5b1b5f34cde2050278647", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867362, "uuid": "35e8d17b-4657-49da-a7e4-f41066f850d2", "value": "6D936D26A3AE9E15F2BD0B7D74B0013543F1E1DE2112FB578DC864CE2E27B416A019FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867362, "uuid": "e5db69fd-ca04-4e5e-84c6-706485e13fb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867362, "uuid": "bee2488b-93f4-4d2a-845c-caeb9fdd9b2a", "value": "1536:u2APQDR0uT2qOoMSteyHJ6LX5N111+8suy9OZ7NNb4AZTGqG3ERy6JdNQOStx953:ulPFuTbMcp6r7111+GVNdfzG3yyedKO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623867362, "uuid": "db999a84-88ad-4d13-b43d-bddd3fa746cb", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623867362, "uuid": "e21d99de-2b0e-45f8-a2cd-ba47bdde8ada", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867362, "uuid": "6fa69aa1-5235-47dc-841e-ab3ecb2c5bcf", "value": "0AB55CD5D1FBF6C3EA904ED1A0590435.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7d00b9-ce96-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623843261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843261, "uuid": "c532366b-14d9-4ad0-9883-b8e7cfe8d670", "comment": "Malware payload (RedLineStealer)", "value": "b3b8ed7fd124edd6b33d688e0c67544c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843261, "uuid": "0e8caeb8-6811-42a2-b53d-2032cfd65418", "comment": "Malware payload (RedLineStealer)", "value": "48d0dff7748083a16125cedb4b20997b979945242e25af29b29136a51f69233c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843261, "uuid": "fea35bca-32c8-43d8-8a04-ffe865d51fb4", "comment": "Malware payload (RedLineStealer)", "value": "3c526b3e271b134900af9582af90c08c28aaa9dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843261, "uuid": "84d7705c-86ca-4a19-985f-28b7a5597d67", "comment": "Malware payload (RedLineStealer)", "value": "1f738b3e08bea03a49783c1ef2ba2eade3ae6f5cfa3869a407a95b01c42146f3b0593a972f01a3c7d0524c288f0c5c32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623843261, "uuid": "a85f6078-9e37-4537-8bd9-f15e95cc8f2d", "value": "A594AE10A7A0C034F5F652F85A7693B9E53E7AB1AB3860CF52D41BEA56346E0EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623843261, "uuid": "a0309189-f218-4d82-af70-3862dbb4abf0", "value": "8293ad000eb8f07ba025580bfe785c23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623843261, "uuid": "1d79b4e3-9b6b-4991-b9c6-d4e78e34f973", "value": "6144:gO9nCpKzd6Iwd+fbm1COC00gYB83KVmvthO0IddClllA:gSnCpKzd6Iwd+fbm1CO81O6mvthWPoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623843261, "uuid": "d7d63e90-c610-4255-aef8-2d056455f4d3", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623843261, "uuid": "6f4ccf4e-651b-4342-b4dc-55a5c1f45430", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623843261, "uuid": "f6ef1d10-5c99-451b-aebf-482b4d9a884b", "value": "b3b8ed7fd124edd6b33d688e0c67544c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb667fd-ce7f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623833251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833251, "uuid": "e777a04c-99d1-4867-b9bb-50d8abe4d086", "comment": "Malware payload", "value": "35c1042f3e6beb96ed47021db81b87fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833251, "uuid": "49ebba81-e45a-4411-a642-633c5916fef6", "comment": "Malware payload", "value": "490db6ec3d3529a054f723f12cabd2195ef16705dd485dbd869fe3fae7e5f2f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833251, "uuid": "d9905118-d70a-45c4-bbbb-d688e906f908", "comment": "Malware payload", "value": "6be79169d83f21e815242cc49559d633ea9ba279", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833251, "uuid": "6d7a1b4e-495f-4edc-8cdc-a2a5431663de", "comment": "Malware payload", "value": "f9d465a42ad399ba74f18df4ad5dfa703635e3880773075cf7a04b546ffd44118fe29159905050dd08f3fbfb558816e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833251, "uuid": "1acf162d-1840-45fe-897e-02894d3bdf17", "value": "A4D31937A6180B63C1C749F12C673BF08F64A9F212D751C5B92BAFA046779BA2413F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833251, "uuid": "1a3890a1-63a3-46c4-abbb-39e873635489", "value": "3072:RVnxeVEomK5WONxxqXE+mz/90zxwEhctUNO:RRxeV975WO/xqU+mz/90z2EhctUNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623833251, "uuid": "0ccd087e-1659-4922-ad9b-b03cd8d88b45", "value": 132984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623833251, "uuid": "39323291-bc0b-4f6a-8353-2df38ad89e71", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833251, "uuid": "51045a25-ba79-4a8e-b13d-d4ebb4fe60b9", "value": "35c1042f3e6beb96ed47021db81b87fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f01116-cecb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623865749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623865749, "uuid": "ebca14e8-507a-4cd1-9102-b660030e6e3e", "comment": "Malware payload", "value": "cfbcbb087e65eefe22f9e39f1e68143b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623865749, "uuid": "ecbb108d-4aaa-4894-8b7a-2aa095413e93", "comment": "Malware payload", "value": "4a03c257e123f8482b2ba0ce763b08a64c0d7db5e83f21420dca38cb65d05127", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623865749, "uuid": "87f14e40-2a0e-4cd7-88d2-1c79db01df20", "comment": "Malware payload", "value": "b60fa5a06e6c0896064b06413375983bdef408d4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623865749, "uuid": "b4d746d0-db35-4dd7-a9e6-f9a30c28630c", "comment": "Malware payload", "value": "b90758c1a29921cfaee21413770d06bea7d70577c07f3aafca0ae8de1d69aaadcd073844e2a68e9e418236382cd27dff", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623865749, "uuid": "212210c8-cf99-436e-a4dc-ab6a0e9a2876", "value": "F9D65C13B2C86539C06A0A7A883F9A58A93F7E316A17CC5677F43D8C8F355407B35A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623865749, "uuid": "308195aa-95f2-42c0-b017-f43379481198", "value": "a157c0189f13a848a27593795e957b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623865749, "uuid": "c2dc58af-3df4-4952-b67a-c58ac69b7c03", "value": "98304:c9rulM5g2Y8rklf5ok5vE2Be/Vc0p7qdMoRmIQG95cpcU8XgAlqi2W:9TJtP8VXqdMosclU8Xg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623865749, "uuid": "b5b419e0-a671-43dd-8877-62fe7eb37576", "value": 13133312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623865749, "uuid": "476b16c9-c6ac-4e26-9f97-ec1878a1a9fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623865749, "uuid": "c186dbb8-0b56-4619-8a1c-af868dd2b189", "value": "Binary.gadododo.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715d42a9-cea4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623849123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849123, "uuid": "84cbe4d1-d380-4b13-82c4-ee2249a34239", "comment": "Malware payload", "value": "0a64e03ff620d96629ef1e9d123f8a71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849123, "uuid": "d62cc4c8-68ee-49a1-956e-f0abcea3d9ef", "comment": "Malware payload", "value": "4a79f527d403fdfec5bf88068a5ac86494395d0b735ac27741a4ff78b2434a55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849123, "uuid": "def227cc-70d5-4195-b8dd-32bbec5158dd", "comment": "Malware payload", "value": "02d44d08a6c50caf6845ad03800cc4fef94a7632", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849123, "uuid": "de1a3db8-8239-4f35-87e5-0d4347cf2372", "comment": "Malware payload", "value": "13e8154e34a1633a658c8f760805db0b73883948dd59e10f3cd9bf05d9f69162161cf2f1be2aaaffe8ec12a804586841", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849123, "uuid": "49ebe6ed-9719-4680-9515-a43d7030d8d5", "value": "40451210F760C430F0B612F41AB593B9A62D3AF1AB7890CF52D52BEA47386E4AD31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849123, "uuid": "a1cd5491-882b-44e5-8a21-de4e65809e10", "value": "f15a946d6e0659432dc9b8c464554438", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849123, "uuid": "ef96a5db-3493-466f-8418-b0eee4cb8699", "value": "24576:GMFslRR8kcGDrg3WdwKtPisfCiz2V07+ZvVFA1y2Zg:AlxcGDr2i+YjD+Zgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623849123, "uuid": "74607d81-d50f-4a8b-99d0-004c570408e4", "value": 1167872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623849123, "uuid": "b1b1ec3a-b56a-44a8-9032-c8146a6895f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849123, "uuid": "57548c1e-7c6b-4a30-b54f-c6d91043bdc6", "value": "att.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc1d9eb-cee5-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1623877247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623877247, "uuid": "bf4191ed-d5ba-45a2-bf40-b1ae084a0009", "comment": "Malware payload (BitRAT)", "value": "804af89648b0d702f9a5a47a182f308a", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623877247, "uuid": "31ece0bb-e23e-41df-b850-59d194ec1bf8", "comment": "Malware payload (BitRAT)", "value": "4a860f20e57d25107df3f0db640b4a89a64a8ddf8cbea88b6a268f512c84dc02", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623877247, "uuid": "8efc57e5-6bcf-4316-8434-f0a6f12ff392", "comment": "Malware payload (BitRAT)", "value": "3ae332587de918d03445bbd4b0386b5af3d8c3ad", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623877247, "uuid": "21429b61-8929-4010-80e0-18ef6ffe6d4f", "comment": "Malware payload (BitRAT)", "value": "7a707d9b353430af4ea7e0421ebfafe7406ae06f67fc25e86586d09c8f9e405477e05d04c842345ae9f22807cc5206ec", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623877247, "uuid": "a3113bb7-3961-461d-8aca-e58321f42d68", "value": "996533F691128123FB6CD97DE9122F35192285D3D3BE72A62C8F94278E3C315BD82835", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623877247, "uuid": "db352eab-c10f-4153-badb-3bbb9277f861", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623877247, "uuid": "57ed36bc-16e3-4574-a83b-650b4afdca94", "value": "24576:4JmQ3QWWrDXNmFyC2SadnEHgeJhDIZyHvoUdEdNH4Nh564YI63PJysJQBA1:4qrD9TC2SVACoUe91JxysWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623877247, "uuid": "b3fd49cc-2b54-4b04-b502-84ee88397295", "value": 1510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623877247, "uuid": "704e801f-f786-42d4-b752-a2c7f51a6017", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623877247, "uuid": "6b47fd6a-478c-432a-9ecb-79d7d4696112", "value": "804AF89648B0D702F9A5A47A182F308A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e84a64-ce9f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623847111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847111, "uuid": "01966d9d-3219-4139-a4af-086671737040", "comment": "Malware payload", "value": "4ae50cbb1eb34f2ab6880f25519504a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847111, "uuid": "a9a521d9-4a72-4bc9-852b-1696ab36435c", "comment": "Malware payload", "value": "4bc74f0c9c8b45502fa4989b3e25808db909cf5239034951b6ab343d90678470", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847111, "uuid": "7ad8bcfe-fb7d-471f-adda-caedf5de482f", "comment": "Malware payload", "value": "24b4fd1a3c93a31f9566542cf02eec4091abc28b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847111, "uuid": "0289131d-82b7-4ac0-b986-49d54361040a", "comment": "Malware payload", "value": "6b6f3696ddf1f4a4a11554645956420fd40678f1b9725577961579b56eb43a8b4a803edccb7724f98cec02722dbb31ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847111, "uuid": "5acbb28a-0bbb-4aee-86d4-71049823233c", "value": "335523467B65C036EF9047F00EA279D3446ABD651C70E26F5B42688E3A766014F2EBB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847111, "uuid": "4023fc99-4204-4349-ba9e-6014049c0b69", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847111, "uuid": "638643b2-d9b6-432d-964b-e066d22c439d", "value": "24576:Hf1ZgZzH8KUbJlbow4bf9SdEpfm9u9rX7qro+QZYtA8NXoiQWIHt:/1ZgZz8ZJlbF4bfw4yrBQCtA8NY7Ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623847111, "uuid": "1dcfe1cf-f33f-4df5-9f7a-567ce6ed6983", "value": 1304562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623847111, "uuid": "d517ec76-1ebf-4102-802f-51b2db39861b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847111, "uuid": "75b7fc08-69da-4474-b17f-eaab4e8107c9", "value": "4ae50cbb1eb34f2ab6880f25519504a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d825e0fa-ceb3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623855738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855738, "uuid": "09ae227f-3c53-4bd2-ad0b-84e2802d77b3", "comment": "Malware payload", "value": "7c8cfedd6bac1cf360551e163a7fea79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855738, "uuid": "86f4efe7-e786-4adc-b578-8965bebc7749", "comment": "Malware payload", "value": "4c5235c129cc01a69a1dfb4f50dd0cf670f9546679009e131547ebdcf35cde41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855738, "uuid": "cc0d80e5-6171-4eef-9eff-deb91d67e662", "comment": "Malware payload", "value": "6474ba5971d9ff884b7856c6af5cca526ff58143", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855738, "uuid": "7474fafa-641f-4c57-8143-0cdbac4f53c0", "comment": "Malware payload", "value": "18fe2654499d432a5d6efc5f141ed58c26d7e66708006599dee96e187e02bdbe65f2e333c1776a0aae6ee306f68c0a83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855738, "uuid": "f871922b-559b-4eff-8434-959a5bcd79b0", "value": "E505B4303FB863D6E07AEAA185ABB447C9ED61FA260DD8CD5C4007C557326CB49F2D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855738, "uuid": "f531f079-4406-48b9-b486-896a44b294de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855738, "uuid": "21be075b-ded0-4f42-a005-c179f6071550", "value": "12288:S6dyu0AyRZJhlm4S4F3M9ydr4MHmxWRXw90J68kGAYSo3By8x68P0WG9DaP07ja8:Rd4AyRlWmr7GQ08aZoxyi6zY0iZuv9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623855738, "uuid": "bb81160c-78a9-4620-925b-0adf84781f1c", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623855738, "uuid": "aa67a75b-68d2-4600-9d86-c8d83e5a4c83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855738, "uuid": "e3140870-8381-41b1-8392-f6457e03c357", "value": "Oginal BL-Invoice & Packing List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db07401f-cece-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623867339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867339, "uuid": "3560e4b3-4fc8-4b03-9622-f6a97b7e3244", "comment": "Malware payload (RedLineStealer)", "value": "d8731d0896b8dd70a9b845b691c24f05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867339, "uuid": "7d1f5a14-2ebd-4486-9881-40ef458cc02d", "comment": "Malware payload (RedLineStealer)", "value": "4d77b91724d6827fb90e0a04e96d4a9771e7dfcc6b108804f0f47ff280fbc88e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867339, "uuid": "2812e6d2-ea8e-4ad8-9195-5da53ea61186", "comment": "Malware payload (RedLineStealer)", "value": "b83a252a6be92ee47abfc48edb17c8fb64d4fba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867339, "uuid": "65f1aaf8-2d60-4a5e-a86b-19000b09a094", "comment": "Malware payload (RedLineStealer)", "value": "eaa8813a01bdcb8efbfed63bb48346d754aba24a0e05fe9eddcd675b6339536594ba6345c7516ea10128a959420da0bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867339, "uuid": "b24f9abc-e6b6-4d67-9fe4-0f2f03931c02", "value": "2294AE10F790C034F5B612F85AB693B9A53A7AB1673490CF53E52AFA16386E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867339, "uuid": "5feccba9-6668-42f9-9d3b-745d2b938a1e", "value": "f15a946d6e0659432dc9b8c464554438", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867339, "uuid": "62134caf-aea6-4433-a8b1-39785121c683", "value": "6144:mOcjaxQEZauXlUs8DAx8GWdQxgUrTKjwCIhmzPlLl+/znl:mDjaGEZauiRDAiBdQxgvRcqLeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623867339, "uuid": "b48386d6-38c6-4372-9c95-019a10044d1b", "value": 428032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623867339, "uuid": "ca8464c5-a053-477b-8514-6b74e8f6c633", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867339, "uuid": "05ecd706-ecf5-4cdd-b551-8f4c19e8fc83", "value": "d8731d0896b8dd70a9b845b691c24f05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb06d402-ce62-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623820981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820981, "uuid": "5f07ac8c-bd62-481d-95ad-252ef9f8aa1d", "comment": "Malware payload", "value": "bde08bd5bb3985ae4203a43f1a9e2cda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820981, "uuid": "0d032208-0667-420d-9ecb-f269d4b63da6", "comment": "Malware payload", "value": "4ecb6f30bc9eded8fbf4efa085a7691ac9fad1baa32b0ae6ff356735fbf6e4cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820981, "uuid": "4c8a1843-beb3-406c-9c65-be0e75ed21d3", "comment": "Malware payload", "value": "bde726a47e54c8b74e21fd2d974487e90adcd100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820981, "uuid": "24aa8cd7-eee1-43c7-870d-9387d43f9794", "comment": "Malware payload", "value": "a269c583b53010ae3b7ca1a73f55bd20e3d85cf3ea3f74eefff364ab2f7ede565a58c524f315aee2de0782a4042b6573", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623820981, "uuid": "ca02ae01-a855-426d-9f1e-fa06761caa3f", "value": "99457B983D6031DED8EBC535BEA81D28EA673C26731B8347901771AD994FD87DF102A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623820981, "uuid": "39f6ee4d-8be9-46f5-ac45-4b15baee6e8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623820981, "uuid": "4adf91f6-ac07-489b-ae19-a58466a1f0b3", "value": "24576:MT1EaxrVrtMMYqO+YgC57iA0e0GquPHpRxttFavQ:MT1EaxRrFYfgCJd5TttFav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623820981, "uuid": "f2c3124d-f4de-4fdd-b71b-be444a31b4ff", "value": 1246720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623820981, "uuid": "7b35a4e2-1cbf-4ca6-b0da-409626b2b9ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623820981, "uuid": "ac976448-eaf4-48eb-8f5b-9dca472a91dd", "value": "SWIFT COPY_PDF_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76f7775-ce66-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623822692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822692, "uuid": "9a76b76d-abcb-44cc-bd4a-6b88faf7e8e2", "comment": "Malware payload (AgentTesla)", "value": "8db2c9ab57073b5da9d00308433c4f22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822692, "uuid": "b8bed5c4-9354-4a89-a254-2f85268f6852", "comment": "Malware payload (AgentTesla)", "value": "4fff3e315b46a93a4084447c243fc277bace24a79a3745f9375080ece2456da8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822692, "uuid": "9a56b6a3-2429-4c23-90d2-7d600fcac883", "comment": "Malware payload (AgentTesla)", "value": "8141d37c6bd49c12512742cef87404723da163a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822692, "uuid": "4996b13b-0822-464c-b38d-0734caa13786", "comment": "Malware payload (AgentTesla)", "value": "5438aa47bd44762bd3ec6cef50db65ec423d1e343734cc092b8c1b054c98a1aecaa67ea193fe00c1c38be0048e0d9c5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822692, "uuid": "47cfeff4-c5c4-43cb-bcd6-663a64593328", "value": "5B05BF3036EA9148D6EA5B318DB9C19407BABA267F51CF2E244D234CDD23253DB11BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822692, "uuid": "8e02b907-0d2d-4f8e-b9ee-c2da5f524c4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822692, "uuid": "276b66eb-3433-42bc-89b4-9c1aff9ca90b", "value": "24576:jV2AquPHpCUKLVqppY3uKRq28/k7LyO+:x7KLjHRq5svH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623822692, "uuid": "de63cba8-4ee8-4c86-b39f-c74735e73131", "value": 832000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623822692, "uuid": "7bac7950-307a-4ecb-8abf-e0c4847c3a61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822692, "uuid": "4b8f7972-a402-416b-96a5-d2bfc04e5d03", "value": "Enquiry-00090001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb878d4-ce75-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623828795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623828795, "uuid": "ee6fe003-7d32-4a63-84dd-959d20147d82", "comment": "Malware payload (AgentTesla)", "value": "075f5290590070e283b3d152d7b18b9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623828795, "uuid": "f7dfba73-c3fa-4fff-9850-377fc4d29193", "comment": "Malware payload (AgentTesla)", "value": "50366bcd221afef5c46eae87fcb17a14080a4ae9cad168048cf7c003ead1c27c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623828795, "uuid": "6fb35313-8e07-4ea0-9fd2-b8d22764bc0f", "comment": "Malware payload (AgentTesla)", "value": "14bbf31f842f13e6bd409d971d242f8b6283abf5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623828795, "uuid": "2bc8e676-8041-45ff-9439-ed5e9f69a8e3", "comment": "Malware payload (AgentTesla)", "value": "0ee40f39dc4156554d973746b1717b26ecfd79d9d8bfb80eda3d69c9e396b2fcd784ace95efeeeacc480689b23ae1a08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623828795, "uuid": "dd66c650-6975-4d28-a751-d3ce11c0dc6c", "value": "7105A02437F59148D6FA1B318DB9D18807BABA263B50CF2E6449224CDD23753DB12BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623828795, "uuid": "1b063a29-da8a-4874-9eda-4ef70eddd299", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623828795, "uuid": "5a1a07da-cef2-482b-82b6-4c35f7470161", "value": "12288:J935bzqCORi52gcvquwaHpyJ6k9wYNpCWfV2wDLkOBeTtljJ0A2bNGyW:tSiUVquPHp/2NpRd2w0ieTtVJNnyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623828795, "uuid": "af7596e0-db21-4ea7-bda3-a7d0b3511151", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623828795, "uuid": "5141eef1-fa80-49a5-8bd2-abd07705b63a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623828795, "uuid": "2af2fc68-7a42-4981-83a8-a68721777b40", "value": "SecuriteInfo.com.Scr.Malcodegdn30.16082.27306", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4119138a-ce67-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623822843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822843, "uuid": "367bb553-4ef6-40b6-8f5d-759a252d59b7", "comment": "Malware payload", "value": "eae7bc2a3216563e749fbdf3a1ce1ed2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822843, "uuid": "ecf9536e-8832-4f67-8ab8-ca850ab90b02", "comment": "Malware payload", "value": "5123c45dce6275efebc0c0ba3a5879c8af0e30cf14c33144be71bb4e9b8b0615", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822843, "uuid": "92ba9a53-a8fd-4f4d-8338-333af585aff2", "comment": "Malware payload", "value": "8c6e9f591ed73efafa227174eb4d1075fc513cc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822843, "uuid": "92228189-c6c3-4575-ba99-4a87cefc6bd5", "comment": "Malware payload", "value": "a60bbe83ee8fbabc956b1c64e8166f8e0b40e65150977902a13511493c20d6102e364a99b0f1f69dc8db76817f2abe3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822843, "uuid": "ee379cb3-c418-4217-b0fc-61b9f459cbe4", "value": "D025BF69B7139D08D544F2FC8B52DDB837DD2E10B814DB96BAF13C9A7E98603A8C6047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822843, "uuid": "feddb714-07d6-4c7f-a56a-a927e4bd5a04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822843, "uuid": "6653f875-8771-45d7-ae46-55e5570adc26", "value": "24576:u5ULNZicME4fiZe+fDcFUs5nNAWqckpdGMUVb:saZqCJ7cN5qfpvUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623822843, "uuid": "25e2c291-563a-41c8-8278-bfef35364bd5", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623822843, "uuid": "78132cba-f467-4eec-82a9-873f4001c3b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822843, "uuid": "d203a1d6-1ce3-4c81-987e-241c57c3faea", "value": "Order Enquiry GD040621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350a8e89-ce66-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623822393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822393, "uuid": "b38e8c19-6c4b-4607-84b9-58af0794ce00", "comment": "Malware payload (AgentTesla)", "value": "3d217e1b48eb19a781ff9faa3834ef19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822393, "uuid": "c67b0520-dc23-4019-8f51-68a2a9b13fed", "comment": "Malware payload (AgentTesla)", "value": "5133f50e4eba6506c9b0236ee2b881301886ab8967b75316d9b259063ca1a2dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822393, "uuid": "d9f6297e-41d7-4467-9498-5271f57aa2a3", "comment": "Malware payload (AgentTesla)", "value": "2157d11a88c79dc175177f52a0e9e8a86a02d90f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822393, "uuid": "a9f289b8-0226-49c0-8573-31740345eb28", "comment": "Malware payload (AgentTesla)", "value": "c6051df5dd26495eca1b22031a85fb82e49770053aa1d7c622c0c2eb3c30a2baa2bd2e825e5759e3bf355dc82b042fe2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822393, "uuid": "c9a09be2-2f5f-422b-b541-c9497a35e052", "value": "C2C41263FA50FDD5D0590077D53392801B61DC2DC3A1EB3BA0AE763639B2357D68AA07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822393, "uuid": "808a85aa-1637-4c95-a1d3-0a7d7d38851b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822393, "uuid": "06be3612-36b1-4c15-90e8-fb56cf303be9", "value": "12288:7EvkOvegwFO84ZwxDZUdC8Tvn8EDKGJysb8zJ4gJNoN:74JexFEQa88L8nGJZI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623822393, "uuid": "b4170e5b-09fe-45a8-8048-bba765c1c58f", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623822393, "uuid": "a3133761-c7a9-44c5-a0d7-a0db8ccd1759", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822393, "uuid": "229053c5-9d8e-4b63-85ad-5b4f15889e05", "value": "PO8985542021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a49445-ce8c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623838692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838692, "uuid": "142e29be-d095-4153-85aa-82c882ba1a41", "comment": "Malware payload", "value": "2c15edc4865cc37ac9bba9b51ac440d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838692, "uuid": "1e34ceca-4c6b-47b3-8e1b-198a04c3ff53", "comment": "Malware payload", "value": "51c6d8922059bfaeeffe8b316660aca907651292f4a022ffa8ee3b425c7b3180", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838692, "uuid": "aa02fee6-a44a-49e2-984a-e7eb01e8c894", "comment": "Malware payload", "value": "25164bec4f4285c2d679855d9db157df9ce1d85a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838692, "uuid": "c7eeaeb5-83b1-42cb-9a99-61246d7041a1", "comment": "Malware payload", "value": "dc0c6a12c930f1cc8642174094b6aa55d9d6ff44ed997c43938e02748b565d42a6e8b1c2d08a1f0f3a312c4f98bbeeca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838692, "uuid": "76c7f4f1-387b-41ce-ac6d-78379b6313ff", "value": "C97523F5A67F5B736435C3BC358A8E5D24C8B73992CE816AE7AC3B83411C7142946C8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838692, "uuid": "79328dbe-6adc-4efd-9b27-8c4970cd527b", "value": "24576:zmEkI6FGtL1Cmkg4jzj3rBT4pgl5MS47xPVZDS2/i8iCRg3xPRn/ehIl:zm2AGtwmLkzj7Bvy57xPVVeBVrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623838692, "uuid": "ea20b7ef-ebf6-47a3-9c7d-9fb7b30015d0", "value": 1601235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623838692, "uuid": "3263f88d-b2de-4699-b50e-ff6c53601b06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838692, "uuid": "66c676a2-4f71-47ed-8605-84caccd24256", "value": "2c15edc4865cc37ac9bba9b51ac440d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d81793c-cea3-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623848526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848526, "uuid": "4094362a-024b-4173-99a7-1fc625b39fec", "comment": "Malware payload (RedLineStealer)", "value": "80444615f2140184c28f5bf6ef751127", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848526, "uuid": "bbf73656-7a5f-431d-acfd-57aef2172e8b", "comment": "Malware payload (RedLineStealer)", "value": "51e96096360aaaa7df70507ee70610710b1c532e30994b60fc3d20792fcd688d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848526, "uuid": "536fe1d1-b6d8-4f4f-b580-bc2f8a1a35fe", "comment": "Malware payload (RedLineStealer)", "value": "597cc1e3cdf448e08fd70cb51e41a1cccf6a2255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848526, "uuid": "1dc7d90d-10d3-4c47-aea9-d7f653d161dd", "comment": "Malware payload (RedLineStealer)", "value": "903373c616c11f5e114349b72d2353a922265a273a3c0a007fe2d70935b57f0042440ab3472f57a0cf5cd948614e22f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848526, "uuid": "5c98dc0e-5a57-409a-bb93-d019469cc5eb", "value": "F6253B883B9C87B1F2575CF1F47AD17B0A2C1F0356E8FB9EF59830842A34AE12B55865", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848526, "uuid": "9432ebbf-dd06-4448-a600-ad49e264c6bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848526, "uuid": "b9852d9d-98ff-429b-8a1a-6e2dd66c35ef", "value": "12288:Oi7rLHHVE/VFYaoxZE5kOybzkaz/4Uz5Py9+:n73V81oTE56Xkaz/hBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848526, "uuid": "7aa767d5-af6f-4278-8d0c-af90292236a5", "value": 1004216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848526, "uuid": "2d3b9586-8ba4-4a6c-ab07-cff5db880add", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848526, "uuid": "cc18ffe3-05ef-497a-a481-6f3045ea812b", "value": "file5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8407c8-ceed-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623880574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880574, "uuid": "8d85a46a-f2e8-4b7f-b4c6-59b1266bfad4", "comment": "Malware payload (RedLineStealer)", "value": "179b165b164f308826d98d7df5d3397f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880574, "uuid": "052d7950-7f3f-4552-aecc-130fb86ba1c9", "comment": "Malware payload (RedLineStealer)", "value": "52d6bf44c55686892687b7600ed9a52557127e2eb6956e4d89d8450439e29df3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880574, "uuid": "8b11dd87-1554-405a-8669-2a154bd91acc", "comment": "Malware payload (RedLineStealer)", "value": "094c3a56f38cea8e2cc86cabfead74fbf87557df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880574, "uuid": "87d61a9b-6263-4d17-98cb-a91b125f9af1", "comment": "Malware payload (RedLineStealer)", "value": "52736b2ee8cb8e1ac9ab69359048b21bf2de9bb312c144053c0908681233c2290b49bae377a8ba4532f26a75ec57c5df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880574, "uuid": "8428ac6c-7ef0-45ff-8c1d-f197dc37a5e5", "value": "5884BE10FA90C034F4F621F85ABA9378A53D3AB16B3491CF62E51AEE56346E0ED31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880574, "uuid": "f54bd2f7-a979-48d4-8e38-bc0fdba280aa", "value": "ed103d03110ecdb36297492051b4e917", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880574, "uuid": "09105e6c-d099-4f6f-ad4f-da0e546598dc", "value": "6144:QgFMJsIz8Va20Wj6GpWdLPazFmGGhNP5eAkdS7Re+aiyF7BPntVe:eXQVa20Wj6GmLPkFkNPkgdL87B/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623880574, "uuid": "84b11f40-5228-43a2-8a90-e93a473c70b2", "value": 394752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623880574, "uuid": "276e7ea3-2ab6-415d-8cab-83f9c0ef1b0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880574, "uuid": "4b6895de-0852-4c99-bb66-2fa2f58433cb", "value": "179b165b164f308826d98d7df5d3397f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aca5a12-ceb1-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623854696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623854696, "uuid": "59b23853-3d82-4b67-8c79-7d8db4328a4d", "comment": "Malware payload (RedLineStealer)", "value": "5e51ff771292d383b9942ee310a0df1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623854696, "uuid": "c5977108-64d0-425e-a91f-f0fb138550b9", "comment": "Malware payload (RedLineStealer)", "value": "532ad0ae1e8256d6a9bb94dae853f8cae2d497999070d4d1e26a39e046032548", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623854696, "uuid": "0f8b9d01-5d75-496f-a8fd-38f190d0fbe3", "comment": "Malware payload (RedLineStealer)", "value": "7bfc60c43aa71cb52ec9d09f59c1f28ae784658f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623854696, "uuid": "affd35e9-4de7-479c-8717-2c98a4888c9f", "comment": "Malware payload (RedLineStealer)", "value": "c729b8adb57e365618b61b1fe3b023343b5d3385ac4b1814b59249474f9dedb141f5760a30676f62cbfd6aa1d1bad146", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623854696, "uuid": "6f42ff99-1f60-4f79-9a68-52f4f0bdcd73", "value": "D584AE00A790C039F1F752B55ABAA3F9E52D7AB16734A0CF52E51BEA46346E0EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623854696, "uuid": "0659ea64-032d-4e06-9038-98c09d62b790", "value": "2ab857f73c9912dee0698f559b75c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623854696, "uuid": "e5e4a086-9714-4359-9b5e-126b8d4a11fe", "value": "12288:c76vL3TOb1pnepp+2Qi3L5gfssA/J4fO:c2PGe7FQ2P1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623854696, "uuid": "70106950-f4fb-4691-bb94-864fecc3ab19", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623854696, "uuid": "53b47ca1-73eb-430d-b7af-168a0a6d854e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623854696, "uuid": "e2a8e3a7-31f9-4013-bd77-b9a2a02cb76e", "value": "5e51ff771292d383b9942ee310a0df1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf834a6-ce7e-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623832953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832953, "uuid": "15eff734-6cfb-48b6-98cc-c910de2a53f9", "comment": "Malware payload (Gafgyt)", "value": "22515e7bdbd99959749f57195756e5d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832953, "uuid": "169703b7-a33d-4ec9-a3ea-4888634f6149", "comment": "Malware payload (Gafgyt)", "value": "5364671eff221323f2f3c3e83c543c913221e5e0c0a9301c0bed92a3b7352771", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832953, "uuid": "da265d1c-d552-4bb6-9ef3-0b842f1536a8", "comment": "Malware payload (Gafgyt)", "value": "778e4436fe695f5c9c24730f6ddab31e847c7692", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832953, "uuid": "43c717af-fd27-4133-8eda-3556fb71eebe", "comment": "Malware payload (Gafgyt)", "value": "7f600afc1ebf76f28cd285ab4514cec342b6a224d13e3938bc4fb79083fdfb2734c89db693b8fbdfeaeea42834b003c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623832953, "uuid": "82011473-4966-4f21-ac59-59fdae9ca5e5", "value": "23C33A73A0615EB7C143AD7D24A6A9200F11A9971F2F6A8A75394BF0468F8CE741FF70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623832953, "uuid": "2e4cac7b-4cff-4305-8ba7-3e50308d6666", "value": "3072:NJzc8hUGdqLwXNsbysQ6PjgMmug0z0wORct5NS:NJxUGZme6Pj/mug0zXORct5NS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623832953, "uuid": "94ced8c1-23e1-43bb-bcad-9fc7e7f6e2dd", "value": 129181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623832953, "uuid": "d7d4ba55-d950-4f78-90a9-55e65ca2ee7b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623832953, "uuid": "29a523fd-cae5-4821-a112-691a9a10929a", "value": "22515e7bdbd99959749f57195756e5d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26424c40-cef1-11eb-875b-42010a9c0053", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1623882068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623882068, "uuid": "805691b3-1e6e-4bd7-98cc-01968c439220", "comment": "Malware payload (Adware.FileTour)", "value": "890b1c3b0cd42053ae27396b43f2d5e6", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623882068, "uuid": "4cab25e2-1d02-4598-a5a5-e7c960cb4616", "comment": "Malware payload (Adware.FileTour)", "value": "5492e3416a525e99e343354634250dd8d9c0620547803e67b3831fd3193bec3e", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623882068, "uuid": "ad27a08e-4926-4fde-8669-395f5196c0ce", "comment": "Malware payload (Adware.FileTour)", "value": "b7ebf330412b7636579a82871e764841e43175ce", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623882068, "uuid": "b8d21828-b3f2-49c9-b511-335ea3b5b4bc", "comment": "Malware payload (Adware.FileTour)", "value": "8add1fea604f8fee16146ab45c6b9a463557b17fce75cf46d01f90cf0e3b437ad913f1c3939032eb59b5fe2c69a6b214", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623882068, "uuid": "b789bbe7-1415-4e17-9b19-11309697c1d3", "value": "0E1633565232A866EA958338388FAF377F8FCB7F12B15C8457787A45C4868505B0BF0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623882068, "uuid": "1a58e8c5-3cc5-48b2-b2aa-ea74e470f216", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623882068, "uuid": "1cdc9f9f-a0b2-4029-8d95-2877e0adab4c", "value": "98304:JUvGDH+SH8WUt9P2RQgqlCwlysZ1krXxPriDd+i02+6l8:JUMHTcWQ92nqlLlBZ181+8yO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623882068, "uuid": "f7f93a17-ceed-4292-8e47-5364c0aca00f", "value": 4079123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623882068, "uuid": "01d4e038-75f1-46dc-ae47-e9da74aceb50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623882068, "uuid": "94d20460-bcba-419f-bb0f-855820bbd336", "value": "890B1C3B0CD42053AE27396B43F2D5E6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603283ae-ceb3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623855537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855537, "uuid": "709a31e2-d5ce-4405-8963-933c8b4efa74", "comment": "Malware payload", "value": "e74bce0399c7b2ad999bf97b3202ff3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855537, "uuid": "53f77356-06cd-4f0a-b78d-04862e8c488e", "comment": "Malware payload", "value": "54c09aea1d655dce8a0a861d30fc43034d94172f9481455814f8a0c53bbf43b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855537, "uuid": "7250f381-c7e5-42b3-9864-51f3b030af30", "comment": "Malware payload", "value": "f9315f1495ac98b2fc3aaf2e63b011555fab13c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855537, "uuid": "4703a96e-0f36-4dd4-a28b-83ad95e578e4", "comment": "Malware payload", "value": "b3d90e695072f2496ac3269166de3f7883d5e99a4774a0462d8411730380d9c250da18a21bd505ffc0c05fde140d2614", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855537, "uuid": "fb5299e2-a2bd-4c0d-9eaa-a7cc2f8f4fe3", "value": "04537CDAE553CAB3C86640F16425A722E672E076A199D8D3F3F43E30FC52DE0D609798", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855537, "uuid": "e3d6bd0b-d307-41a4-a70e-284e1e6aa857", "value": "1536:6JoKuJEyuktjGKazwuaDqPUMhhpMcUOjsJuO:B9JudrPUMhLrUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623855537, "uuid": "314a010a-0f51-460b-8895-8f992a0044a4", "value": 62928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623855537, "uuid": "12e98ad9-0f9c-4943-8c7e-2f79c11520ed", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855537, "uuid": "d2e4a53d-cef1-4c3e-8c63-64666368e439", "value": "nbot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12539851-cea3-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623848534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848534, "uuid": "91821508-50af-457d-8c12-49beabae871d", "comment": "Malware payload (GuLoader)", "value": "90b0b6d129a4426f048c425919834c3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848534, "uuid": "ef516373-8bec-4b10-94a5-09305f87c55c", "comment": "Malware payload (GuLoader)", "value": "54d6bf54d00aa6ce5376f705ed87bd6d85a87b1920bfb6e9f71c00a0974acca2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848534, "uuid": "cf695967-4575-49aa-86fb-2337feede273", "comment": "Malware payload (GuLoader)", "value": "5349a462fc61cb3e31766e71d2e9bad591062bae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848534, "uuid": "d5c16055-4e56-4d3f-8db9-4b3a278de4d2", "comment": "Malware payload (GuLoader)", "value": "a8fd29e5f4dfb4e5ab4246c7e473ed1a88cd6c2a69fdb8b0fa7d4f9e862457bd6b1d40a5f468771e29142ae2dc171b24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848534, "uuid": "8c1eebb7-e5cf-4689-80b8-4c88265ab32f", "value": "2E931A13FD08C459E50587712F21A9993A26BD32C5809E2737B47EDE1BB2A93F850F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848534, "uuid": "ec87b20b-b14e-40ba-9b96-50a4e4b025f2", "value": "d5d16d1b76210dd28c8586fe9bac3119", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848534, "uuid": "71b300c5-9d40-4932-b225-194bd56b8245", "value": "1536:s0Iamg38Bz7WlXI9CtkcL3mwjK+4KAJevuxkJEz9Ugy1mAgM8ncNSATduY+Ns4yU:p18Bz7WlcCtrjmwjK+4KAJevuxkJE3C2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848534, "uuid": "267c6655-1aaa-4ff2-ac0b-d0c378e41ac6", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848534, "uuid": "44874e92-2643-46f1-8e6e-e8e3492ff3f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848534, "uuid": "04c2d784-4af3-409d-a325-e157fe800519", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a852653-cea5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623849380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849380, "uuid": "bf68d101-b444-49fc-9bc7-4182f0ed5a3a", "comment": "Malware payload (Formbook)", "value": "3fb566bf6d492c2b6782bb8afd3fa499", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849380, "uuid": "7456a15a-8c2e-455b-be9c-763e88b0d1ae", "comment": "Malware payload (Formbook)", "value": "55d030ccdce44ce560c937356b7c24819dd73772d2dbef1bd258bb9f23daf169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849380, "uuid": "9e67cc46-6d4e-4952-8135-8409758af5b3", "comment": "Malware payload (Formbook)", "value": "1dc72f2f9fe40471cff129d535405867a3ef8789", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849380, "uuid": "0a2c34be-26e1-48bb-969e-4f8dabde21d7", "comment": "Malware payload (Formbook)", "value": "7cf44259653398cb6a91c250678e2171a593928a9c0c83b88ffcd4580d64ea38dcd7de3e258569dc7189143cbad21a77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849380, "uuid": "22eea0e2-6ab4-48a3-9585-a5469292f255", "value": "9034121D22C0606BF8266C7115B3BBFDDEF7A7660B306D4F17A1CE6E3521A81E45D182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849380, "uuid": "af122f4a-a643-4f63-909e-9575bdd625ba", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849380, "uuid": "52dd5031-6da7-4701-a79b-e303ba2992eb", "value": "6144:cQqTFqM9HkLCtbdjHuTvKGQ84yWJtsN4XhPK4Qt:yFlE2tdHn8DWAixW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623849380, "uuid": "2ef43fca-df91-48b4-a79d-11f7d6001e16", "value": 244245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623849380, "uuid": "4b050cf7-d526-4fb3-8fb1-721046af0718", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849380, "uuid": "0b3aea97-45e4-4e28-be73-3f9380594723", "value": "Richiesta di preventivo.202106.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca871331-cece-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623867312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867312, "uuid": "ce5e5d35-e6bc-4604-8b8e-d599c5ca305d", "comment": "Malware payload (Loki)", "value": "27632d046d676549f608823f86599545", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867312, "uuid": "0ff00c15-647e-4fcc-b397-810c291c656b", "comment": "Malware payload (Loki)", "value": "5625f34db586296794476e714caec94bd7fda78622238bd5259d9d0fc99a2783", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867312, "uuid": "e8db3b96-dfd5-40ec-9f51-0ea6ac51637b", "comment": "Malware payload (Loki)", "value": "4676d38a0859db460027d169fe4a2a7a2001f161", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867312, "uuid": "41cd17d1-c4e9-4924-93f6-05731fe37d37", "comment": "Malware payload (Loki)", "value": "38ff8eda88f7a0c562148dc2c6983348b49c960a02080299c81768cb6cda618d6b3c49ebd302eea47ac9adb65b138849", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867312, "uuid": "d094f62f-6c4d-41b8-9be8-3c8b662389c1", "value": "8B74BEF5E7707919F510C93CF99886303AF9DFA06F329142B469363A197E2AD3E220D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867312, "uuid": "6471207c-94e7-4017-baa8-54449ac33f19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867312, "uuid": "37b3bf85-7b5b-48d8-99de-981070f19e46", "value": "6144:hFIs5ky9eQLl+mn3mHVYTQiGLEGV9++FKwhVm9jF36FL:h35o8bTONi+bV0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623867312, "uuid": "5463c0cf-05ba-45f2-a19f-f80506ba07cc", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623867312, "uuid": "6eac059b-df87-4ec2-a14a-36b0c849090a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867312, "uuid": "9de07b1b-5ed9-4def-84a8-80086c797c38", "value": "5625F34DB586296794476E714CAEC94BD7FDA78622238.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abae3712-cee2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623875850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875850, "uuid": "fa379a63-4d83-41e8-93aa-3665b77467af", "comment": "Malware payload", "value": "0f113215a9b5c1912dceb121951ab3a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875850, "uuid": "3c7012ae-dc36-4cfd-871a-1e7420ee6c6a", "comment": "Malware payload", "value": "5636cddb43765a7e9228c88bd9f5c4cef443da2add0f7b7a9b77cead9387f5db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875850, "uuid": "48faedc0-2f59-4a4d-8db3-b4f995fe9f57", "comment": "Malware payload", "value": "1a172509a9a3c96f60cdbcd4eda0a47a8d84c3bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875850, "uuid": "1b32d712-d2ea-4293-844a-cccbde972a57", "comment": "Malware payload", "value": "490943e8354f2a4b209031818e52ca2267238217f58129d1b38e1cd3c5e5819f0be0b70d11627074f268979655c1dee9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875850, "uuid": "6253c908-36c5-4e72-ab3e-9a4d56f24ca2", "value": "CF833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875850, "uuid": "fb372ca4-7567-42bd-a20b-5dd9a2abbeed", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LlWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Yh2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623875850, "uuid": "63bd232c-6bd6-4156-870a-2d2cba4913c3", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623875850, "uuid": "3b74ba35-a3b4-41d8-8ef3-8092a20335f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875850, "uuid": "cd8b9dd5-abce-44c2-848f-1189dc47a659", "value": "0f113215a9b5c1912dceb121951ab3a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15645ec2-ce6c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623824917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623824917, "uuid": "c9d4d131-61ac-453d-a574-0d27f8ca807f", "comment": "Malware payload", "value": "53d0c8da41d2006c91058dd6f7001914", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623824917, "uuid": "3d6bd28d-7294-4af9-86f1-9b6aefcb33a3", "comment": "Malware payload", "value": "570c03f7913cd2f96147b379690d934d53d7ae71537df54c3e601ef703230967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623824917, "uuid": "d6195aff-fced-4210-9bdc-6d0bb78f7ea4", "comment": "Malware payload", "value": "ce38000b5322c2845530382e570af394f148aa5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623824917, "uuid": "d4a9f031-ed73-4a32-a71b-c188ab3691aa", "comment": "Malware payload", "value": "e836d4479fa6e75b61afac82f776ec6c126268f892657e8f407cb85697af6b99dd37e5db87720507739dbd618fa8f473", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623824917, "uuid": "0307674e-a241-4d1e-afce-717742b334ad", "value": "A9058F6977139C08D554F2FC8B52DDF837ED2E10B815DB92BAF13C8A7E98613A886047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623824917, "uuid": "897567b6-295a-477e-af49-ec507e8beca3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623824917, "uuid": "e1a2969f-cdc0-4bf9-a393-077f31928fbb", "value": "12288:tURC02jotn1TUFch5duzQKejLF28PcLmoGwyhRvwuisoYSfrkiLl8oG89zC0VIe:85UzQpjZ5P0QwHsVmR8oG89FV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623824917, "uuid": "8b063184-0c2e-4c25-8bf4-496174ad121c", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623824917, "uuid": "818b8599-9448-4870-ad51-4f1cec89d58c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623824917, "uuid": "9dec8744-cc98-4fa3-ae85-d844443e59d5", "value": "TS_HKHKG_to_CNZHA_CSN0162061_2021-06-28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a3781e-ce91-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623840945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623840945, "uuid": "0aa598db-afd0-4fbd-89db-c7d14d0f7072", "comment": "Malware payload (SnakeKeylogger)", "value": "c006190fa78ccb993ec371958b78ab54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623840945, "uuid": "8ec3a144-eb89-4bd8-a871-3885f27955d1", "comment": "Malware payload (SnakeKeylogger)", "value": "57bcdee4cc181db0c6671ccdd70a978bc4fa752bd6bfc9557be713539127baee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623840945, "uuid": "3e3a3467-b477-4c63-9cad-7ccc3ae78444", "comment": "Malware payload (SnakeKeylogger)", "value": "1001769cdccd9470c8e627c8fc4027540b649a95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623840945, "uuid": "a9f57280-34b3-4f71-9a54-99d9c2f88e38", "comment": "Malware payload (SnakeKeylogger)", "value": "fca8cf2534d7e9033aa6902bb42bb02564d04ba14367d01e278dffc60619f057ae5ab120568439ef65c913ee6ac6fb0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623840945, "uuid": "2cd9d5a4-c3f5-4aad-83fc-a88c6aaebc2c", "value": "C3B46B1FF56C75B8DD1D07F120E839348686BF846968848E31F9315E97B8BD68231E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623840945, "uuid": "548cada2-7db9-4a12-a232-6ca777637045", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623840945, "uuid": "1821f967-accb-4017-8901-47bbfb901b23", "value": "6144:FQqEePc4Ftoi/YUp5g2LvPg+1fAnPaRrhJy1oeMPoNEHAWr/Dvqv4J+Tt:F7Ft/XLLvoWoPaRS1ori8qve+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623840945, "uuid": "9639f15a-780b-43fa-a492-b1706d2e7bda", "value": 500336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623840945, "uuid": "ddb004bc-8522-4879-8241-68d5a9547be7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623840945, "uuid": "260151c2-c88f-4afb-b72c-4ad10f8f9982", "value": "090000090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64986419-ce89-11eb-875b-42010a9c0053", "comment": "Malware payload (WSHRAT)", "timestamp": 1623837505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837505, "uuid": "5e53743c-efaf-405d-92a5-0cd9dde4a0eb", "comment": "Malware payload (WSHRAT)", "value": "2b00042734f08ddd2e845a0494787ed2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837505, "uuid": "a9ecad5a-6a5e-484c-94a2-80025a38a2c3", "comment": "Malware payload (WSHRAT)", "value": "57c696d96a15f2d551a2c30a24ca8705e61c5aecbdb10fafcd73dbdc6e23365c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837505, "uuid": "b7f3615a-f3c6-4c4c-870d-e1e4ad55ffcc", "comment": "Malware payload (WSHRAT)", "value": "410f3d1b894d7583baa8045671c2be649aa02f18", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837505, "uuid": "1e7383fb-1c33-4901-970c-a388284b9d81", "comment": "Malware payload (WSHRAT)", "value": "db7cf40b13f832abf0e24b96987b47e9c60ae7a35b4ddd68237e2544e9ee41db1e6e4d776ff7231f59d4fa6a928e35be", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837505, "uuid": "2db991d7-f4a4-4d97-90e1-66d94e94af68", "value": "AB35E56A23B9572FF3B3E057D701C702943CD60C2E57E9E76C94B94EE131C98996EA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837505, "uuid": "e4a0cfd4-f965-4e08-bffc-4681287f7636", "value": "12288:WoI1svrj7w5q6J7/myfuHbyi4abqSvjo9efdGUhp+unEDVZb3M6AzZ509Jf9frZ8:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837505, "uuid": "c0ca7bbc-686c-40a2-b399-a30d7182aab5", "value": 1074294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837505, "uuid": "371820fd-58c0-4ab3-80e7-8742e4267cbf", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837505, "uuid": "b5d09a8f-c105-4bcc-85e2-1c6a645e25ef", "value": "Spec006.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513f8fe8-cea0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623847351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847351, "uuid": "b517f69c-0454-4cd6-935b-2afb9db9c6fd", "comment": "Malware payload", "value": "afbcbb4b56bcafe081620e04c8e55775", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847351, "uuid": "45da8cc9-9814-4baf-b7b8-d4862cd2003d", "comment": "Malware payload", "value": "57d392e13da883ae7f36912e3d766694b476623894ab80c1f5b35370cb8316d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847351, "uuid": "92420b7e-9c79-4d28-9c0c-0b220c6fa661", "comment": "Malware payload", "value": "f38ca563fe0e8ecf1b0fd92fc975731b9c880b5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847351, "uuid": "4a8e4aea-f130-4ddb-b6ce-93151511e96b", "comment": "Malware payload", "value": "9036a983cfee3611c5f50dcf854d4c670413caaf781f29a68949fc0e395981fa5887a570f5584a895592b15f9eb4f9f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847351, "uuid": "1bb8b7c4-c67b-49f2-bd79-631f9045e9b0", "value": "6C75E00373DE83A0C3725233BA66BB55AE7B7C2506A1F59B2FD9053DED20122521E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847351, "uuid": "f9167156-61c7-4939-b75c-5d12a2c2a436", "value": "bbac62fd99326ea68ec5a33b36925dd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847351, "uuid": "a1c4f573-61cd-4790-b395-8babfeea2d2b", "value": "49152:3kwkn9IMHeatlU5NFD6R7zvXBW9waPCS:UdnVri278JPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623847351, "uuid": "211ab0e2-0f97-4120-9834-c54dad229e93", "value": 1575936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623847351, "uuid": "98340e1c-080c-4e75-ab6e-afacb4a46abc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847351, "uuid": "a68f4f45-f20f-460b-b830-e804534ab457", "value": "NewOrder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121cfd5a-ced3-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1623869150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623869150, "uuid": "a2db8814-642e-42a6-b84e-f845e7c59729", "comment": "Malware payload (OskiStealer)", "value": "419d99e24ebd12e4b5a01e90c45b8810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623869150, "uuid": "d3bcc0c3-1bc2-4033-819b-19bdbe5ca231", "comment": "Malware payload (OskiStealer)", "value": "57fc60d0947baa02716af3f0ba6ad5676908ce222ef179d8a80bea054eb447b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623869150, "uuid": "073b73ff-9a82-44ea-b253-b2d537c6e405", "comment": "Malware payload (OskiStealer)", "value": "0ad4e7827aec682ab1bcf1b987fd55f4759140a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623869150, "uuid": "920efbd6-cb78-4c3c-8682-b8a30626832d", "comment": "Malware payload (OskiStealer)", "value": "d5d4b71fc66bde386fe29f12e0218c3cfe1bf76ef886950a6ebe21e0a22d5d5bad5864c3c20cf339a87e940d73f811b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623869150, "uuid": "7585e401-83de-4eb4-a50d-ba4781480125", "value": "2FA4F1CDE2178328C1304679E4316EF327FAEC37DAA88313786C7D22797916146A53B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623869150, "uuid": "23fa82c5-35b0-40ad-839c-237c84e7c104", "value": "6bac3cfe8acb6c6c4a30aaa022de2388", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623869150, "uuid": "924cb657-b37b-45a0-a105-d428e632038b", "value": "12288:l2sFttV8nAeOQKNKKKKKKKKKKKKKKKKKuKKKKKeKKKKKL75FnIZiWfjr04N8HXTq:8sFPV2AeOQKNKKKKKKKKKKKKKKKKKuKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623869150, "uuid": "4ba6e715-068a-4172-b782-ad12e817630c", "value": 451938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623869150, "uuid": "323ce51b-95c7-4691-a3b0-10578ec509eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623869150, "uuid": "6559e803-7aa1-4c27-87c1-c1ec43fe011a", "value": "419D99E24EBD12E4B5A01E90C45B8810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bed8709-ceb8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623857543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857543, "uuid": "dfe6afdf-9b06-4884-b36f-f47814f9e8fa", "comment": "Malware payload", "value": "1321563063ed390fe14620d952ad7266", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857543, "uuid": "de302c7f-fed0-4c54-8b50-35f66e17c70b", "comment": "Malware payload", "value": "5900c94b3c3b096279dc12e149607c3c798c33977391913ba8e535dab12d3a70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857543, "uuid": "2abedf5d-7347-4c0e-a82f-02da324a6a7d", "comment": "Malware payload", "value": "9509816063cee31e76b4647ae4594980196c678b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857543, "uuid": "6d9daa59-7993-4acb-a06b-59a50177b852", "comment": "Malware payload", "value": "01c36c6c73915d9861bd35f42c3acdb5dbc2763c7dce0a9f52cbee5c7fb987404472d8050c74d416fefa4ce555f3b2a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623857543, "uuid": "4fe24119-a46e-4fb9-b6ef-31f53a695833", "value": "63931946F9819F02D4C625BAFE9E118933136BBDE3EE7102DD209F6027CA5DB0B76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623857543, "uuid": "ab05d3b0-046f-426f-b3ae-9daa46d21232", "value": "1536:a/nGkkzmJ7kf9KqKT7KSK9xK3KwGTH7YNgIRKdfJgabsyNeauU0D6llBwin2WYer:ykzmJ7OKqKT7KSK9xK3KwGbMR4fJgabR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623857543, "uuid": "63776f8d-cce8-4be2-a492-01a447d926af", "value": 96060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623857543, "uuid": "27a52dd9-bce8-4a3a-b4c1-268ebec8dbdc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623857543, "uuid": "163ce386-64e0-45b8-9601-4ee8c8f8b39e", "value": "1321563063ed390fe14620d952ad7266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d0b964-ceed-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623880541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880541, "uuid": "ffbffc5c-6238-463a-a096-26e5b0529eb4", "comment": "Malware payload (RedLineStealer)", "value": "7ebe044f472295a5cf4cbf18c39c6256", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880541, "uuid": "e59acbbb-c8f6-4439-a996-c87eec0d24a6", "comment": "Malware payload (RedLineStealer)", "value": "59d30546c3fe61c92dfd9855cde2e741c40aa685e7597258303dba0ed639810c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880541, "uuid": "934c7c0d-945f-4156-8f93-cfb22ed7ebd7", "comment": "Malware payload (RedLineStealer)", "value": "60ac0554ff6c36451701f49d9b22fb844f44c183", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880541, "uuid": "28149b6b-1c50-4ba8-8123-d18253fa1262", "comment": "Malware payload (RedLineStealer)", "value": "b450b76712605536c5777bed179670325ace17c4a4e65a7a79409a8d994c44fb949cff83008702e541a579896da73fc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880541, "uuid": "385dbb79-7e0f-43f0-a721-6814317538f3", "value": "0784BF10FA90C035F5F622F84AAAD3B8A53D3AB0573491CF62D52AEE56346E0ED31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880541, "uuid": "33c882c1-5605-42a2-b0e2-20d3e81692b9", "value": "ed103d03110ecdb36297492051b4e917", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880541, "uuid": "693f21fb-d91e-4abe-b67c-797ae841ed1a", "value": "12288:tpOnE20Wj6cmLE4aWZf0OZzkynT47BqXr:KE201tagnJkvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623880541, "uuid": "d28610c8-1de6-4462-acec-bcc647b74fa9", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623880541, "uuid": "af1bdea0-19f7-4a57-8134-3590bc4bcfc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880541, "uuid": "52d64cd9-b5a0-42c0-bb9a-fd5ac1ff7fea", "value": "7ebe044f472295a5cf4cbf18c39c6256.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749fd683-ce78-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623830231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623830231, "uuid": "caff626b-7ef7-4c9b-97d7-5a1d2b7d2392", "comment": "Malware payload (Mirai)", "value": "89b56c3ba31e4d00d868457ccabedad5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623830231, "uuid": "3fd00691-de3d-4a1d-8a47-3a8caa5c99c0", "comment": "Malware payload (Mirai)", "value": "5ba7c0bed700d5b01363bd877b3cb6b91def34ce3c96a78ea4dfa6454badc77b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623830231, "uuid": "6e4eaf18-52c3-4efd-a403-f39af578ee25", "comment": "Malware payload (Mirai)", "value": "4a611e202ac70b03d69d956475bdc2cd8b084051", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623830231, "uuid": "9187f67a-e88b-4695-8681-92d2ff3f5e55", "comment": "Malware payload (Mirai)", "value": "00d13d084c7ca25e2deb11336ce818c2969cb192e44fa767e29d6b8aec13d3e1b7f1bd3910a7937c9a4f55816ab38e77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623830231, "uuid": "334c5dfa-0c87-42e1-8b9d-2b443d3e324c", "value": "75733AC1AA93D8F5DC112670347BEF32563AE57B1015FB86F39CAA72AD82601D5072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623830231, "uuid": "db0de428-60bc-4ded-9b50-84bd8ccaba5d", "value": "1536:padz73vtswv2JMPTx6B+/3AnivD48+mnK0tEmMQGH2UY:pSz7/y62Jw0B+/wnmvad21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623830231, "uuid": "05aff598-4549-4a27-ad41-6e76efb32c98", "value": 74512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623830231, "uuid": "e446094c-54c4-455d-ad42-99079e95dabc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623830231, "uuid": "733bdd9b-45b1-40c9-947e-c7c55ec0524e", "value": "89b56c3ba31e4d00d868457ccabedad5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf6ade3-ce99-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623844309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623844309, "uuid": "6541cdae-477a-4219-83f6-09fe32b192e4", "comment": "Malware payload", "value": "e16064f26570a775810b15f265de107a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623844309, "uuid": "a0999b73-70d9-4dfb-bc78-f0ac06ae5f8a", "comment": "Malware payload", "value": "5d88bb454b27143e2a0def4a265e68ff4db16306f143ced97798a6d4dd72f341", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623844309, "uuid": "48dcc5d1-e607-4e42-8fa7-a1554c1b3eeb", "comment": "Malware payload", "value": "3ce76593da157ce8edc9d93244c2fae1d5f76c50", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623844309, "uuid": "6c05ad4a-d13d-47b1-8fbc-e9a9ccaebd40", "comment": "Malware payload", "value": "80d3deaa36382b6ca7f9bf2d3d03b7e07f7c8fdd6788a37f63138bfde9d1c8c3e0856055ababa5f7079424cb7bad12e9", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623844309, "uuid": "fe35fada-601d-44b1-bfbd-9d060196a885", "value": "53043A037491C9FBC4D69FB91BDB91218523F8391B33220AB398BCA51F4DED86E2D654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623844309, "uuid": "d93f16eb-722d-4abb-a30d-85dea20d315b", "value": "3072:QW1/ToLHhrlrXLn6hBM4ltZ+ykoP30uvO8HpB6N3LVuaapZsAPmRAOH:TCPzLCB7QavOAz6N3LVuaapZsAPmRAOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623844309, "uuid": "fd87718e-7956-45ce-9e85-300fbb4b7195", "value": 178149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623844309, "uuid": "a73478b6-37ec-4d93-a21f-24765755e868", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623844309, "uuid": "102561ef-ce29-41cc-a4cf-5f8c761186b4", "value": "e16064f26570a775810b15f265de107a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8c45bf-ceb3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623855563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855563, "uuid": "139ddf3e-a2a1-4a59-8ebe-ae5be48a8ba8", "comment": "Malware payload", "value": "e5af92823cc69fd1df4a065dafd1d157", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855563, "uuid": "86b6aac1-c2b1-466c-a500-dec27a3c6f40", "comment": "Malware payload", "value": "5df3b1ecfb5b5fcd8a7d0d9acf7b2652dced3ad8412f3802cca0ef5177245751", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855563, "uuid": "3c356b84-f838-40f5-b8e7-2fde4830188a", "comment": "Malware payload", "value": "32e898d27f419c335096c6a6841723cb4dcda56f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855563, "uuid": "697c7ae1-da58-4316-85de-2c18da080432", "comment": "Malware payload", "value": "5f4c31238ddc3f5158997a8b292a7bdfb069b75b19af0ac3041b87f5e356157594e42c4f5f5b1ac251dc7b13a1715363", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855563, "uuid": "62314db6-ddfa-4828-ae16-d15bb45fe2b0", "value": "E693185AF881AB02E4C925BAFE0E118D73135BBDE3EE7102DD145B2527CBA5B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855563, "uuid": "8dd415c9-7b05-4fe2-8ec0-68ee614ef931", "value": "1536:k/nGkkzmJ7kf9KqKT7KSK9xK3KwGTH7YNgIRKdfJgabsyNeauU0D6llBwin2WYeg:IkzmJ7OKqKT7KSK9xK3KwGbMR4fJgabi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623855563, "uuid": "67e5f1e0-d7c0-41ba-80c8-8b06ba4cb44f", "value": 92968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623855563, "uuid": "1ab0379c-fc87-4c13-8c1f-7513665c241d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855563, "uuid": "b4e5f971-3215-4f79-8953-2d4be8963540", "value": "nbot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5c05ab-cecf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623867691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867691, "uuid": "5d5b3360-5986-41f2-a219-8cbf528d7275", "comment": "Malware payload", "value": "aae5b4c8eb3968b6bf06074865070a4e", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867691, "uuid": "7cb8c841-81df-43be-9ee2-b95863a16970", "comment": "Malware payload", "value": "5e138035c574034de0be2d3ae24bab8763fb918b3d0891311446b29663568534", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867691, "uuid": "3aaa07a6-b86e-4bb9-ad61-ebddcbb7b098", "comment": "Malware payload", "value": "35a4e0593009278aa41f9b35edff28ed0a176214", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867691, "uuid": "31b00c71-b4b3-40d3-ab7c-f46e87900a86", "comment": "Malware payload", "value": "c99b580441104ebea3423a6ccf3123ea8bd664200f4ce9b879088a5d29d12e762b702f918b87ef469f63f2bcbef725fa", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867691, "uuid": "764e4a11-f59f-4940-828f-62568759a039", "value": "A024D092F2C5D55AD56507358CD3D6C8173AFC53AE224B4F7380B73E1E72580DA23A26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867691, "uuid": "89ec68e2-eb1b-4e5b-9991-c9dec09dfc84", "value": "6144:6xEtjPOtioVjDGUU1qfDlavx+W2QnWxuX3NZi305tYiItmzwy2ymP4P:WYZnMiemMzymP4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623867691, "uuid": "a298a278-faa9-4582-a38d-56c9009cef25", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623867691, "uuid": "88dfa5b1-8070-4fa1-80c2-253d54b413eb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867691, "uuid": "5673f5fa-f31c-40a8-b11b-8bc1d60c28dc", "value": "aae5b4c8eb3968b6bf06074865070a4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac06bd5-ce88-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623837032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837032, "uuid": "12d5d260-7ccb-4a6b-a9bc-aaf957ce7296", "comment": "Malware payload (Formbook)", "value": "2e75248bf9decdb8d02c9e69ac261a61", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837032, "uuid": "d79e332e-6db4-4eda-8d69-787b41211cf6", "comment": "Malware payload (Formbook)", "value": "5e9b6256c2adafe03e928b0afe98328a3d77c69c6f924d2608e9daf131063d9f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837032, "uuid": "b3ec0c61-2beb-47b4-868d-6c16c1825705", "comment": "Malware payload (Formbook)", "value": "45f584d63706026e963cbb5b7242a4bc130efee7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837032, "uuid": "a030beb5-1362-451f-a9d3-eecfc85e2dc4", "comment": "Malware payload (Formbook)", "value": "6255c57ed1b4d5016003d9712e621c4fa410ae411d31cbfc36b05b18ff62b2bc437bc88b29f77baefabc0cf228ff7ca2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837032, "uuid": "0a41085a-5fcc-423d-8097-77e132ef8a61", "value": "EF6523A9ADDE8729F80768BD358F533E08E9DD51F6244D0F3A647F2A2176E3025523C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837032, "uuid": "b51c2bb6-55b4-49ba-a0b8-64afd01e2bf9", "value": "24576:Dhdcuk5Up3V1AIHxSD1X4i9KDTw7nL8swHmHvag8C8X7xKwzNs67ZA:Db0sa+xSerUjLPwHmP98Ft/ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837032, "uuid": "7bcc1f85-7d82-4c2d-bee1-beb725f54367", "value": 1434624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837032, "uuid": "a0572f55-5a86-48e7-9d50-b0a9c07a5f29", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837032, "uuid": "6edaf2ff-02e1-4996-9418-2dec291661ce", "value": "CMACGM-XIN SHANGHAI -08M91W1MA-TRISK-QAHMD.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c39ba59-cec9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623865006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623865006, "uuid": "8052a3b6-361d-478b-9b43-168233994ccb", "comment": "Malware payload", "value": "282a753be9e47bae7d38163ce52404f1", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623865006, "uuid": "b45153fa-c94d-4af6-9dd6-582c8b934404", "comment": "Malware payload", "value": "615a766ab51427a2d02af8ed1e4c262f0bccbb24c9b2ca890cb4760eb15ea241", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623865006, "uuid": "d9d8d2c7-370c-451c-8d93-6896ddde188f", "comment": "Malware payload", "value": "96497197b34bbbf2704051945d315c229c47f82b", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623865006, "uuid": "87c0e7e3-551b-45c4-a69f-4d948debd293", "comment": "Malware payload", "value": "502136a9ed2c7ca455193d5b9617b339dc47ef24364dd75b17cdb9720c5662693f1f1afcc37d752cbfda6bce6771148c", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623865006, "uuid": "f8a97ae2-3309-4a3c-bf4b-7257710a18cf", "value": "3F6523B7B1230800D86F6C353AD1349F611D123AFAA6F85E0E3779D0A79C8A5B5D439E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623865006, "uuid": "7ab92adf-b2de-417c-993a-94c5d38b2075", "value": "24576:ZLtuiZnhewyOGGGnG0GGG7jpP7OGGGTU5dUGSrrVGJ537VP5vSOsEYCoW3btIZLf:JtzZnhewyOGGGnG0GGG7jpP7OGGGTU5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623865006, "uuid": "d6fcfe89-823e-40dd-b344-d65626905c44", "value": 1494722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623865006, "uuid": "8feb2a23-8470-4174-91b7-100d04a70d75", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623865006, "uuid": "9e3b7d98-ce4c-47c8-9cb9-3a658cd0f13f", "value": "Payment-SI-T2-068837-AND-SI-T2-068858.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba58ab2-ce94-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623842188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623842188, "uuid": "c5fdcd04-ed39-471e-bceb-9e477796c82d", "comment": "Malware payload", "value": "66f348f54eb3cf9d2fc3a91058bf3bb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623842188, "uuid": "961011e5-f511-4ecf-a987-ca1cdc423361", "comment": "Malware payload", "value": "61b36c03b131bf1dac4d6ddf392b9ebd48a0d6c723abb9119c308dd22b5432db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623842188, "uuid": "cfad6048-f8e9-403d-9f45-5fdafd32d78e", "comment": "Malware payload", "value": "c8cdaa90ce596308e62850db4ac331bf17a1abdf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623842188, "uuid": "d2837e7d-d750-4b1c-a7a9-d36787e6ae6a", "comment": "Malware payload", "value": "069100992d540a057d8b7e6a721b488642a1f583853e0e7b20b9a31c22eae76f96150e2e4882c182f05516321069fb93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623842188, "uuid": "d4a79f14-d5db-46a0-b598-89bee98e0340", "value": "AE75010BDEEF116BFC552B71D02548B310FBF9F60E464722B6E1E60D2A70FA165384A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623842188, "uuid": "e7996fb5-9fed-48b6-9df4-298c76d8c609", "value": "2f095340e94ca508e3b83fb009ebf4cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623842188, "uuid": "0c291ecf-60fe-4274-8d40-7b7a4d9f53de", "value": "24576:rcCT67wHqWis4l+jIACFr5hqjiLDpSJDN93pqb6W8cU4gLQeA:YCpn8t74iA3qb6W8cU4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623842188, "uuid": "82c1c2c9-b463-4458-85ad-476d61cdb43d", "value": 1576960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623842188, "uuid": "9553477c-3832-4a79-86cc-6a1ad989eaaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623842188, "uuid": "231bc86d-228d-44ff-959b-843f72289fea", "value": "66f348f54eb3cf9d2fc3a91058bf3bb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353f02c3-cee0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623874792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623874792, "uuid": "1f5c6d8b-5aa2-42dd-b24e-bb58befdccb4", "comment": "Malware payload", "value": "73d0f5db820e8b491365e3faa9b55498", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623874792, "uuid": "8a035268-a88b-42c1-9118-7401dae7d63c", "comment": "Malware payload", "value": "61f73bf90c3234faeb8aa7c90f24fa3f7a3a1d38b2e94d40ce96a21e7320fd28", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623874792, "uuid": "994154ae-cad0-4399-b8fb-3e5fbffbd47e", "comment": "Malware payload", "value": "d5ef600aa1c01fa200ed46140c8308637f09dfcd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623874792, "uuid": "b818fb09-a76c-47db-8108-a61100149467", "comment": "Malware payload", "value": "977ed911ea1fe373d7d3126b264984a25bf99dc7417b630349a13c85fc7f69f191ddc4870070bcad03a294e73ef785cf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623874792, "uuid": "4dbb06d7-0e17-4279-8399-713915c7c3ea", "value": "6E762382A7C9EC2FCDBB80360BB2472A55558C618A0BD753756CB11C9BBBEC05E85FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623874792, "uuid": "5d46863f-245e-418b-8a4c-ba2d8d4b2b18", "value": "196608:HSwZWQeHQZzcTK77FMQ+V+Y4Bz/JdLdJ3Uh3IwNde:H5ZwH80EJEv4h/9Shz7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623874792, "uuid": "9dd77085-0413-4319-8597-22fd070571b8", "value": 7166342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623874792, "uuid": "7583e23c-2e54-47cc-9b21-3301cf914c25", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623874792, "uuid": "7b1550f4-ac65-4f90-bf7c-01fefd0e6b87", "value": "61f73bf90c3234faeb8aa7c90f24fa3f7a3a1d38b2e94d40ce96a21e7320fd28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a218c2-ce8c-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623838799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838799, "uuid": "c515cb3a-8ff1-4f8f-9b48-0b44de071f35", "comment": "Malware payload (NanoCore)", "value": "5688c69c4379841eee42dcaec2dbf55a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838799, "uuid": "385bd916-832d-4bfd-9c3f-43e618ee257d", "comment": "Malware payload (NanoCore)", "value": "62801897ae3411a8f144f2f7290ad2133ad0895f4f1550922dca9c6f4b9e8114", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838799, "uuid": "27a3e00c-f210-4fdc-a1c5-201a82d031f9", "comment": "Malware payload (NanoCore)", "value": "09a30ec730d1fdf77e80f6d31aa4d810e36b1c44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838799, "uuid": "8af5063d-4fd7-430d-8d53-49653a2c01e1", "comment": "Malware payload (NanoCore)", "value": "c60bbb222d72f06b6024a6af504fa8fb502af0bcf5c8d57536b3dc9abbc9f4fd381909d18af31438100418c2be750fab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838799, "uuid": "210ece84-005c-4617-8b84-0069ccb37579", "value": "73E4C026B3446BA6C22D4F3B81230C5893F1D103B772F75B78DC2EE84E157495A2E69B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838799, "uuid": "b4a18328-cdff-4244-bcc5-04eaeb4f05ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838799, "uuid": "1c4cdde9-0971-4c2d-a0cc-4ebe4750804f", "value": "6144:ie7tkcyarn5KfNZCM2RG+zcwxOVbcEkXd5+d/T7xvoldaoAxKiYe1SvA5UamZ6vh:XFn5W8M4GSYbcb/+V7B+AcigemZ6Xd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623838799, "uuid": "28bfa960-beab-4152-9afe-4cf952524f4b", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623838799, "uuid": "5bf6fdae-60b4-4b54-a179-258d3954a615", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838799, "uuid": "49206d40-2756-4fb5-b0b7-072ee03c2a67", "value": "5688c69c4379841eee42dcaec2dbf55a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b4ea600-cea3-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623848522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848522, "uuid": "acd8f3fe-9a68-4f13-b488-22a900c42919", "comment": "Malware payload (RedLineStealer)", "value": "306ddc2c822bcf673eb1ddee9aeb418e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848522, "uuid": "86f0c14f-b577-40ea-a32c-d6daf5b716bc", "comment": "Malware payload (RedLineStealer)", "value": "62a47f5b00fd13033debb845a6874afb640b98b09038a3d70a6f76d3de27bea9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848522, "uuid": "896cbae7-4f93-427f-b182-e1e58524e0d7", "comment": "Malware payload (RedLineStealer)", "value": "adff45aef204408ec8b615665ba8e6c7cb95d8f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848522, "uuid": "3449e309-ab93-4a9e-9c6a-f397a399168f", "comment": "Malware payload (RedLineStealer)", "value": "30f9b364a374d6f04ec5e04f6a9231042c300142a218eed4bd6d2bc5acb4aecff923d50181ba82cf987a904cce7bd807", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848522, "uuid": "090f11ef-b2b9-439d-99ff-b0727448a84c", "value": "62F40110A790C039F0B652F46AB5D369A9397AB16B7888DB12C117F917746F0EC32F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848522, "uuid": "8c170fc0-4218-4e28-a7e0-d08734108e8f", "value": "9a87733f396baca7ee1c81e5d149213d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848522, "uuid": "b25e99bb-d7d5-4854-913a-d160b6bd4a57", "value": "12288:5sPvOR+W8b3Lmz5hSzZTL8RN1viYqNdcl4BB0OsnY6KBwLLE7aJTYEYQG:5y5vLmzypL8RTmyl4Pbp5BqLE72G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848522, "uuid": "8c0303f5-d6e8-43db-8b03-ed3d29f2f049", "value": 754568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848522, "uuid": "87ccb4a7-123c-4642-b110-5f4358327249", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848522, "uuid": "4da8c79d-fb30-465c-9752-a247ec8c9688", "value": "file3s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d323ac-cee3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623876164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623876164, "uuid": "c91e3f5d-14d1-4c72-98f8-0d1bc9377738", "comment": "Malware payload", "value": "82b815e2e9bbccac6e15dd5f95949172", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623876164, "uuid": "3e64a44f-ed0b-4135-9d6e-09964010e561", "comment": "Malware payload", "value": "63ecae3751e6b7ad55e16be3dded77f1f8b74f5eb108dced9581b4063426a229", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623876164, "uuid": "0221c312-c858-4776-9bdf-492b58e3fe74", "comment": "Malware payload", "value": "e817e39dd9ba82a683a1346bbd1b0b21cfb99b22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623876164, "uuid": "9ebcef17-d38f-49d4-92b4-49888f288320", "comment": "Malware payload", "value": "365769c46028795dd86c366bbaf1eace5ef373b73c904363f8a07a52c810d9630d00acb7e6edc20935dc9b6e006d5dea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623876164, "uuid": "5b9b29c9-a16e-4bff-9577-c4bb91e94d16", "value": "F1159F6977239D08C554F2FC8A52DDF837ED1E10B814DB96BAF13C9A7EA860398C6047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623876164, "uuid": "3cbd60ca-e75b-4a91-99bf-a2168dd056bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623876164, "uuid": "c691b401-b2b7-46bf-8d69-4d7f63decfba", "value": "12288:+QBWcenklPVjXhIm5duwFAIuVLv3JSH4jQHSceY5/SFAfCt/fBXGanV0e:F5UgUJSYcyw5/S2fC5flpVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623876164, "uuid": "5630902a-3ff6-441b-8fb6-e6710dbc2f31", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623876164, "uuid": "3909df74-3321-4756-9a90-0cc8b269f75d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623876164, "uuid": "25a09a2c-fb53-4638-b6d8-87f90870839f", "value": "New PO YSE2106-3004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd826a16-cea3-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623848929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848929, "uuid": "6c04c5a6-524f-4e81-9154-0e3d4cfb460f", "comment": "Malware payload (GuLoader)", "value": "838760de2997d9998f17e34ab555ad34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848929, "uuid": "935bab11-65c0-4354-a2a1-1d4ffb01330b", "comment": "Malware payload (GuLoader)", "value": "63fc38aa5b0c164782277fca75b34aa78c935f08b4e04335b4d1833b0231d1a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848929, "uuid": "b75bee96-0dbb-4121-9e67-5bc9092745c2", "comment": "Malware payload (GuLoader)", "value": "bd76e4233c4ef20b0472f0c56812414b8e4156f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848929, "uuid": "423d3555-37b5-4181-bcf3-a9661ae0e517", "comment": "Malware payload (GuLoader)", "value": "fe1a2ee85be8c03f119f93908c96bedb4966b429aecab05c08018f2f8757a948810acfdf262e9e3ad9f8f165b440938b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848929, "uuid": "eb092b9d-79aa-47fd-80e8-212af9ae4527", "value": "D9936B03ED60C969D2419A702F5186AA6A29FC21D441191737F07FEF1BB5AA3F890F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848929, "uuid": "c38d2381-2f60-4da5-b3ec-e4849b6de806", "value": "d5d16d1b76210dd28c8586fe9bac3119", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848929, "uuid": "5cb7d0d8-a010-4f01-bca4-8a98046ba93c", "value": "1536:LzrO3l923cvLyTLh0mr0OaYKA2v9a8V52/yqqBu5W3EUanOYA2nJ29GLwb7zN9gY:LfO3l923VF0WaYKAqLu5W3EUanOYA2nU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848929, "uuid": "2ca649bb-b174-47a7-892c-947c595504be", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848929, "uuid": "3b84c8c2-a682-4ea3-9226-ee9e1390ade7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848929, "uuid": "bfbc5437-654e-4e80-8170-09b175abbe5e", "value": "SKMBT REF MT103 15-06-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec71e09-ce6e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623825926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623825926, "uuid": "aa477a43-8508-4320-bbb5-7b8b22fde410", "comment": "Malware payload (RedLineStealer)", "value": "af930540e379df11fc4b8d1fa84dd528", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623825926, "uuid": "a2cfdc14-6ebf-469a-9dcc-5f0a3f609fb4", "comment": "Malware payload (RedLineStealer)", "value": "655107fc8ec1147d3c1d734c2991b3df1147b6962196b9c3eeb776d3034c37ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623825926, "uuid": "2c5c4da6-1ac9-4386-a87b-dd3e222af285", "comment": "Malware payload (RedLineStealer)", "value": "89627ca876e845d4f0e59cfec123ea913f8a7419", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623825926, "uuid": "4467b5dd-3d2a-4388-b5cd-0d2412a38936", "comment": "Malware payload (RedLineStealer)", "value": "0d682aa24faf0cddced06c96d8a3d858707b613be504785d6c231381df966832d706be144d6929c14a8f3cb404349a6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623825926, "uuid": "3a5e9ae5-0e08-44dc-bfdf-692691945530", "value": "5394AF10A7A0C034F5F216B81AB693B9E93E7AB16B7850CF52D55AFA57346E0EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623825926, "uuid": "a883a501-bd94-4811-8c52-718c7a6d9677", "value": "a88bf0d4e011f8e1919dc00ad8d99f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623825926, "uuid": "5d33bd5a-3898-4c77-8307-423763bd03b3", "value": "12288:p/K0cL86gG0PA/oLCOMOslAavhpb17lFRdxKT:5/cL86gG0I/oLTa/RliT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623825926, "uuid": "f0bc8b93-3988-4240-9323-435a41cc64ad", "value": 418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623825926, "uuid": "ed18fd29-0c50-406c-bf2f-dff4ef818003", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623825926, "uuid": "29ee7b58-1a0d-4e3d-8a94-01e6f6693797", "value": "af930540e379df11fc4b8d1fa84dd528.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d927d7-ce63-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623821135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623821135, "uuid": "cb3fda9f-449c-4ed3-a75c-c5c090cdaba1", "comment": "Malware payload (AgentTesla)", "value": "6b9c5d9e36506e37e6834a15db6944ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623821135, "uuid": "879fadb6-a65c-471f-a275-6e80ad17c917", "comment": "Malware payload (AgentTesla)", "value": "668467454f962a8a8fdc49490d1d0bc02538e83fc7e22d07b932e903dfaa4d5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623821135, "uuid": "676f9bb8-7410-4342-b389-db80b59fe98b", "comment": "Malware payload (AgentTesla)", "value": "4115332c26ca6e1dc8fd884d2d732e56ef51c864", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623821135, "uuid": "d79364f9-4755-4b7b-90e8-044f2fdf54c9", "comment": "Malware payload (AgentTesla)", "value": "02d59d9d83106cb2c71fe139c3e161fa58477bf83c3da0c8ba1a99b944b125b5e29d8f9dc086977f62815cb6bc43a05b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623821135, "uuid": "661769e6-ba44-400b-b831-e904bdeb13ca", "value": "27459E2035F6A14CE6AA4BF38DF5819416B6BD263A2CCB1E7479374C8D332539701BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623821135, "uuid": "37de1aaa-b8a9-490a-a644-ea952dbd68b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623821135, "uuid": "57ea307b-b37d-435e-a789-1eaf9c1b8045", "value": "24576:XSCquPHpPlDT8JDgkyWC0db2l0WVj9ORk3:Xp5GDgkyWtdbEjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623821135, "uuid": "2e1b4eab-2b86-4ea8-9b05-a5ad501c4524", "value": 1214976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623821135, "uuid": "417d85b2-7cf0-470c-b456-bbc9948768eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623821135, "uuid": "0efacc4f-6bfc-46ce-a8ed-89e0bc343936", "value": "DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5d5dbc-cece-11eb-875b-42010a9c0053", "comment": "Malware payload (NetSupport)", "timestamp": 1623867365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867365, "uuid": "556289bf-986e-4783-b7b9-f70b1e2f7747", "comment": "Malware payload (NetSupport)", "value": "1a44217a97c294c528d5da09590e64e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867365, "uuid": "2b98f095-1c06-441d-a586-7567bf05cd51", "comment": "Malware payload (NetSupport)", "value": "672eebccfb00a9a4cc11fec4232eff3c87f7870d1cef4c647d364801cab814ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867365, "uuid": "48c48206-4d77-42a9-82cd-887ad1ece533", "comment": "Malware payload (NetSupport)", "value": "a9de727fae19a1c953bbe6cfb559906428f09e52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867365, "uuid": "5e11c5cd-664f-4fa2-a496-61a3ad5ec5bd", "comment": "Malware payload (NetSupport)", "value": "8dcb1c76fb5722af0fdd63e60aadb4a42eae1e85ad7d1cbbb28237a4e793cbc0ff7c95910a1479e2512e62d8f2eceb53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867365, "uuid": "3d9a6699-5d65-414d-9434-d3235a6db10e", "value": "D3A533137AE2A0BBD953163368F86254D5BDFD317551EA86F302B90F3FB028A4961783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867365, "uuid": "1771b872-5d1f-4e9b-81a8-3c934cfb17e9", "value": "dbb1eb5c3476069287a73206929932fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867365, "uuid": "e249dd84-3c10-44ec-a608-0676af4e5389", "value": "49152:KxcPjL9f3YkubCggt+k0F6eYClIKzEWHoimigmkV+:Kxcf9/YPbfrkI6e1VzEWHoiLgmkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623867365, "uuid": "1ce45358-77a5-4a02-b987-3bd3108425af", "value": 2072096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623867365, "uuid": "6c36e695-370c-4827-bef4-30d10d30c6f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867365, "uuid": "55e26da3-1e19-4f79-9f62-b953da5ba7ca", "value": "1A44217A97C294C528D5DA09590E64E7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d206b3-ceae-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1623853562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853562, "uuid": "fb052a8f-dd98-4f61-a0fc-17d3dbde994e", "comment": "Malware payload (Hancitor)", "value": "ac83eeb462fd77913555217e9ad2bb4f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853562, "uuid": "85e2f358-7aeb-460d-a62a-c0146be94d47", "comment": "Malware payload (Hancitor)", "value": "696417ed1765a36267ad83d28bf8038d8e56615485db555edd09fe5e84d59547", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853562, "uuid": "a59678cf-07f6-41ba-ac5a-309a391b0c04", "comment": "Malware payload (Hancitor)", "value": "05f1f730b3e7dca691bb35e3d3b9b87cbaec4db8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853562, "uuid": "92ef93e1-a8e3-4c3d-861b-df3bc0cfb7a0", "comment": "Malware payload (Hancitor)", "value": "98fa172daa00cf68c595009bf167a75e04072370d13ce9a5bb7b1067829da752131d6c8b518159ec9d68a55d040d37d3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853562, "uuid": "b2254b99-9809-42ea-86b6-b5fe5867352d", "value": "3345CF00FA91C135F4B341B946BB9AA8AB38BD70672841CF72C5779E5E349E29D31B13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853562, "uuid": "6b39f595-0b56-4ad3-aaaa-332fc48ab9b0", "value": "24576:fEIj8oOSRnXHnv3L0cDAPpVvZf+UAgtv8DGDiIwVePe5:fjRXHnv3owAPH6gFKePe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623853562, "uuid": "cd8636f4-6f7a-4a14-b19f-3a565f82bc13", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623853562, "uuid": "f2fb0549-99db-4d9f-a97d-99065f1755e9", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853562, "uuid": "e863cc36-09e1-4647-9cd2-20233baa8727", "value": "0616_1338797754728.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52fb523-cee1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623875544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875544, "uuid": "10fb7e9b-7b82-4e99-bcfc-17af305ecc78", "comment": "Malware payload", "value": "51c10802ed8cbcb4850a602c43b691ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875544, "uuid": "7b3506bc-e2e8-4234-88ba-5f76c7593e39", "comment": "Malware payload", "value": "6a89deb3aa29bae199ce09551378986120b2806f15e7e09c9742676046556d79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875544, "uuid": "4428cebc-942d-420b-92be-572cdc0cafd0", "comment": "Malware payload", "value": "f221c67db600b2e2796d9f55a44540febf9d542a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875544, "uuid": "06f61a6a-81d8-41ba-99d2-7147bdf16df9", "comment": "Malware payload", "value": "049ea99df102bb0449165bb10f0333732d52e7e77449fd068b00f6443770cc15a8db11f8344a284a1290663d4976909e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875544, "uuid": "0d986b14-366e-4bc8-a1b6-f489cf64d488", "value": "03822903A7708DABC1B513F905DBA207A6A82D218F76861B13F1F72DF4F17359E09A61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875544, "uuid": "87007a89-ff9b-4be4-b67e-7004b400fa96", "value": "cae0259af6116376a984aebdda1867f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875544, "uuid": "2b57d841-c840-43cd-a3c4-06e342d5748d", "value": "192:2kisNgpAXgPu9JAxjwCMrpY7e8LqPZo5LdCfq1Rn6O3Qv3ztVYs85naRPcyJmbOj:28PJAxjr6+e9Pfqbn1QvJVYqeOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623875544, "uuid": "53539cbe-a4aa-475c-8723-9d6b7fd75aaf", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623875544, "uuid": "30490e87-5242-4ad1-b7b5-0fdaa1d30d46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875544, "uuid": "d9cc890c-a7a3-44ff-9e72-7a21e3a0a2c5", "value": "51c10802ed8cbcb4850a602c43b691ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfe1551-cea3-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1623848524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848524, "uuid": "ffca235b-78cc-4751-b34b-5f045cbc753c", "comment": "Malware payload (ArkeiStealer)", "value": "7336d5532b53b3e7dbb9abbef4c04b55", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848524, "uuid": "e415109e-2e22-4fbf-b0eb-25d945071e77", "comment": "Malware payload (ArkeiStealer)", "value": "6ae2b85bbb7df33cb5c97373647b30331f8dfffd1ec0f76a11a0af81d1c1d592", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848524, "uuid": "9b4e9137-59a6-402a-bba3-b80c38a02a5a", "comment": "Malware payload (ArkeiStealer)", "value": "c0e7bab163116d6c5c01d4baec97c9cdda09491b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848524, "uuid": "920612df-f8ff-47f2-9170-dcf503d87da3", "comment": "Malware payload (ArkeiStealer)", "value": "0bcf5e6e336cd4615e72919a11fe672cd9881b9c14dab0b94583cd9e97bc306d6f60bb80f07e393deebe5a0c14eb5901", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848524, "uuid": "46b70d7c-aa42-444c-baef-3986a088abf1", "value": "91E3CFACD6B8BCDBD41BA0F59C76F6E5191BEA185468092A342E711314723933CF6C2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848524, "uuid": "6b123b55-15ea-4d17-aea9-249e6c474c0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848524, "uuid": "004f2367-4f82-436d-9e3d-31db59a3921f", "value": "1536:LkJ6V1+FcD0ZCAz15f22kDM7bOjaH4ZinJ0i757FB:LkJmwFcD0gOqQ757FB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848524, "uuid": "737e21a1-2ef6-47c2-b933-3f493f51ccc3", "value": 146064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848524, "uuid": "589d376d-1e5c-428c-a511-bcea805afcaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848524, "uuid": "d9f94081-6063-42fd-a613-958e814c53cf", "value": "file4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab6ddb4-ce61-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623820524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820524, "uuid": "3162bfd9-771a-4c92-a1b0-0bab17573923", "comment": "Malware payload (NanoCore)", "value": "e188a602d29f49e019b6baac888385f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820524, "uuid": "a6f90303-9280-4f59-8220-540409d4cc65", "comment": "Malware payload (NanoCore)", "value": "6b5b9c651ba3c492a4fd59da31ead2f2a788e4ad6f4bece55fb004bbaa87ca64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820524, "uuid": "93fccc66-3f5a-4fab-97bb-ac9d2616da77", "comment": "Malware payload (NanoCore)", "value": "e6168426ac9a03e9fb466e61b8bdd19e22285263", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820524, "uuid": "ba0a931c-2b3a-4e0f-9aa7-0b0edb11d44a", "comment": "Malware payload (NanoCore)", "value": "02cab0952e14afc75d3d6af19b4a8a4710bbd0839a6d877dc367b35edeee085fda79950b54212b6ebe6b48b90919a5e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623820524, "uuid": "d2cdf017-aa2d-4892-be2e-6b2c1fa4a901", "value": "5C05BF3036FA9148D6FE1B318DB9819403BABA273B55CF2E2449224C9D53753DB12BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623820524, "uuid": "bd441215-6c35-42a5-8883-5a2be60a7831", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623820524, "uuid": "1af6c395-48e0-46ba-989f-0b5d47e48621", "value": "12288:V5+byjZlk7CvquwaHpe0D746O1oOUMwDOLnVMxk4DacVlknf6pI3H0jQLQ7lHdb:iEquPHpeZ6OFeOz39fJka+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623820524, "uuid": "d5e5e8c4-3c00-4941-bc33-d91a9b93b38b", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623820524, "uuid": "1976ab29-47c8-4008-9448-9013dc42432d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623820524, "uuid": "50d39d25-2e76-46be-877e-f2571dded1c3", "value": "PO_NO CU-3257743,Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2eb902-ceaa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623851769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851769, "uuid": "52d98477-8916-4c80-94da-75bc6e0527dd", "comment": "Malware payload (AgentTesla)", "value": "8cce6278a6370041c587a04889548663", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851769, "uuid": "ee49d7c2-62d3-4981-b020-947722ad2001", "comment": "Malware payload (AgentTesla)", "value": "6b692e2b88a852017fd59803954fbfa91468e1f5b6c1345dd4b4a4ff0ca8681e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851769, "uuid": "500d991d-f88d-417b-b81b-a2424296668a", "comment": "Malware payload (AgentTesla)", "value": "174c7dec06a82fbe618d4246f568a2bd18b4bc26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851769, "uuid": "dfae8b61-aee4-4645-bae7-5b61df8c9a0c", "comment": "Malware payload (AgentTesla)", "value": "7ea354b7147358e53890d9473fbc12c99b785d0a46a080eb144c04bf8b9f906927d6f73b70d8ebd782a9c46b33a824f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851769, "uuid": "2c768eff-c6d0-4d0b-9049-6e5bd88bde0d", "value": "6F15C3303FB867D6E07AEAA145ABB447C9ED61FA260DC8CD5C5007C557326CB4AF2D28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851769, "uuid": "0d6dbd1b-74ee-443e-ba04-d3f9cf27f7d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851769, "uuid": "d6a6212e-eb1f-4c61-8840-4eb92550dc93", "value": "12288:1yObT8jckUUCUMUlU/hlm4S4F3M9yQrl038jVrf7FKlTYonTuf1afxqYj05oWY4D:NtUCUMUlUZWf50sxrfRKqCuNafxR8Pc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623851769, "uuid": "08479cc0-8996-4a05-a818-8b38d2f75938", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623851769, "uuid": "f5a80d11-6269-4033-9f0d-a6ad7c70ce5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851769, "uuid": "b0a622e1-b13f-4889-826e-6a6dedce2133", "value": "BKKIR02524717.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f24e69-ceb2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623855142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855142, "uuid": "271edd37-66f9-48c6-8445-0c95d0d172d1", "comment": "Malware payload", "value": "23b9cb76a6af5271408856dd2647d741", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855142, "uuid": "c57e28be-a390-4012-a5b7-73a5f76ee7ac", "comment": "Malware payload", "value": "6bae4b8ce44e2cb44eeba9a70fe638e4c5a25474aeed5719d175b0facc89d646", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855142, "uuid": "d89c333e-c098-4d00-bd61-aac574fb862e", "comment": "Malware payload", "value": "82be7d02413f66f232f03dac7054374a55dc5a3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855142, "uuid": "f91eea78-500b-4a15-a8ca-b1a19c07d474", "comment": "Malware payload", "value": "8d61840bfd01a9cfae422e54d052fb5674a8c23c1cb9b8b43bd478b7e5b1598db70cc189693026821232d17fc89fea1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855142, "uuid": "de92434d-c775-40d8-ad91-aba03583f441", "value": "4C15D4303FB867D6E07AEAA145AAB447CDED65FA260DC8CD5C5007C157326CB4AF2D28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855142, "uuid": "1f528a56-332d-49f4-add7-47b520666aa8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855142, "uuid": "cc7d282a-100c-4678-b5b1-1452418654dd", "value": "24576:ygZ+z0M+aWWd2aCBLsBf1G2kmqr5hSUNX:ygZ+z0M+QYABNL214UN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623855142, "uuid": "b99efd2e-4f62-45d5-a533-5a20757db28b", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623855142, "uuid": "4ecc3fcc-5958-44c7-89e6-36124ccb725c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855142, "uuid": "88f2763c-0e7f-46cc-b485-d694d508af0a", "value": "commecial invoice and packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0705f55d-cef9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623885452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623885452, "uuid": "117aa121-db0b-4ef5-bce4-8ee8bde7d87d", "comment": "Malware payload", "value": "ef5aa56a8007d1581583ba0d0188c27f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623885452, "uuid": "5aede06c-ee50-4373-baef-df44d8b5aeda", "comment": "Malware payload", "value": "6c6939f72d85a8d97f4aa81c53d02dccca16e6deff4a2a3eb017ea374713aace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623885452, "uuid": "3c89f00d-d3d2-437e-8cc7-4bb9d7b603b7", "comment": "Malware payload", "value": "64041a20c3423cb515d382adaab72f3f29785984", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623885452, "uuid": "cbe89da0-8cbd-4443-a0b3-f2dab2ad2fb8", "comment": "Malware payload", "value": "ec72e4ed82e75212a3af130d709642d5ee5fd3d0c226b8c7801b2c56651eb8a261a8767f71103357c710ef021c0730c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623885452, "uuid": "8e25adc1-4376-4237-89a7-bb8ae496c94a", "value": "ABC49D41F6A041B5D07BD13AC9A38B4AEA723898973197CB4354971A3F337E59E3E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623885452, "uuid": "392914ea-25f1-4084-9be1-905f640e28d8", "value": "64acb232cfea7c0902338c183e37877f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623885452, "uuid": "1114ad92-a470-4ea1-9bd9-36a0823c3d72", "value": "12288:MbTpAiJo2niGvSe3c5tIW49khRHKvU+/lqvWOW:MbT3/1vSe3c/phoUsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623885452, "uuid": "991cd936-2f6b-4c66-b45e-6eb13858557f", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623885452, "uuid": "099dcc11-0db8-491d-9b47-f192e089bd01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623885452, "uuid": "e1fb8e85-8cd7-4ce2-a5e6-e1e8a9a15678", "value": "6c6939f72d85a8d97f4aa81c53d02dccca16e6deff4a2a3eb017ea374713aace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10c81a3-cee1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623875537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875537, "uuid": "8bd591c1-6f6e-4309-8a0a-dbf409c24e5c", "comment": "Malware payload", "value": "e105a2ac0863bfce2ece7eddfc894467", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875537, "uuid": "f03c96c8-41bb-48f7-aab4-4c1ceb9684b1", "comment": "Malware payload", "value": "6c71ab11218610160d208de8735a2b0f3a869b56676c9589d8d0ddf024c21ead", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875537, "uuid": "d3066c7f-a544-423e-b490-ddf1638af4c0", "comment": "Malware payload", "value": "1bf41ccdfa84db2a51bbacdfc2f4910e4fb076df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875537, "uuid": "75cd752c-410e-4285-8430-4519db5e3356", "comment": "Malware payload", "value": "94e6ebc1cca287cbfe597cfdd2af2f63872d62c0f3f54d10933f32af49c1b4bea35e626bcc57ee1981730f66260f0bd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875537, "uuid": "192734a3-b174-46e3-9158-4f45097d4682", "value": "A8C32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875537, "uuid": "5c80dad3-1fc7-4a6b-bb07-e4c030d99c9d", "value": "3072:ekYPUfsgnsb0J2ag/VfrkDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0rkDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623875537, "uuid": "aaa3c6f2-c0a5-46a8-bdd2-f14582927bb3", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623875537, "uuid": "4ba71122-08e1-489f-b170-9796aef513b6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875537, "uuid": "eac67328-f732-4da6-848d-321bcc32cf1b", "value": "e105a2ac0863bfce2ece7eddfc894467", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669055d3-ceb3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623855548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855548, "uuid": "7ca83638-c02c-46ab-9c22-62e4b124143c", "comment": "Malware payload", "value": "efff16af5446c0746a8d7d793daf0a08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855548, "uuid": "c6673041-7f57-41af-9911-16401c7aac1c", "comment": "Malware payload", "value": "6d582e1c269ead1f4116fd17cb07a7c60e459f0ec0dedd890c21e12cd7f8aa3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855548, "uuid": "bb1ececd-c4b0-477a-9c37-ba3653cf026a", "comment": "Malware payload", "value": "0bec0fad1724bfb41e9a5324f6d58c1d2a3720c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855548, "uuid": "d91c02e3-ce38-41af-9df7-93feff68c1ad", "comment": "Malware payload", "value": "1e753c0e0ce2362bcfe35eab4cd0ece81abf7433d9d48ac715f42e054eae109b8a519bc19995645b6ea8f2cb63637880", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855548, "uuid": "533f2196-eeed-4a05-99eb-d936349e7ce5", "value": "6B83C60A2E714FADF77C833447B78A22A79933D633E09685D26CE9001F6034D645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855548, "uuid": "062e2fe5-6ab5-4422-b5dd-91d641fe59fe", "value": "1536:PXCpoCc63r3g9K3VuBmX3WYGhCsG/MqLrCre/zdX8u5:PypGBmXv/Mq3hZsu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623855548, "uuid": "c560876d-4b92-4764-81df-e18745799ebb", "value": 84948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623855548, "uuid": "92e61a40-3c2e-4d97-afcf-0e2814699133", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855548, "uuid": "9c3a569c-5127-40f9-8c29-4089135bfff6", "value": "nbot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d0f672-ceaf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623853746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853746, "uuid": "8820edc3-3fb9-47ac-b237-10f5b70d480c", "comment": "Malware payload", "value": "56f562e4173a3039052d4d366c13956f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853746, "uuid": "0d34bc11-4a8b-48cd-8288-36f7f860ce6c", "comment": "Malware payload", "value": "6d9377b6827a00fc8243b31a405b85b6b20c8d4f1782b0de27b8a5de39c429b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853746, "uuid": "ed40d1e5-9680-459c-a5ce-42eff77f28c4", "comment": "Malware payload", "value": "391a77c37aa0166e1e65520b5ee9e18874b6c8d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853746, "uuid": "c57038b3-7d5e-431b-888a-c1b1003c01c8", "comment": "Malware payload", "value": "c29507bf292f253092cb9224175c3d2ee0478e20a7f109a6ac4c65ac77baf891ee3307af3bf09aa6236befecd29c7ade", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853746, "uuid": "e435862b-2b3b-48d5-b9eb-b53f41287003", "value": "40C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853746, "uuid": "4566902b-1f17-41a9-8d20-55d92268b9b6", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Epn+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8EB+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623853746, "uuid": "5fb55798-176b-40c4-9f1d-6f664f60f73c", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623853746, "uuid": "7b3c1fad-c098-4694-abc3-fed9ee432fae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853746, "uuid": "207a50a3-661a-4011-96d5-cc86d39f964a", "value": "56f562e4173a3039052d4d366c13956f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e69e004e-cea9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623851467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851467, "uuid": "0a01d35b-4643-498e-8bba-974f08db7fdd", "comment": "Malware payload", "value": "70a53f53970bac94b5ccac2b4c524447", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851467, "uuid": "5f23c023-021e-42a1-abd9-21a3f7946472", "comment": "Malware payload", "value": "6dac73bc8a378e210a08c2633c69bd70837968f975ec5d71026711ade02511a8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851467, "uuid": "7d0104dc-ef31-4ca8-a1d7-a0a3993ddc3e", "comment": "Malware payload", "value": "7631b5c801525ec61974caa548b62e22efbfa5bc", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851467, "uuid": "bc037fb6-5233-4101-bac3-cb6108f6a5ac", "comment": "Malware payload", "value": "c4b78fa94e70cf3c6e3079f0fe31365e0aaeda204914a9f190bd606264405852a3fa35a974a26cbdd61f1594b75beddc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851467, "uuid": "d6ea6090-650e-4cdf-a881-bf16045f1ec3", "value": "3CC423253E0BD46EB8D227375FF524E786562D08CAB7650F6198228C37D2DE70E70D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851467, "uuid": "ec6c3d0c-3aca-4c22-833a-18f3199611e4", "value": "12288:eF8pJtuT87wE475G7w2GO7ZT/hsg+iwn/6mId09RB/q/sywiro66Ad0U:eF8pJtuT87wERLPNr+x/ad09RBSUywPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623851467, "uuid": "4a18a26f-6f3d-4eb1-9474-96a1d0eb4e01", "value": 588657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623851467, "uuid": "1631f20e-1e84-400e-bcf1-dc345810c89b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851467, "uuid": "9092ecf7-2bfa-4041-877d-45c2abfcd989", "value": "SWIFT copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f4bf1e-cec6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623863836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623863836, "uuid": "e097e640-1d21-49f9-afb1-05d9afd53555", "comment": "Malware payload", "value": "ea7288619bf7bfca4167cac85d87c553", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623863836, "uuid": "43f22305-7dcf-4b01-aaa4-b4e5536ccb60", "comment": "Malware payload", "value": "6db2a0c94c07dd7fb2dfb8106910eec70c605ce5b13fb3fd3a5cec44778ecb73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623863836, "uuid": "03ca717c-67ea-4bb3-ad85-e866fc981b5b", "comment": "Malware payload", "value": "2a16d61f75725b83905f6e16c2e26727fe1001b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623863836, "uuid": "dc85e05f-5c2c-46cf-a126-e75853db1c20", "comment": "Malware payload", "value": "c3a03db3513ffdcec4d00286fafb23d91d96d2e51e1584a235f5c1c7846f170c895e178fbfa75adc1b1c2a709be843b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623863836, "uuid": "da329a3d-96fa-4a34-bdec-1f97b0dd813b", "value": "D4D633C4ACA7C0A4F62A6531C452C6F25BEB5D28DC602C65F9097ACA41F772B5B0D4F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623863836, "uuid": "1dfde8f1-8bac-44c3-80d4-969655eecc62", "value": "ffe3cc63e5a1efb4d2f4cc004c584646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623863836, "uuid": "963d2565-f4f7-4b3e-9112-acc8f4976166", "value": "196608:48DASL6vkwL+GyWUCZvxTUY6IbVzrHDgFNPadFzUoIFY/LEbua32cEV:5vwHvU0VzrjgFVWzUpFqLRa3BEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623863836, "uuid": "2eaae9de-8ebb-419f-a182-5ecc3b8705fa", "value": 13098600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623863836, "uuid": "817ac372-f1fc-4425-b5b0-d1977ff3f5f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623863836, "uuid": "a7105213-14fa-4928-8818-e69cecfaf3ac", "value": "ea7288619bf7bfca4167cac85d87c553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b054415e-cee2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623875858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875858, "uuid": "983b3e0e-2d9f-4cf3-8f54-2a8069b8f0e4", "comment": "Malware payload", "value": "eb0ad157c13552566f67a9e34277aa73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875858, "uuid": "8dae6f6f-76c1-49bc-b195-d52682db3319", "comment": "Malware payload", "value": "6e2c2822fefdb30a39f8d927ff63f869003fdbb556c23b8588a6272e8b171054", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875858, "uuid": "79b6e10e-5833-44ef-8755-dbe561401e85", "comment": "Malware payload", "value": "016b4b844066ec8c216670580e6c529e41e25156", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875858, "uuid": "b300d710-7d3c-48d8-91cf-c28af7d2e214", "comment": "Malware payload", "value": "d169c72cb6d63935c418414d7ca019e6d24f69a1511e57e17a5ebed4a98957620b016e7ff099fb8b07e8bb8eab42adcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875858, "uuid": "53520ec7-a737-4703-9003-59be34dc727c", "value": "AFA30897F800DFB7F40AA67604D34B20B670BBE54F532622731739A6AE762D52823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875858, "uuid": "34fb90d9-70d5-4e14-ab04-ff72f864379a", "value": "3072:/Ir2vIBAxMyAOLRcftZ2OemuxVqDr78fz1e:/Ir2vIRyAYcj2OemuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623875858, "uuid": "58d313f3-54b1-48f3-8dec-74db6de2524c", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623875858, "uuid": "aeec9e4e-08a2-432a-a9c4-7f84434f23a0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875858, "uuid": "39875f02-6ed3-4837-9e29-8ee11c62e61d", "value": "eb0ad157c13552566f67a9e34277aa73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00da5031-cea5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623849364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849364, "uuid": "ad594931-bd47-4b4e-9b0b-0243344224cb", "comment": "Malware payload (Formbook)", "value": "8a46c4a30c4b3e210110cb852dfc364b", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849364, "uuid": "222bbb1c-0ac2-44da-a7bc-a967ecee8a44", "comment": "Malware payload (Formbook)", "value": "6e720dac4b3678ace86957fda63e10bf99a9a102bdfa2b9f4293d1911a4b6c80", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849364, "uuid": "a638a512-e2e3-4e0d-a8af-eab4639a2bc4", "comment": "Malware payload (Formbook)", "value": "3e26264883ea66dabe61073f4ec9ec7143db8673", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849364, "uuid": "5a27e58d-aff9-449c-adb8-d23061f81b3e", "comment": "Malware payload (Formbook)", "value": "4948d250367b2545a62d07dde14af92e70441de67be3ed6df0b5ead80b672d04f81a2ec1b113c88ece5909cce8641db7", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849364, "uuid": "d9caf358-5197-43c5-98c8-76d71a1a7e34", "value": "2B15D5303FB867D6E07AEAA145AAB447CDED61FA260DC8CD5C5007C517326CB4AF2D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849364, "uuid": "ba69a0d6-2dc2-457c-ba3a-8221ece34fb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849364, "uuid": "d4c37f42-7e92-480d-9287-a4af21651c0e", "value": "12288:6QJh+rWrhr/rvhlm4S4F3M9yGwO81z4FDuPOY4hbjcwC0sCYySst6w+PjJB:6QymBDpWlzNFqmY4hkw2Nst6w+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623849364, "uuid": "3388a2a3-a2f0-4283-a180-97a065c65132", "value": 916992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623849364, "uuid": "d2fc5094-94dc-4d2f-ae86-4d01ed4c7f66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849364, "uuid": "6c75a471-d066-47c2-b469-d3fbd67bbf8c", "value": "Por favor, consulte la factura..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0107ec-ce67-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623823000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823000, "uuid": "646f3c07-242e-45e2-834f-fa9dde955040", "comment": "Malware payload (AgentTesla)", "value": "073d37030aff18175026b1412206953b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823000, "uuid": "d9958ca9-faf3-430b-957a-f9b88fbdd1e1", "comment": "Malware payload (AgentTesla)", "value": "6e73eb9db1f552b4fe8a0aeed4caf6cff4abd36f1bfeb7cc670fe02bf0dae4c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823000, "uuid": "af6d1aad-86ec-49dc-8fd6-a8eea8bccebe", "comment": "Malware payload (AgentTesla)", "value": "b3d1b0259950de68dcfa69ca13efc8d62c592cb6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823000, "uuid": "11d035f7-57f5-4a3d-a3ce-7f01083ee730", "comment": "Malware payload (AgentTesla)", "value": "d6ce0a39c71cb53592869c65907cd2aa95b967a603acd099fe5fbeca3b3b4aabd4cdf780d8c306e7442a200b768777f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823000, "uuid": "0c6959c4-7f41-4882-bd5e-828ab5fed230", "value": "2855C0532DCE5BAEC9754AB26735AC1182316DBE620863077DC231BDD97F2EAC85F402", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823000, "uuid": "81cb67d1-45c1-44bf-994f-9f2127b9808d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823000, "uuid": "fd1b64d4-5865-48dd-9946-97ceb23091f5", "value": "24576:Fj7PipV9amFuoa77Aop4NUU5usjTYZKjTHFh34flXBY4gJ:JsdFuoiMHNLHTYZKjTAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623823000, "uuid": "62385d41-2df6-4b75-8a5b-3f2d1a789831", "value": 1364992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623823000, "uuid": "9e6a8a8f-bb2e-4293-a099-250dbf412545", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823000, "uuid": "dfa03348-c591-4977-b11c-b9d42b25c18f", "value": "Statement of Account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd74830c-cece-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623867343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867343, "uuid": "6893dfa5-fadf-4408-b1d0-5a3c18faed95", "comment": "Malware payload (RedLineStealer)", "value": "6462eba261b9c027a27585228da42963", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867343, "uuid": "891664ff-eb43-4964-9802-ceddf1f4cde6", "comment": "Malware payload (RedLineStealer)", "value": "7130256274f84aee008d5b6c25676b0319173a0ac2c59fb820569b6d3d037742", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867343, "uuid": "83cc8155-f369-4b5b-9ce0-4a59a4111c4c", "comment": "Malware payload (RedLineStealer)", "value": "e40ec07f6ed0f1ba8839fb22db651837d7cb8a75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867343, "uuid": "ae342008-07d8-4b48-9765-b6c9c90e0b4c", "comment": "Malware payload (RedLineStealer)", "value": "0753a6add62cfb6033f46e39b0fd2ce1bc72a3f871ad81d29b99da60c83c20ba4dac7257116bd2074d9feb92d3dc1fe6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867343, "uuid": "e5af58ad-a6d7-4265-81e0-e99091c69434", "value": "D784BF10FB90C034F4F621F85AB693B8652D7AB1972451CF62E52BEA47346E0ED32357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867343, "uuid": "5cdc494d-f3ec-4d36-a770-8e75208617de", "value": "adc2d74ad17b69fb3b2dcb922692a07d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867343, "uuid": "735cb16b-3cfd-4a11-a3a2-c1c5f71fa43f", "value": "6144:cc14NOhgZ47/6ytgGIy4TSt9++vosMH/YvIaBFKlfFWCteGFtmkMoiQ:t4YhgZ47/6Zy4ut3KYvICKlfsCMaRMDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623867343, "uuid": "e4038f85-1b21-43e3-8795-db063b7f35c5", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623867343, "uuid": "16166a2b-989a-4665-af8a-be7c034709f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867343, "uuid": "3f1d9120-d11d-4e23-9867-6dd3752237d5", "value": "6462eba261b9c027a27585228da42963.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd86105-ceaf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623853760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853760, "uuid": "5439c2b0-c0bc-4f96-8944-b2a322fc251f", "comment": "Malware payload", "value": "d9b3c843b767f4c2ccbd9e062ce1c7f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853760, "uuid": "e5972d01-1310-475e-8101-aac992fe2c77", "comment": "Malware payload", "value": "7385e0d1a17a63afcf72421f2dc2b6da19d96dd8934c3aab5f81250fbdab644e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853760, "uuid": "6681c90a-20d9-44ae-baad-741149f0aba4", "comment": "Malware payload", "value": "59c18defca8ccc0921619e3d55bff02b4242e511", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853760, "uuid": "3722be12-b960-4089-bbfc-d0e1ef3f7fc4", "comment": "Malware payload", "value": "5a01a89d20c22ae419c9e73ac39c84e5eb5b023318116fe2db5d75197f949238352a79da18f2b1754fe8322633eb3691", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853760, "uuid": "9ad38a36-7411-4135-8218-6bbf03e7042d", "value": "4EC3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853760, "uuid": "86d217f3-9bc2-4744-b028-4989eb23a123", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBeqEdWfRZrmW+IFj:Ted0W0MZQHQd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623853760, "uuid": "090a6e10-e28f-4ecd-b249-0a84e56d75ea", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623853760, "uuid": "504042ba-b982-4705-b5b8-d77a753967df", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853760, "uuid": "5a23e8bb-7989-4a8a-a388-9fdc2ac8f893", "value": "d9b3c843b767f4c2ccbd9e062ce1c7f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1648e8da-cee4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623876458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623876458, "uuid": "6862235f-b198-49ad-94c7-a2686780f9df", "comment": "Malware payload", "value": "c532c8572f5e0fb7485c2792da9787ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623876458, "uuid": "060c0a6d-6f11-447c-af66-f5561b5dfc6c", "comment": "Malware payload", "value": "747610321f9100e0dadd7c7728282b7403172ad1fc23e60eea12f4eaff28ce7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623876458, "uuid": "806cd879-e6a0-4a91-9e82-aa3f35021ec8", "comment": "Malware payload", "value": "84b88f36ab1d6e4cd64826fa97ded72dae09d35b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623876458, "uuid": "82685bc7-2e05-4de2-8cbd-09038207ba99", "comment": "Malware payload", "value": "abe0472127285a2a68f073133d716228a981efdbdd5506f663dea7aa9e77dccdc1cb4caee0b6dab323e418c0befe5b0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623876458, "uuid": "40b5ba7a-aa6a-4573-81d9-13a34c9a5b4b", "value": "5EF47D6CB26148B6ED332BFDC81A92D5787A3E4139A8EC4D27F53A057E36280791D05F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623876458, "uuid": "e3f6f642-3db6-4757-bfb7-f2cb1eeddb9e", "value": "6540183ada623b7b6b50db50745c1536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623876458, "uuid": "fef66c9c-59f2-475f-bba3-533412a18921", "value": "12288:kTF0R8yZK0xXeFiP26TlLlosSXu6OKnqX0uNb+T0HXX+jBnnXLVgKR3qb:kT2u6Ai9lxK+6OKnq/XQBqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623876458, "uuid": "00107269-cbd1-4809-a697-1db4d289d44f", "value": 767056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623876458, "uuid": "ef59e8ee-6bc1-44ea-9ea5-02048ae4cf3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623876458, "uuid": "38962926-5574-4284-a735-43c4d487b5c8", "value": "DHL_119040 al\u0131\u015f irsaliyesi belgesi,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e44526e-cebb-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623859050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859050, "uuid": "2dd50237-368a-4dee-996f-faf01701a000", "comment": "Malware payload (Quakbot)", "value": "f1fb3abb2393f77b6192945aa277151d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859050, "uuid": "4c5b4c8a-5902-4cbf-a713-83f9cb50389b", "comment": "Malware payload (Quakbot)", "value": "75bd9e581d48f304bec7cf8f07fc56937501e67a578d33252915b455fc2506f1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859050, "uuid": "1fd855b3-c0c0-41eb-a653-2074178ff28a", "comment": "Malware payload (Quakbot)", "value": "f62a31eb33e26cabdbd3ef843bd19c95df47dcdb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859050, "uuid": "463f8ec6-2941-4ac5-adb6-0fd03b2da30f", "comment": "Malware payload (Quakbot)", "value": "b9875a5e4f75da9379c0d2a0722bf3981152a90c7772a25d182205c6899174e76e263341c60dd891024a15999512f08b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859050, "uuid": "f00f3248-b97b-453b-bad2-c99f0b951378", "value": "FC158E72B2A38C37D1733A7D4D4B63A4982ABF413E3BA9462BE41C4C5F396413925397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859050, "uuid": "81f828dc-58a0-487c-bc52-6b0544282cc0", "value": "299f6f1d2b8a3e164da0e6578d1fa5ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859050, "uuid": "235d93e1-accb-4ce2-b44b-1f828cbf0604", "value": "12288:jhFr6SSWqOdUuVAXJaBbWdsrHOYQYpPGFEQ+TYxd3JE3MX/Pu6ULos:jrnemAXJ9+OBPyQ+TYb/yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623859050, "uuid": "df643033-941e-451f-bf88-a2e99867ca3b", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623859050, "uuid": "e8ca90c0-ff92-44e9-bb0d-8051fd8b8b7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859050, "uuid": "c6312409-ed4e-43ce-b961-6d793b76de1a", "value": "f1fb3abb2393f77b6192945aa277151d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc874f1a-ce88-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623837223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837223, "uuid": "43e0fc22-e79e-4621-8dfa-9c3b142bc992", "comment": "Malware payload (NanoCore)", "value": "f33a4758db1d754b3cd3b90e8386d7c7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837223, "uuid": "14d1a883-d1c6-46e6-83e1-6795cc0145c4", "comment": "Malware payload (NanoCore)", "value": "766d558c9a0c4d1d0ee79099df73fc780d6d3537ea68571e03d1690618d247af", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837223, "uuid": "7c88b953-4f62-4c7a-b745-539a498adc0a", "comment": "Malware payload (NanoCore)", "value": "c3d71be75d3b181d5852059452b0ac06801ea815", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837223, "uuid": "eec2d3d9-6c09-446c-bcaa-d4b997e44a19", "comment": "Malware payload (NanoCore)", "value": "d97b8852243d00208b8d302a0741550bc37662015368f5a2ffd57868e7c52e9623a1460629f9835fc67c0aa7faf1fccc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837223, "uuid": "e6f56f0a-7a74-4e42-90fe-f972134e39b2", "value": "1DE54EF0AD01D8C1F57A4B6EF2FD3A48A1347217EBCD4A4A04E7E5651DF6A01B90EC89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837223, "uuid": "7cdfdc56-d078-418b-87da-07074c6f9e2c", "value": "24576:ag8Jg8Jg8Jg8Jg8Jg8Jg8Jg8Jg8Jg8Jg8Jg8Jg8Jg8Jg8Jg8Jg8Jg8Jg8Jg8Jg8p:VNNNNNNNNNNNNNNNNNNNNNNNNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837223, "uuid": "fc8d5b3a-6032-4bab-ab0c-95155659c3cd", "value": 3216910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837223, "uuid": "e52390ff-8919-465d-9235-85f0c79464be", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837223, "uuid": "84b133a1-07e9-467b-b223-a5515b9b012b", "value": "ORIGINAL SHIPPING DOCUMENTS.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea507ad-cec1-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1623861493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623861493, "uuid": "5c2b923e-f9bd-4efe-802f-2741c847c43e", "comment": "Malware payload (Hancitor)", "value": "83c5ad4cd6fa69fc698cfeeef930e769", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623861493, "uuid": "b56d1a46-3753-4a39-962d-239ede872470", "comment": "Malware payload (Hancitor)", "value": "7952fe215ddf17bdcd41de3433f78f7cab2d4c1313fc8f31cbfbb6fd60605508", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623861493, "uuid": "2ec9b930-8503-4c5e-94ed-1bc337b3ed95", "comment": "Malware payload (Hancitor)", "value": "b1b515aa2102bac11b59034ce7552ccd95884856", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623861493, "uuid": "d5f67a31-a42f-461e-94f4-93d187c31609", "comment": "Malware payload (Hancitor)", "value": "e5419b04427b4ab9f60a6f359c69361c9db3dc0ba8dd48df290b6f584c84944052aed35fc71d1f32b1f041387e287626", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623861493, "uuid": "4bc73557-c15b-42ad-8e1c-1b6d73886080", "value": "3B45CF00FA91C135F4B341B946BB8AA8AB38BD70672841CF72C5779E5E349E29D31B13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623861493, "uuid": "1ac979df-2a56-498b-ada0-2207641037fb", "value": "24576:xEIj8oOSRnXHnv3L0cDAPpVLZf+UAgtv8DGDiIwcePe/:xjRXHnv3owAPHegF3ePe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623861493, "uuid": "0dd4b3d9-6ccc-4a52-aeaa-d40a6811e8bb", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623861493, "uuid": "ba8a31d7-f8ea-46f4-8eb3-c44863a904e0", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623861493, "uuid": "3019a68e-42e3-4bc7-a556-7d1513f788fa", "value": "0616_433887484261.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd44372-cece-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1623867321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867321, "uuid": "12e93b86-ccb8-4bb6-abe9-2c52f610b127", "comment": "Malware payload (NetWire)", "value": "e21fcaec897211bbf2ab31d39f6f0ce6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867321, "uuid": "016207b2-d4cc-45b8-b40c-3cdca78432a3", "comment": "Malware payload (NetWire)", "value": "79712cd9030282fbf73a6a8a0ada993f2b0f682d75a255cebf5a344896652306", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867321, "uuid": "866dbee3-0427-430d-ac0c-8a257d0443cf", "comment": "Malware payload (NetWire)", "value": "7a65d01d6ebd99e902b55107f8f9c3610c824512", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867321, "uuid": "2ce51bb0-5638-48fe-a2db-2ed0eca7b234", "comment": "Malware payload (NetWire)", "value": "05014f831106e061952e6101a551da7d88d20e26a4d4ec5466f342adf7f9de5a2cb60cc96e8760ef595a85bb5c18499f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867321, "uuid": "bcc8c61a-e699-4cb2-823d-4207bb20fefe", "value": "3384CF882198F407EBD8B2388FB1DAB65360ADCD6A15957737F83E9B37FC1576100262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867321, "uuid": "0cb5c120-dacd-4013-b4a5-78dc87748e46", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867321, "uuid": "9ace82b0-a87e-4e30-b16b-a10b518020eb", "value": "6144:5QqNjPHVMZE1jom+ultzfdhdJX8MH9KHE6ogW/t:NViE1jom3ltrHmHE6ogWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623867321, "uuid": "a56ee641-88d4-4a1b-aa2b-2ecc319b9d87", "value": 384653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623867321, "uuid": "33f00031-01d6-4add-b307-74042fdfd621", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867321, "uuid": "e8e70678-9885-45c2-80cd-218e82bad220", "value": "MONEY TRANSFER BANK RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd83b41e-ce9e-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623846701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846701, "uuid": "462db84e-5cad-49ab-8e4f-2ee3cd3aa714", "comment": "Malware payload (SnakeKeylogger)", "value": "63e8946d9e7da82a176130ee5a5376cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846701, "uuid": "a2383b61-d7d9-4339-9aff-c4746b8c8be9", "comment": "Malware payload (SnakeKeylogger)", "value": "79752df8218f83253e43c971c39923653e82c8411e76cd92d85a12447fde01dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846701, "uuid": "ae4e6a2f-aaf8-4f93-af38-f87f6af82de9", "comment": "Malware payload (SnakeKeylogger)", "value": "19340ff0933bbd071360ea45a06bd7d86c910bb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846701, "uuid": "dafdf382-5e72-4ef3-9953-6e3dccd1a8a0", "comment": "Malware payload (SnakeKeylogger)", "value": "e21515adafe677a98e4c356ed19893e979ceb7b77db80b0e53826870b814fefcb9024a2eb67df52f1d82e6c10c189d8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846701, "uuid": "ca6582a0-34fd-45f2-8984-7f2fc371967f", "value": "C505AF3036E99148D6FB1B318DBA819843BABA173B55CF2E2449234CDD13753DB12BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846701, "uuid": "d0c18634-ba07-406d-b1fb-866d138d772c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846701, "uuid": "ef907587-2cde-45e2-a502-a457a4a68a64", "value": "12288:jIOj3kvquwaHpwe41AGfutkzxGryblduvNidS9Hk5liRhu+jhdh0:JuquPHpwRVGtk9jVSy5liRo+jhd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623846701, "uuid": "e6fc5ad1-c827-409a-aefc-a8f76bbee247", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623846701, "uuid": "aacc22fb-1416-4889-9f7e-f350826c4b48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846701, "uuid": "2030afe9-3665-4d3e-bc5c-58f2b0052055", "value": "Price inquiry.16.06.2021.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f64157-ceae-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623853451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853451, "uuid": "a25c88d6-4136-43df-96a1-1762d8c2486f", "comment": "Malware payload", "value": "46a1e39112aab18d9b4f291faab69d53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853451, "uuid": "52dce31b-69c5-4c88-8529-fa4c4d884f62", "comment": "Malware payload", "value": "7bbeb754b21dfff3fdb1324f9f4161d205922a0df3b5302f792829c0285b9dbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853451, "uuid": "67eb942f-15a5-43fd-9ac4-e30829a0ce84", "comment": "Malware payload", "value": "4e8cc5cf7bd1160ff345d74abaa8460ed794d0d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853451, "uuid": "9ac02237-2979-4fca-b177-fe77f0dc5375", "comment": "Malware payload", "value": "402927548fc1ea2439685c938d3975609255922c47fa6a92bbb5294733c3205cef649c0c6417909dfc6ffb32a00bd459", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853451, "uuid": "6e49d8a8-ec1a-496f-8789-48a55405e9ae", "value": "D1B31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853451, "uuid": "9d565be9-f39d-4aa6-b888-6b4784c764d3", "value": "3072:MSY+46m1qOzsseFPPKNy+AmkZrQAhPDCXFke:06mgOzJeFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623853451, "uuid": "3c71b486-fed5-4d2b-95a7-cd1844e080fa", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623853451, "uuid": "878f0daa-c6b6-4848-8d3f-ab523b5e407c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853451, "uuid": "18f54165-cf60-41dc-b457-3446869782ae", "value": "46a1e39112aab18d9b4f291faab69d53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf237aa-cea3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623848846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848846, "uuid": "c2c5b123-0df9-4d4c-9f10-b86b234b8980", "comment": "Malware payload", "value": "bbe6ea4fc5ec20ca908d35d97cd77938", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848846, "uuid": "358829dc-a563-4f90-9817-511a2903b91a", "comment": "Malware payload", "value": "7d446b7796285e465f3ec895abcbc576f6b53a815fc09886212bd13a242a5595", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848846, "uuid": "8c3001ba-dfc1-4bad-8cb3-4b69d58161d7", "comment": "Malware payload", "value": "ca84cf2cb30a052c3fd9488ffc652c4fb0aa456a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848846, "uuid": "6abd7bf2-d90b-49c7-8f2f-96af63ab7ff5", "comment": "Malware payload", "value": "4febac905bbc76393dc9d4d5c735f9abc0e9dccd511013d5305c846279bf982414afa31039c1222f20de75451c98b362", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848846, "uuid": "ae058753-f969-479c-8a89-a14a681092e0", "value": "E1159F59B7229C08C544F2FC8B52DDF837DD2E10B855DB96BAF17C8A7E98603A8C6047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848846, "uuid": "0efcb0a9-b0a2-4cfb-9add-a58f08a84c56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848846, "uuid": "be436e29-18f8-4b5c-a7ce-bb15d513f1f8", "value": "12288:t4OFwIfN6FrVvW7ay5duWsUx9welFYxFpNgPu9ckiJGwYVwtYeOghUqRfKJPx4vd:X5UO9LPu90YGvObqRfKJOVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848846, "uuid": "8dd17366-85ad-42bc-adc2-669cd367eebe", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848846, "uuid": "e24ee23c-9748-4d61-9f83-60c351cb9716", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848846, "uuid": "8ea85ab5-144a-4feb-b773-cbc20a083575", "value": "Gilvan ZBU16075997.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51dab706-ce6a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623824160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623824160, "uuid": "8903ff07-9eb1-4561-a38f-f4cedbf72cb9", "comment": "Malware payload (AgentTesla)", "value": "91f01611f06266bbb637ae18324d2717", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623824160, "uuid": "6623505d-40fb-4fd9-b9ee-bf7bf8297885", "comment": "Malware payload (AgentTesla)", "value": "7e51a77e743f6628014b844006256da1d6a7e9685aa41cf6b1721a96374582df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623824160, "uuid": "0a95dd87-cdc6-4b09-bd2b-e0d7660560d3", "comment": "Malware payload (AgentTesla)", "value": "c2534fe8803fa0e0e3caf953e0c99d30547addcd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623824160, "uuid": "cab3fa65-4599-4a6d-a705-77cc781a654b", "comment": "Malware payload (AgentTesla)", "value": "0e4a543d2b0d6eaaf898b9eef918cfb4eaeb04ecfd17a34580903f9179a9c8958e0a8fff7c9744b420a77c79bb088aee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623824160, "uuid": "9f6c9375-ab02-4b9e-8d26-148fdc625db5", "value": "8BF4AF3136EA9148D6FA1B318DB9818807BABE167B51CF2E244A234CDD53353DB11BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623824160, "uuid": "4fda5074-4828-4fb9-b50f-aead57c73a2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623824160, "uuid": "d87be1d1-2f7d-4622-a970-d04c8a9b3192", "value": "12288:eYqhZ1H7LvquwaHp3O3iVMaD4v5QPZ/w8+YSTXNa6shFm+DmL20NhK:cZhquPHp3O3WMasxQmpTX4Fm3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623824160, "uuid": "b56c0dbe-03eb-4226-bf55-ef89b9243743", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623824160, "uuid": "819da412-8a5b-485b-a0b8-330c64cd8c47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623824160, "uuid": "fae370d4-a465-4ab9-9027-cd97cb4f9257", "value": "quo 4542.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f494f0-cece-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623867332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867332, "uuid": "93719e51-913c-4630-b474-0c951d1c7c0d", "comment": "Malware payload (DCRat)", "value": "e654104cf3f7d7b0d3f63d781f2d6ec6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867332, "uuid": "2864b7c4-7218-4e1b-a98f-cb500e73ac67", "comment": "Malware payload (DCRat)", "value": "7ee77a45282939f784f7d224b7345399efa09a14a9ca619d6692d6ac04ebfa17", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867332, "uuid": "895b897b-4893-4fd5-83bb-d1d9bed0740d", "comment": "Malware payload (DCRat)", "value": "5574360f72164d0d0b99629e090a036518801117", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867332, "uuid": "84aa583e-7504-4bbd-b5f6-89c9a5f058dd", "comment": "Malware payload (DCRat)", "value": "41c8115481b167c43aeff6a53db1a6e1b575131bfcc961f479a64e19bcf80313c8a0f04c346d1bf16a08e3e69289736f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867332, "uuid": "e72bde0b-87e2-4c39-b2fd-4dbf3a1fa267", "value": "764533B1A1F2630BE1200A79E96F11F146627D528AB1E72F1DA94EB0FCD67134B10D7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867332, "uuid": "2684b0e6-c9a8-48d2-82d4-fd6abd1d42cb", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867332, "uuid": "35e65bd3-77dc-4d93-9827-b02eedef6232", "value": "24576:R1N45fb2CFnwDvLn9WZAbbo7Z33cmFWw83c4NDWCTFgGCcyXxZ4G8pruw:CNnsL9dbboN33pFINvTVlyZ8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623867332, "uuid": "3bcdfa58-d8c4-4f51-ab71-087ac7c65e94", "value": 1254400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623867332, "uuid": "38ddd06a-130c-4d4b-a300-82d05598e145", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867332, "uuid": "04b17a55-e8a0-4a13-bb76-1fa9271c992e", "value": "7EE77A45282939F784F7D224B7345399EFA09A14A9CA6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada2240d-cedb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623872847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623872847, "uuid": "b8c71da7-3e26-4f5f-9b80-e16ddf34fef5", "comment": "Malware payload", "value": "a39808fabcc8db146c80a43362183a87", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623872847, "uuid": "570caeec-e54b-4e6d-815b-ff80eb0d7c80", "comment": "Malware payload", "value": "7eee512c06f88f3b58c2104ff9aadf087baf989f22ebf9e62ad95f4ee367f747", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623872847, "uuid": "3aa1227e-a005-4cc3-98cd-3aa434db19f2", "comment": "Malware payload", "value": "3cdf971ddd0c68f067945d1284017e2f1bc7f807", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623872847, "uuid": "5822530d-eac2-4300-a1cb-17b58f524335", "comment": "Malware payload", "value": "bb660f481d6024b5faf47897153ebe92d040e845d8909bc732b6370803a0b74b95013b48577b9c1617182d10db0f4c6d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623872847, "uuid": "b16fad13-7758-4bae-a21c-01d35c78d149", "value": "76258D2076DAC536E57E05B02A2CD75E406D7EB00BB998EB63C85E6F09F09C24635F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623872847, "uuid": "155347b4-9f91-49b7-987b-61923c9cd663", "value": "24576:qZaBqnGIQ5M6DLrVVdWG859GCHrSoUzLyaVtFUl:qZ8lrXVVdWX59GUrSLzeaVtFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623872847, "uuid": "a04d896b-3d96-4a06-88ce-6399898de1b5", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623872847, "uuid": "930feac9-5e34-4505-ab17-f604b2a64c67", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623872847, "uuid": "8594f3cd-39bc-45a6-afb1-7aee97db2da7", "value": "a39808fabcc8db146c80a43362183a87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a0f8e3-cea3-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623848518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848518, "uuid": "17aa175f-ff17-4ce7-8da4-310ea9ff66b3", "comment": "Malware payload (RedLineStealer)", "value": "27dc007a29f5242853203d7c75262061", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848518, "uuid": "cacfc541-8a65-4241-b610-015e98719cfc", "comment": "Malware payload (RedLineStealer)", "value": "7f0c45c91a7634f5597025e608773c7c61ff8a5c391b7f8e0aff82066221f272", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848518, "uuid": "be0f9628-2227-435b-9cc8-6dffc6a0b2bf", "comment": "Malware payload (RedLineStealer)", "value": "cebc782bb55dae8a4887ebc9327d10263df70591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848518, "uuid": "3d4ea071-9bb9-4654-b3a1-44f6f38d43e2", "comment": "Malware payload (RedLineStealer)", "value": "bcc5535a75d1b62db35471fa3bc8250f00e236103e9fabc8f6a04ae960e4ec2b513494e6ef247d134c0041476dad07c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848518, "uuid": "8704a6e5-e3b3-4d68-a16a-f166a8299631", "value": "89354AFB379883E1E3A4207170762D7F0B146D9E74E0BB9D36DC313AC63AA2299E1554", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848518, "uuid": "30b7ee4f-9cda-4ea0-aa0c-107d3da6362e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848518, "uuid": "564957a3-baa6-4c85-b038-0023b2566ca5", "value": "12288:EATaryeFKk73Ttxq2fYaoxZE5kOybapE9XXVkaz/4Uz5Py9NB:heY6jDq2HoTE563nVkaz/hB6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848518, "uuid": "7aa7b4c2-3270-4bda-9dd2-a5ada67cf4d0", "value": 1073328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848518, "uuid": "21ef805c-9f9e-4124-b4a3-9a69be5823a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848518, "uuid": "3ffb6d28-1b2c-4825-ab3b-a04784d95482", "value": "file1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c106fd77-cee2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623875886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875886, "uuid": "0810b280-bd6a-400a-8ab9-1e8aea84343c", "comment": "Malware payload", "value": "b3b4cfbcc7cce0e3ccec5ac31c7087a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875886, "uuid": "99e14286-9752-4572-b21d-93fe09993a24", "comment": "Malware payload", "value": "7f1145c43f3ec63d14bb86d9072c1d06025422e673b3d2bfa9cb6da50632eda6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875886, "uuid": "f2f7dacc-2613-447b-9f01-4afb174f0a46", "comment": "Malware payload", "value": "bdb20b215430e7ccb142dd209ea90fb09bb4ed03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875886, "uuid": "ec760ad9-e4f7-4fb3-a3fb-9344dc2a1046", "comment": "Malware payload", "value": "006987ac0df5627e0541efde510d01255f9b43e697847123bf8c2a18c7d2a5f2eb2036bdd33925a58afab296c302a097", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875886, "uuid": "17a79b0c-80e8-4e4e-b19e-b6356fd7809c", "value": "12833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875886, "uuid": "b0472fbf-10da-4b98-90be-da1f831c4696", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJC4dojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3J3BQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623875886, "uuid": "ec6fcd01-fd95-446d-9609-74d69affa260", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623875886, "uuid": "042e7d4d-1260-4158-b747-0c4015117ac0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875886, "uuid": "129a2b62-5118-43e1-b8f5-b898c3c76923", "value": "b3b4cfbcc7cce0e3ccec5ac31c7087a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321a4742-ceaf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623853742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853742, "uuid": "282c6ab1-5a85-4b20-86fa-898903415329", "comment": "Malware payload", "value": "690e7aa825e376a3d737f6ecffc872a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853742, "uuid": "196ae702-5b81-4c19-bb70-c79697434a4c", "comment": "Malware payload", "value": "7faaa34abac5599cc3852b1f40ceb647c57ff3c7f80a0199c06410e2b3a6c13a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853742, "uuid": "27718670-5e81-4720-a3b8-954a474aeedb", "comment": "Malware payload", "value": "9613018490da27fb6126fa0eb77d94a49ef81d3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853742, "uuid": "25626183-8e7f-4dad-b458-385b0a28402f", "comment": "Malware payload", "value": "0e7718213825cc40c5385ae33b216ffc2af516969abd0011885f4ff39632103e9de0ff2db356f9f30d857784397e4d48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853742, "uuid": "8400440d-1ad7-40c0-8508-863758d269e3", "value": "80F34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853742, "uuid": "4b217fb0-7166-465f-ba5c-c6a00f0c9d90", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBxYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/zYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623853742, "uuid": "1f22ba90-d8a2-4b30-b012-0490d7d921f7", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623853742, "uuid": "fcac25e7-07f8-4e77-a532-513fa3967b20", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853742, "uuid": "463c90ca-1cb6-430d-af05-67f14167ff5c", "value": "690e7aa825e376a3d737f6ecffc872a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bffe1217-cebb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623859134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859134, "uuid": "ce0df7ee-8499-4790-add9-641aa7e8967a", "comment": "Malware payload", "value": "c663597f0f53dc3f8a13f46533f0d159", "object_relation": "md5", "Tag": [ { "name": "PowerShellXMRIGDropper", "colour": "#AD764F", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859134, "uuid": "38fbd8fc-adba-4c94-b109-1f53ffaafe10", "comment": "Malware payload", "value": "80538f5e0fa03e14f04b64f42c69159a07528491ef63c07e6ebcac4058ac86b4", "object_relation": "sha256", "Tag": [ { "name": "PowerShellXMRIGDropper", "colour": "#AD764F", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859134, "uuid": "2feb8d26-9317-4597-91b9-5ca6a7e6c240", "comment": "Malware payload", "value": "08a37482d83d15a30e5c7bf248bef2ef54d5c9cd", "object_relation": "sha1", "Tag": [ { "name": "PowerShellXMRIGDropper", "colour": "#AD764F", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859134, "uuid": "453f497f-d988-40bd-aab9-a88b7b715990", "comment": "Malware payload", "value": "607e3dfa01433eed8f034921db9f90fe68788bd46e3619c4d4de60cba28a2d7a9db8e60ad96b236d4e352e45935290ec", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellXMRIGDropper", "colour": "#AD764F", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859134, "uuid": "8f2fcc8e-33fd-493a-bd40-70a37f75927e", "value": "31E06826A1D1E268DC8091A860BB9003DE790A42BA85C16565B8ED48E41A2389FF45E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859134, "uuid": "840f976e-581a-4ce9-a07f-d8a76fbcca6a", "value": "6:s8qXS1fo+/qOpBRdffV7a51IferH/VnDjkxySc7uwb5QucHhzhvRHFeN/tGaVDl:s84S1w+1nR1N7oNf1/S0uG5Quch/HF7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623859134, "uuid": "27a38e98-68e8-4959-9b0f-cfe92a33ed31", "value": 373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623859134, "uuid": "e723322d-a636-4c99-8d8e-980cefceb74d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859134, "uuid": "a7f33078-b1c8-410a-bad1-f1b722de6df6", "value": "gnmdUhag.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deefed40-cece-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623867346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867346, "uuid": "7e66f2fe-5262-4388-a784-c320441918c8", "comment": "Malware payload (Loki)", "value": "9b5447056270eb207a4dfa18ab8fdfe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867346, "uuid": "80716737-b776-4cf7-8341-24e04ab423f5", "comment": "Malware payload (Loki)", "value": "821bc12d61a9ad2698823b6f54bbba6b8e9fba81a167a438f7da728d1dcd381d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867346, "uuid": "2df8e323-f639-471a-81a6-c268c88dba9c", "comment": "Malware payload (Loki)", "value": "a89d1121feecb8135d11ed321270054fcac6c4fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867346, "uuid": "a61422d1-c31e-45ef-9ccb-be830bc0e506", "comment": "Malware payload (Loki)", "value": "b1f948ebc0600a1995557ef61c62fadee463389aa52cd5d9f64c0f87413a50caede355f86e61ad7fca4f8571e93145d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867346, "uuid": "f94244e1-8ace-4563-9419-5549178f89cc", "value": "96F34E27AC6ADA65D2514A70D8B0C2BD27037D33AA57CE2363277F5FAC705979CA020D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867346, "uuid": "96bc5113-df85-4797-9679-8b295653428f", "value": "646b0badad20ba025cd8fef6f59a6973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867346, "uuid": "74061b68-0041-4c5d-b854-a3392b184854", "value": "1536:P96TOAbqIsNSd7YUNwH37RAb3LlUUWUnGtHj0hVLoIWhD:1WOAbqI8Sd7YUNwHLSb3LC0GtU/gD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623867346, "uuid": "d34d3182-8cce-43c6-b7a6-5a29c200122a", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623867346, "uuid": "d94a1f37-dbbc-48dc-a631-d1d0591c7a10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867346, "uuid": "cbd59bec-92b8-4432-a36b-b12ca78aea9f", "value": "Bank Payment Instruction 15062021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855ec556-ce7f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623833265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833265, "uuid": "d7a9bdcb-b227-43c3-a120-80dc4fe787f6", "comment": "Malware payload", "value": "a15e3ee1c18d38f35546a3762f5d5384", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833265, "uuid": "8e600732-0114-4203-bff9-0b5ef267d19e", "comment": "Malware payload", "value": "8275f8fc05c98df5cc4e4a940851c0ab54ccfb0760b81a430ed43c51cffefb55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833265, "uuid": "4f7715cf-aed6-44c3-80d3-3f7678721f01", "comment": "Malware payload", "value": "e7e7d4c9f6e27114489a7112b77bc5c459a1f73f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833265, "uuid": "a14d6e38-da41-4f47-9dbe-dbd2c59cd062", "comment": "Malware payload", "value": "7f604534c642852a85aa6b380f7c6b0146ac6a9c7d88ca877d40f86156bb5302e28a1e549d56dcaaa6c1becffcdce443", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833265, "uuid": "3db03f9c-220a-49b0-b861-8fcb4e663e4e", "value": "A9048379B7618EB7D80FCD73029A4505188C999B42D96FABF3B4C628E78B84F04E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833265, "uuid": "eba59176-fe7d-4411-9b9f-9667063d545d", "value": "3072:IZt0nqYBY+sbgTKCXPfXmOuhwGWolOQKNO:Iq9sbgTKC3XmOuhwGWolOQKNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623833265, "uuid": "3de51d15-e81d-4c61-aa07-703065ca163d", "value": 175070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623833265, "uuid": "4e56e289-263c-46f6-860f-aa10556e9bf3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833265, "uuid": "4658371c-90fc-4993-95b1-080a11cc859f", "value": "a15e3ee1c18d38f35546a3762f5d5384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ab167f-cea3-11eb-875b-42010a9c0053", "comment": "Malware payload (Glupteba)", "timestamp": 1623848516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848516, "uuid": "7cc2953d-99d1-46cd-b3a4-28cb864f2ef6", "comment": "Malware payload (Glupteba)", "value": "cea33ea90eb453c712fe653dccca3121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848516, "uuid": "f98fdc44-16a5-4735-9129-56fb707632ff", "comment": "Malware payload (Glupteba)", "value": "83c43f97e3004978fdf9f8b74c914ef8569fcef4bce255021c05b71a7ed0828e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848516, "uuid": "7b8a8128-fc29-4076-ada9-6db8b3340e6c", "comment": "Malware payload (Glupteba)", "value": "e869d99a3762324407cfb262e23dd6cbb60d0906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848516, "uuid": "e75a38cb-a57b-4775-ba5a-dc5ce2998e07", "comment": "Malware payload (Glupteba)", "value": "82bb012496aa659bd06ee55fd9f7f2d6c8ae14b370fdb043c101325670cbafcf45b27b054fec4f46b89adb12804228cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848516, "uuid": "dc756f1f-09e1-485c-9c57-6e03da5fdbeb", "value": "E72633106A50E034F8F259F4E1B9A26DB53E75B19B2441CF82D65BEBD32C6D4AC32B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848516, "uuid": "c6747d32-8630-4ffb-84da-5ddfab193572", "value": "f15a946d6e0659432dc9b8c464554438", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848516, "uuid": "31987774-d0b5-43cf-90ed-a5bbb2692c60", "value": "98304:MLBiqDDOOBWpVqASIS/FFFDgeX4QYlnfOz0:MLQ5SI8FntX4Q6nC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848516, "uuid": "b1457de7-636b-4812-9d91-a7a03e87c721", "value": 4735528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848516, "uuid": "8c6db2e2-978c-49a0-924f-e17fd4ae4996", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848516, "uuid": "8e897c54-90bb-4dd9-8967-bb35b7a8d8c0", "value": "app.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfa4f49-ceb8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623857840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857840, "uuid": "fa1f272b-69d0-424c-bd5a-5fe3ff26bd0e", "comment": "Malware payload", "value": "19cf22e59ef8e14372f5385a8d2812c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857840, "uuid": "4be12480-e0b4-4c71-b303-5005ae153377", "comment": "Malware payload", "value": "84131fcec395843710e3b8daf378e92ce54a12bf190d4d354bb50cf000e557d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857840, "uuid": "1a8c14fa-d6b7-4a01-a28c-30354c7cac04", "comment": "Malware payload", "value": "26cef9f779aae77eb7cd493cf5ac6a109db6965b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857840, "uuid": "c1336ec0-154d-4d9e-8280-f25be124e4b7", "comment": "Malware payload", "value": "40fa960b91aa435d8319cde7715b123fda4aa4cecc30b96eb1c6a09add93add655574f91a35759ab87a55ca9e78c851b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623857840, "uuid": "6631670d-976b-4d1d-9a52-ef1d55954979", "value": "96436BC5E982C8B6FC1350F1892BE3B1B773B13A601ADA53F3565A34EC60A90D65739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623857840, "uuid": "809d0bed-8aa0-4471-a123-4eba041b01f5", "value": "1536:i9/1c7C18aOIXZXVd/+8ebCnsLb/4HPDvy8mkySUs3:Ec7C8rens/O7alkt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623857840, "uuid": "3d525d3f-d88a-4c5a-8a46-9778f3b2ae35", "value": 56756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623857840, "uuid": "f34d1d54-bfa4-4afa-98a2-1877af48bc25", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623857840, "uuid": "8e941188-5b45-48e4-8bd8-3e7d9dd6fea4", "value": "19cf22e59ef8e14372f5385a8d2812c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9890eed-cea9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623851365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851365, "uuid": "66475d98-beab-41b3-a51d-eae799381d61", "comment": "Malware payload (AgentTesla)", "value": "ba21df2ca1e281d358e07ba1ef97da67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851365, "uuid": "5017e276-f4ed-428a-b253-7f8f84886963", "comment": "Malware payload (AgentTesla)", "value": "84ca69c5b4aafce43efece75b3074198ff53178ad89e3044dd74a5c85bc72258", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851365, "uuid": "44ebe166-9ffe-4037-b39e-d7284b238e8e", "comment": "Malware payload (AgentTesla)", "value": "8a5f415b8eb0c797cbf8df92319845a8a91e277d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851365, "uuid": "aa91ad3b-de8e-4d32-b795-a5eefbe544e1", "comment": "Malware payload (AgentTesla)", "value": "087d01c84690105a57faca71f33b78327c9c551ab1ef2e767cb7bd5dbac403b849bb8ee4de3afce774a076be8f81c9ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851365, "uuid": "8df4279a-933f-4d6f-89cd-f170617ff2df", "value": "2315D5303FB867D6E07AEAA185ABB447C9ED61FA260DC8CD5C5007C157325CB4AF2D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851365, "uuid": "04b9acf5-5b7a-4fa9-9fbd-503dd02e3851", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851365, "uuid": "5acda2a1-c7e8-4aac-8ad2-46ed020cd897", "value": "24576:dkX+XtXfXTWD5BKi24jM/UpbsFKEm+Aijiv:dkudPIKxJ4ajiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623851365, "uuid": "d116b8e8-cef9-4a52-81a9-ce886ed9a4e7", "value": 900608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623851365, "uuid": "48e92286-503a-4d9f-b6fd-ff731b6185ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851365, "uuid": "9da3faa1-ee84-45d1-97b6-260fe5fb11dd", "value": "PREPAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9d2583-cea7-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623850300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850300, "uuid": "a0633020-de6b-4028-b0bb-1705022ea2ab", "comment": "Malware payload (Loki)", "value": "983ddc2bc9503302e5ca3ff855d21763", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850300, "uuid": "6f2ac511-a7b8-4f07-b5f9-7ddc00446ef0", "comment": "Malware payload (Loki)", "value": "84f074caa2630864f4ce7a5f6ee9148bd5831f292efcd763fb1c99166bf45576", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850300, "uuid": "02022a0c-4817-414f-86c8-9f5af47399e2", "comment": "Malware payload (Loki)", "value": "0ff5d09fe94b67d0177e5653d6d37c8e29126f0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850300, "uuid": "599c4a31-feb9-49ef-b047-c2f0c159fc49", "comment": "Malware payload (Loki)", "value": "d8979d5af952e0522b418a5bd8785f717c2700f203491731e8fac7c81758bfc39edde9ec5d503e55859c052ac05d8bb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850300, "uuid": "ac0fb1bc-be11-4937-98ac-15f1eb9c3aa2", "value": "F4E4BF303BFA524DE5BA1B30187592D412F7BB2A7F14CA2E2859524C9E732538B21F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850300, "uuid": "eaca1672-4a3b-42c6-98b4-263e394b2ef1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850300, "uuid": "c7441d35-9b99-4391-9e9f-bd6db0671089", "value": "12288:JsGDbvquwaHpSQY/c2W7YMZnlQV5ZOa3psPwVhSSy+p7:7LquPHpKEJZnlQVaaFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623850300, "uuid": "1664b078-f21d-4856-8513-f0f39091a39b", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623850300, "uuid": "176e4da6-58af-4e37-9a91-2eba3d33ab85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850300, "uuid": "74f10b25-ba27-4587-8274-1f1d736e4aee", "value": "983ddc2bc9503302e5ca3ff855d21763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42fa0b73-cee0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623874815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623874815, "uuid": "fe0bca22-332c-41e2-8eab-6b8c762f2f62", "comment": "Malware payload", "value": "cbd92757051490316de527a02ac17947", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623874815, "uuid": "d1af3bbf-622f-48c8-a7de-e6c59925f31e", "comment": "Malware payload", "value": "85763589171b520806c08fd836010a4ca264ffa3dbf428cc4797fefa9136a189", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623874815, "uuid": "3d849462-0992-4f60-9efb-912a2127af23", "comment": "Malware payload", "value": "7827b55923e1ac65a4d58871ad7574406a8aad53", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623874815, "uuid": "fd1bfe45-5039-4a5f-96aa-5151e14093c3", "comment": "Malware payload", "value": "6e6815525172ebb1b280f9a18641fa1ee63de286a97ad7a27a5aaa4fec3205da87431a7a0494e2baf3c7e2580c9e8222", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623874815, "uuid": "1270dedb-3d96-4180-848f-2d6a08e6cf47", "value": "F3C5CF47F718A82FC87BC13249BA0332A2568D568A53D7576A1CB35C2CB7AC44F99FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623874815, "uuid": "c64a8ce8-80a8-458b-8365-3e74ae26c90a", "value": "49152:nlifTe5IrzXu4BH5kgd4fFVKoY135pC2Z0frYaA4jH3G:O650LdBH6xdC0frYaAa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623874815, "uuid": "43c8a217-3e44-43a6-bc17-fe057cf84471", "value": 2542781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623874815, "uuid": "5773f195-bfc9-47da-b317-b0f8cac21bfe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623874815, "uuid": "77229314-ac5e-4f4a-9b0d-20cc4745eeeb", "value": "85763589171b520806c08fd836010a4ca264ffa3dbf428cc4797fefa9136a189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78f2da5-cec6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623863817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623863817, "uuid": "5f1bc9b0-b318-45a9-85d8-849b72483b04", "comment": "Malware payload", "value": "64e866e6d19a5ed1a65ebe5b5a648b4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623863817, "uuid": "3359c6ac-269d-40f6-9d28-f1a86b7d2e47", "comment": "Malware payload", "value": "85effdbe412b05165466378640259c282070f40efdca3e92721e1e71f89c2464", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623863817, "uuid": "7701628a-4d0e-496e-bb7d-5763a230d6fd", "comment": "Malware payload", "value": "451d4b371d8c7b7f1864b27810fc9865fb3e1830", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623863817, "uuid": "5f00810f-03e7-4887-9408-27a09fcadb28", "comment": "Malware payload", "value": "1c4a4860692b4c8819accc58ed8fb91556116413042ce9d0b365d973fb64f231a685ed916718d71c3c58235527b7b909", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623863817, "uuid": "9e7aa0b8-326a-489c-aa68-9ff46370a378", "value": "19D633CF1D5AF1D6FD6350B1848AEDFE15FBAC64664087C6E0127ACE18F86E20388576", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623863817, "uuid": "cbab96d0-698f-4925-943a-4ad974f999b7", "value": "ffe3cc63e5a1efb4d2f4cc004c584646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623863817, "uuid": "50af2330-e3ac-4c06-b5e5-cc93932e5dff", "value": "393216:pukYIzl4M4wjnxm9tvpWrxcKlhVS87w4drur2x:0kYIzl2wk9scK9bw4dqrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623863817, "uuid": "92a9c662-cc75-4102-903d-d6328c19af3c", "value": 13098131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623863817, "uuid": "a3923788-26dd-4a8f-8fcf-bd60b2dd5f6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623863817, "uuid": "fcec0e81-5ad9-4ff7-a886-86f725027568", "value": "64e866e6d19a5ed1a65ebe5b5a648b4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab28c1ad-ce6a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623824309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623824309, "uuid": "1588f299-7421-4b25-b8c1-c19642d7c273", "comment": "Malware payload", "value": "7dc85f1eedaf7bdf21497fd7df3c2a53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623824309, "uuid": "e6c37cd0-c89e-4691-b568-a21da3fd0897", "comment": "Malware payload", "value": "87b46299d6e7091c7c7b28b7ab3770649af4db2344e7397db7d35d1baaf7bc98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623824309, "uuid": "447bfcf8-2fc8-467c-af18-f75c6d44be8b", "comment": "Malware payload", "value": "24f2a1a12b70ce90253adca47f6358d4bbe2d503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623824309, "uuid": "85d8ca52-e62d-4a3c-803d-718bb8038669", "comment": "Malware payload", "value": "ce6668ff3e2adbd55ad29d944ff424b5d1a39a0bc9b14beaf27d4dda353b595bd77b29d325f02f239c418a6868f28182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623824309, "uuid": "51966cce-5bd1-4e0c-8e22-3b32eb5906c4", "value": "81356C91F2066CA4D415B2F98D33ED74219F2E687824CB1569FA7E1A7FB720374D280B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623824309, "uuid": "9456bfa4-b39b-4c86-b532-163706a1f8c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623824309, "uuid": "80fc0d28-2f5e-47b6-ae51-539bc0a46cb8", "value": "12288:96f/u5CfaGLl1jTtq5FnWFnQYLxjFVTc4MjHiVVhVF8:wfm5kaGjTeWh5LxjFVTc2VrVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623824309, "uuid": "30789e63-424a-42ba-852f-b40d777deb85", "value": 1073664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623824309, "uuid": "7599492f-abd0-4620-9a29-4560374db09b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623824309, "uuid": "7a9a5529-2681-4b6b-9750-f094338e9863", "value": "20743912 New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9578437e-ceed-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623880537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880537, "uuid": "08139d91-9224-4add-8886-13535bd488cf", "comment": "Malware payload (RedLineStealer)", "value": "2edb133f62e96aa1ce6a10548ad12974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880537, "uuid": "e0881e34-0c9b-4421-8731-84e1fd7f8000", "comment": "Malware payload (RedLineStealer)", "value": "87d38a0df49687aa9055d8e46b62a07a331c47981673ba96f624732d7977f786", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880537, "uuid": "78f33d66-987a-48a7-b717-43b97e6b58b5", "comment": "Malware payload (RedLineStealer)", "value": "5f96517f9a4597d75bfd3e6e4c559d95b35611f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880537, "uuid": "65ef7199-d24d-4d48-aaa3-7fc926d92470", "comment": "Malware payload (RedLineStealer)", "value": "e74dee0fe60c41b825b3fdc3f5f8041d1873d679691c75f5210be00634437f283eca73796de34eb053f73601a305e7d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880537, "uuid": "2cb2446e-f09b-4577-96cb-beffc26b8624", "value": "4384BF10FB90C035F1F612F88ABAA3B8653D3AB1573451CB62E52AEE56346E0ED31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880537, "uuid": "b797a971-1aac-4179-8693-9d16f54f9a9f", "value": "ed103d03110ecdb36297492051b4e917", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880537, "uuid": "d160a8d3-b75d-4305-9e27-44e6561584a8", "value": "6144:KgjMQsIzHI320Wj6YpWdLDiH5y+tr22nxTvz5FHD7BzGtrl:KETI320Wj6YmLDY5VtCcxP3j7BCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623880537, "uuid": "faa59aeb-7341-4fe4-a333-0b1044d67f01", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623880537, "uuid": "e643f702-715e-4e55-82f1-825f210f9ac6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880537, "uuid": "d29896b0-54c9-4169-afc0-076b2c89a0a5", "value": "2edb133f62e96aa1ce6a10548ad12974.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cb3e5f-ce79-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner)", "timestamp": 1623830738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623830738, "uuid": "78d3a513-b563-421a-9756-2e13089e3551", "comment": "Malware payload (CoinMiner)", "value": "8d0606f40721b7482f6887c39dc6b1ad", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623830738, "uuid": "cec3ac79-8712-4aa5-a735-00ce8878238b", "comment": "Malware payload (CoinMiner)", "value": "88a83111ce207548aef670365cdc87d66d3ae3a951cda407d065269fadb8fd06", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623830738, "uuid": "3baa1162-bfaa-42f6-a824-61483a7eeb46", "comment": "Malware payload (CoinMiner)", "value": "3f88606c84fab0f6738fdc69e447d7e3d92ba9cb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623830738, "uuid": "4093b400-7fee-48b2-bd8d-1f134c1ddb46", "comment": "Malware payload (CoinMiner)", "value": "533c3f598fe09277d1b0e8fafd362b1afaa9de262702438820397dca705325ee51801607f44d794b46c3ebe1b016c315", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623830738, "uuid": "42954312-b160-4fd0-894a-07b3f70d40cd", "value": "F2159E69B7238D18C544F2FC8A52DDF837DD2E10B815DB96BAF13C8A7EA861398C5047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623830738, "uuid": "75ed601b-a17b-4a10-84bb-7143c6310735", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623830738, "uuid": "da5ab88b-b8d5-492d-a28d-515b48339bc7", "value": "12288:VQBWcenklPVjXhIm5duC7yE4/ZALQWIODpT/hug+a+f/omedS9RR/qDQ0wCr8zSu:W5UC7yEnh9tR+RnSdS9RRSM0w9VVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623830738, "uuid": "95e237fc-4c4b-4dc3-858a-9d7c34dcf1bf", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623830738, "uuid": "8072e77d-7872-4e6d-8624-2ab81be4973a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623830738, "uuid": "2742fce7-840e-4809-afd2-381e4759baf6", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3802edc-ce96-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623843221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843221, "uuid": "06ba32cb-250e-4b94-91e3-0030b435e732", "comment": "Malware payload", "value": "70bb72f5c61c00ccffd81c7c60398d18", "object_relation": "md5", "Tag": [ { "name": "coblat Strike", "colour": "#1A94C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843221, "uuid": "83b0fe34-7175-4a6b-85c6-6036b87598ea", "comment": "Malware payload", "value": "88db9795a3877f87631f031c6adcc24e01923f61815b86ab5ae8d2c7d083d2d2", "object_relation": "sha256", "Tag": [ { "name": "coblat Strike", "colour": "#1A94C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843221, "uuid": "2600c3b5-fbd2-41e6-9145-0e30adb4db33", "comment": "Malware payload", "value": "a0457d710fb22011f4142769ca86876b61342da8", "object_relation": "sha1", "Tag": [ { "name": "coblat Strike", "colour": "#1A94C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843221, "uuid": "6a8fe7e0-c60f-4f40-a981-2f6788d78899", "comment": "Malware payload", "value": "a8297fda0a2c87129f95a27e8d5e2d21602b382442b0c7e50e9e0372ef13dbb5561d822f34d4e7c5b8e2c73b6cd8fac2", "object_relation": "sha3-384", "Tag": [ { "name": "coblat Strike", "colour": "#1A94C6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623843221, "uuid": "219ad9a6-37a3-4c1e-8d9d-713820a82b77", "value": "9C24E13FF654EB1DECC63286DB9ACC35E0B4BF79AD8689A500C04688FA7581D613B531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623843221, "uuid": "af85cd49-2579-48f0-b54b-be08a84b5439", "value": "6144:LQpBfCOJuacTnnCIjKeQaQexmHQy/B7LHo5////wbmB:LydZ1uceQicHQ4ogmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623843221, "uuid": "83396118-d6f0-4b93-a81a-d38d4f997db6", "value": 210000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623843221, "uuid": "ffedd6b2-9bf8-40cc-8c4a-736eea1aab0a", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623843221, "uuid": "a322c109-0a52-4d00-a78b-28957862f448", "value": "185.153.199.164.http.6Ldv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c44310-ceca-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1623865453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623865453, "uuid": "482fdbbe-0733-4ae7-bc55-265002c79b0a", "comment": "Malware payload (CobaltStrike)", "value": "580763b415dc488a3b6cd76475f16bf3", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623865453, "uuid": "b4849668-a8cf-46e5-acc5-3e8bc4324b7f", "comment": "Malware payload (CobaltStrike)", "value": "89a049df229ca7352fb69c48facf4b721c90ed0360b75ba671246dc29129e3c9", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623865453, "uuid": "b5c71ffa-fab7-49b6-a9b9-005675f3fd3f", "comment": "Malware payload (CobaltStrike)", "value": "73a2e56ccca9a7246a2ace05f3c614826c83d0a7", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623865453, "uuid": "43c95b6d-f01a-4ccd-a8d1-9c09bf816495", "comment": "Malware payload (CobaltStrike)", "value": "cc5811c2df31f8426d760b804c11813713546f03c4f20fa873d027547d9a03996eaa5da1f951781627cf71ac4abbc6f3", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623865453, "uuid": "56828f3f-7cf3-49e5-bbea-d2e79da60da0", "value": "0154CF65FC04CF08D00079FB9319D651392B365E78204ABE7BBA86C22AC737BB2575E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623865453, "uuid": "90654688-da58-412a-a9af-18e959bdf1e3", "value": "db502765cff159e5db66145a73cb6cd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623865453, "uuid": "0c85e6b1-4f16-450a-bc60-135fdd5e8600", "value": "3072:eSEQw/mIOfSAAmLGGxR1pB0lxZ0J9FIRKmj8q2Jclf3tcw:eSEQ8IXqOR3B0lxqJ9oK08q2+pCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623865453, "uuid": "8a4ac85d-6683-463a-9af7-06abeb5a6d5a", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623865453, "uuid": "fa04d00d-c7e9-4a9d-bbef-71a326717a36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623865453, "uuid": "e99783c8-3f8f-4f39-8c42-aa008a4767d0", "value": "TRVSz8V0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105686c1-cea5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623849390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849390, "uuid": "59fbb34e-3360-4b03-9cde-2c5396eefe90", "comment": "Malware payload", "value": "f1cce7e4c3ca1288a6995e07500dd7c0", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849390, "uuid": "f7c54b15-017b-45e6-9519-060d43f3bc06", "comment": "Malware payload", "value": "89e4ed120d31a0e511164b85c01fc5fd5ac0f752f1b235c5cbea710e6b6fc805", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849390, "uuid": "43fd195c-de60-41d1-be5f-370234b31c34", "comment": "Malware payload", "value": "4f0689b69ef4706004bb0689754451c3afb58d96", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849390, "uuid": "f00f2861-69a6-419f-bf4f-010948378cb0", "comment": "Malware payload", "value": "68733aa7044fcedec09e6f7f300796ebd2f9507e8b7c51e7b3848147091954bd466b21e3a37f8c53cbfdc54fce28f6f3", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849390, "uuid": "7f00f3ca-b0e4-4fb0-b407-f55a2fcc2442", "value": "8315A2303EB9A7D6E07ADAB145AAB447CEED61FA260DC8CD1C5007C517326CB49F2D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849390, "uuid": "54e54165-8c1a-40d0-8283-f07b3fa9f30f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849390, "uuid": "610ae02a-cfa0-43f4-a364-5309dd6bd503", "value": "12288:hO/3Lw8Mhlm4S4F3M9yFCOi4/RHg40qKwJNisWcg:hELw8MW+COi140qJJ0sWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623849390, "uuid": "7e307523-8b7a-47cc-9c12-23d1256fbd13", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623849390, "uuid": "e1796c18-2ebe-44d5-a527-e813abb4808f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849390, "uuid": "14bbb2d1-c824-40d7-9afc-ce0abe0fda5c", "value": "Zahlungsbeleg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af830331-ce88-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623837202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837202, "uuid": "b6463820-5a96-446b-a566-81a1075b4c56", "comment": "Malware payload", "value": "f643ad0869e312f403fb24393a7edec3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837202, "uuid": "f9575a83-9782-435f-a6d0-aebf836c684b", "comment": "Malware payload", "value": "8b2a1b1a5f3ef787cfa70e33d56111f2318162bec5eb699f7371b19b7e38ee29", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837202, "uuid": "1b40c1e7-fe1f-4c7f-9177-06f45f823786", "comment": "Malware payload", "value": "ac4884060d8da9a84c80fcb24384d1042e52e91b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837202, "uuid": "cd8c115d-d559-4389-a770-433dcf28e2ce", "comment": "Malware payload", "value": "8339233c683d5ee457bec50a31d572475f0ec25ed2e3749fab95e705051517851efe5859db9b0e8d5a953977b4f82e11", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837202, "uuid": "204eec2e-2030-47dd-bf9f-e08cdad717ac", "value": "2E55AFF876047DE6266F576BCE96ACED13B617229ACBA4CC40647BC305A3375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837202, "uuid": "f178b220-64a7-4a68-80a7-add99c1b4e95", "value": "24576:5BFeohGLeQWeXVJWUqXAVPsq7tuVYoI6RQb22Yy/bM671OY+AUvqHYCJeUTjDlRh:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837202, "uuid": "709ba6a5-999e-4f41-8b39-86d4404646f4", "value": 1323407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837202, "uuid": "ddee5c4f-1b1d-4701-ab30-aa89f9996c4b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837202, "uuid": "681152e6-7da7-451e-87d5-c9ba3a8d9ee2", "value": "RFQ PO821606.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2ca75e-cee1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623875532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875532, "uuid": "5eb5926a-db33-449a-a8ed-1e6aa2b003fc", "comment": "Malware payload", "value": "fb76ba6e30458f8e6a3b69bc5fb5be4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875532, "uuid": "d61b3e0d-b7d8-48d6-97b5-97fea8df27e7", "comment": "Malware payload", "value": "8da6b87d710d313de05b1af302c227947a1c204d99b22a1fd4a1ec588cea08d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875532, "uuid": "5d1cd9aa-609b-461b-adc9-3383cab85a94", "comment": "Malware payload", "value": "2efc1658cfa6557bd44c78d1d2b8da211701fa63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875532, "uuid": "ac2fb633-39bb-4b7a-9e44-434d9564dce0", "comment": "Malware payload", "value": "51bdedfde4e3cae2b4459c4aff27c7f4a784b791f38dcd7d853548d536e7cd4fd8cd1a1f0a3d67ee64609c51ed21dfee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875532, "uuid": "c50e89af-75a6-4d6a-a399-6968cb0be77d", "value": "D4C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875532, "uuid": "ed73fac6-4b90-488a-9f70-e36a526c112c", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8EpK+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8Eo+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623875532, "uuid": "d1a5f3b1-7130-441a-aaa9-0d563174740b", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623875532, "uuid": "e4c61973-4463-4193-b901-bd7b4cd4600b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875532, "uuid": "c1a8b8e5-3b3b-4a76-8825-cb665af7adb0", "value": "fb76ba6e30458f8e6a3b69bc5fb5be4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71acbf41-ceb9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623858143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623858143, "uuid": "7ed971eb-8044-434d-81ee-c88ce8ee38db", "comment": "Malware payload", "value": "d224e95f42257f66709d547518a0f3b4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623858143, "uuid": "c01b8a04-dfb0-47d1-a835-80d4fef7f285", "comment": "Malware payload", "value": "8ddad686d3f8da0c780e55db21f745aa9a0fce9928b46986b892ef4ae4e8074f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623858143, "uuid": "487f2e5b-f210-4dd9-b934-348b6ac4bc56", "comment": "Malware payload", "value": "008349cc8ea8c046ec8664d8eed2093001ce9206", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623858143, "uuid": "01fdebaa-42d2-44ed-b9de-502d0725a5fb", "comment": "Malware payload", "value": "141918bee7fcc887d0d8e6e427152e4a8c4e861f6205a63ec44cfdb63b2aeecbb6614cec912cf2f64fb60c5c93ac0ec2", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623858143, "uuid": "5d6d6a53-5b52-4c05-8bb7-58f644e6c724", "value": "FE935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623858143, "uuid": "4e243a3d-d47c-45d7-94c0-161651ce971b", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3vyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjK/ifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623858143, "uuid": "4007eec7-bf63-41d8-b8fc-3559eaba1da0", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623858143, "uuid": "71431b01-b149-4140-a242-0a5d72603502", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623858143, "uuid": "82fd6e25-2d03-4917-b36d-43d788729cb2", "value": "d224e95f42257f66709d547518a0f3b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d046b2-ce84-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623835244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623835244, "uuid": "d468c0b8-4547-4332-991e-296001c18c35", "comment": "Malware payload (RedLineStealer)", "value": "bd3d7817cf0eff2263b6bdd090d88ffe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623835244, "uuid": "a0941cc0-b67a-4202-b1e3-01bb86a47826", "comment": "Malware payload (RedLineStealer)", "value": "8e759fad023bf1bdaeb49d4705b56af8ab602ff8e46974b1fee2340502c7aa30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623835244, "uuid": "469004fe-69c1-45c7-88df-93aed597e40e", "comment": "Malware payload (RedLineStealer)", "value": "63a0e512d662d23e51e7b484999e665e1e53a8d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623835244, "uuid": "b6da7050-ac2f-416a-b03d-de11bafdc9ce", "comment": "Malware payload (RedLineStealer)", "value": "0e1093351bc4768f9a8af01eb066a2e4726dd5e30c51271b2b8bcedf635661b06a5f267d6869a9dff6e4ddc0d55215e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623835244, "uuid": "c182aa9a-4abd-43b9-b068-aef09a15d0fc", "value": "98351222F597E477C893F231344EE66409696D2F2B315AC77760FE1B09F06C18A6C2B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623835244, "uuid": "e0c40f07-9d65-49fa-9750-d046a49856bb", "value": "011a034751880c1944da3b5ecc18520d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623835244, "uuid": "35696d86-6d0e-47ab-bbe9-c83b10276af0", "value": "24576:J9btxEOIIZW41aqRSsiiE9CLfSsqUckSz/bfrBRqjwXfZ:JNNIITPIuEuSsjQ9sMXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623835244, "uuid": "5ae106c2-682f-47ce-8891-f0eff186e9cd", "value": 1123598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623835244, "uuid": "a4cc3b5e-edb3-4cfd-acc5-6f22ae85678a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623835244, "uuid": "9b72d8a4-b848-46f9-b776-b6a12c37504e", "value": "Trainer v22.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19aa215-cea9-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623851352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851352, "uuid": "fcb5ba06-cbc7-44ba-a638-9b1dc7aea80a", "comment": "Malware payload (GuLoader)", "value": "608879fec432acbea30492d724854751", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851352, "uuid": "6ea95188-05c2-466b-8c15-03cdaa7728bc", "comment": "Malware payload (GuLoader)", "value": "8ed09463c39d08676a3cb36e44f59d5b15df69a4a661640a53992598c4afc7dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851352, "uuid": "1e8b1433-709f-41d2-a37a-573bb7299c5e", "comment": "Malware payload (GuLoader)", "value": "b9f42435af76386ff05faf4a6f2814e94ac7a37e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851352, "uuid": "454462d8-2c1b-4dc8-8fbb-363c45bbaa87", "comment": "Malware payload (GuLoader)", "value": "f47cf3c89826c4cc5f597908408be4b04fcfd886820be752fa5cd4e899b5757a3d31fc6b90afe8f7a96b5d12fd641aed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851352, "uuid": "bcdf5ce6-9d62-42d9-bc6d-ca76e815ad78", "value": "44E39232F2436514ED568074FC159AFE79546F312C438E07B6F2BB1DA1BAED3BAA0502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851352, "uuid": "e75def88-a6cc-44cf-8c56-c5523fc9bc75", "value": "2c08d8f9644132654eb702b279083d5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851352, "uuid": "cbbf2719-473d-4c62-9003-6c1a91507645", "value": "1536:byR3u+8QSChgSZpdjnCndIJZ8FzHsPCsMXgwFf4RUo/CEFU57eZtqZih:OuqSChbpdDmAZAsP6XgwFGUoLU57oT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623851352, "uuid": "2a4e02c1-d5e4-429d-84d0-87c9be195380", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623851352, "uuid": "4833fcd1-b0fe-44fa-9dfc-355ca9c75113", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851352, "uuid": "8164e3a7-6645-4421-a61b-6cc7121c23f7", "value": "608879fec432acbea30492d724854751.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b328de-cea3-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1623848535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848535, "uuid": "8d58cc81-96ca-4290-86a6-49bd5c2110dd", "comment": "Malware payload (Smoke Loader)", "value": "90e82fffcbf70196edb7f4f64f34a370", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848535, "uuid": "5dcd17b4-02d6-404d-b79a-b31257c6274f", "comment": "Malware payload (Smoke Loader)", "value": "90c0cf976bc9377697fb31e8ca6f21aee0168cc5471a8ac33ece631ee346afa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848535, "uuid": "9c1741d8-648d-46de-a591-1141b7ae6dbc", "comment": "Malware payload (Smoke Loader)", "value": "d61f4c53d2f9622a9183b1d8c8725ad0e1ded6a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848535, "uuid": "b6f5d8f3-ae6c-4660-bb71-034dd2c78a8f", "comment": "Malware payload (Smoke Loader)", "value": "d3a1203c6d45adbd7908fdf69548556deecf269c6b5e89147634a98f724cbdf16830b6d19957abd0223c831705010743", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848535, "uuid": "6ea4f65e-a913-4a7c-a5b0-300ff9670cca", "value": "46748E00A7A0C434F7B352F859BA9379A93A7EB19B3490CF56D11AEE46746E0EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848535, "uuid": "75af3701-e371-4467-9c42-9bb3f0470efc", "value": "f15a946d6e0659432dc9b8c464554438", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848535, "uuid": "6cab7b80-5fc6-41e2-88f2-2fec868a16f3", "value": "3072:9OaI9MOaQ0rabmqicvGCF9BcYEMPWE4kqR+nTSUH5SqPAd8kf2t0CESXH0lBN/xb:9Oz9zb9icvZTeMPCNrwPLkI0LuT01/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848535, "uuid": "62752b90-e778-4e77-a7b3-7e93e824506e", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848535, "uuid": "4ad4cbb8-a855-40f1-ad34-4714caa5d69e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848535, "uuid": "fd724e94-9e19-43c9-b154-dc0e839dc4d0", "value": "toolspab3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c38d41c-cee0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623874804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623874804, "uuid": "00565b0f-5736-4c2f-ad54-9b00ab97dcd0", "comment": "Malware payload", "value": "f07b8cc1e331ec181031a0d90fbffb85", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623874804, "uuid": "b7e0b0c3-a722-4df1-8dcb-fe23065688a5", "comment": "Malware payload", "value": "924e8a1c0d7fba2b069b5ce514c45d0835c474a4ce146263cd1d27d405904420", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623874804, "uuid": "be17ae1b-41c9-4087-9cb5-9a1dc45e8893", "comment": "Malware payload", "value": "f31c67ccc0d1867db1fbc43762fcf83746a408c2", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623874804, "uuid": "f7d35ec9-3ae7-453a-8b46-8aa5cb885bf0", "comment": "Malware payload", "value": "66b8702e97418042a75936a09f53eb9ba33287899f2c19fadebbd87008032566a8b256fdb5de70e196693ae8eae4f9dd", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623874804, "uuid": "024d3709-fec1-4fea-849b-eb3ee440b967", "value": "68762382A7D5EC2FCDB784360BB2872A45558C518A0BD353756CB11C9BBBEC05E86FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623874804, "uuid": "93bd588e-6e52-475b-859e-c3834c796b56", "value": "196608:WqZSQeHQfzcTK77FMQ+V+Y4Bz/JdLdJ3bh3IwNdn:/ZsHK0EJEv4h/9thz7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623874804, "uuid": "9b67c800-608c-488b-b5ea-f0c920bde6d0", "value": 7166362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623874804, "uuid": "51ae83c8-3f87-4063-abe0-863a71a39705", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623874804, "uuid": "bfd68fdb-d682-428c-b0af-ce815b52b3c6", "value": "924e8a1c0d7fba2b069b5ce514c45d0835c474a4ce146263cd1d27d405904420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d43ebf-cea9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623851443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851443, "uuid": "832f0f98-da97-4b45-bfd1-66b88fb4ab83", "comment": "Malware payload", "value": "2b50f59b16ccf2337a3edbf6460d7e24", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851443, "uuid": "839ec340-627d-4847-8372-658edf3c7a8b", "comment": "Malware payload", "value": "9255714aa4b87d885fe60cc60576241a0a77603704a55b3035de18a0543c0269", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851443, "uuid": "e0fd4f3b-0815-458a-abef-492192054102", "comment": "Malware payload", "value": "17c69d16268f484089b9173e3720916602363b04", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851443, "uuid": "6054af07-c2ea-424c-8a31-cdf7a2dfa1f1", "comment": "Malware payload", "value": "9565a5ac01f56b9e3d0eef4a80f47cacbf7e66a89a087b059743039eba873741c5dfef8e9f1b3d3a750fc7eff404ea3b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851443, "uuid": "3e849cd3-7fd9-41d1-9f5b-326aaca1d534", "value": "8AC423253E0BD46EB8D227375FF524E786562D08CAB7650F6158228C37D2DE70E70D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851443, "uuid": "01404abe-c6ce-4601-9a62-1e54a5d6c9f5", "value": "12288:0F8pJtuT87wE475G7w2GO7ZT/hsg+iwn/6mId09RB/q/sywiro66Ad0S:0F8pJtuT87wERLPNr+x/ad09RBSUywPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623851443, "uuid": "a8bc78ae-d2e7-4f59-a62f-8e3f9c39ea4f", "value": 588643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623851443, "uuid": "44ebf89f-9512-4bf1-94c2-452f0bceb548", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851443, "uuid": "8a2bdede-7694-4999-ac77-8019e56b33e6", "value": "P.O.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37502663-ceaf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623853750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853750, "uuid": "6cc79957-2b1a-44b2-b4ae-4b1095de19a8", "comment": "Malware payload", "value": "e0fd8b1a9531aacaf342b3355aab780a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853750, "uuid": "33a44388-47c6-4e73-a6f9-1370fe184761", "comment": "Malware payload", "value": "928e37fb3e65b7353aae2573dd274d57448986f2c8e13b8e4fb5dcc614545a93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853750, "uuid": "0564aed4-3cd3-4870-801c-69dcfe84f4eb", "comment": "Malware payload", "value": "6083a2d361caf78eef55fc781aa4d565e4d40839", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853750, "uuid": "5d8caf88-c9e0-4f9a-bde6-66f312520ea2", "comment": "Malware payload", "value": "0c22b0af34a3466ba40faf05cbb37d4e3e82f6d6b46ff49b77f92eefbb35aaf9ccaad664340a87ea1e7cbc4441ac7b49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853750, "uuid": "d3186ba4-87ac-435b-9424-773db7a55d8b", "value": "8D933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853750, "uuid": "19182678-9770-4d85-b259-959e2e790229", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8hl4umXxVqDrstKfz9e:Q97vk51RcG7Azl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623853750, "uuid": "c04146ca-b266-4f1c-add1-de7a900dd77a", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623853750, "uuid": "91a30d04-f8e5-40bc-acc4-f8a778d16618", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853750, "uuid": "89fa5011-9f33-49ec-8d9e-68298a2bc995", "value": "e0fd8b1a9531aacaf342b3355aab780a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bdb4532-ce8b-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623838377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838377, "uuid": "ae23d8c8-ce58-43a7-bfad-a17423535b1d", "comment": "Malware payload (RemcosRAT)", "value": "6b6d3a42847483adc86e7f5d3731540e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838377, "uuid": "44754674-a9ca-42b2-b744-139a58d5aa6a", "comment": "Malware payload (RemcosRAT)", "value": "9293d69e18aeace49e1589491658a84ba2aeb90358b4e35aeae2f2aa18ec81ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838377, "uuid": "2ee8b9e4-fa3f-4a3d-b49e-a0bc7d4a4389", "comment": "Malware payload (RemcosRAT)", "value": "b95a817992625100ba159845b7a6e5e038e314ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838377, "uuid": "3172625a-2036-4f82-a404-f5f9047f4539", "comment": "Malware payload (RemcosRAT)", "value": "24758f57047da63f3a0f93da0b9c8cbd8247afaa0c9580c8bcb7ccc6b4d60eb41af2d6281505cb2a8281bcaed1848252", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838377, "uuid": "a9e44d45-414d-4b98-a9d7-b9aeaf79b7de", "value": "B1C4D000A7A0D034F1F667F81D7693B8A92A79B1677890CF52D616EA1B34AF4DC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838377, "uuid": "e57cfbe4-e60d-46c4-b7de-fc649f750c9e", "value": "8293ad000eb8f07ba025580bfe785c23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838377, "uuid": "3e8ae0d3-a599-4559-9883-f100b13656f5", "value": "12288:Cdg1g7IHGvuSMyhot/euPFEy1+/CO/mbG8yJSLBbd/2AM:Xi7ImbotD1uX/WyJSLze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623838377, "uuid": "5a480829-882b-41e8-88f2-d65e5a2303ed", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623838377, "uuid": "04354a2e-306f-49f5-8c20-bea507f36988", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838377, "uuid": "6735d4b8-c354-47ac-b60c-02621c0f4ad8", "value": "6b6d3a42847483adc86e7f5d3731540e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39784075-cea9-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623851177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851177, "uuid": "fe548bf9-38f3-4c03-918c-7bdd95a939a9", "comment": "Malware payload (Formbook)", "value": "bebc82b589371ecaefb7889cf1d03b8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851177, "uuid": "45813e08-8838-467e-8142-e98d89120a60", "comment": "Malware payload (Formbook)", "value": "92976a7ee61468fb88761dfa0f9cfdf99b6c6c484ae47e970986acf66926f3a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851177, "uuid": "65ba9a4f-8141-4759-a039-da0ba2aa9ab9", "comment": "Malware payload (Formbook)", "value": "bf8772091292592a1a7407a0963d2f5978f6ab44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851177, "uuid": "bd4019f5-641c-47b5-80d4-09c6f0f7ef34", "comment": "Malware payload (Formbook)", "value": "c0aedee05b2c28e167918fa11be1f5cd035a81d0dc46e1d0bcf1938fb199ed50df648bca0a3538b77d4d6df7a9b988d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851177, "uuid": "800ba61f-c5bf-4392-bd48-1087554de410", "value": "1F84F111B4E09022DBD676340FD6C7389776EE0C4A960A2B3BF13FAF39BD1935905662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851177, "uuid": "794f7834-5cb6-4bde-a5a0-6c9dd694bf17", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851177, "uuid": "e2edbef5-0da1-4dbe-a997-fc65f80af480", "value": "6144:lQq6nzUsDb59M8LGE5MeiiAD5HTrmt9bp3V8t:w4sn597LGCU7pT8L3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623851177, "uuid": "58322077-a8b4-46e9-9d4c-4991fe5a8d9f", "value": 393185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623851177, "uuid": "82893765-9785-4582-a394-582b1e114522", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851177, "uuid": "622a5482-c232-41ca-9933-c9de97184e6c", "value": "SKTCG_PTT_084677673647_ecu2021doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86007d5e-cebb-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1623859036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859036, "uuid": "41c3f156-4858-432f-9c67-9001e9b4564b", "comment": "Malware payload (Hancitor)", "value": "55474b222c6b22aa76d1ab53c5b25542", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859036, "uuid": "e07ea61a-649a-4c62-a962-6994ae47dcf4", "comment": "Malware payload (Hancitor)", "value": "93adbff8c5a654cd74f0b3fc714d15ca9699e89edcb713b35119ca3f132ae748", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859036, "uuid": "9d2f5332-2515-4c9e-b8bf-0e52c5a73f97", "comment": "Malware payload (Hancitor)", "value": "a78880b48be7741093b49de005794f4b741d368e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623859036, "uuid": "08786bf9-f4f5-4172-9b47-468e4f2ede9e", "comment": "Malware payload (Hancitor)", "value": "c16775853201b98dc7414195db76cc24f2ec91ddae9f55345821c696c22818abda73e0d97c1b1077e5aa31ddb5559803", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859036, "uuid": "c386caea-a976-4b5f-a32c-59ffc8a169b4", "value": "8DC46B00FA51C039F4F741BA47BB9668AB3879706B2841CF73D56A9E5E249E39C31B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859036, "uuid": "1f539ff2-269f-4540-b28b-99d96ea36c30", "value": "37fafb473194256b2b713a1bfe22a425", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859036, "uuid": "5246bf7f-6eef-4603-921f-90a1a5988cba", "value": "12288:AZf+1ahU6QgtvG29kDGlBkJI6hxiee4LK2pFKkTRb+J:AZf+UAgtv8DGDiIwwePe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623859036, "uuid": "c4f53f6f-fa15-486a-809d-eefd5b7ef78b", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623859036, "uuid": "76c06759-2c89-4d5f-8e93-cc640814178c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623859036, "uuid": "22990c5b-c374-45b1-aa18-d397ef1e861f", "value": "omsh.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca84d829-ce89-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623837676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837676, "uuid": "72bef8a8-ca12-4149-9ca9-9841cad67cb7", "comment": "Malware payload (SnakeKeylogger)", "value": "e1434b2135da120321c3683e36cc2727", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837676, "uuid": "72c417ff-dd56-4810-b845-668457cac812", "comment": "Malware payload (SnakeKeylogger)", "value": "93cae28d3ae17b560c738e38d6ff788924bb515c1312d39f5122041dcc79a114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837676, "uuid": "3c6af89a-1183-471e-ba5c-c367b346e20c", "comment": "Malware payload (SnakeKeylogger)", "value": "49ff4a52699cf60b6676d828dcd28351f6b36bab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837676, "uuid": "f1c74f72-aa12-49ba-a1ea-4f1bf0b091f1", "comment": "Malware payload (SnakeKeylogger)", "value": "5d0fd1db78a84300f5a47334f57b80cae879b4393412c82f445f8e6baa08791d3c5039ede776339aad950801230648c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837676, "uuid": "76a966a5-e722-45b4-8c01-3ff6838a8c5e", "value": "37A4E0942C40D89ED465DFF225F185B3C72E6FEC2E60986E7654FF3A1A355AD8320A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837676, "uuid": "b952cb51-d699-43e8-8f3e-453dd7ae9b16", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837676, "uuid": "1510bb79-2988-4a1c-b5ff-72ec84c0a5bd", "value": "12288:gBIx4gs9mM07Sk+vLgQ4ZwwB34FsBO55x4:gBIKgRHtgyBIFsB0x4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837676, "uuid": "9125fcfb-88d1-442f-b00d-455f1f4eed49", "value": 488223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837676, "uuid": "544428a1-73c3-4472-bc8a-8b11e6912f8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837676, "uuid": "b941a5b5-cd67-4719-b9a6-98d3c94c6f1b", "value": "TT0900090000090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4daa6299-ce5f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623819428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819428, "uuid": "bcb6675a-7bfd-4dda-b8a1-84cfc6524b67", "comment": "Malware payload (AgentTesla)", "value": "535b75079a995b79851259caa03c632c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819428, "uuid": "339af213-c6ca-4a55-bb3b-371644f5a672", "comment": "Malware payload (AgentTesla)", "value": "9567b3488dbbf5343aa7b466d2b4ba5384202809251982121521e465b1279544", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819428, "uuid": "9184298c-a4b5-444c-8dd8-829e6ae9bf72", "comment": "Malware payload (AgentTesla)", "value": "2ea7e66333e5515bb419ca85ae9cfd95e1c535d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819428, "uuid": "18ba742a-fa18-4801-811d-390f2deae5ff", "comment": "Malware payload (AgentTesla)", "value": "7e700bad232b6da859a98f604e2c2e5025d68351ecee9331824a60d27cd9292eebc145c605429f7508b742c46640de9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819428, "uuid": "748119ad-9120-4ad4-b9c8-4750d784e9ef", "value": "1EF4CF3077EA525DE9EA1F301C3591D112F6BA2B7F08DA1E3958124C9E636838721FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819428, "uuid": "968e68ec-3bb9-43ca-abcc-2e2a115b435e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819428, "uuid": "b8a39aae-2f57-4c6c-9167-8285f1dea497", "value": "12288:ngoaNvquwaHprIcF6hVYfnUZOvl3QR/B7EL+DiQgtnNxu4Zd:KquPHprGVpQgr7EHt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623819428, "uuid": "4c43f3fb-6d86-4206-a6c8-44df9ee87558", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623819428, "uuid": "ae86b30d-7d8a-4042-a05d-bb1e5ed889bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819428, "uuid": "53bfbc3b-47a4-4d4a-8eae-3aa366ae7085", "value": "70654 SSEBACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de292580-ceae-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1623853601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853601, "uuid": "d2caf4da-eda1-4297-a27a-b5f081a66f60", "comment": "Malware payload (Hancitor)", "value": "ff1a5daed04a992f0aa387c0e71ae7c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853601, "uuid": "7c00e604-275e-4a15-a865-661a3bdd3170", "comment": "Malware payload (Hancitor)", "value": "9b5c8a744c3d78f4d0c2e48f4316ab58216ab6e22b7af8fcb3b4eace5d447b64", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853601, "uuid": "86a7b13f-25a3-4e6e-afd7-35271ec98349", "comment": "Malware payload (Hancitor)", "value": "73648b902affb7b0dc5a869fe818fcd7b3a2f2bc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853601, "uuid": "3fcb9845-c91c-4865-beb0-bf1008c6833a", "comment": "Malware payload (Hancitor)", "value": "c8f9c8339fd37f823075470839cf39b0f47700a0fd6de75b56d218cacd464cbfd0262e03a0ccc4592333dc17fb39123a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853601, "uuid": "cfc3ee65-c6bc-4872-91c2-bbb8a958a4f3", "value": "22C46B00FA51C039F4F741BA47BB9668AB3879706B2841CF73D56A9E5E249E39C31B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853601, "uuid": "dc685e6a-dd4d-460e-8272-89ca17746d0a", "value": "37fafb473194256b2b713a1bfe22a425", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853601, "uuid": "9cb5bb8e-1ebb-47ce-9560-3bedbfa2bfd1", "value": "12288:AZf+1ahU6QgtvG29kDGlBkJI6hxRee4LK2pFKkTRb+J:AZf+UAgtv8DGDiIw/ePe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623853601, "uuid": "d238b152-eb32-4d0c-90f5-0f0dde63c72b", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623853601, "uuid": "d68350e9-9660-4230-8228-bb6f57c95031", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853601, "uuid": "f928d783-7208-4136-8579-36755d3c1b0f", "value": "omh.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd98aae-cef6-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623884173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623884173, "uuid": "a278951f-4b5f-425a-bca3-28bbcd06c78b", "comment": "Malware payload (RedLineStealer)", "value": "eb3b2db808791517b0736c2e30ab2f9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623884173, "uuid": "6d07df5e-9d17-458d-a35b-186fbb72a88b", "comment": "Malware payload (RedLineStealer)", "value": "9b7417548d5610166c1bc06abc90edaa1407ae93f25e4a1231186fdba70c101d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623884173, "uuid": "1ff512cb-66a0-46ff-93c3-9d078e5a3451", "comment": "Malware payload (RedLineStealer)", "value": "ca68b77b00849bc1534a3b89926cc9458fd1c3b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623884173, "uuid": "14e31ec6-de68-4dba-953d-6e9c0245e2ee", "comment": "Malware payload (RedLineStealer)", "value": "06b6712c6b5012baf86f05440a64d770e23949a04d9226102cc57450ff54234e08fdeaeb41deb752ee306af30abf0c12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623884173, "uuid": "405b6095-dbaa-48b1-ad1a-30a3d67a4126", "value": "8984BE10F790C034F5F611F84ABAE3B8A53C3AB1572491CB62E51AEE4634AE4ED32757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623884173, "uuid": "bbc06d8a-110b-4547-af53-669c0ce78395", "value": "364098e961c6433a5f030e6d84a48050", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623884173, "uuid": "171f1a27-ba1f-4077-ad50-b3b329e29b3e", "value": "6144:F18WsIzEuvrP2Dg8m6rT2ZsElJjVmoRkzdpyM04Sc0dr0ulBzF4stkP5:g2IuvrP2DgOrT2tlSGM0RiulJFdC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623884173, "uuid": "e6eaa22e-5c6e-4e8d-995f-325babe304c4", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623884173, "uuid": "a0556e64-504a-46b8-ba89-7c7a00941c03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623884173, "uuid": "ef6ee9b9-40b3-498b-af35-ef663ae11f30", "value": "eb3b2db808791517b0736c2e30ab2f9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd9be8d-ce8b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623838514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838514, "uuid": "c102ae79-8eb4-4457-9e03-5a83297e808d", "comment": "Malware payload (AgentTesla)", "value": "f72277eebaf6b7e2891b7ba24188ebda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838514, "uuid": "9f0c30a2-cc1d-44df-b93f-48ce5c141de8", "comment": "Malware payload (AgentTesla)", "value": "9b907ae3d2d9f776c068a4b2371d1bfc04e0ed359fc68b8863660301c5a644b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838514, "uuid": "bf9e82c4-8115-4e70-ab27-87bd84edc1f7", "comment": "Malware payload (AgentTesla)", "value": "4e50012a8102409f570ee4b36785d7baa5dca364", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838514, "uuid": "d7d8cc84-5898-49ed-8ec9-9b892a5c5083", "comment": "Malware payload (AgentTesla)", "value": "1eba0adbe37e0637f52d641dc9389e8a279b3170ba252604fa4cdd809f4ec6a86079bbba05af6f6b3aab817d3da27a81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838514, "uuid": "06266653-357f-4736-9309-97d3b6d561d6", "value": "C6E3BFECD6B8BCEBD41AA1F5DC75F6E5191BEA285468092A382A710314723933CF5C1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838514, "uuid": "399c5c7d-576b-4f44-9d62-063e11e3ebb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838514, "uuid": "ebc46060-2b57-46e4-8490-bd259650273d", "value": "1536:Xyw+Fl90LoD0ZCAz15f22kDM7bOjaH4ZinJ0iQjx:XyhFDhD0gOqQQjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623838514, "uuid": "12a2a77d-ca4f-43df-8ca8-cb67ef1318d6", "value": 144168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623838514, "uuid": "28dd9910-fb92-4606-acc2-d43677a3f251", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838514, "uuid": "c4deec44-b2cd-41c8-b460-03bac0a990f7", "value": "f72277eebaf6b7e2891b7ba24188ebda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f89d08a3-ce84-11eb-875b-42010a9c0053", "comment": "Malware payload (ServHelper)", "timestamp": 1623835606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623835606, "uuid": "3490ea97-2315-4618-812c-eaa0407798df", "comment": "Malware payload (ServHelper)", "value": "6efc7601be401f3e9b49f4f2cf63fee9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623835606, "uuid": "1f960882-0a01-4eb5-a89b-dce31b85f4e5", "comment": "Malware payload (ServHelper)", "value": "9d2a3042c4e2d68df7a39cd7efae7c64f2b7ed5ae507bac9282e154591757724", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623835606, "uuid": "18b57385-e4e5-46eb-9527-205f4a6a214c", "comment": "Malware payload (ServHelper)", "value": "6c975b9f64a3e0840c43f11571bc4b1bccdc3d83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623835606, "uuid": "372246a4-4aa5-42da-9eb7-19f5e3523804", "comment": "Malware payload (ServHelper)", "value": "8ff6f331cbe820ba92834cd4d6abf102d859c006a7c8ab9e3f4267d822c45d809e36de73484e20a27443721c0c24f925", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623835606, "uuid": "4bee3ccd-ef62-425e-a5f5-10c7f02669bc", "value": "B856E012FCA214FAC57AE170889697617B313C6483327BD72A94B5AA1F75FD02B3E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623835606, "uuid": "ab1ff824-df9a-4074-a371-4647b007afd1", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623835606, "uuid": "9752ad8d-1bd6-4a86-b5d3-d82c73031dd2", "value": "49152:NNE+2TdVJ85aN55J0h6Kr7k36MNdy3kl3TJrZ+2I3K7ks3CVvbFjqjQ/GzUVmVQa:N32TdnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623835606, "uuid": "793e559d-6928-490c-8d6c-b10019ee936d", "value": 6325248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623835606, "uuid": "4afc23b3-db94-4f63-bac3-6ba3b57b1d39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623835606, "uuid": "1c02bd71-c1d6-466d-b3a8-44cd5edc87ad", "value": "6efc7601be401f3e9b49f4f2cf63fee9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0857cbdf-ce8d-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1623839069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839069, "uuid": "87a0694a-6bf9-4a00-b914-3f0d9ea1dba3", "comment": "Malware payload (AveMariaRAT)", "value": "a8fcf9f01f6ac912a38cb17e59eb1ed0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839069, "uuid": "818abe90-eefd-429e-a83a-1290dce55531", "comment": "Malware payload (AveMariaRAT)", "value": "9d56ad7e390d35d3fcf2bc03ac7b38e5efeee12e8bbc2917a375e6cf8c65d69f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839069, "uuid": "72f9a1a3-5b4e-4270-b997-609caa7a893e", "comment": "Malware payload (AveMariaRAT)", "value": "40072436d5bd265261bcf0bfd5cfbb046e70a97a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839069, "uuid": "78d49eea-1c0d-458e-bb5d-28115769c27a", "comment": "Malware payload (AveMariaRAT)", "value": "e0a65524e0c1c7b94ed7e747295605075d907d17297bf9d299a47e088546320d687a7fd1185f616edee4a01343cb07ad", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839069, "uuid": "a9938ba4-4da0-4c4c-85b8-9c0e1f474e95", "value": "87B39E13F7E54835F3B201B01ABD7E7ACBADF9701628C49FA394854B2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839069, "uuid": "abc42529-32cb-4775-b00d-4ca1a59d0d21", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839069, "uuid": "2b848a43-2378-4e8a-8dc7-78467a68ad29", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE013:K1VmhaH8EFvW+0OVE0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623839069, "uuid": "e1196fbd-6897-46da-9fd2-e0b336af7895", "value": 112035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623839069, "uuid": "710282ab-a621-4324-9413-b6a1a3855be5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839069, "uuid": "fad74080-874f-4ec0-ac7c-cadf8be812e1", "value": "a8fcf9f01f6ac912a38cb17e59eb1ed0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527707c2-ce89-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623837475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837475, "uuid": "b2f8bc42-e158-4294-ac6b-46dd3f20261a", "comment": "Malware payload (Formbook)", "value": "3d6578e16c75a823748074697f1e6d31", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837475, "uuid": "75c0dd5d-5bb2-4292-99c2-21960c2e672b", "comment": "Malware payload (Formbook)", "value": "9db658029b5e4f7ad9b961e183d6470e1cfbf4218a9c98d6d8e126ba51104bdf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837475, "uuid": "df2924f4-25c0-4c27-a7e9-fbd51584ad29", "comment": "Malware payload (Formbook)", "value": "1d496adffc280499661a5091922d12cde1052ae8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837475, "uuid": "1e6a1ea0-bd4e-4509-ad38-3006142da932", "comment": "Malware payload (Formbook)", "value": "714d32aad0f9709136441a9cc7f9eeaa2436b298b0f2d4422d38768c021458651364d2660ba9a49a709b39d4262c9665", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837475, "uuid": "718dd349-b4be-4130-b999-53c48f371b80", "value": "DE3412CFC69B2C2AFF4FC668CF5DAD8904E999B739AD58409106FD88F40846E71D6A40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837475, "uuid": "5a80edba-b3fd-4dfa-bed9-abb0c04608a3", "value": "6144:KBZsZpYnjbvIrDVssSOmwNMzC5HjnOgObhkpKIYOyb:Juf6VsEsStOFyKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837475, "uuid": "441908a7-2238-4367-9e61-bff22038f7dc", "value": 230691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837475, "uuid": "e00d3e1a-a04d-4e30-a201-9ebb7cd0cccf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837475, "uuid": "55f5946a-a2d1-48c5-8a83-5caf552aeda1", "value": "BankCopy6152021_pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c92cbf4a-cece-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623867309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867309, "uuid": "cb883caa-2aa3-4e44-9e04-8c213ad89570", "comment": "Malware payload (Loki)", "value": "801c5b1b30ae9319c56c49c0d085d813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867309, "uuid": "63195cab-9737-4772-bec4-0d320b5e87fd", "comment": "Malware payload (Loki)", "value": "9eab1df968b7e596474987344c537c83cf8b869a78392a0f443ca1889c075250", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867309, "uuid": "cb470894-4fae-4a39-9c9a-7103cf07813c", "comment": "Malware payload (Loki)", "value": "c47f9bc729729afd267330279f78be9c9b9ee747", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867309, "uuid": "bf0b662a-e759-41ad-8441-d292630f79c2", "comment": "Malware payload (Loki)", "value": "ea41c320a6415896d083ceee115ece064f81bfae603b67e72363d426b3e56943cb3ce8de9a501f40177ea30e06794958", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867309, "uuid": "22f30cd9-9d4c-4140-bb7f-9e91c2e129cc", "value": "80F4AF3036EA9148D6FE1B318DB5819447BABA277B50CF2E244A234C9D13753DB12BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867309, "uuid": "b224d8ea-bb7d-4a4b-a4ee-00ef2b5b536a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867309, "uuid": "c9df0b85-f715-4526-ad03-7de85fffbfa5", "value": "12288:tWiaUHVPHkvquwaHp7Fqx+gT5sntVf29LRh9CgHCgySBUT:TEquPHp7QhWr25hHbyS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623867309, "uuid": "2f0ebf39-0db5-4d58-a9a0-25062486b5cc", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623867309, "uuid": "9047bed9-ca40-4ce9-9948-a4b4cd47d685", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867309, "uuid": "eee19e3b-30bc-4f10-8af0-83b6798cece8", "value": "po.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3958acb-ced5-11eb-875b-42010a9c0053", "comment": "Malware payload (RevengeRAT)", "timestamp": 1623870360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623870360, "uuid": "07bdd993-f43a-4489-9dde-f5e7bbd165a5", "comment": "Malware payload (RevengeRAT)", "value": "4dbcad0928d1922aebb5a6269e0590e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623870360, "uuid": "15d0995e-cc95-49a7-82aa-e6566276fb5e", "comment": "Malware payload (RevengeRAT)", "value": "9f549d7c1524df9f8b0dd28d440a0c55bb3ef49c1c9114b43e67545ca727e9d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623870360, "uuid": "1c93327c-dc06-47c9-9779-8401cfa72264", "comment": "Malware payload (RevengeRAT)", "value": "3abb538e25c7d67420c9b5cba27c3e0f3589b3c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623870360, "uuid": "8f1d44b6-c205-402b-8faf-525a1c0c7bb2", "comment": "Malware payload (RevengeRAT)", "value": "d1adcfa4e8f9c8392503f94d6bf9669284a42655523a384db2f5e80fec2cb5af577e612d8ecc056b78ee6af638579d30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623870360, "uuid": "0366f2b5-933e-4827-bfbd-7bdbb03f4c16", "value": "D344AF0197BD4F65E3AA2778C2A511054B28BA44C2CFE74F608E0BA9FC417FBE963457", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623870360, "uuid": "b498da53-9bc3-416b-af9f-08975efc4a0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623870360, "uuid": "607993af-e049-46c5-a4a0-bcf627850543", "value": "6144:xhZGSlMivfO5ca3Uzje4GKUtmzcDImnJfy:DUSlMiv22a3wjsmzcDIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623870360, "uuid": "cb0eb4d2-4b9f-4a96-82af-a70fc54c1c61", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623870360, "uuid": "28656f1d-dfef-4a2b-b27d-2027bed8dcc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623870360, "uuid": "4e06cfe4-2783-434c-bee3-ca39741ee545", "value": "4DBCAD0928D1922AEBB5A6269E0590E4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498a0b84-ce80-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623833594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833594, "uuid": "33ee063f-14bb-44fa-a357-6b6d21840d28", "comment": "Malware payload (Gafgyt)", "value": "519a6b4db52f9402af38a3b23e406e50", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833594, "uuid": "248a2639-b905-4869-a512-cb86279b51fc", "comment": "Malware payload (Gafgyt)", "value": "9f8832eb9fec7ec3ecb0546f3c856bf6a978f5ede29c5bb82eecca58914ef78a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833594, "uuid": "05b39724-e0b6-40f0-b568-b989c2f3843d", "comment": "Malware payload (Gafgyt)", "value": "88cf4bec9c721b333cab6a1cf954d2235229d5c9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833594, "uuid": "bbbb1896-12f0-41e5-9522-5970b1d677f0", "comment": "Malware payload (Gafgyt)", "value": "eb896a344a81b962d1887cd7e89c2a81d9b0055665e3f7de38572d732c30837db97c12cd1b20c9a98ba88638fff9e00b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833594, "uuid": "4377d010-9c77-4a3c-be71-30cb73b472ae", "value": "87D32C37B7A1CAB6C04315B426DFA5919D12F9BF0773712B73A42E702F2E8C61D19A12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833594, "uuid": "13691a24-db7e-4d4d-bc9c-d1ebe595baf5", "value": "3072:ZrqsHely73aCgDhoWo59I5+QGwgNnrAKdzj1eenR83iBpMS0/nwmwFMV/PwZnKE1:aMNnr/zZeAYx4mwFMV/oZnKE+NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623833594, "uuid": "e43b683a-35c7-439a-bf04-86a98a78162a", "value": 130544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623833594, "uuid": "e6762eff-8128-461e-a944-7f6d6916bf74", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833594, "uuid": "def9b80b-f8da-43ec-860f-25e79617bd04", "value": "519a6b4db52f9402af38a3b23e406e50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45416d3a-ce88-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623837023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837023, "uuid": "8bf054b5-d943-4a72-ae88-577fa0cffeeb", "comment": "Malware payload", "value": "4c9867155a69c0e089cbf6e287442798", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837023, "uuid": "998b4de2-fea2-4c3f-af18-e431fd09faec", "comment": "Malware payload", "value": "9fcc8435ac8254ae9b1dea93cff53098e94d193ea4edef5b5300e7c8f0328d2c", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837023, "uuid": "9af54002-8c17-4e51-bc58-c87f3140cdff", "comment": "Malware payload", "value": "72fd5acd0ce33714c3aff9e837af3be0db733800", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837023, "uuid": "44831455-a110-4615-a7e0-d14bfd1bf6e9", "comment": "Malware payload", "value": "8e9e103fe27d15dae73e8b660de6b90ee6a7527e5e0990cd57cf341c5577eb411b2f94858bf850dbbe0f0df16137a3bc", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837023, "uuid": "30e8592d-1dd1-4630-bc46-d9b36829d6a0", "value": "DD552361B9A4AF13ED4F34B92207EF6AA13DCE4117B6C60871ADFB62603097145F329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837023, "uuid": "e4349ae8-aa0e-47d9-80d0-8c1beffffb43", "value": "24576:0qPFc03WtYM1mvUtca7XBUBMfaM0XeUSkiRROa:XChtYvvqRUBqazu/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837023, "uuid": "f946fa29-b070-4b06-88ab-ce88cb870d2c", "value": 1315840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837023, "uuid": "e42592f6-8051-4d23-9070-1a8fa6ec4630", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837023, "uuid": "27089845-7ed7-4343-b3e2-495986e41006", "value": "Seafood Order and Company Profile.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91a8490-cea7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623850586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850586, "uuid": "af3ba13f-a542-4910-b3b5-0cf9185f7a40", "comment": "Malware payload (RedLineStealer)", "value": "8298f3c94808a2faf79fb364321b5909", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850586, "uuid": "6757d5e5-3e4c-4231-a6c5-de539815d36a", "comment": "Malware payload (RedLineStealer)", "value": "a0bfed57630d886f0ac897a52e05465763e5c10875f057c3a702369901a7bf84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850586, "uuid": "9827395b-05c7-4076-a298-84f823e6ab2b", "comment": "Malware payload (RedLineStealer)", "value": "1f5bfcaab9628a318a39113f208481cfd798b091", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850586, "uuid": "7b99147b-d489-48ad-b6bb-e46eeb02a3bd", "comment": "Malware payload (RedLineStealer)", "value": "5e6cc10fe9cc273c492be58dc4891f4a6b1fb507455560c332da3cdb06772691a504b647e630c5a8cd229af2dd1e7d28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850586, "uuid": "015f280e-69db-4abc-acda-5eaf829aa07b", "value": "C9F4F120B792C034F1B212B86AB69378A53E7AB1AB2C60CF13D516ED57746E0DC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850586, "uuid": "8b3eb63d-7237-4b21-8db2-1181219602e2", "value": "f15a946d6e0659432dc9b8c464554438", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850586, "uuid": "455350be-5c66-4922-9bd5-70fcd03c896d", "value": "12288:U1F9H7X0cnAuRs8zRd5s01dCLALbzBWq39SZYqSRrjDQScU3+vrOiyzHNF:Qh7Hjfp1dd/zL3gwUScU36gN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623850586, "uuid": "b47e6cb8-83a1-4501-8d3c-3790217dbf9c", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623850586, "uuid": "6fa029ba-b93f-4449-a9e8-cdb9fc37347e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850586, "uuid": "dc337720-4fe3-4280-ac8e-7d5e27357843", "value": "8298f3c94808a2faf79fb364321b5909", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff0cd47-ced7-11eb-875b-42010a9c0053", "comment": "Malware payload (CrimsonRAT)", "timestamp": 1623870971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623870971, "uuid": "d95383eb-2e69-4432-8471-c0b19df777cd", "comment": "Malware payload (CrimsonRAT)", "value": "529ba5d2c599a72bb56a4b66214af1ae", "object_relation": "md5", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623870971, "uuid": "29da8f96-49ce-49f2-b0b3-edf64af8dc5d", "comment": "Malware payload (CrimsonRAT)", "value": "a0f6963845d7aeae328048da66059059fdbcb6cc30712fd10a34018caf0bd28a", "object_relation": "sha256", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623870971, "uuid": "dc60d155-d8de-46c7-a9c3-b2a42857946e", "comment": "Malware payload (CrimsonRAT)", "value": "a6bfe60170efd697ccca1e2e2dd7c6990e0bb90e", "object_relation": "sha1", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623870971, "uuid": "c5a98b1a-53f4-4ad6-9d75-1d419d3aa926", "comment": "Malware payload (CrimsonRAT)", "value": "9564017b17ef6346de4c2708ec6777025b41961b0730e444909ad428afdda84474a30e561475e90f9b1bb929d4a5b5a1", "object_relation": "sha3-384", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623870971, "uuid": "8f0e0753-f9b9-48d4-abcf-54ca1a03f0a7", "value": "FEB602E8F7384120C86B5A374680A375D065FCE6042149A7BEB4B9BD3C56BD4F8172BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623870971, "uuid": "3c61aba5-4c5b-4f74-a742-512d41a8bb8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623870971, "uuid": "1ab26584-fab7-401d-b580-52bd0b441355", "value": "768:XnzHfh5s5+uBsI07a24msgjtQoIYlHqqlYcGYF2X3w2vf0DDe5MFgkaj7QUAc8Fc:Xrff4biIYlbaYFIHX0DSeFXan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623870971, "uuid": "56f7f0d3-4f6d-4ea0-92b6-9f839b6f1a5f", "value": 10938880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623870971, "uuid": "d748772c-4f97-4225-b45c-bf50158ae083", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623870971, "uuid": "e871fbb9-da07-413b-9636-3867961061f3", "value": "529BA5D2C599A72BB56A4B66214AF1AE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ad77d5-ceae-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623853446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853446, "uuid": "7d653c45-a3b4-4880-bc04-3ad040252f62", "comment": "Malware payload", "value": "bf0b7ea0403830ea49a222b8416a17ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853446, "uuid": "a39cf1c1-8032-439a-ad43-33a17dea4495", "comment": "Malware payload", "value": "a128a62d2290a71183bcb46e10cf300c1ce2182ed74be355bb270145012cd163", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853446, "uuid": "1421b43d-5f71-4f88-a6e5-ef424da4b15a", "comment": "Malware payload", "value": "20a4e5cf9e1371e10ff38b13c4215769282db6cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853446, "uuid": "61df1de3-ea04-4307-a2c0-3d426a80b88a", "comment": "Malware payload", "value": "06714786368eeb30da29a25387fc26ade04377b081cb73957afb36610815a8d5480ba64da6ae630a062cd7cbbb605d28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853446, "uuid": "506eca62-a551-47b8-8688-8380c7a0a4cf", "value": "E5C32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853446, "uuid": "9f0cb0fb-fba1-43cc-bc84-f6328844b0c4", "value": "3072:ekYPUfsgnsb0J2ag/Vf+kDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0+kDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623853446, "uuid": "e9832335-0fa6-423e-84ce-5c45f3cc43d7", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623853446, "uuid": "5d7800ac-83a8-4023-98d6-d7b100b6e7e5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853446, "uuid": "da412095-9d2a-4cea-b9ed-d3e3354c724b", "value": "bf0b7ea0403830ea49a222b8416a17ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52b7d08-cece-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1623867356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867356, "uuid": "87e0f8a0-5331-4c75-a22b-737265dea277", "comment": "Malware payload (BitRAT)", "value": "354f3f2d5331066c35e943232d97a0a8", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867356, "uuid": "ca6eae59-71d9-43fc-937b-8a7926ebdc7d", "comment": "Malware payload (BitRAT)", "value": "a236fda82de1d026793f045e2f1b5d203dec051adf7eeea8fa8863583a697631", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867356, "uuid": "9c218764-b7e9-4469-ba9a-b1edbeb4accc", "comment": "Malware payload (BitRAT)", "value": "7335925303a294edc540f1ba72e75a40cc3f1f81", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867356, "uuid": "db2ae134-8540-4df0-b7ef-a479c0c3a308", "comment": "Malware payload (BitRAT)", "value": "b4cf0c9961ece2a456316dda8ca57d77bc42a0d51c6c84fb84a05d837ae23b33ae857147020731722ce45505a20e1776", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867356, "uuid": "e4513966-4ed1-4f3d-b675-61e6b696d877", "value": "BAF533605D054D16DA7CFA7CB8272F280E314AE3D0BCFAEB17DEE8734A297006997561", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867356, "uuid": "7265e3c9-7584-47eb-a4af-215f6d9a7828", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867356, "uuid": "545f62b3-3ea8-4417-897f-4051907ccf2d", "value": "49152:4qrD9TC2SVACoUe91JxysWBFSuPAGbFJq+rFkYXsy63ZfoJBqCXdl/7q:TDDCOJjWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623867356, "uuid": "3e2220f5-8841-418d-a24e-4bc196fc3552", "value": 3525556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623867356, "uuid": "8c68fe1d-77a3-4338-acfe-3226bcc364f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867356, "uuid": "47e834da-f8da-4efc-abd2-b73334d9b42b", "value": "354F3F2D5331066C35E943232D97A0A8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929e7275-ce85-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1623835865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623835865, "uuid": "412f7b8b-8e43-4fb1-8761-fa9582c244bc", "comment": "Malware payload (AZORult)", "value": "7a930bceda1ae55476658320fe2b1c7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623835865, "uuid": "1faaed70-1888-4ee4-9e69-991deec4b096", "comment": "Malware payload (AZORult)", "value": "a379e8c0d5fe834139f11c3ef6e1853b6183dfa84600a38b195bace5398b2d5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623835865, "uuid": "3e9c1b67-ff85-4a66-83a6-1bd4361600bf", "comment": "Malware payload (AZORult)", "value": "202159d3781b211829e958c7643481a9f05cf5e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623835865, "uuid": "b0bfc6c3-cf11-4b22-aca7-0e488bad3f37", "comment": "Malware payload (AZORult)", "value": "417cdaa5abd0bc994d2d3a856b46c19885371d55f0fcb2c92c33982122e0c03ec34e99e9c7c5b8c2b7ee3d92525a69d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623835865, "uuid": "b17fcd93-e953-4a73-b0e1-85a13c1615aa", "value": "1874AF1313A558CED2001EB0F5D37E316EADAEBB3B448A4AD7527E3875AD8785440B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623835865, "uuid": "0ee71a62-a302-4b82-adfb-9073ed30ff4e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623835865, "uuid": "5e02215b-4ecc-4dfa-a98a-d1a8549d4850", "value": "3072:NLk395hYXJ47LQZhqYZgr7nIPGA6M3mcCXaTWla1bF8BQVWrnMi+wF5/DiCWopSy:NQqC3QhtM7W3oXs1bFmQor//DVNpSKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623835865, "uuid": "7bdbef3e-a6a2-4bab-af34-6958f5e43df1", "value": 354918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623835865, "uuid": "e4d7b2ea-9e84-4326-989d-d4c48df9ecb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623835865, "uuid": "75080f29-2918-4b28-8b6d-104db1188c43", "value": "7a930bceda1ae55476658320fe2b1c7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377fc4bb-ceb5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623856328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623856328, "uuid": "dfc42e30-34c1-4059-bae4-9555db2d8142", "comment": "Malware payload", "value": "b3ee245d481da095a1bd449e8997400b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623856328, "uuid": "7c8d0c2c-45d6-45cd-92c5-8eeb5068765f", "comment": "Malware payload", "value": "a3da054acdec041cec534afabc094efd15d497fab37050917589a8ca2ee0f0fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623856328, "uuid": "21ca8084-e330-4d83-864d-eef90becd036", "comment": "Malware payload", "value": "d2ffb9fcdbe76a56105777559a7acf41daf92673", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623856328, "uuid": "814e8ae0-325d-44bc-a415-a677f88666f6", "comment": "Malware payload", "value": "fcfbd9b65a50ea707cf27c42cda08bf1877b2fc923e71f9fdbfac8f2f94651a7b60349d7d73bb5f1a279cd9f36e207b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623856328, "uuid": "124aedbf-376d-4b72-8e14-a19e789b8963", "value": "1415C3303FB967D6E07AEAA145AEB447C9ED61FA260DC8CD5C5007C147326CB4AF2D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623856328, "uuid": "8daaf10b-31e9-4275-be86-bc2c0562c5f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623856328, "uuid": "5305df06-c582-40a1-b4d5-c39646337c00", "value": "12288:D0hUrb+oxhlm4S4F3M9yLDAcqx0lWlZ7giGvwzRC21R2TJhOlz3WRxGfyMFxg:wEb+ofWkcV0lW3RGvwT1cJYNux+yMFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623856328, "uuid": "a354ad46-121f-42d6-ba5e-796352a3dc46", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623856328, "uuid": "6ffc83c9-a99c-4fbf-93e3-07951e4eee6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623856328, "uuid": "e3e92494-53ff-45a2-8510-c462d1fdeb8a", "value": "QR 2021.6.16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5325e09a-ce88-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623837047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837047, "uuid": "5ccf8c06-57cb-4d97-bb51-de4f601412e7", "comment": "Malware payload", "value": "e2254c3d7c2dbc0647d23747dcdb7364", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837047, "uuid": "2242fab8-6a8f-4638-89cb-66c413bbecc9", "comment": "Malware payload", "value": "a4241d238344019a941dca7f4b20e3258a363afdfb2dd4a75f09bb41f0a676f6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837047, "uuid": "013796d2-5f59-4da7-a322-62d4a9ef1d1b", "comment": "Malware payload", "value": "524507972fed3f61ee4b54cf521aacd7056aa65b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837047, "uuid": "d0d8d233-5dee-4d60-b48d-c81a3bd81afe", "comment": "Malware payload", "value": "796c903fcec2f9d4e9ae12c1a0ee1609f9dfbbbe52a1c5fc36bcfc25718d6d7d590bea28b52077e400bccf0cd185bb2e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837047, "uuid": "66114b3d-20b6-425f-a987-0100f87e3d3f", "value": "F38557F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E5551EF6A11B90ECCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837047, "uuid": "dbb22096-2110-425c-b13b-df24d9252625", "value": "12288:omxnSz6qZZemmnPVp/m+EB4nZ2nkYR5Uo:ocn+tZem+Np/m+KXkYR5Uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837047, "uuid": "ec45f1bb-3447-4d75-a775-581af585aa52", "value": 1834339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837047, "uuid": "92c8a668-c131-41c4-9b2a-4c3a632d072f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837047, "uuid": "b02bcd35-cd18-41be-9fee-9483546c494d", "value": "CVE- PO-0798.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dcc57d7-ced9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623871827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623871827, "uuid": "c1e0bc92-52d2-4428-9fee-e3a1eb2bafb5", "comment": "Malware payload", "value": "a3536543f63045dc8fafe180aa177a7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623871827, "uuid": "c2d29822-d50d-417b-a3eb-e628c522d840", "comment": "Malware payload", "value": "a5e57e24a9d5cac8c01746cce2c81d95d6fc0178a3b133985473aad06ba986a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623871827, "uuid": "68194edb-0cda-4ea7-be2b-3dd2cef45a91", "comment": "Malware payload", "value": "728d22ea946a9e69402386faec0d474d065e491d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623871827, "uuid": "152fbc0a-70ae-4b75-8cbc-8076581ffe6c", "comment": "Malware payload", "value": "546c952d59da3eb4b076ce3975080b1d96fd615abf60a89a181d80e23d75c0271fb8341dd56067e3c867528a4257146a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623871827, "uuid": "1bca5a0f-0398-49d3-b9f9-c73b890034e6", "value": "BAF48E32F190C037C13376799C1B92D9642ABF212E38688B7BE52E5C5F396923D252D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623871827, "uuid": "81621043-8fac-4aa3-8523-87cc730b551c", "value": "9882eb4035dda06820977e0c5b3ceed0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623871827, "uuid": "84760a98-e95e-4ff2-8b3d-581ce8a8a813", "value": "24576:VWYlc//////QS8iIOfPOerAY29QdkU0nPEzTZ:1lc//////QSrIUPOMGYkpPMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623871827, "uuid": "b603d2c2-af19-4382-93f3-153878bc987d", "value": 786820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623871827, "uuid": "2d37de03-9d9a-4a18-8100-54cdf1dd20ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623871827, "uuid": "da3b5ea9-a0c8-4b4e-a70d-14f258268390", "value": "WinLocker_UPDATEDharmfulVERSION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16de469f-ceb8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623857561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857561, "uuid": "980e1e12-4b8d-47d7-a556-e81956413b90", "comment": "Malware payload", "value": "d36b8a4aa3f7e7686fc667393ae0f2cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857561, "uuid": "20f20ec3-c110-4cf8-85da-c49345a13f81", "comment": "Malware payload", "value": "a77c845d54b9cef4f7a88820b7ef5f8813cd99fd3cc7cbef423c59fe812a72db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857561, "uuid": "947e87d5-6394-4ca2-9bd7-90f93b6e4989", "comment": "Malware payload", "value": "e35bbf7e7b42368eb6aaa50259159458200899bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857561, "uuid": "831be30d-041a-4b36-bd24-f03cac8ffcd3", "comment": "Malware payload", "value": "ac30373bb1bcc337efbae1fb7342f09ac4e8ffbaa3436de9c00f9f50dfd76b170e2e56f0652207a6de9de230059fe6e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623857561, "uuid": "7cf94c4d-5412-45aa-8c96-ebec8280fda3", "value": "A50733560445B1F4F5913C30A73EF4E5AA4A78230F9635354D8ACAE9493ADC3E7E2B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623857561, "uuid": "0373a40e-70f7-4fc0-9b55-def824c5405e", "value": "c91697c01dea129337d22b481a99c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623857561, "uuid": "4bcba26c-589b-40f5-9eba-7e0f5e250611", "value": "393216:uy9ynGmHceXwVFeLYaxa+o6fdjR3HkYbhKKXC719V4PRVpvwRT9Y9nfgctJxbUhY:Z9wGmLXs2nxhLb5azGRDvwT9CfgctJxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623857561, "uuid": "866d1798-9501-412f-9949-cc2b3445951f", "value": 17832448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623857561, "uuid": "043a2def-7b0f-4298-9a1c-b253d25ebeef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623857561, "uuid": "f55ace02-2863-41ed-ac6c-db45a204693c", "value": "d36b8a4aa3f7e7686fc667393ae0f2cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb292452-ce8c-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1623839020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839020, "uuid": "5acd30a6-c2f5-4f12-a43a-beba5fa4f6ba", "comment": "Malware payload (AveMariaRAT)", "value": "7660d890be49c9825c920c3667177d48", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839020, "uuid": "c9b3f495-7da4-4b58-ae66-5ced61290bac", "comment": "Malware payload (AveMariaRAT)", "value": "a7992471b83b777ff44f4c5a2e242cc508e9956730ac44c758da2f068db16e5b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839020, "uuid": "7bd88b20-67c8-4915-b484-dfc83f9710a8", "comment": "Malware payload (AveMariaRAT)", "value": "5cf7f98b5454eb3db052ab3ed14fe0534fff3516", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839020, "uuid": "eca67862-01de-41cd-9cdb-18d79a6cd566", "comment": "Malware payload (AveMariaRAT)", "value": "6b6588e93bd8b7ca655544e957bf4e261cb779fafab673a36a08e2c177111e4ddd2a51a90fb5816ae9648f4e655259d8", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839020, "uuid": "f91ec752-817f-437e-9e81-201fba0083e1", "value": "70B39E13F7E54835F3B201B01ABD7E7ACBADF9701628C49FA394854B2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839020, "uuid": "05db3712-916d-4a0b-a30c-1eb86180e52b", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839020, "uuid": "c1fb5d60-a251-4445-8837-74fc640dddd0", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623839020, "uuid": "d899bea4-e498-44f8-8021-da4a22761ed3", "value": 111092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623839020, "uuid": "8ae221fc-6772-4c05-9a63-1f24aa91ffa3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839020, "uuid": "30d79aa0-80ef-44e2-a17b-77eb93a0040c", "value": "7660d890be49c9825c920c3667177d48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81bc4ff5-ce62-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623820804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820804, "uuid": "7ffaa09c-a402-4a70-a1fa-703ad0bdc02d", "comment": "Malware payload (AgentTesla)", "value": "2548a875102ec2d5b5b052565735eee9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820804, "uuid": "cf6cd11f-c2a0-44da-b39c-0d02bc4513d8", "comment": "Malware payload (AgentTesla)", "value": "a87c4f827b07ca1534064b05c4ed66b3d355a6b369feacc823e0dac5c2f9176a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820804, "uuid": "7c3da4dd-9c59-4582-8e5d-2719f014374f", "comment": "Malware payload (AgentTesla)", "value": "0c24a108cde23ddc9ea1c2e28c2bec747f50012a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820804, "uuid": "1516ec29-14e2-4447-b73c-6c2e95ead8db", "comment": "Malware payload (AgentTesla)", "value": "53a5658c3a3fe953d81a4fce26da412aeebb265521dcee01c9237c0e412936bdc72f158619e02d0d4ffa749870262358", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623820804, "uuid": "e3fa3e6e-e852-4ab8-9374-7907a11db101", "value": "D0B4239B4A32554848CB08DF8C35A743C1B34161A67D1FF89F4724FC20E4C6AB79AF5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623820804, "uuid": "f7994144-b327-4265-9cda-05465366d0f9", "value": "12288:FHRFzwuoFQ8GNsH3HKnzeZOPfhi5EnlpI41Yd9Ku/J0yWt9:FTwuoS8GmanzeZofc50p3u/J0yWt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623820804, "uuid": "1ba327b9-e9ab-4705-8ae3-de281cff3a1c", "value": 512553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623820804, "uuid": "40c4fd93-4eff-44c5-bb44-cf49865d6182", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623820804, "uuid": "c9ca23a7-eddf-45f8-98e5-b7b5714cb4d4", "value": "SWIFT copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56773fcc-ce88-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623837052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837052, "uuid": "5cbf92c3-aab8-40bd-9fcb-ecbb8e15d5ed", "comment": "Malware payload", "value": "a6e2fc1a8a800ea9daf1db79c6f6906e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837052, "uuid": "9f1b50de-1e4e-44ce-b379-558a54adb3ea", "comment": "Malware payload", "value": "a92a4a98df77db2701c43f53f5f7a9396356c46084250e8bc005beb35ee082fe", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837052, "uuid": "e85f125f-072a-47f1-8014-22bc571f32cc", "comment": "Malware payload", "value": "5f465bbc2d000f5e5d4d65a0816bee3d12889cb7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837052, "uuid": "6f51770d-dfe6-48f9-8955-fc1e1504971b", "comment": "Malware payload", "value": "88135f2a62e60df6b4e5e2165a4851156cbbb4cde2f039ca2ce72ea4edc4a236b8a889958c5ac123dc028688fb9c68e8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837052, "uuid": "ddd33398-a897-4d3d-9122-6db515e0b1ce", "value": "2F7557F0AD01D4C1F57A5B6AF2FD3A48A1343217EBC94A4A00E7E6551EF6A11F90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837052, "uuid": "73a79ac8-4a5a-4dc6-b985-ddebb93fc336", "value": "12288:PQWrS+H8UErBQLeugD72F5XIAQwP3mhzK/+enAsFRMf:4mwrOgD45XIAQwPx/+eAGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837052, "uuid": "241ad6a4-ab94-4eaa-ae65-7225d8215822", "value": 1609213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837052, "uuid": "4d3c46cb-7f15-413b-903e-a4dd6034b9a8", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837052, "uuid": "c0fd4237-f9c3-4b3e-8623-5dbef3d7e729", "value": "PO-0798.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac02f658-cea8-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623850940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850940, "uuid": "663c9b34-2265-40cc-b833-324d6b021a6d", "comment": "Malware payload (Quakbot)", "value": "f2d9c653be1d8fe82ed9c1029c2a18e8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850940, "uuid": "1f5280e2-73c4-42f2-89f9-60929fb176e3", "comment": "Malware payload (Quakbot)", "value": "a94291cc6f39425c30d1152a83ae122c0c8f10c8bf2f77c94542bbb30203aa94", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850940, "uuid": "2de3ffb1-2c9b-4e88-9e68-c3cbbd7fbec6", "comment": "Malware payload (Quakbot)", "value": "2a96a55156b761e5e29144789f1661a5f719b76f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850940, "uuid": "8f9873a0-1e6d-44c3-a4c8-0df9a7337954", "comment": "Malware payload (Quakbot)", "value": "0f627f1c2bdf22b799f9e96e76306dc9fc1fa6ce2ce0049b49403cb8ba247851e4a617473ce8605d88f9b27eb64cd82f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850940, "uuid": "00fc6f61-8b8d-49b6-8bfb-a9446741b651", "value": "E2158E72B2A38C37D1733A7D8D4B63A4982ABF413E3B69462BE41C4C5F396413925397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850940, "uuid": "64cf9b3a-29db-4234-93d9-86f5c8687e00", "value": "299f6f1d2b8a3e164da0e6578d1fa5ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850940, "uuid": "997e177b-0f1b-4341-b14c-0fd425c9f81a", "value": "12288:jhFr6SSWqOdUuVAXJaBbWdsrHOYQYpPGFEQ0TYxd3JE3MX/Pu6ULos:jrnemAXJ9+OBPyQ0TYb/yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623850940, "uuid": "46d6a55a-9356-4c3e-9961-d2b56de22242", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623850940, "uuid": "e842f1f6-2d6a-49eb-a59d-dc8c08572b0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850940, "uuid": "51049751-1a59-45de-b28e-00a40e7584b0", "value": "Jipos.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255fb98f-ced4-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623869612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623869612, "uuid": "7ad5f248-a122-4f4b-80a2-4fed22ebb160", "comment": "Malware payload (Loki)", "value": "3a974f4f18c353433f5711a86d78e13d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623869612, "uuid": "afb0c990-f2b6-4857-8d68-b1f8a0e28c4f", "comment": "Malware payload (Loki)", "value": "a9f9495ff4aa2688fd9f8fae22d918488e9608eedaa6426ca282495c33b4e308", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623869612, "uuid": "02fbc5c7-3f8a-49e5-9179-7e07e904e922", "comment": "Malware payload (Loki)", "value": "d5d37d3b169d56ae1d6c7a092db732e6caa1cffa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623869612, "uuid": "7fec3572-5445-4aa1-8db1-4fb54e6ee3fa", "comment": "Malware payload (Loki)", "value": "7b636e9f34486ce04a43227eb00ba7baa0e8659e9c834f738b81881c22160c7a9b9bc6c8c837471e6649fe08c5251d36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623869612, "uuid": "32ad9abf-d1d9-4875-8be8-83f91599ea28", "value": "67F4CF1033D4AB19E57F1BB988715040C374B906B96ECB5E6CC532ED2DB2B81DB627A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623869612, "uuid": "2aa6e793-6662-45d6-81db-4719262bb7a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623869612, "uuid": "bb12c98f-9ed0-4514-8435-b4351f2ad7a6", "value": "12288:x8wXeoskPGXAb5ZM42MBuvBbfLuCJ6ZR/9AnDH8VDO7NJGjjS:xxnP2irM4PBqTufVwDcVDgU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623869612, "uuid": "22ee75c2-b312-4964-92ff-af446f896531", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623869612, "uuid": "e523ff33-7ae2-448b-88d5-a77c08e7363c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623869612, "uuid": "c80dbde3-6543-481c-b347-abc542466992", "value": "etiqueta de transporte_8391906725.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a35c9b-ceed-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623880539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880539, "uuid": "5ad1d0a0-139b-4c35-915c-66dd433778e2", "comment": "Malware payload (RedLineStealer)", "value": "0ca559074c3fffb88495b9d566c5788e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880539, "uuid": "9e9e5e13-e46f-4d5e-820f-620ed53b2b3d", "comment": "Malware payload (RedLineStealer)", "value": "aa1775b3b5e6d8ef08f45bf32ef069b6b07c20a26304c53b94ffcbd4b1228e13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880539, "uuid": "a27dbe7b-cf3b-4a01-8c99-585f9e4f2ba7", "comment": "Malware payload (RedLineStealer)", "value": "d92522dffc0024ce2ff00987e149c8177c6149eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623880539, "uuid": "9caff291-24eb-4745-bce5-1be3b597ad5e", "comment": "Malware payload (RedLineStealer)", "value": "15948ee243bc40820c842eb5a4ed85163c9342c4ed797a70f9b1f883cb0982d5d46a924d26769399dca57ea71306911f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880539, "uuid": "42024f1c-9461-4699-bd0d-3226f6cc16f3", "value": "7084BE10FA90C034F5F612F88AAA9379A53D7AB1572491CF62E52AFE16346E0ED31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880539, "uuid": "03185372-edac-4496-ab45-5880ec7df0d8", "value": "ed103d03110ecdb36297492051b4e917", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880539, "uuid": "086869e3-9035-42f9-9992-881608f6512b", "value": "12288:jkzoX20Wj64mL78HPkXIT3JfMNgUc7B6OP:fX201H8HPkYVMuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623880539, "uuid": "99365141-c96f-4227-9d09-d3ec43d29e6d", "value": 394752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623880539, "uuid": "c0a977bc-f618-4817-900b-5e049556ab5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623880539, "uuid": "5712a47e-31b6-4d1b-8f5c-725e50423794", "value": "0ca559074c3fffb88495b9d566c5788e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8643e8f-cece-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623867335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867335, "uuid": "b1a12ace-7404-47c3-b061-d85261fd88ee", "comment": "Malware payload (RedLineStealer)", "value": "ff5d72d44c6daf8915aa93bf1aef72b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867335, "uuid": "046b5188-8db0-44a2-8610-d1fa85fcd019", "comment": "Malware payload (RedLineStealer)", "value": "aa60f40a38a635f74d30ef8d0d636e525dab78aa987b9d1d80aea9f5e498cf78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867335, "uuid": "fe2ccc8f-9824-4e4b-8094-6c7df60a626e", "comment": "Malware payload (RedLineStealer)", "value": "e4dd66a0e51d3d185cc12be3a6b9ddc8dc68b027", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867335, "uuid": "1ca5ab4b-8448-4182-81a8-0c3a84add33e", "comment": "Malware payload (RedLineStealer)", "value": "e58f28a2e36fa9be6b609d9fb523ae66cfe42b31e257bce91c14570e8b4c24f8aa4843fc0124a96de66110f970331f5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867335, "uuid": "6b248881-b71e-4f50-bb66-069d4a5966c5", "value": "62358CFC76459CE2DA4DCBB3C655988C53A03DFE0173921E18B4B6C815037EABF5A886", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867335, "uuid": "ed1043ca-18df-45dc-a835-bda6fd553c3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867335, "uuid": "01ca4b16-c263-4151-9866-742b383becda", "value": "12288:OmIftF47f5hWW9GsjwuCYmWH0WYri4QbMr4xVwAv0RuFJ9ISXbWpFppQ8QI+k/Sh:OmIftij3mWH8zQQr4xVDvCWJ9zSIiQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623867335, "uuid": "e9cc57a5-c717-4e0e-bfad-3fa31468a6e5", "value": 1061280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623867335, "uuid": "1cd5070a-5993-435b-a5d9-fe98ae2083d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867335, "uuid": "41eb7b57-ed2a-44a2-9c1a-1c54b79c8392", "value": "e4dd66a0e51d3d185cc12be3a6b9ddc8dc68b027.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fcc9797-ce8c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623838786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838786, "uuid": "998c0508-6fc3-4572-96f9-21c3b608315e", "comment": "Malware payload (AgentTesla)", "value": "e123306fcc7fd3c3bda8993b4f6c43a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838786, "uuid": "e2231b81-9030-47bb-bb66-6ac0faf34e9b", "comment": "Malware payload (AgentTesla)", "value": "aab5f4c72afc1c8f1beacb75eb3fa27dfd18e6d1e58e6a0c9f28222550c30af7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838786, "uuid": "5ae71cf5-8cc4-4894-8c17-bafa301b971b", "comment": "Malware payload (AgentTesla)", "value": "b9247ec8b7158c490369961d0e5abee45c305c9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838786, "uuid": "9ef887ca-6929-4462-95bb-41de3c9c5173", "comment": "Malware payload (AgentTesla)", "value": "c86af60a32cf88c4dc9bce994b566118c330dea7e88bc2d2d60d22d137a379ad03f4790cdd1d49711a7151cee8815b3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838786, "uuid": "55d6822e-6648-4057-8ab1-f1d708a6812e", "value": "5205BF3076E99148D6EE1B318DB5819403BABE267B54CF2E244A334C9D33753DB12AE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838786, "uuid": "24f9f4b5-1e88-4da7-8d86-6ce24037e1de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838786, "uuid": "d1bc6711-1fae-4404-91c0-cfbac581a2b0", "value": "12288:lzlgfvquwaHp/S4RxwD4jvcQ8MfHVQViTa7zfl+D6YtW0E:llaquPHpK4R2cj1eVbHfl30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623838786, "uuid": "aef94147-e3ac-4f14-871f-a9dc6f6dc2b3", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623838786, "uuid": "ff0d7a8d-43b2-4deb-ba46-46c02ccdd94c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838786, "uuid": "f692743d-4cad-4da2-aa15-31a9990f0e1c", "value": "e123306fcc7fd3c3bda8993b4f6c43a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed2ea6e-cec0-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623861172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623861172, "uuid": "1ad21823-d524-4995-bb7f-f5d7ec8943bb", "comment": "Malware payload (Quakbot)", "value": "5eb937c5e76f8b268d5986be44ab2b02", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623861172, "uuid": "17020a91-487b-466f-8399-8eda4fa2cb71", "comment": "Malware payload (Quakbot)", "value": "ac209fab68bf2562237efedb28cd06a792d30d3dc84fed804a9c8b667ac5d351", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623861172, "uuid": "7ea11695-cd72-49a5-9ac0-c2ce6402d3c3", "comment": "Malware payload (Quakbot)", "value": "ab58004a151382225d8e63acf3b0af2d4fa1ba8a", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623861172, "uuid": "3fadfe67-9f02-48b7-945a-342f1e5d5a08", "comment": "Malware payload (Quakbot)", "value": "43cade4b9604d8cd48840498bb73e609f83ebe1731b4aa5ec199b31da468df9764ee1107b845227f73231204a9052899", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623861172, "uuid": "9b2dd6b3-319b-4876-8ada-569cdd3e86e0", "value": "73F3120DD310A4D8DA67203881037DDD5D1AB56BB8C3FE4F2AB57E9995020DB36CE71A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623861172, "uuid": "30dadfec-7f48-4d20-9c54-a20ab68c3b0a", "value": "3072:09VlUBWA6CFvA7bpKCxAVIKa8d/p4DqLdb1luxVymd1xXPtuDCIX6:03liWA6FVNYa8dh4exQxVyWxftH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623861172, "uuid": "b89f26db-065b-4155-8c77-8e77d7f0e5e3", "value": 159214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623861172, "uuid": "07a1c808-e969-44ca-ba48-c18f160137af", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623861172, "uuid": "c32849a8-078b-42f0-b62a-6a84349b8916", "value": "idea-1045789140.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1137c364-ce8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1623838654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838654, "uuid": "5e408bf3-0577-40c7-9ca4-a954149ebf7a", "comment": "Malware payload (Smoke Loader)", "value": "c5c9a99d045fd2b0380e2b7e3fd28189", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838654, "uuid": "1b3b5af2-0aae-4bc2-826f-34f1758d1520", "comment": "Malware payload (Smoke Loader)", "value": "ae7ae9ea7fd0100b620704d462083caaedda2c5c5618ceeca54c1d7673b6be4a", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838654, "uuid": "ffbb7397-718a-4f9e-b412-059d03e7f2fe", "comment": "Malware payload (Smoke Loader)", "value": "56d82d12434d7069bfccc93d35d7312289b65ea8", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838654, "uuid": "b17a8e49-34fb-470d-8f6c-47401bdd86bf", "comment": "Malware payload (Smoke Loader)", "value": "3b6d01d5779cc4142cf9589958156c826d0dff8841bce2fd9e848fc3f540977cb32211b8f7fe211fb6a90c24a811c081", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838654, "uuid": "aeab9e6d-9c34-4dc3-8000-378be196391f", "value": "34647C00A7A0C434F6F712F85ABA9378A53E7970AF2890CF53D51AEA56746E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838654, "uuid": "8d91b0a0-3115-4d76-ba73-6d79ba3434e2", "value": "8293ad000eb8f07ba025580bfe785c23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838654, "uuid": "39ce38dc-9a67-40ef-a095-456713b1571c", "value": "6144:LOnyM/Ds6FMPdOZ6uNqOvyy3GbRSOj5v:L0yM/DsgMPG6uNqOKy3GUI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623838654, "uuid": "9d378181-1b26-4e04-a582-c4baeb8deae6", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623838654, "uuid": "f818f187-12cc-42bb-939d-75c45d077551", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838654, "uuid": "7168f739-b3b3-4970-b278-20360544642f", "value": "c5c9a99d045fd2b0380e2b7e3fd28189.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b37eb17-ce9f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623846912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846912, "uuid": "31872aa3-6f35-4bd0-8cfe-91d37d03ff19", "comment": "Malware payload (RedLineStealer)", "value": "4794ace15e8a797df1d0da1031ddc938", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846912, "uuid": "290e0d26-3c95-4777-ab3d-ca8301e794b2", "comment": "Malware payload (RedLineStealer)", "value": "aed0497b275c92082203bbcd78f6f853ee87145aecf6f85fe8c7ec433ab29bab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846912, "uuid": "d3ff242d-2691-424d-852b-cba136884f99", "comment": "Malware payload (RedLineStealer)", "value": "75ddf923d98bc905226609d08dd216d5d90eb216", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846912, "uuid": "74fbb3e6-df49-431e-9071-d088eb4d98b1", "comment": "Malware payload (RedLineStealer)", "value": "7ab920f5deeaafa12b5e40a035ae46be2c657dac251a6102e703600773f2e57a37ce85408402761fe92b10737e325cbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846912, "uuid": "511c7c22-0ead-43e7-9429-2db5a8071a58", "value": "4194AE10A791C034F4F312B85AB693F9A63EBAB1673890CF56D51BEA56746E0EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846912, "uuid": "19af9fd5-53ee-4e5a-87c4-b6f26cd37686", "value": "9b6cb8fb7864152f2c65c8441d386700", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846912, "uuid": "65c6e3fa-6645-4c4a-a399-51ced75d9682", "value": "12288:JCq9QCflIrwafjLFEEDUissyODrp0bDfdT3FX8d+n16:R+CflIrwabLFEeRDrObjdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623846912, "uuid": "f6acbab3-85c6-45c9-b427-aa81f4a40c62", "value": 418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623846912, "uuid": "1ec5e513-272d-4582-b2d7-7e278b5e3ea8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846912, "uuid": "35032041-7ff5-441c-b340-2159aa5ab91c", "value": "4794ace15e8a797df1d0da1031ddc938.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6781883-cebf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623860862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623860862, "uuid": "f16039a6-c63f-4c0f-8a82-31c61c452d27", "comment": "Malware payload", "value": "66dc5f1dd7d36839434ad39b4a21639b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623860862, "uuid": "ed451e7d-ae0a-47e9-8335-a64e13588980", "comment": "Malware payload", "value": "af356a39a298f6a48f8091afc2f2fc0639338b11813f4f4bd05aba4e65d2bbe3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623860862, "uuid": "0602a274-6013-4b7d-a3c6-ea0124a68c21", "comment": "Malware payload", "value": "fb089f06f65ffd937e44f328b54e43ed41b4190e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623860862, "uuid": "3ee6572e-b311-497a-b55c-7bfb257206b1", "comment": "Malware payload", "value": "66f18892e852aa7b73d703411a17a078953f9a82ea3291d3a7ca184426dd67af70a40d218c783b1818419369a1d696a9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623860862, "uuid": "9d2f1aa6-9447-4295-a8ff-1f534e8ff8a9", "value": "B3E47DBDE71BF006F1FC1B7056C35B5A1A3A59D83212000B86B65FA97EA63A47D0B7D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623860862, "uuid": "74a8b0f4-e683-4677-b895-2c687409f890", "value": "70e34059df011046dc435bfee7ee1b99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623860862, "uuid": "90e752a8-ed44-434a-83c2-956f2f925d6a", "value": "12288:0MZzof9I6WVx5LxPL64AG0poASx2ME/VqVR1XEj1Kq8o05G:0GzoHUx5LZ64V0pBa2yAMvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623860862, "uuid": "2a1f658a-483d-4132-80fb-34db507db099", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623860862, "uuid": "dca5f1e3-6771-4da4-a55e-5142d6a39334", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623860862, "uuid": "4cc29ae6-5a5b-49b1-8a60-c5184c54870b", "value": "Matanbuchus.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf2a00f-cea0-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623847398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847398, "uuid": "df90d85d-12a4-4a1d-8da9-0655fff3481d", "comment": "Malware payload (Loki)", "value": "3618761c078af3c9963aa5014b4eb89c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847398, "uuid": "8158f16f-37d5-4047-86ea-59154f75dec4", "comment": "Malware payload (Loki)", "value": "b0afeac2631ae6d8e2cff788a58cbc60945005e908981713761ad818642c838e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847398, "uuid": "788fd2d2-0b35-4d23-9a7f-1f6a888221d2", "comment": "Malware payload (Loki)", "value": "c308640e1b517776d33e399488b51b2c2271e43b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847398, "uuid": "d93a262f-dd07-4ca4-a374-b09a07cb0133", "comment": "Malware payload (Loki)", "value": "b5903a50c4423998f3b77f8bab3b2493c0fff41bd3d9899a246f1eeb3553004307568b5f4cd83a8aa50c84da3f3a7d0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847398, "uuid": "c7dac44b-09e6-42dc-86b3-7d3619249537", "value": "2FF4AF3036E99148D6FE1B318DB991D407BABA277B51CF2E2449224C9D23743DB12BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847398, "uuid": "61e6e4f9-916c-47d0-8f14-59e58a81c20e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847398, "uuid": "1d8449f9-9869-4fdf-bbe5-5af5ab09b56c", "value": "12288:rapyOvquwaHphZ8XfG+00EfDHDmyCtpXh4ICZ9zNRw0rVFIGEZGwj:WRquPHpuu+XEfHmZpCZNN20/IGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623847398, "uuid": "9dfed7e5-9b0f-4a70-a0f5-116011b1dcee", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623847398, "uuid": "133c40a6-4705-4f93-a9c2-bc624b844db9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847398, "uuid": "c36222a9-fd8b-4179-9ded-02b1e811afea", "value": "3618761c078af3c9963aa5014b4eb89c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04fb251f-ceb8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623857531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857531, "uuid": "4affe9b9-9c83-4130-82ee-577e4f59b586", "comment": "Malware payload", "value": "4d6754901c864af98844d400fed83d94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857531, "uuid": "73fdea02-04cc-4eec-bb1f-b88b2dba6a09", "comment": "Malware payload", "value": "b0df63e7d140bd71d744d19695503cac52ed6d27edbda74c0b42b616f79ec375", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857531, "uuid": "6ed7a0b3-08e8-48e2-81c6-8e90269ffb3a", "comment": "Malware payload", "value": "e1cb0541af98bd0ac2f2cefac83b60adb87bf430", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857531, "uuid": "4b0f6e01-7fa3-402c-a4c6-9d0d63e740f1", "comment": "Malware payload", "value": "f690e6a2eb1571c7bb3aaab570c780c1a9d10430f85e602e547e0975d6fef41168c43271a0f96846d7a88416ba8811ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623857531, "uuid": "5034ba72-9b74-43ab-83f2-d5eef4f672df", "value": "D883D906AFA00FEBEC6FCD3341B85B4539CD664622B52F357634C928B65A50F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623857531, "uuid": "b91bd212-f8c6-4660-82da-78618e24fdac", "value": "1536:4vievMTHIqotjo05owokR1HrEZyms+yqcCft0BZ3VMCbF1kWd:+MTHIq8jx5nvzrEHft0Bj1Fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623857531, "uuid": "f9812140-1c87-4288-9f90-0b15dc529ffa", "value": 86500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623857531, "uuid": "cd0cecd7-0418-4146-962e-ff6301f9cf52", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623857531, "uuid": "a3c0fc99-aa52-4ec7-8736-14ddeaa06ba9", "value": "4d6754901c864af98844d400fed83d94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53371f8-cea9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623851411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851411, "uuid": "6f520df1-63ac-4a11-ab81-17c4b3fde950", "comment": "Malware payload (AgentTesla)", "value": "8c00ca811ca40a71cf9afbb7ec09192f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851411, "uuid": "355ca024-43ab-4175-953a-18eaac276b35", "comment": "Malware payload (AgentTesla)", "value": "b0f1414b7b447c45f5e9d57fad3fe58b8024f34580c8f9b20e902db966a08517", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851411, "uuid": "4cc16486-b68f-4676-8ec0-095027c67b6e", "comment": "Malware payload (AgentTesla)", "value": "1d85e5142223ccd5a80c87b6e7eb641d52013499", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851411, "uuid": "5c3fe854-d5be-461b-bc9d-3600c93c4c50", "comment": "Malware payload (AgentTesla)", "value": "013aafac7d60b1be3fcd714a0ea834735e5e77ba0b2d8bf346e437cf2c3bd6c5d1fadf326f7ee50d972c6615e0119ebe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851411, "uuid": "8309732e-2003-4c8d-9d2d-96ea224307f1", "value": "A805927E7B843F95961B3B587BFA092C1FE1252D2D70E58D1D6200E9EA77B37092304A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851411, "uuid": "f015f7bc-94db-4d39-96b8-5b9bdfe11680", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851411, "uuid": "f25702e3-d873-4f7a-9282-4154ed5e49b8", "value": "12288:FJiTgkQtmtd6ieGW8iv3X3ZzrKdkdmQqk3hO65ETJg98f0BN9IaLrfIIM:Cd6ieNfnhZVEtgLPOw1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623851411, "uuid": "92c8fbb0-5ae6-4283-b114-a055dd849f19", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623851411, "uuid": "b2b327b4-6848-4273-b5a5-c76c20e7a8b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851411, "uuid": "3e663693-6289-43b9-8590-f3baa0049f96", "value": "70654 SSEBACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebdb32a2-cee1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623875528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875528, "uuid": "783d638f-9736-46c2-878a-8b107112349e", "comment": "Malware payload", "value": "718893502f899f4d96c32aba1f2c057a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875528, "uuid": "5924ef05-667c-4d7e-9a3f-8b2fb1b938c3", "comment": "Malware payload", "value": "b17a20c83527cf64d07083298a3a2c0ce169df6d557ef5051f552a5c2c125e3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875528, "uuid": "303beaa7-1d50-4bb0-8386-78015d0ded29", "comment": "Malware payload", "value": "fb7da95a1e8254ca4d104cdffcf2cc15b5eb4acd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875528, "uuid": "41c0f679-414b-4f71-94b1-e99de0ebbb2d", "comment": "Malware payload", "value": "12b531a07351ac392278e7e3b3c7f03eca4416578b03ef833d8ae7d7ee7b4557286163a8d7c9a2b5b71419711c39b035", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875528, "uuid": "e501d98b-cc2d-496f-9194-aecefb2e476f", "value": "52F34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875528, "uuid": "c82f7e58-70e0-41be-9cb4-7a4667f47eb6", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBgYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/uYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623875528, "uuid": "eb3b35c4-bde4-4162-829e-0ed3107cfcf5", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623875528, "uuid": "ddf8fa2e-5d2a-4e1b-afda-38c5c6e28f28", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875528, "uuid": "49735bff-14e6-4c3d-8292-2b58401df4c6", "value": "718893502f899f4d96c32aba1f2c057a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e697a4-ce67-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623823151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823151, "uuid": "e8da188d-26ec-4b6d-96d1-7844fd63c03d", "comment": "Malware payload (Formbook)", "value": "6235b2f6cac8f9fb6b47f63b42823b7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823151, "uuid": "1d4d05fd-d759-463e-8b20-a2a89c7bfb70", "comment": "Malware payload (Formbook)", "value": "b18cada45b281365bf225c30a5ec0b58a85f6cae6abb486cc734d345446eaf7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823151, "uuid": "311fb0ab-86fe-4cd1-bdff-45ee93f0cf84", "comment": "Malware payload (Formbook)", "value": "c27e5bd142a394149cea216908d53af0eea8d7fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823151, "uuid": "f58122e9-1a0d-414c-9547-1d1127a979c2", "comment": "Malware payload (Formbook)", "value": "39d3ee790a65f4d950c5a1e83ed17072943a0b0433ef6ffdeb56051f8be23c5825b9ee7ebeafd10150f086da62816021", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823151, "uuid": "c0c8eff0-e660-4664-a873-1ec1c9255a2a", "value": "7F05B03036E69148D5EA1B318C76C1A847BABE673A51CF2D148A324DAD33753CB11BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823151, "uuid": "625b0811-fbea-4871-aa87-8127c80831fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823151, "uuid": "5ef91c16-e0d0-4b85-b7c1-50bd44b70a06", "value": "12288:ZIA9SAvquwaHpoFnYzS4pU0Fqtd2SFgJQojcO4oFnCXYSRpG9:zdquPHprzS4XFqHneJ0lcnCXzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623823151, "uuid": "e9327b5b-bdce-4ee4-a970-02ddf595278a", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623823151, "uuid": "f7e0cc54-18fd-4f3b-9b52-1b8608c8aa5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823151, "uuid": "dc8ebb5f-763e-4c51-9b6a-8d5ebeac7575", "value": "Enquiry_014821-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdba7f05-ce8c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623839051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839051, "uuid": "913d3fb7-824d-47cb-8ba5-0cb7d0920957", "comment": "Malware payload (AgentTesla)", "value": "cd792484c1a953df2463b57df46dfab7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839051, "uuid": "71270779-5a35-4065-8bec-db2f8fcbcb01", "comment": "Malware payload (AgentTesla)", "value": "b38a9336028c12c89ecdcf27789f66b7cd818bec3dec1135657c7ca6a33cefc3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839051, "uuid": "6fc2ff03-0c48-4bad-8570-a69defb3d674", "comment": "Malware payload (AgentTesla)", "value": "3b6ebe06107d4043e262488cf574e1a346f41d85", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839051, "uuid": "266b2b24-4ef8-4204-8d6b-f642cddf2fa8", "comment": "Malware payload (AgentTesla)", "value": "2b385e59e31b01c20333d7e32e6d00ec39392c9afa80f5ce1705f059e34859e03cc285c97632efdd600db5830c89cc7d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839051, "uuid": "7779aaa5-638e-4493-8bfb-a5942054b4fa", "value": "0F456C993D1072DED8E7C532FDA84D64E62B7C26771783079013359EA97FE92CE102A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839051, "uuid": "7d766ad5-0113-4a7a-af27-924f8299b3a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839051, "uuid": "175fe58a-0fc7-4981-9eb9-aaa3046a1183", "value": "24576:wZki2ZCFIf1axLJ9oieEquPHpcxNtavo:QkbwytOzMLav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623839051, "uuid": "7a9e083e-42af-41b3-aa5b-86d39446e5e2", "value": 1221632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623839051, "uuid": "ad7045c8-d443-4195-a7fd-fff6dc4fd8b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839051, "uuid": "b7a8dee8-d3d9-43c8-a619-75e3f4ce228b", "value": "cd792484c1a953df2463b57df46dfab7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c9dd09-ce8a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623838128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838128, "uuid": "9ecb3a04-ebc4-4bb1-a24c-593f7deb20d8", "comment": "Malware payload (AgentTesla)", "value": "47c643dbf05f56192a1e77d88caf2c27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838128, "uuid": "7204bfc6-91e3-4ece-a024-95e2871bd221", "comment": "Malware payload (AgentTesla)", "value": "b5073e328e1b5af6a324e5c9bbc92757f2bfe70b9522d83905e99d5d29fc3c9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838128, "uuid": "76101da7-f0f8-4017-826f-11d3dc8d9547", "comment": "Malware payload (AgentTesla)", "value": "df6acd263cbc29cf183f0a5194033e83a9ffaeb6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838128, "uuid": "161f170c-9527-4be2-9eb2-05deb9d23530", "comment": "Malware payload (AgentTesla)", "value": "2d19e76f85d21f1f9138d30d2df50574d25d78396fbe0a90b2be27c5377cb34116b6a14a96b066d9534bf6d3cb0103c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838128, "uuid": "86e11374-d779-479f-afc6-b52ddb402f87", "value": "92F4BF3077EA524CE5BA1F300975C2D412F7BB2A7B14DA6E2859124C9E737838B21B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838128, "uuid": "57db64e9-1242-4c72-bec6-f82434f977c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838128, "uuid": "98e8272f-ee26-4fc6-8398-cedf02be5428", "value": "12288:Isl0jbvquwaHpu53DRLj0qSZ3k0c6SWwotKN/ilf:kLquPHpOLjra3kV6RcZyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623838128, "uuid": "b7772c47-079d-4e45-b3e6-17e129c5f6c7", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623838128, "uuid": "67283646-36e1-4e1a-8213-9d8631033f9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838128, "uuid": "97c4e159-6ae3-42fb-a92e-16744dee9296", "value": "documentsProforma invoice and Packing List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631bd9c0-cea9-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1623851247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851247, "uuid": "83b158e2-2441-4114-8a95-5490e2b913e1", "comment": "Malware payload (njrat)", "value": "624115db5496a695953473c3c541baca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851247, "uuid": "434183b8-a97d-494d-8b1d-f62924745d1c", "comment": "Malware payload (njrat)", "value": "b6fcb667faa7fd656d502bb16162fecc20b79f483007061c4bb8543e83499ec1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851247, "uuid": "cb76646b-df67-4c13-8941-6de0a823e125", "comment": "Malware payload (njrat)", "value": "793a859b8de0c26c29c9d9b51637f3eb0db4b122", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851247, "uuid": "07aae35a-adb6-470e-b67e-263c35d13ec0", "comment": "Malware payload (njrat)", "value": "839a65e528cb794e77c1f21f620ee7c6e24fb388d180e06c3716c0f841671bbd778bf198e804a6e70d73a1193b48baf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851247, "uuid": "ae833e38-731c-4755-866c-dbabdbf315e0", "value": "5E7412075B888262C0C803B11965D3759770AE769B12C67B7DC4BF0F7EBA3831A476E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851247, "uuid": "2f592850-380d-442e-96e0-de35c6f35306", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851247, "uuid": "8796c8fc-a52c-4a72-8acc-3abbffed635b", "value": "6144:4Jd5MFC7QqXl1IeSFW4C61L3fOU7Tm+EFdF+As1izwaSY/x3aPQGVqi:BFuX3IeSFr9p3fO0TvQF81cwa9/taPOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623851247, "uuid": "d163a1cc-de6a-4406-93ec-b8457094f892", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623851247, "uuid": "013cd3f0-6445-49a7-a8b2-aacca6053bbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851247, "uuid": "84ec8ade-02f1-4918-b6bf-6314737766bd", "value": "624115db5496a695953473c3c541baca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc5b224-ceb3-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623855590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855590, "uuid": "c707953d-9ed7-459d-b0c2-03f8c1d9f14d", "comment": "Malware payload (RemcosRAT)", "value": "64a3b6703e63fabbf341e5995c4ffbe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855590, "uuid": "9ea4fbfb-f89a-429e-95c2-88660fcb8de5", "comment": "Malware payload (RemcosRAT)", "value": "ba8718e9657ddfff66ad93d7b08bddd51549d505fd6020b9ec98c8affe053c04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855590, "uuid": "1227c629-7fa9-4c63-a6da-72f21d1eee56", "comment": "Malware payload (RemcosRAT)", "value": "fc1f8ceda856ff9f401f45fba3c451e055dc97d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623855590, "uuid": "631ded5e-6868-4d70-a346-9f5a65e36469", "comment": "Malware payload (RemcosRAT)", "value": "90e4e9fbb79dd0f625a89ec0c41387a911ff1700813c6c8de10fd48d6319fa28bc93a9d1312071b6b18db810bd328bd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855590, "uuid": "246c7211-4fb1-47dc-a0bb-d23f55345480", "value": "663507303FB863D6E47AEAA145AA744BCDED61FA260DC8CD1C5007C557326CB4AF2D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855590, "uuid": "c45b027a-f1dc-40a1-8564-8d14c674e94d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855590, "uuid": "c8ca94b6-b2c8-44c5-9127-8f76564b5482", "value": "24576:j7jqAuW+FrQAhFT6UWwyETsjxK97b9xm:j7jqAoE2FDyastK97+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623855590, "uuid": "2c0aa898-0989-4f37-a837-0e14a605d2ce", "value": 1059840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623855590, "uuid": "2774ac7f-13ef-4605-9b76-908d1f27cc7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623855590, "uuid": "f064e862-429a-4ebf-8102-ec1664158095", "value": "SWIFT COPY_PDF_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e5f8fd-ce9e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623846706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846706, "uuid": "af723296-2935-44b2-85cf-49aabc300093", "comment": "Malware payload (AgentTesla)", "value": "8ef9eba69402300ebcd39cc3e6281912", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846706, "uuid": "a0e5bf47-1ae0-4aae-a8cd-43f78e0ae906", "comment": "Malware payload (AgentTesla)", "value": "baa22430e3ab043558bc0d263ef5787735089318064bb7d530a4eebedd358f88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846706, "uuid": "a67b3840-0ef7-4270-b4ae-d852b054894c", "comment": "Malware payload (AgentTesla)", "value": "92af6ba6384b7b0afac5129ca060ecede9ca7bf7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846706, "uuid": "b00ac0e8-ef49-4407-aa4d-a3ac0bd0bc7d", "comment": "Malware payload (AgentTesla)", "value": "77388f915ab53997270e19b35d11156686802f2cab5c74e1f8e088011637efd9d48ca094da510f423050c215ac3e184a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846706, "uuid": "d7b129c2-50d3-47ca-9397-ce544ab1fbaf", "value": "16C42307F416E4FAF654819C34A81A24FAFD98B6D912B4ADC15C7206FEE1C363DD7228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846706, "uuid": "35ef867a-be0a-47c6-b20d-3f64fd2da5cf", "value": "12288:1gH9Y6cnt94v0FnY8bd+7q+Pjnx1U5GALYyRgKJwTgTc:1O9Y6cWqbdWq+PzrQGALYPK6TgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623846706, "uuid": "11568ba9-e3e4-4e1b-880a-b3668f0417a0", "value": 561713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623846706, "uuid": "22bb3412-59f9-4402-acd5-4b64dd55fe01", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846706, "uuid": "648dfa73-867d-4766-ae51-8627e3774fab", "value": "SHIPPING DOCUMENTS.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4349d7-cece-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623867368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867368, "uuid": "c5d79cae-493a-4c02-815d-e1f484dc9410", "comment": "Malware payload (DCRat)", "value": "35446b2c71a2f3e2556e450139688a51", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867368, "uuid": "81cf9ca8-1331-4a1c-a357-4d2d8079af2f", "comment": "Malware payload (DCRat)", "value": "bb13cf7f4d7f5db58730a4dd948093ab12ee0f65c2393784e43143913d51130b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867368, "uuid": "b0f502c4-2924-423a-9c8c-86e7ef6e309b", "comment": "Malware payload (DCRat)", "value": "fe7979247f13e40a912d3699616ea9fc60c07fa4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867368, "uuid": "4a85b781-ecdf-4b3b-a9ec-d2c29a8de168", "comment": "Malware payload (DCRat)", "value": "49886d7541ab1cb561939478f531730a8931177d15106ce5150ece3e664cf02c9138276d980d2462e5712d148bb3801a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867368, "uuid": "7ad1efb9-42b9-4c6f-9964-337f943c8b15", "value": "8045331E7A2A1771F0C6987B4146A1FC85007928A12ED57EAC693E2FF8DE52C71097F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867368, "uuid": "30bbc761-c816-42f4-b49d-ed6e85bc88ab", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867368, "uuid": "d122be16-3657-421c-aec2-75ea26795db7", "value": "24576:pbai7vbsZ8Ax+D8EjPQxX74hRUOrvteXruVvN5ON6ZtMyH0BBO/fBTv:pei7AZ89IuPQx7a2GcXKRrONiCyH0m/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623867368, "uuid": "9ba5a7e1-037a-47c8-a16a-b85b8c7fb72e", "value": 1253376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623867368, "uuid": "3bba0c44-7f51-4513-a213-fd03dc9dce3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867368, "uuid": "f2211068-c6dd-4472-8c87-0e5be2607a40", "value": "BB13CF7F4D7F5DB58730A4DD948093AB12EE0F65C2393.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7f49f9-ce8d-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623839242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839242, "uuid": "906fc7a7-8a12-49d2-8208-d5227193fae5", "comment": "Malware payload (NanoCore)", "value": "952f11a6448d61f7ce250d914bd5f355", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839242, "uuid": "7315e0ec-4036-4158-878b-a2257faacf78", "comment": "Malware payload (NanoCore)", "value": "bbc152f3703d40cea0de088c618dba8101388506402d57344752a07db179f4b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839242, "uuid": "6e54bf44-225d-4eb1-bdbc-006998ba36d7", "comment": "Malware payload (NanoCore)", "value": "154243a3a6d1d52b0fe294cd28ee8a134f61862f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839242, "uuid": "419dfc5e-332f-4fa6-a944-3ae6c066cb51", "comment": "Malware payload (NanoCore)", "value": "2ccd04ce70a31e6147a54bc105e212714802a279dc54866089998383af8fb06cf6659656277c34309f0bfa9b67250111", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839242, "uuid": "17cc6e2a-7523-43b2-8fa4-814c5045a282", "value": "AB258E3235FD61D7E1AA0734486782490F757F363E32CE1D146936EC6B32F928A12E96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839242, "uuid": "0b4e2000-e6c9-474f-bdc4-c881e6a6ce5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839242, "uuid": "5e6bce07-c5fe-45c8-8837-06591776f9ca", "value": "12288:es8DyLZOUMvquwaHpn0WzKIP6zVnPUv5hnMFayNz4uc5N6A6fiEqUMi:zAquPHp0fqaShMQSaP6fitUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623839242, "uuid": "434bc17d-606f-42a3-8c47-e24ea2d5b36f", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623839242, "uuid": "f3199175-854e-4d6e-ba75-f8771f52a166", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839242, "uuid": "fd5c47a3-03c5-4211-9bb0-701d5516ed95", "value": "MINH NAM TRADING - PURCHASE ORDER_34002174.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785b4495-ce65-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623822077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822077, "uuid": "feeb357b-0c95-4fca-9cb0-a031c7af0b4d", "comment": "Malware payload (Loki)", "value": "1a7e209dfcc293ac77bac50bcda69aef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822077, "uuid": "9cf9f736-f5c3-418e-a8fe-d17cf01b6afa", "comment": "Malware payload (Loki)", "value": "bc2a2559b561f1fc4cbb2cdbaa94ddd558e480e08d0b9bf28f4a14e6fd8da9b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822077, "uuid": "92bc2718-7802-4226-aa0f-c86c66ee90d5", "comment": "Malware payload (Loki)", "value": "42090111f241e08496187d5e2277b7b050aaa60b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822077, "uuid": "75c3e7f3-4c03-4d5c-ac99-90b82c848f3d", "comment": "Malware payload (Loki)", "value": "1dd63160e5b251d5df7cbf8b6a89115e67ec9224234e605f603f9faaa248eda2b353f82b2ab58e8b7582a80f894cc3a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822077, "uuid": "32e1696a-0126-4ab8-8a04-65708ef426fc", "value": "A9E4C0307BEA524CE9FA1B310D75918413FABA2B6F15CA2E2868124CDD736538721F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822077, "uuid": "c3d32b9a-daf1-4033-bf1f-047ede46a22a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822077, "uuid": "51af6dfc-a8cc-4d12-aa89-bff4aa19b7df", "value": "12288:zn/xwvquwaHpkTJSxp65Oa/QJhNtUD5xL9gRlGOxdU:70quPHpcTwa/QJv2NElGed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623822077, "uuid": "5473bd2a-f721-44e8-bec2-e9aa731ff706", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623822077, "uuid": "fca83258-f8c7-4ee7-af44-2628120326f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822077, "uuid": "a9e6977b-6c97-4e5d-9cf8-297e1d68a1b9", "value": "Detalles del pago.pdf___________________________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc5ff77-ce8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623838699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838699, "uuid": "4517d8c1-30d0-4854-872d-b204919e44cc", "comment": "Malware payload (Loki)", "value": "7e62d5dd3d13c7bb9d7979f2df4e2e29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838699, "uuid": "54312f75-da81-4ce4-baec-6060dbfb15e7", "comment": "Malware payload (Loki)", "value": "bc6b1909338c036dbcc50d017690d87f20eddbe897e25e9d0527dc4651fe8fc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838699, "uuid": "24c6447b-f427-45cb-a115-673be27c1479", "comment": "Malware payload (Loki)", "value": "fcf12bb6395657cb4ad9b275bb1d49731116954f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838699, "uuid": "6a5c21ca-6335-4790-9452-ae260180dca8", "comment": "Malware payload (Loki)", "value": "0125aa522392f5706692723941a57cfa6f71f21ac69f31f602770d1f2e5213526691116c95a8d4aa1cb2b3fa6d7457bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838699, "uuid": "7c06b439-4464-4b20-940e-dfd76a6a79e0", "value": "3AE4BF3036FA524DE5BA1B30197581C513F6BB6B7B15CA2E2859120CAE73643CB21BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838699, "uuid": "51b8174b-6866-412f-bc66-6a13521132af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838699, "uuid": "8d6d41a4-c1e4-4ace-a93d-9c53ac0983a9", "value": "12288:QsO+bvquwaHpTPlLg3HfaErEvhnDS9+c4ms3RYad8zIbA2hXB9W:vLquPHpTtc3HfaGEFS9p4B3RYej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623838699, "uuid": "9ab0f70e-7db1-45e4-b5cd-3efb3a698d6e", "value": 675328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623838699, "uuid": "d31c4e43-9528-475b-abb4-d016060a4a05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838699, "uuid": "2431d08f-d6fd-464b-874f-8779d9a1777b", "value": "7e62d5dd3d13c7bb9d7979f2df4e2e29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0ab7cc-ce8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Phorpiex)", "timestamp": 1623838702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838702, "uuid": "27d75921-6319-440a-a318-f0c1181e2b1a", "comment": "Malware payload (Phorpiex)", "value": "ff594c2ad052c914e665c12311debf1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838702, "uuid": "847cd64a-afdf-4bac-930c-d89eb31e50ed", "comment": "Malware payload (Phorpiex)", "value": "bd21f4bd5e04e181b90e19fd71d2f30a40aad6cc9edba34b5a5ca2d56b55d611", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838702, "uuid": "d505157c-d2cc-4187-9ad5-41a7917ad288", "comment": "Malware payload (Phorpiex)", "value": "46737a78ea837100c71dfd501f310a7a43790437", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838702, "uuid": "14253acb-f0fd-4b92-8817-b3e2f4a1e672", "comment": "Malware payload (Phorpiex)", "value": "0ab48681506bce564bcd6cca2e38c3b54b7438067dd3f157a3caa345adc6fc4033f5b425b72cb79f5d4df0b851e02dc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838702, "uuid": "423d6139-be7f-4f71-b05b-cad0ca9f3ff0", "value": "BFB2C900867449B1F6BE05B0416F42FCA57A5B72D7939FFA21763087BEA4A0295D233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838702, "uuid": "85bc1b12-4fbc-4132-b9b6-96dfcde6dfd0", "value": "009e69e1b00a5255918718e8d3384340", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838702, "uuid": "be082c27-3ebc-4a0c-b13f-caf37136de0b", "value": "96:Qo4070lffqRTTF2PMtZB+tboynA1Ctwr:vGUNyZ1oyn3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623838702, "uuid": "63b02d07-ddbb-4d4a-9082-f3f06764c601", "value": 24016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623838702, "uuid": "78997da6-c2cc-4b36-90cd-6c501699b8ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838702, "uuid": "c8060dc8-2358-4d1c-bd01-7ab9196b444d", "value": "ff594c2ad052c914e665c12311debf1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f50ab36-ce4a-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1623810465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623810465, "uuid": "acb82a51-de21-4052-a6ae-88b8412db90e", "comment": "Malware payload (Smoke Loader)", "value": "f02011c9d478d2669c0d9750beb9ffb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623810465, "uuid": "35704fcc-e7bc-422c-8713-97f708cf8102", "comment": "Malware payload (Smoke Loader)", "value": "bf6203cce724dfd1cb313f27d39283509e2b0a507fe977c4125d0c1a9e24c1f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623810465, "uuid": "422b8cac-dfb9-4320-958e-21c83325f2e7", "comment": "Malware payload (Smoke Loader)", "value": "b92bc4446089eee746b1c354a9dc307b8d4f2706", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623810465, "uuid": "0971eb04-4193-4206-89d2-0dcec393af2b", "comment": "Malware payload (Smoke Loader)", "value": "f7497652e170c9a160a4c78b8183dc8531272336df1ccc2b556a4f72cb3a17bdb81f5a623b42d76b8e81f5326f48f4a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623810465, "uuid": "bed86f0b-9a83-400e-9a98-5e35f829bb21", "value": "D2549E20A7A0C434F1F312F859B69379B93E3EB16B3490CF52D52AEA46746E4AC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623810465, "uuid": "b1e22e0d-0e05-46f9-8f9f-7c841860bb1a", "value": "22d54580109f0c9a62e58d52129bb603", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623810465, "uuid": "be6343cb-48ae-4a40-91a4-a03037082ce4", "value": "3072:mNddsJqIHUC7KlMK3zedqhE0V48i9S7bzR6Pq/0YKiYytq4HMvLqqXf:mNdw1UC7KlLSdqhE0y04PgqvvL/Xf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623810465, "uuid": "1e4c4d12-0f55-4ae8-b415-203e7b09fc89", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623810465, "uuid": "c454a305-1594-4e8d-9660-8cec1d47bf11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623810465, "uuid": "1a260699-fb70-4743-9d47-5f4a41b5d144", "value": "f02011c9d478d2669c0d9750beb9ffb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a70aae6-ce8b-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623838240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838240, "uuid": "b41c06c1-24b2-4ff2-b3d0-c17aa2870dff", "comment": "Malware payload (Loki)", "value": "090815de9f214eb803d20b318baf01b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838240, "uuid": "68fb7525-247c-49b0-a706-a642a068be7a", "comment": "Malware payload (Loki)", "value": "c0928225885d5bd8fa680f7fc6cbe5d8e79923b2adabc3a66cadacbb79099d27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838240, "uuid": "3c8e64c7-bb0f-40db-b2af-79b2dff133c6", "comment": "Malware payload (Loki)", "value": "d8bf06ac67e3fb0cfb17171f0a93ce645208564b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838240, "uuid": "345723fc-291c-49d9-bd68-164b17cc19df", "comment": "Malware payload (Loki)", "value": "bba552bd09e1df1c84f57e137251b5995d2f8b3ce1644c1f532ad13ece6012f0c43d4cd1e9870a0b1a6af2662f78c5bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838240, "uuid": "8670801e-ae2f-4929-9c5b-6a43355a93b0", "value": "3BF4AF3036E69148D6FE5B318DBA819417BABA167B50CF2E2449234CDD23353DB12BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838240, "uuid": "f1cb3dec-28f4-4e2d-bd29-0d9c57cac2ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838240, "uuid": "9b94e616-f8ab-48b1-ae89-553389f5289c", "value": "12288:0cboZAtvquwaHpXG/0Y9BCsPhtDviB1kkhjOUHcPO176hdtqFTlS:/3quPHp2/06CsZk4KOU8Gpe0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623838240, "uuid": "6b9d1954-a004-469a-accd-2ea97de426bd", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623838240, "uuid": "d27191d0-0fc2-48bf-800b-9398c6246eaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838240, "uuid": "17f89db5-d06c-4585-99a6-d61e50cf9cac", "value": "090815de9f214eb803d20b318baf01b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46781f3a-ce80-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623833589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833589, "uuid": "df5f2385-b4e5-497d-9713-a916a539ac49", "comment": "Malware payload (Gafgyt)", "value": "c91765ccf503521cc4a71ec86db693fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833589, "uuid": "25677a25-1703-401e-9914-8c3ea81f2d9e", "comment": "Malware payload (Gafgyt)", "value": "c0a7ad8c295acc47402a651f8c5fe474f7c1944f427533c1bb32b481af1b6ef1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833589, "uuid": "f520c9eb-5108-41d7-bfcb-247163febe7a", "comment": "Malware payload (Gafgyt)", "value": "41b0b4b8607435b509285c68da58e6829c9e436a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833589, "uuid": "336a9024-53cc-4d6d-9978-fab2ec5f1ba0", "comment": "Malware payload (Gafgyt)", "value": "98d57bf4b41a642ff9fb6f1166746ceca2ddacf836871262b798777b9f239cce90d833cf4f35dc46d35fbd7c333d90b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833589, "uuid": "9fd8ee72-f5fc-4216-8f82-1e590abb4b07", "value": "EB144C18D6004767C2D3177DF68A924D3B324BEA63DB7319A9385BB43BC3B9D1D22921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833589, "uuid": "cbc5a78b-3356-4b23-903a-bf5a64208386", "value": "6144:QS4A4TEaaKXH/XGVC0B/qLvDXM/9tmXnwYkDrmN3:QJEaaKXH/WweIA/nmXnXkDrmN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623833589, "uuid": "36f0358a-5883-4353-b385-c0cead26402c", "value": 197815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623833589, "uuid": "efb5629a-7e15-4c25-81a3-bc4714c40dd6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833589, "uuid": "cd14df57-141b-4b77-8a44-01d33a143c59", "value": "c91765ccf503521cc4a71ec86db693fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d842c31-cef0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623881785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623881785, "uuid": "f29e5f19-72f2-4093-afa3-3a375f4ac434", "comment": "Malware payload (RedLineStealer)", "value": "27cf42a752fede8b778f0bf040557609", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623881785, "uuid": "b4875a9f-2074-42c3-bac9-0a27d999ceda", "comment": "Malware payload (RedLineStealer)", "value": "c0b5220b765c35b22965c922f8c5eccadf2d82c285058ce577c19b14d850058f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623881785, "uuid": "8563d233-3993-4793-a554-92172cfc92cd", "comment": "Malware payload (RedLineStealer)", "value": "9521945024f023e6d014aa10a2b4454d62f30de8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623881785, "uuid": "9a9c7791-9d0e-41f8-8687-082cd22767c5", "comment": "Malware payload (RedLineStealer)", "value": "54f82715584618440e7aa27ce91f691209d0e815a34f14e69587a0f978556269b1fb8042a9454e9fe7074c55455cfb1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623881785, "uuid": "0be61be8-e76c-4aa0-b097-9cb6b9df0b4f", "value": "7C84BF10F750C034F4F622F84AB6A7B8A53D3AB0573491CB62E56AEE16346E1ED32717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623881785, "uuid": "0de25901-f93e-43df-a121-1f09fd8ea87f", "value": "ed103d03110ecdb36297492051b4e917", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623881785, "uuid": "adb5ab84-1b55-4d68-823f-152c2d629e3c", "value": "6144:BglMpsIzc1620Wj6mpWdL+ELGEHNyPKwxrm4D2997Bn4t65:f3w1620Wj6mmL+ELG0Gxrm4yj7B4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623881785, "uuid": "c6909969-415e-4472-b895-cc36bb09865d", "value": 394752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623881785, "uuid": "c71cc93b-3cef-415a-80e7-db1289372094", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623881785, "uuid": "a0065fd3-c4f0-4bd5-9548-6641764cc1f2", "value": "27cf42a752fede8b778f0bf040557609.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53ee156-cee2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623875866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875866, "uuid": "efc6f26f-ad59-422a-822d-221381fb8206", "comment": "Malware payload", "value": "0dc1aed13a4d068f5288c8c55627c0ef", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875866, "uuid": "a190efe7-9be3-48b9-8eb2-2931d12eaee7", "comment": "Malware payload", "value": "c17899d056a29f54b5423005baf351e718436272ffabdde403ebf32b11ba98a1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875866, "uuid": "6af6ae8b-be92-48b0-94d8-c4e6b8a954c2", "comment": "Malware payload", "value": "e9fc00534ffa22514a6870bfcb3dc8f4b9c3985b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875866, "uuid": "6981785f-86f2-4ed5-a7c0-ea4e46d1d763", "comment": "Malware payload", "value": "57b21e187c2a1ebbfa8c4b69dd13d818a0a676b628665fc96ca112bedaccdc6c640c71fdad6c6a3b00bc5bc83d10bc1e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875866, "uuid": "2edd1af9-f40d-4399-9831-52c1eacad938", "value": "25935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875866, "uuid": "bcb97520-b90e-4dd7-83fa-0f73613b2093", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3myPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjK2ifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623875866, "uuid": "bfa01414-d9d8-484d-8f79-ddf4791fd789", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623875866, "uuid": "850c1b90-2dfc-4aab-8f36-e1fa5ea0cc5e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875866, "uuid": "2e46ad64-97ea-4d05-80a8-aa6494727003", "value": "0dc1aed13a4d068f5288c8c55627c0ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7da165-cec1-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623861783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623861783, "uuid": "b8636c3e-0ad0-428f-8188-0aa549ac3760", "comment": "Malware payload (Loki)", "value": "fb5e16db4a5f91cf7a990a723e9aabda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623861783, "uuid": "59db1c05-286f-40c0-9872-61ef761b9d6a", "comment": "Malware payload (Loki)", "value": "c252af943c2c85f2c3dfcbca5d16877d61aca44d462f088a4a8baacacf59a3ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623861783, "uuid": "e8840870-23a2-4cc5-86ff-2719005a96e3", "comment": "Malware payload (Loki)", "value": "5f39803c10158e33835770e8a804699505cadfb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623861783, "uuid": "32d4cfef-5df9-499c-a9c6-5015b937b347", "comment": "Malware payload (Loki)", "value": "96ebce5dea070821888439434c1f0b5b6c0c557a4dd834b3348a089659786f5121e8300d3d5986457a15b957f3114aaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623861783, "uuid": "3b2709a6-a07c-4c1e-9e63-7b21ddaea56c", "value": "B9157C6D7612AC4EC406F5B8CA51DCB8B7DD2D20BA0AC743A5F33C9ABE9C5439D85093", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623861783, "uuid": "3eb1875d-93bd-41de-9ea4-6afad6aae6b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623861783, "uuid": "c33df6bb-40bb-4cdf-bd60-7645463950f5", "value": "12288:s5duyry8QDuXXO20odgAYzHaIhGBq3gkdUZd/O+f2gKe:s5UyrzQDuu205Au6AaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623861783, "uuid": "dd63c478-0a05-4a16-b614-1184e2243f21", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623861783, "uuid": "663874bd-16b2-43fb-ac2a-612b6c8357c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623861783, "uuid": "01f50ec4-eeb5-4149-909c-2dea1b2d2fd1", "value": "OrlnREeuPN2LgnR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb646ba3-ceba-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623858696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623858696, "uuid": "2d34394b-bdd4-425d-96b2-84b42efbdefc", "comment": "Malware payload", "value": "bc0d0be2bfc7f9f43201fd48e9b1d18a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623858696, "uuid": "fea818b0-d5e0-4bba-a94f-c01e1d13dc24", "comment": "Malware payload", "value": "c4a715d61c58fd5da2fb09dc38daaaf749bf99629a2654c956efb7d4380bd465", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623858696, "uuid": "1d46e022-3c27-467d-bca5-ff53c2742d61", "comment": "Malware payload", "value": "3fb7736f244617565c6ee8a8105730e1bfe8ed8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623858696, "uuid": "3b6a3999-1b24-4bae-866a-678bbb8c4f8d", "comment": "Malware payload", "value": "318d8eabdd609c2652312f533ac16c5e30d262b84aed6634b025dd61b35ca8011560f16cb100dfb0c1cd65e776715e26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623858696, "uuid": "1c3d65f2-a6a2-4588-a64e-36d3065e4d4d", "value": "3C633892F892A612C1D596BBFB4F42CC372213E8E2DE7203DD295B2137D706A0FA7151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623858696, "uuid": "b2f15c02-f462-479d-b0f0-3478032b1596", "value": "1536:0jWXSmD1bJ3N3883EtGS0tPtR0ONPowsg15Y5vuTd:2WXSmD6ztOtVaONfskoqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623858696, "uuid": "a9e43fee-7b24-419d-bcf5-3f1396edede3", "value": 71364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623858696, "uuid": "f06ffa7d-d3a4-4ef0-8c0e-2c66f6f8b787", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623858696, "uuid": "fa12c000-016d-4485-b439-817948b4997c", "value": "bc0d0be2bfc7f9f43201fd48e9b1d18a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7777a0-cea9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623851319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851319, "uuid": "bb168b73-8293-4182-be2e-ce933157f568", "comment": "Malware payload (AgentTesla)", "value": "3c868ba6224dce05a9268a79212eb80a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851319, "uuid": "f128f84b-0150-429c-8557-8598413bee0a", "comment": "Malware payload (AgentTesla)", "value": "c50594e26bf475268109c2843864ef12acaead42dba369abbff672f2e0db55bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851319, "uuid": "f4dd4f61-abe8-4da6-9cdd-2f82d230dc77", "comment": "Malware payload (AgentTesla)", "value": "cfb5e2ae4b0c8711155876d84aa223fd351ae264", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851319, "uuid": "2e548022-9880-49e4-9959-9513cffdd0a1", "comment": "Malware payload (AgentTesla)", "value": "15808ec51a076b6b015ab6ef296f3b8f357669d3c233ca37bdff69772f2b6fe46930180796d10861cd71b6bbccacaad9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851319, "uuid": "1cd36c2c-2696-4f3f-ace0-129fe7b035f2", "value": "6315D5303FB867D6E07AEAA145ABB447C9ED69FA250DC8CD1C5027C117326CB49F2D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851319, "uuid": "5dfc36ee-20d9-49e9-9204-9c6274a0e1e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851319, "uuid": "d5904260-f561-4256-9436-727c5a7e7572", "value": "24576:wSuPwsoWe7aUxzheQpip6WxM0xaPYTBsH:wSuPwsoaUZQQpsZgYTBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623851319, "uuid": "abe04d0c-9183-46cf-8a2b-b3744fcddaaa", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623851319, "uuid": "13467d34-4c77-4266-92e6-0634e28e1712", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851319, "uuid": "45690062-f3fe-4ca9-b83d-ab82f1f9f4ef", "value": "3c868ba6224dce05a9268a79212eb80a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8efe651-ce7e-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623832976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832976, "uuid": "0b7ce7b2-ef03-4977-b895-a7b8dc3a05df", "comment": "Malware payload (Gafgyt)", "value": "04753c5660fa0cb76497fea892bb6e24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832976, "uuid": "0c0bba65-1a79-43c7-b77c-2f5befef97f2", "comment": "Malware payload (Gafgyt)", "value": "c5fdba8f6e41701785d90881fc100b27b47a6355c04879eb96a85daf12a89edb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832976, "uuid": "e45d218b-5952-4d7f-a9ce-344b5ff2d92b", "comment": "Malware payload (Gafgyt)", "value": "2424ff721ec90942ee7cfa56d60cfdc834151199", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832976, "uuid": "64422bb5-8cc5-45fb-8a94-fbb3e0c83687", "comment": "Malware payload (Gafgyt)", "value": "f7960106a8666f4db39a4e0b620a2cde06c3eb4682846fb1213788e6ccf7292f175cfdf83f3e8d9629d705b1cf08557b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623832976, "uuid": "da5c6a85-08cb-43cf-b663-8d4853bfe378", "value": "78D3E814F804836BC3D217BAA64D438D3F355AEB63DB3315BA384E742BC5B992D36960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623832976, "uuid": "7abe6feb-518b-4941-ac5b-9b25b26b7fe9", "value": "3072:hAJEnBnrsrCIUiz+t8jnGrqZwfzf26ZaDF72cmw/khQpxkaME9PNO:jBrGLUsa8jGrqZccmw/khQpKaME9PNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623832976, "uuid": "7c8cf8de-dd47-4d63-9706-4fa98c7817eb", "value": 138530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623832976, "uuid": "13dc03b3-968f-4739-8088-39ab3cce304c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623832976, "uuid": "265dd71e-4499-4990-8a48-eceb56431ea7", "value": "04753c5660fa0cb76497fea892bb6e24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b727327f-cea1-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623847952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847952, "uuid": "a117168a-7c73-4b24-8526-fefad784ed1f", "comment": "Malware payload (Formbook)", "value": "3a617ce814288b8a8e33541192173be7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847952, "uuid": "911ae41d-9add-4ce3-871d-89838626a8a2", "comment": "Malware payload (Formbook)", "value": "c6a199bfbe12473c6aed6c656cbab5a96cf4163cd6034389b369a55cbbdddeca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847952, "uuid": "d6fa2102-7b0d-42a6-9abf-0b94fc28b0f2", "comment": "Malware payload (Formbook)", "value": "a97a4da44170356efec281c57c5a1a48c4600000", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847952, "uuid": "3f55ae2d-2666-4071-986a-830a5ca78fc3", "comment": "Malware payload (Formbook)", "value": "8aeed42ba8c99bcaa6bef1b1cee03c93569a4964f762834257459ac1f45265941d19710e1f4d84b2d2a5d550b082fa61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847952, "uuid": "4d463d15-751d-4a27-bfa3-1d197c720753", "value": "5724129197C468E7DC910A710A33EB70D377E7236B2A196FB7200FAA6C246C5F4161E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847952, "uuid": "d1b96517-395a-4e51-b6c7-de03e343d561", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847952, "uuid": "6ca4c147-981a-4853-9c16-3d2a7cfb6f56", "value": "6144:cQqTI816IgaRClshzgzfQVWZ9spL8yzjZocLgvHxkt:yFwsh8bQVeypNloXvHx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623847952, "uuid": "0e6b797a-1081-402b-8343-5f75736cb87a", "value": 222853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623847952, "uuid": "c0b49913-fc88-4297-b7ac-226a224590d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847952, "uuid": "b2d26bc0-f893-4391-a7de-51c4e6d309b8", "value": "Request for Quotation # 3200025006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65740428-ce8c-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623838795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838795, "uuid": "020a8519-ee17-4c63-a3bc-8e5190fcafb4", "comment": "Malware payload (GuLoader)", "value": "457fcb32ec7df1868df42f31cce2a301", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838795, "uuid": "bf2d769e-342d-420a-8c65-0832621cde9f", "comment": "Malware payload (GuLoader)", "value": "c7d1295093d4112a976f0c13be811d2a1fb6dc5928e1fabefe7b1315f7b0e95f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838795, "uuid": "886dc9f4-0a11-4ebb-aef1-9ebc76455490", "comment": "Malware payload (GuLoader)", "value": "8bd3a8d8e0f6a48b51e5b3fbc119b154304044ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838795, "uuid": "24c30789-9d7d-4826-836d-457997d58ac4", "comment": "Malware payload (GuLoader)", "value": "d967601cb901ffbe280b42215170eb0c6c9d971fd14bbdf99ea3d061d57f4e502e7ab490559ec6829a8836e2fa67e9f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838795, "uuid": "005d4876-e0ca-43fb-a117-418d4aa36e12", "value": "CA935B17FC04C924E5148A701F62D6893615BC3AC5449F3B32B87DEE1FB56A3B990F2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838795, "uuid": "a4bfb7e2-f8ed-4d6b-9140-49ffc0dbe98f", "value": "d5d16d1b76210dd28c8586fe9bac3119", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838795, "uuid": "e982a09c-c645-4af3-b33f-3bb45f758989", "value": "1536:L10ol0/gh4343HqtCJWg4edfJPVo8xZSsIgO4jcYzy6ipu5W3EUanOYA2nJ29GLN:L6UdJ/4edfA0ZSsmVu5W3EUanOYA2nJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623838795, "uuid": "e018e705-006b-418f-a5c0-87bd9b689001", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623838795, "uuid": "b45fd51e-e391-4566-97c1-e05e87076786", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838795, "uuid": "66b0bfc2-bc05-454a-b72d-c7c0064b6cac", "value": "457fcb32ec7df1868df42f31cce2a301", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f6a09a-ce83-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623835144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623835144, "uuid": "d1b57835-814f-41a4-9a18-b4458e4e06d8", "comment": "Malware payload", "value": "4e46f6bdf91e714f9b02b84fee04e31f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623835144, "uuid": "dc02aada-96e7-49e7-b17e-da55606ecc84", "comment": "Malware payload", "value": "c82632a47843cfd435948025386e5cdb48ba75f96be991c6a107f772e20d1d17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623835144, "uuid": "aa876abf-baec-443d-93ad-479c6ef1fe3a", "comment": "Malware payload", "value": "cac01777e29dbe5f64afda36b7da1407a4edcb58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623835144, "uuid": "e012a2af-45d3-4a51-a809-0fd6da916d9a", "comment": "Malware payload", "value": "8912c80a86f0e2fd12159d9a5136acf229ad4b562b616894b222afa34d6d380a7e4548cb7e1f9544e13301d89f744572", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623835144, "uuid": "58603133-20a5-47e0-be18-fc50ec22c299", "value": "82058E59B7239C08C554F2FC8B52DDF837ED2E10B814DB96BAF17C8A7E9861398C6046", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623835144, "uuid": "7362aa87-df8a-4216-9fa5-e28e0c9a6470", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623835144, "uuid": "c5268248-51f6-4cdf-a54d-fdc3c094a8b7", "value": "12288:oQBWcenklPVjXhIm5duCi54YJTvPUldnHTh1bZpBGelLb8z57qzzFQVIe:X5U754YJTvcHnzHNpBGsq57qzGV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623835144, "uuid": "d6b46562-6cab-487c-bff6-3369348aea30", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623835144, "uuid": "6d06ca7b-35ff-4eea-b0d9-b8bd0e62d626", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623835144, "uuid": "72c8bb98-2d0f-4973-9c14-b1193de29f63", "value": "535434564766574656_9847466534.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21594e6-ce9c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623845876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623845876, "uuid": "ed53f36a-23ab-412f-b9bd-17dc827a4ffa", "comment": "Malware payload (AgentTesla)", "value": "1af4b28e44d75b4fe50ae509798a626c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623845876, "uuid": "c83763c7-c2ed-4b07-822b-c249ac4c7b3a", "comment": "Malware payload (AgentTesla)", "value": "c872dfcdf2ca3c4e19f5e1b46dca045fbd8c533c0179e92684da3d8fee7308d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623845876, "uuid": "6a6c8829-7536-4051-9ebc-911771bc20e7", "comment": "Malware payload (AgentTesla)", "value": "c7cc9f027cb9d461b41aad20f736f3c2f99e5fda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623845876, "uuid": "c076096b-a5e8-459d-aa44-18cec65543f5", "comment": "Malware payload (AgentTesla)", "value": "123f59bda2097e5830d8cecec0e6d6df3fe628491e7cd76a0719dc7db7c2312e15d76939ba5b7ed7a26febbd87f886bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623845876, "uuid": "2b8bbe7d-cd9d-4f50-96f5-142ad1de8f72", "value": "BEF3C0ECD6F8BCEAD41AB1B59CB5F695181BEA185428092E396E310314B23533CF5C5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623845876, "uuid": "1687e3fb-58c1-43f2-8332-f38adefb16fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623845876, "uuid": "27633a83-cf54-489f-9a45-1beac93d6571", "value": "1536:Zp9GY6zwwVh5kjSprEtlUolRc9qjMoD0ZCAz15f22kDM7bOjaH4ZinJ0iQM:Zp9GY6zwwVh5kjSFEtT6eD0gOqQQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623845876, "uuid": "d0ada3ae-b151-4475-b8d6-0edf6320dc19", "value": 161136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623845876, "uuid": "6ca12a68-1325-4762-9709-adfbb5c05840", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623845876, "uuid": "1d20ab31-8161-40d4-ac7d-c4a262e43b4d", "value": "1af4b28e44d75b4fe50ae509798a626c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1e9ad4-cea9-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner)", "timestamp": 1623851423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851423, "uuid": "d1a9dae0-edea-4662-8c8d-f17dc95e3e0b", "comment": "Malware payload (CoinMiner)", "value": "6c180be66adde557f1c7148bb85691e8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851423, "uuid": "641b5a2a-5c04-4c0b-9405-eef1b90e82e1", "comment": "Malware payload (CoinMiner)", "value": "c8ef38b7938c247511952d4f7d1e30ffcdc6cbcfa4bf6c1801ade0e9ed55c7e1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851423, "uuid": "51d7d2c9-3a13-4355-8cfa-a9253404ee82", "comment": "Malware payload (CoinMiner)", "value": "de7266210cab47f1399298f003f5401105a901f5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851423, "uuid": "788f28bc-fc0d-4037-b159-e8bd696a25ec", "comment": "Malware payload (CoinMiner)", "value": "e81df010d501be82d7866fd813f77fd9e8d6f88b4ab879235d428ac6a1513ad6d479fdc10d03705772bb85597af3ece2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851423, "uuid": "84217edd-dce6-4224-8189-f65e005f8ebf", "value": "05C423213E1BD46EB8D227375FF524E786562D08CAB7650F6158228C37D2DE70E70D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851423, "uuid": "c59bba2a-4831-4275-be1a-e12235917282", "value": "12288:WF8pJtuT87wE475G7w2GO7ZT/hsg+iwn/6mId09RB/q/sywiro66Ad0k:WF8pJtuT87wERLPNr+x/ad09RBSUywPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623851423, "uuid": "1c74550e-3ee4-4929-9bb1-ef030d2256e0", "value": 588643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623851423, "uuid": "bef757d7-f774-4561-a0fc-0d3dedd7bdc8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851423, "uuid": "dda44483-cfa1-44b3-a4f0-cb1ee982d6b0", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0690ae-ceda-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623872522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623872522, "uuid": "1d90f0e2-fee5-4b47-967a-a487d650dcfe", "comment": "Malware payload", "value": "91e67094df9bc8b5903b6dfcd9b9213a", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623872522, "uuid": "522b5006-f32b-4782-959d-7c892be84970", "comment": "Malware payload", "value": "c8f72a5f6a462f15582f9424b790a711e8202b5acd234321286c8fb2c883d41c", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623872522, "uuid": "b40d9736-a9fa-49cf-bbe5-7aaaad956bc1", "comment": "Malware payload", "value": "964cd88818feae92e5c3656aa0876c7b7e3ca72a", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623872522, "uuid": "b7d6a312-8b21-4c5b-a2b8-31681cef6c48", "comment": "Malware payload", "value": "3571cc13208cd18ff9316110457bd3ac72a8766de700a2180c65f51d222545a48abb0b0120b4fb3e3d289a6dbd0bcd78", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623872522, "uuid": "b90442d5-a9bd-4ee3-8f27-83eafc669cf5", "value": "D044123F655F98B9E8B1607802C7C4866C880AB449C375CFBA533B58659F13337A9BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623872522, "uuid": "622adbbb-e6fb-4984-94d1-d30e4eb9e51b", "value": "3072:/gDDezcY7qIsq0fzA5CvhUoTwI7xMOwC0nBUdsthf4BwOQ9lF+5qYY5vXx9SUb+g:cq3P8SCvqswkMznzPQzG+GvBkz2IFUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623872522, "uuid": "1b8b9799-7511-4958-a77d-85f88e26cca1", "value": 261896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623872522, "uuid": "c7860160-43a2-416f-bff8-da32f58f1967", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623872522, "uuid": "abb9c453-f557-42cd-9939-acbf147f5ddd", "value": "c8f72a5f6a462f15582f9424b790a711e8202b5acd234321286c8fb2c883d41c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef78834-ce89-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623837415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837415, "uuid": "7cbbe497-b03e-4acb-a669-6a19e9321f54", "comment": "Malware payload", "value": "96a60123974dca0f1a310e4fb9306995", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837415, "uuid": "c0a91f8f-99c7-46ec-8fc9-27d7f32d9edc", "comment": "Malware payload", "value": "caf53e4143d03eb3e7d952710a9c8dfd43d8e715dac23c983f8673ab21ee8d53", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837415, "uuid": "9cd4aadb-e9d2-4fef-b19b-bde235e8873f", "comment": "Malware payload", "value": "42bd7f26857ef26805664ad83da155cc5a877982", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837415, "uuid": "8e526ef6-dc76-484c-b6d6-51a3d1d78c88", "comment": "Malware payload", "value": "4235bb54780515d5281976aa0e6312906d3158b7317fe69716e0c891b87066245cbf84e27d685877e067382b0bbdba93", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837415, "uuid": "8eafb6be-a67c-4126-a7be-5fcdcaf61a50", "value": "77E18E1F8054130ECB3BEA7EC8A4155A6FF3D65878D26B0F2860ECA87481A971703586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837415, "uuid": "babbdeab-710f-4485-828c-f4e07aa3935a", "value": "96:KkZq4HIlG07azQI+3BoKes2vKjwG5e9fCRJCJRA2NY4DTLcn339YRjx6:ZILM0WzQTJSKjwGi/+2NY4DTgnn9e6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837415, "uuid": "4f1400c9-4d3a-46d6-95d5-34260df5e7f3", "value": 7317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837415, "uuid": "f5a20902-f5d5-4218-8415-e037b2c9f7d0", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837415, "uuid": "e65a1ce3-ebdb-44af-89bd-0ad61cbf5df7", "value": "Payment of outstanding.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45665ce-cea0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623847491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847491, "uuid": "09886e4b-69a1-4671-a037-7a5e1d86a158", "comment": "Malware payload (AgentTesla)", "value": "8e5b27f1f6519e0ea108bc79eeffa50a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847491, "uuid": "34d04465-f7d8-4beb-bc2e-96a3853e18a5", "comment": "Malware payload (AgentTesla)", "value": "cb7316ea8d004dc3665c2668d2a9338bd163a41f75b2a925f6af5e853c09282d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847491, "uuid": "e8bf54e9-25cc-4db4-b077-7e1e21ab6793", "comment": "Malware payload (AgentTesla)", "value": "b22fcfed4247eb49f4a25f7000ec86dca2808687", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847491, "uuid": "32c9a709-8323-444e-b56d-563aade11eec", "comment": "Malware payload (AgentTesla)", "value": "3920ca66520f195874c93ce99f7fc113f1b7ebe888fbc059e51df4977484953645f4a93b55d8f3a454845d92fe0864af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847491, "uuid": "24b3df0c-ed89-431d-8b8b-e922241c227d", "value": "8C15B2303FB867D6E17ADAA185ABB447C9ED61FA260DC8CD5C5007C157326CB4AF2D28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847491, "uuid": "66834f19-11f3-45a0-a895-857a69815422", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847491, "uuid": "0a461213-6611-46ea-acd1-f416be22c83a", "value": "12288:ZsnvFjqLhlm4S4F3M9yQFx/NUo/LWijmPnVbq3A2ZenTziXZG/m:ZiFjqdWpFxqo/7mF6A2Yn3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623847491, "uuid": "65b478b6-f13e-4aa3-9e7f-64993822edc9", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623847491, "uuid": "1f634c68-fa9a-47d3-b306-d17b5216a53e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847491, "uuid": "25361f77-09b8-4011-bb27-ef79ed8b6277", "value": "Supplier order data sheet For June Delivery PO 4500101880.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e252156-ce66-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623822543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822543, "uuid": "cef1beac-da96-4427-b056-23b3a96fe27c", "comment": "Malware payload", "value": "6ac6f03eb07419def70877cef5c81dac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822543, "uuid": "d2d5ca29-af0a-433b-88d6-ced6147843c5", "comment": "Malware payload", "value": "cbc1ecd30b02681647d1760ebd84ffeb2d38596e935999939353263b9beae123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822543, "uuid": "165d7e87-eeaf-4f80-9bd1-08b194375646", "comment": "Malware payload", "value": "b5d246d43250d07fbc6fe14bb165183cdb1ec842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822543, "uuid": "93956ae6-78b9-483f-88f8-d0c137249b88", "comment": "Malware payload", "value": "59de48366a2012dd8babafd09e6a39af9b882c2f5b5dd351c5d6215d8ad2de11ef833d9b14e12af62d69ec959abe7a35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822543, "uuid": "6ae60fb5-7437-49d0-9435-b8101d489f32", "value": "F8058E6977239D08C544F2FC8A52DDF837DD2E10B815DB96BAF13C8A7EA861398C6047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822543, "uuid": "760bd5af-0e63-4310-a948-e10c5d3cbe41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822543, "uuid": "84c6ed21-5e8a-40f3-a248-07d02c9115d2", "value": "12288:RQBWcenklPVjXhIm5dukkD8IakkVjjosPxR3LFzVoDvQHZEp8HxgC7FH17O3lgoR:i5UNAlkkosPxRhzVxjHxJ5O3qoRVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623822543, "uuid": "6b136df2-db88-4197-a4cc-419c53b0b72b", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623822543, "uuid": "5ff15612-8068-4157-9479-05f731bc510d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822543, "uuid": "a1e9137f-b366-4160-aad4-079026c1113b", "value": "INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9e0c13-cea8-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623851021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851021, "uuid": "e9e7f6cd-25cc-4d3f-a130-004a9301d40f", "comment": "Malware payload (Quakbot)", "value": "6c0e32060880a9f53c77996b372725dc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851021, "uuid": "5e46a0de-ab7d-42b4-bbbc-8de0bd21ad65", "comment": "Malware payload (Quakbot)", "value": "cc7c0bf6e2e4914992decf62c6c32e0509f66784e97337da451a72694ffca0e5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851021, "uuid": "fa6e38ee-2b6d-4fbc-b07d-e263ec2eff04", "comment": "Malware payload (Quakbot)", "value": "670bd03fd0183cd3162ac2d99added93725b0220", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851021, "uuid": "d25a117a-af74-4467-a910-10ab91e0c126", "comment": "Malware payload (Quakbot)", "value": "d85f6b8052a261fd9ed4cc46fc4f7c83daf461bc3e6cc78978e2cef4ab0fd2d84fce5c2c65bb4387e2822af64666eb5d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851021, "uuid": "cd13f847-48cc-4e97-ba5e-8dda52fcd419", "value": "9D74127ED68169B8C3398D3EC640A1E48159F2D15097B22D03DC3518AB533DBAB9E2DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851021, "uuid": "75364f50-b58c-4e77-ba18-df4aa70debbd", "value": "6144:YRRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNw:YRRMmEv2Bc/nvm8IKABfsYOmauFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623851021, "uuid": "eb9073b7-85ce-4318-b2d2-911a37edf8ed", "value": 352536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623851021, "uuid": "a2652c04-70af-4858-b1aa-3b8111d1465c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851021, "uuid": "b78d8a4d-4877-498e-ad79-537ccfd87d1a", "value": "Complaint_Letter_1198204878_06162021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e3ba46-ceae-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623853458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853458, "uuid": "c257dc46-d306-46b8-8b29-f5f7ed19cb6b", "comment": "Malware payload", "value": "441c1b5fdf23dedd8223993851bcc926", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853458, "uuid": "36e545ee-f412-4564-8c9a-278b3901ef15", "comment": "Malware payload", "value": "cd3a3289349e6d54707f8d48d3e2bb3a428b13bd3a40fe1b844a7b8104adb8fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853458, "uuid": "128c6b67-a9b8-4fed-9c41-2a8aca8b26ad", "comment": "Malware payload", "value": "39abf63960a8d1b15981897c5083bb98b742bdd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853458, "uuid": "5fd78a13-d549-4532-afaf-2b46a04c1487", "comment": "Malware payload", "value": "5b9ae94d245bf8aabbaba82a72e65a8e49c8cdc289d5471fc661bb171a5e612de5592add827d186813a301c6b6d5f482", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853458, "uuid": "4e70028a-1d37-4e9f-b9fd-da95220a422b", "value": "FB833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853458, "uuid": "4f6fefea-e30d-4f93-ae68-6e5839044246", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LIWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0YU2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623853458, "uuid": "b300d376-ddd0-4326-b7fb-008a26d6e22c", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623853458, "uuid": "84ced335-aebd-45ca-8b11-0bdf06069d50", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853458, "uuid": "8424c24d-4c51-48db-8db5-e012a3b1ffdd", "value": "441c1b5fdf23dedd8223993851bcc926", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de90744-cea6-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623850030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850030, "uuid": "8c920992-6eeb-480c-8cbf-6a0b8baca85f", "comment": "Malware payload (CryptBot)", "value": "62073ad808a767dcaac9654fccfae3dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850030, "uuid": "1c316ee1-0f6c-4ca4-a6c6-c8c2364315d8", "comment": "Malware payload (CryptBot)", "value": "cd46f115398cabcb8540f8afc4717636e5868eef028e0403461e9329a309eb12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850030, "uuid": "9812c5e2-31b7-4261-a42f-e0c748a7bbc7", "comment": "Malware payload (CryptBot)", "value": "f861c54dd3c74bbd2f0aefd272b08560b1c41a04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623850030, "uuid": "33702ed4-a807-4382-8232-92e4203c838c", "comment": "Malware payload (CryptBot)", "value": "5fe12683eb04d7b8e902bdf958edc396b9a51cc33bc1fa7070e6a2f5983002f62962a944606685d080c4e35b0105251d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850030, "uuid": "d857c300-3f01-4b8f-b874-d9dc7103d6e2", "value": "B5F4F1106790C035F4B616F85A759378A83A3AB19B6845CF52E217FE42B86E0FC31F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850030, "uuid": "833bf61f-2851-40b0-bf5e-d433daf72c67", "value": "9b6cb8fb7864152f2c65c8441d386700", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850030, "uuid": "76049818-32b8-41b3-8b16-803de3e05110", "value": "12288:86Ym73Wmdbqe23x6WogEL46rh6c8iXkCKn/eUPdUqsM/pQTL3iNgW6:e83evUGw46rh6crVKn/rPdDXpQn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623850030, "uuid": "079fa463-bd6e-4051-9ae9-23ed6a05ee2a", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623850030, "uuid": "0cb17689-bf4e-4195-9097-930533134584", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623850030, "uuid": "94f36093-fb63-4180-b948-8ca5b0ae59ae", "value": "62073ad808a767dcaac9654fccfae3dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8c723a-cea9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623851316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851316, "uuid": "ee69c5f9-9314-46aa-87ee-57b3e83e1bd8", "comment": "Malware payload", "value": "acbd0eb2e1c7b8005cb82847e63b3289", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851316, "uuid": "106f27c2-29b9-49b2-83d3-1b3fce6d76fa", "comment": "Malware payload", "value": "cec5553b44b221216de12e3f613b79f4f251d9d9d7d71a53e68de3ed9a4491ed", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851316, "uuid": "4789421c-4251-41bb-9d04-17c20116fbbf", "comment": "Malware payload", "value": "5ff688d2853ad3b14f8aa369eff444e513dbe320", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851316, "uuid": "feecc27a-dda8-44c8-8406-3b6fc44e5424", "comment": "Malware payload", "value": "900dd7f55e87f3ac8aaf761c46709eec878bb55f144cb02f87cf4bb478af605ce65bc05c6dd4555c668df50ccf9db4eb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851316, "uuid": "c0b255bc-4d2d-4881-b84c-7e802f325ee1", "value": "FA62BFBFC4C7B81DE5738A3D985120F6E72867D1B3339A663286BED65690767430288C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851316, "uuid": "66142cd7-2144-4784-8a1f-5383adfcc372", "value": "384:akUNNOlxr68lvPpMKxdNxt/ZtNNdlgKVLa+0/VxVprU:ANI9PpMMxllNdl7+Trg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623851316, "uuid": "290b2073-0903-4c76-8c8c-35ebfe73b3b2", "value": 15596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623851316, "uuid": "2f53b28c-229d-4f2b-83a0-ffb65a026326", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851316, "uuid": "6e40d722-b688-499d-8102-6b1f7e05a5e4", "value": "Conversion of SAF15 Toilets to SEND changing room%0D%0A Requirements.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0ef31e-ceab-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623852067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623852067, "uuid": "9266b78b-136b-4aa6-878c-3ffe2ae5fa6f", "comment": "Malware payload (NanoCore)", "value": "1f34462407e13f9670c6a6c543b34ac0", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623852067, "uuid": "a52be6aa-e807-4497-98de-4045597a9a87", "comment": "Malware payload (NanoCore)", "value": "cf9923592fdacc61bf5a3c08e4c8bd84f8f12235ba2a9eb4a021413b1c1ba075", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623852067, "uuid": "ad9155d8-b60c-4580-9bd5-44ea2c125238", "comment": "Malware payload (NanoCore)", "value": "d28b6fbe0b50db7a5a603a0133ab037c1131da51", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623852067, "uuid": "c683e6ab-294f-443c-9415-c10c758b35ca", "comment": "Malware payload (NanoCore)", "value": "59bf8e8b8b76dac4aaba535b9f5d7ce8e2d604859c9f756605e6aede9aac0ec5d626a55aa2b05c3d78329b581a6c5649", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623852067, "uuid": "0170efab-0e78-414c-9f1e-045b92e3dee0", "value": "6EC43354FEF4E6E77FB4D053FB710346A2098F26D2DB24E27A164AA84800707D866BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623852067, "uuid": "11e2238c-2648-48ea-b657-3b626fb4313a", "value": "12288:wBvmPGrRaACK/7f9wG/y+bHJkKyly1d0fmTGuWSph27DWhDbGr:wBOGrgACW7FwG/y+7JkKWy1dD6giqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623852067, "uuid": "e1101f6a-2084-467e-93fa-98681f204191", "value": 587623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623852067, "uuid": "3273491a-1f69-47ff-9f07-b4095333d0ac", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623852067, "uuid": "8042e474-b045-443d-917e-b43026a1472f", "value": "transfer copy tt6911pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3c5877-cece-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623867341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867341, "uuid": "83f49c01-65ef-4fef-97c1-0ffc0d4a4088", "comment": "Malware payload (RedLineStealer)", "value": "a367a9a7034785073664bd6e63ee609d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867341, "uuid": "15a1f1ca-18ae-476a-8fab-c2979db6a3d8", "comment": "Malware payload (RedLineStealer)", "value": "d0cebfb71ae3ed9e73c0fa392a5df8657684787474e7f6d31e89229d8947270d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867341, "uuid": "e9f74884-fa51-4d9a-b6a7-a056067f8aa9", "comment": "Malware payload (RedLineStealer)", "value": "577042834289df1e90d56a4f5a3dadb44c17da3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867341, "uuid": "a85e525d-3226-4866-8ba0-4b77617fa102", "comment": "Malware payload (RedLineStealer)", "value": "c8c7a02dc5fecdb4d558d0b888e5c44b40833b84317b465a92aab3df49e04837d1df3fb7d651d718132e91e7998a69f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867341, "uuid": "1e4cf38d-fb73-4aab-8bf5-09575110c05c", "value": "B694BF10F790C034F5F612F85AB693B8A5297AB1A72490CF63D52AF957386E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867341, "uuid": "abfc9b21-4abf-4397-85dd-88ff64f842e5", "value": "a69aa227ef81a409a3b2cd5f64eb1fb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867341, "uuid": "681a376b-6f09-4a4b-83f1-69834086e032", "value": "6144:ZOFjaCQEJauXlU7cJQZ9pc9cNxrevtZKcvq2gkqLz/mJS6kR:Zqja3EJaui7j9txcPvLgVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623867341, "uuid": "2770bdff-4b44-494f-87c2-476efa40ba5a", "value": 428032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623867341, "uuid": "a474496a-fccf-4f91-876a-a393ace270b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867341, "uuid": "c96d8677-4f21-46de-a248-ae9399057013", "value": "a367a9a7034785073664bd6e63ee609d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042aa290-ceb0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623854094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623854094, "uuid": "9cb6408b-a95e-4a7a-8b35-c03f4c82fc38", "comment": "Malware payload", "value": "1c45ca1e6e71381c185bbe518e70340a", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623854094, "uuid": "bff12163-345d-4613-a87b-5ce64007ecf1", "comment": "Malware payload", "value": "d29e60249fbd3139bf2d936c5773c85dbce1107dcd5d1f09c506547104a8776c", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623854094, "uuid": "505ed56a-37ab-4dba-b142-684afc86a7c8", "comment": "Malware payload", "value": "ea54841524ca42fee0ea2be2ec7d1c0dbbe3d2bd", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623854094, "uuid": "f5a402ea-80e8-4a54-a3da-0dfddd9040d0", "comment": "Malware payload", "value": "c27008ed3c037055bb6818d1d23ea66baa2db60536c859693741872fe24e9fe4b7aba84e010efe9305f8543957ac7cfd", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623854094, "uuid": "68c24291-1d4e-4cb9-aa5e-bd50f679ed31", "value": "F653F1D4283248ECC6C0C7A6EF61D8CD61BD7720E7FA22D894342C11B768564EFAC5E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623854094, "uuid": "3f779da7-1ff5-4868-b62f-736ca739cfa6", "value": "1536:dZO0sIjlMBT2VSoQmhBKYTeo+GNg24m/LYXfJ:GIlYk/nhcYTeol+2HLsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623854094, "uuid": "cb6046d3-6a9c-4245-948b-bcf0f87c0872", "value": 61266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623854094, "uuid": "6bab59a5-8338-424e-828c-3e800cf88842", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623854094, "uuid": "9dd06fd4-e31f-49f6-90fc-6346805c5717", "value": "ibyxwd6.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9d127b-ce67-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623823158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823158, "uuid": "9141880f-083d-4fae-92b7-e099d72facd9", "comment": "Malware payload (AgentTesla)", "value": "ba7d2bda5c4ba35e57b62094b5ea8719", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823158, "uuid": "d32704e2-3878-42a3-92d7-8039cf26ce93", "comment": "Malware payload (AgentTesla)", "value": "d38bb1b3101c884a76c74e28a10ad25c0eb60b5fab41985a447bae62c1af2085", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823158, "uuid": "98c8c8d2-2433-4dcc-ae32-79dfc8392a2b", "comment": "Malware payload (AgentTesla)", "value": "c0ef54af9aacedabb8db502aede8c35ae8ece498", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623823158, "uuid": "0bf23710-8bea-410e-a92b-cc3326e22c74", "comment": "Malware payload (AgentTesla)", "value": "b22759ac196aa60a3ca6a12ff486440ed856b6c9849414cc39db7f1ef69d306c598d05187aa4701c356e1b461282c819", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823158, "uuid": "1811df6f-6a2c-4e0b-932d-7bdab3ab74c6", "value": "93F4CF3076FA528DE9AA1B30187491D413F7BB2B7B14CA6E2959134C9E33643CB21B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823158, "uuid": "a7ae81af-c0f5-4ab4-afba-c49e6a56f690", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823158, "uuid": "50305719-659c-479d-95e2-b603f921d19f", "value": "12288:6sONbvquwaHp9yPtYYhnHW4pEiz4k3y2QdyM5Frhy0egNk7z+TPfr:iLquPHpIYYNHWebz4H2UyIFr0b/8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623823158, "uuid": "5b41a46b-e201-4d1c-beb6-80410d736360", "value": 781312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623823158, "uuid": "8d4b1c25-fd74-4bfe-9ab6-3ea1504a217f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623823158, "uuid": "50d78283-719f-4346-a7d5-1a5b0515406e", "value": "price.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bce98df-ceae-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623853463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853463, "uuid": "e15b94b0-6eb7-42af-8e90-60b201a4f975", "comment": "Malware payload", "value": "73c71534d24639e9c6cdc5546b44e6e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853463, "uuid": "65f186ea-be52-4bcd-940b-6e7cdc4f522f", "comment": "Malware payload", "value": "d4965b610ef5fbd4db7552f8d835165357ab8833a37a90ff028e94eef885d400", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853463, "uuid": "91fb66c6-80a2-44d2-a6a5-31eecb3bbcc8", "comment": "Malware payload", "value": "05e4d873034fe6a6485672899ba2a2db067f0066", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853463, "uuid": "b87b56e6-aed8-4d2a-8df2-73031443d0d6", "comment": "Malware payload", "value": "8cc6931bb57aca05961d09027ddbc2a4f3bd036834a0baac6393604c4ded90da9d58cb4f2ab847a3d37243d4701735a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853463, "uuid": "df404669-25a0-4ad4-b868-148ab8f53c80", "value": "BB833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853463, "uuid": "d50fb4c4-bdcc-457f-8a5a-f4bd4a43579f", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJC9dojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JaBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623853463, "uuid": "9c18fc7a-cdd9-45df-9996-23f05f6b44ff", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623853463, "uuid": "26df88b6-1ae9-4c61-886a-c0caaec47e49", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853463, "uuid": "9fdb03af-b0f8-48f8-b207-d613ac819e27", "value": "73c71534d24639e9c6cdc5546b44e6e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72db668d-cebf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623860722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623860722, "uuid": "f3958429-5639-4914-bafc-0f01b94f0e06", "comment": "Malware payload", "value": "6aefc19ab5773859f4c7e7403f4c55b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623860722, "uuid": "ac40d4a6-f18f-4536-9f39-b198236270a7", "comment": "Malware payload", "value": "d4c203e51d0bd26b2535ba5116882cfa7801bbd57383163e784519384a2fecc7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623860722, "uuid": "e2cb0646-7ef9-4ca1-9b2a-9dcf81d0b6a1", "comment": "Malware payload", "value": "52fb57b0b5550912261fca9a5e6ccec058f4164f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623860722, "uuid": "3d06d8da-d350-4758-818c-132954a470da", "comment": "Malware payload", "value": "ff5711b36ca655902af2daac0325ffc2f7c4860a899f6c5b2496b34e792c8600de60809c38a6a7fe9e38dad72aa1c99f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623860722, "uuid": "cc47cbc5-aa1e-46a4-ab65-2c8167dfbd26", "value": "2C171211BEA24873E563033156BEB33E257DEA340729C5D793D41B582D702E22B39B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623860722, "uuid": "1500fdaa-9f30-4eb4-9af9-011db185d6cc", "value": "5e4d209bc424c389ceaddb7dc27a0d94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623860722, "uuid": "dff20161-535a-4396-87ea-bd0feba5e898", "value": "393216:ir6rrgCsTJ05lekUW3VP0m+DoOft5eYE2/a+8aLzov3qv0iq6JmYpleUBA56:iengRJyDUWJuj1ffM3s0iqwmYp+56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623860722, "uuid": "ee7bf526-7b7a-47a4-a8b6-cf7578a999be", "value": 19091456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623860722, "uuid": "fbb327e8-92b7-45cb-9423-5f5b12863ac5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623860722, "uuid": "140af8de-34e6-42c1-8611-b5f27b08b6dd", "value": "6aefc19ab5773859f4c7e7403f4c55b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785c50c1-ce9f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623846987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846987, "uuid": "e5ddfe74-d206-40bf-a6fe-092af73deaa4", "comment": "Malware payload (AgentTesla)", "value": "3072193fbb271c8400b427bfd22ac936", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846987, "uuid": "50c3f193-2222-4372-9ef0-c9afeb6ec48d", "comment": "Malware payload (AgentTesla)", "value": "d696d93b0b75d1fcd1c14fddc65cbbd7fb96bf706a04a608174d9828b1e344da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846987, "uuid": "79f8ba3a-2d7e-42e1-9396-7a3aef65c2fa", "comment": "Malware payload (AgentTesla)", "value": "be521f536e9766c6faf840315c9bedab8501b023", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846987, "uuid": "7b5a9f84-e41b-4b47-b84d-f41a153b383a", "comment": "Malware payload (AgentTesla)", "value": "32e555b04f70b5064007821be83b1732bff3e69015a70dd558b24dca510df728b9005c00e680a675837ba838aa6191ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846987, "uuid": "29d38e14-3ac0-4569-a66e-c8aa6ee832c2", "value": "16242A166715D550CB6F527DC01A820831F1E707A72AD2DF5AA2D8EA2F832CDF90BCE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846987, "uuid": "2ad9c190-4f8b-4804-b8a1-7ec1935a2cb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846987, "uuid": "f635eb52-5bc6-4960-8f37-ce8b11e3602c", "value": "3072:4O9+rhZqYpJqtC4qydcv1UvT0dQrCnB+Woil/LG0NqBNdLkcTYUtM:KjqtCOdEUwaec1saJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623846987, "uuid": "cf141cba-ea85-4e56-a01f-7276b279db35", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623846987, "uuid": "1294fc1e-d871-46f6-9990-0d32a299c431", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846987, "uuid": "061fee84-1d5d-4d06-9f88-24867b106927", "value": "3072193fbb271c8400b427bfd22ac936.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083cfb92-ceb8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623857537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857537, "uuid": "364d20c6-9c8b-42d6-8c60-45fce10110e0", "comment": "Malware payload", "value": "24e0efed6fc3f416abbc04cd3ec88839", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857537, "uuid": "53cb57d2-95de-4a54-8b10-d22f0efafaf0", "comment": "Malware payload", "value": "d6b9eec9c7788cebf04a5fdc0880933fe47c1e553ecc272049b9f1fb1300c6a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857537, "uuid": "1a777d0c-1b60-4a21-9e16-ff0ef8e082bf", "comment": "Malware payload", "value": "3c897d943f8531b1012c173361c59cbcdbb05c99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623857537, "uuid": "377620e9-495a-45de-bd0b-561a6fb2ea1a", "comment": "Malware payload", "value": "b131bc7d2a142db970e23d24d0465cfa6bd8ab1c9bca62403d71ae04f13e30c29fc7541a25b38f35cde12235e3a34e06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623857537, "uuid": "e16c8f50-6f17-4ae2-8fd9-9250fec33abb", "value": "1D734956F8819A12D4C515BEFE1E128E731327BDE3DE7213AD246B207B8756B0E3B811", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623857537, "uuid": "0ebf3a71-7b1b-4be9-832d-b6da5a27b241", "value": "1536:8+nB9UldmzGKhKkKoKuGKzKLBZBi1Mk9RzoUnat6IQJMigiYK8jueJ4Ol5tY0Yz3:JUldTKhKkKoKuGKzKLBP+R7naDK8jueW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623857537, "uuid": "a4b602d8-87d0-4b5c-8f7f-3751dce20758", "value": 79664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623857537, "uuid": "05be7b67-960f-4f28-8b65-2c875bbdaf5c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623857537, "uuid": "e2f43da9-72a2-44eb-88dc-c3afbfad6d12", "value": "24e0efed6fc3f416abbc04cd3ec88839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b821aafc-ce6c-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623825190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623825190, "uuid": "e103863c-ac82-4310-ab07-7f9a4f37f368", "comment": "Malware payload (Quakbot)", "value": "4a6daf8b73fe278b0b2c17c042cf7f9d", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623825190, "uuid": "2e593caa-e13f-4847-a1d4-3ff8831ed8ae", "comment": "Malware payload (Quakbot)", "value": "d8ecdf653e4e5fa30565cd18fc0b0aacb97d54b0fc4953c103aa606943dc5625", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623825190, "uuid": "8f2fb811-a171-4636-9856-7ec132a23b24", "comment": "Malware payload (Quakbot)", "value": "d807b1b8440a7b258fc566522d9b9335b93be91b", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623825190, "uuid": "7cd7fa59-405f-4667-ab28-8f70d268ba8c", "comment": "Malware payload (Quakbot)", "value": "d16d2bea4c8008fd0f2a45be3d43770751aefdc2522cffcc1b9160706d82e5234957c1d3d752c889eea48b5cdd7256ea", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623825190, "uuid": "5c053d5e-cb8b-4425-8a39-22c7b2a7fb49", "value": "1C04F1DAD302F0E7DA65DC7CA11238415D62E1A76F03FA4B0695AB564A01CBE4C2E35F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623825190, "uuid": "13c82085-8ebf-42b4-bd22-d2c03cae2320", "value": "3072:ipV04Yldz+3qcyFaalxV+93qt6GtxVymd1xXPMU9VlUBWA6CFvA7bRCxAVIK0hKF:ipW4HCaalxV23qIYxVyWxfMU3liWA6Fb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623825190, "uuid": "95904ff3-b022-4d3c-93f2-52afc712e8c0", "value": 184537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623825190, "uuid": "cf492e6b-3100-4503-aaf3-2ea27f6ea0ac", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623825190, "uuid": "69de67c6-4bb4-4ba4-9710-922a4846d1f2", "value": "tender-156639535.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cca046c-ce80-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623833600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833600, "uuid": "04d3d205-e431-45a9-8f8f-1a42b67a0962", "comment": "Malware payload", "value": "75dab12bd8040b0dcf7bcc99abb9d117", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833600, "uuid": "06381b6c-5ac6-451f-8455-0ce39dfc3d0f", "comment": "Malware payload", "value": "da6b4f01f22503b2d010e3469cba37196fded1626dbe7a613a4afd3efe901457", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833600, "uuid": "4d67d997-dde6-4c65-ae1a-fadac1b0efb8", "comment": "Malware payload", "value": "5c722cf3ed08f1ad3d5eb808445ab51d7bce63a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833600, "uuid": "09c1cc9d-2f4a-4294-902a-9eb0c3cdd11b", "comment": "Malware payload", "value": "44045cf3d26f70f669bea9bfe97c4c5c6115e71bc10200b7ffc409a1c0a38e482b49bdae452438cc7518526d4cca0679", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833600, "uuid": "fe1b9e1a-bc9a-4363-a477-77259f0169e3", "value": "6604A57E7A21AB7EE16886310BF7AF70CB5511D72291D382F26CE7145EB124D284FB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833600, "uuid": "b520f4f2-0922-4725-ab3b-a5b8ada7b05f", "value": "3072:Cp//3E/9DIb1dNXGk2/NVJnlFOyjKGXmOuhwGWolOQKNO:8//U/9DqunldjKGXmOuhwGWolOQKNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623833600, "uuid": "f099317a-ed05-4a8c-8873-6e8194710481", "value": 175054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623833600, "uuid": "6d2ffcc2-b45c-4bcf-be22-d29adc8dead6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833600, "uuid": "d2c8ec80-ea01-4921-8a6e-18cbfda1b62f", "value": "75dab12bd8040b0dcf7bcc99abb9d117", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf3e262-ce60-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623820043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820043, "uuid": "a8ab26a6-152a-4c4d-aea1-62dc0d592d0a", "comment": "Malware payload (Loki)", "value": "efb227a137bd3af8a1ccca8423463bbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820043, "uuid": "b343edd8-63bf-4132-97f8-b35d6ef212d2", "comment": "Malware payload (Loki)", "value": "db9287dc061817a9f443a7892706374db141f530fb57d1d0b7e855df37a9b3b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820043, "uuid": "4cb155bb-8dd9-44be-9761-0ef4fe5b9a97", "comment": "Malware payload (Loki)", "value": "712d64e5087ee2ee9c2cacb46a883a86ff35d104", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623820043, "uuid": "2841ccaf-97c7-4409-804f-5c0f4e1cc04c", "comment": "Malware payload (Loki)", "value": "0038ecbadbdac68afa7c8729fbf9684d35f7758c164806717c554027823ec2b583c1d8f6438e27201150728e4b815dd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623820043, "uuid": "c63438f1-2273-4119-ae9e-3243e24e5320", "value": "7F64E0453088D49BEBC57A386F71DAB59376AE9C1E10052B36F8BFAF3AFC2535101261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623820043, "uuid": "6c4697c5-97e2-4e1f-83b8-c99fd22731f4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623820043, "uuid": "91bcc954-c6d8-4ac1-a5f1-55ae2310bec6", "value": "3072:bLk395hYXJcN225TMzpJXsdNNd7pJyyP8wE2E5/xOWtKAKoCZ71uJTYmugpRgt:bQqWN7WCNNogRUZ5DKo87QT/gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623820043, "uuid": "f99eae05-4667-45f0-a679-54fa946ded10", "value": 324811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623820043, "uuid": "193a2454-d2e3-482f-b5d2-9b364d35c00a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623820043, "uuid": "aa402a10-0bd7-4ccd-ada3-b31e030f2e0c", "value": "IMGG087 76543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23d4b47-ce64-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623821771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623821771, "uuid": "3b8ab2a9-a410-42bb-a5a1-ced3a7f99619", "comment": "Malware payload (AgentTesla)", "value": "80b912d67bc289b2d40c99f31e1d1056", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623821771, "uuid": "5e4d7467-3c85-4714-b6f6-8194168f3b95", "comment": "Malware payload (AgentTesla)", "value": "dbfa73853cabc5bbeba9df3f5a29096618a0f169dbd91719b2e2e632ba800674", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623821771, "uuid": "27445b1d-dad6-4b5d-84c1-f282b0caac9c", "comment": "Malware payload (AgentTesla)", "value": "ec30432a74c40dd7e87f90563c06b474da63bcb1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623821771, "uuid": "4676e69a-5e1e-419c-8122-e57461dc4cfe", "comment": "Malware payload (AgentTesla)", "value": "2613b1191501c1cc85f02472a7d6c20397a6f9c75c69410581bbfaf95536ba67cf907565884e0a65596dbb9601bd3d70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623821771, "uuid": "068eb24d-8429-4167-9c76-b31ca8337a82", "value": "6D05C050B2D060A6CEF94E3B6A1AEE304B297DF9F515C51431DC3E9F35F6AB302412A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623821771, "uuid": "e7f4452e-ce37-4a33-9d4f-fbeb8f8f0952", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623821771, "uuid": "8f554a7e-c392-478e-a29d-c392cbc680c0", "value": "24576:wxhDV35KGAme+j2E9jf52MMMMMMMMMMMuMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMo:GJi3+j2Ed8MMMMMMMMMMMuMMMMMMMMMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623821771, "uuid": "5547116e-8e43-4ecc-a290-2bac2fe0c161", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623821771, "uuid": "cda522be-0cba-4d7f-9243-a772f5060f0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623821771, "uuid": "87629008-fb84-40b2-a4a8-5844155116ae", "value": "NINGBO_OUTSTANDING_PAYMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d556cd99-ce65-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623822233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822233, "uuid": "5dfd8d54-10c6-49a1-83f6-53b7633719c0", "comment": "Malware payload (AgentTesla)", "value": "87dd16347308af90af3023e507347c08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822233, "uuid": "9a545487-65ee-4755-b50a-f866b5bb82e9", "comment": "Malware payload (AgentTesla)", "value": "dc83ce579bf97edda366eac1cae7c913cfef6617325bf73454917f99359519d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822233, "uuid": "b0fdd3b1-cd06-43a5-9de8-96135c8c486d", "comment": "Malware payload (AgentTesla)", "value": "bf97f4106e1fd04543eaf007f7e53abf9002332e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623822233, "uuid": "0c1530ae-087d-42aa-804f-27f514c11ccc", "comment": "Malware payload (AgentTesla)", "value": "6b78d2a401699fcc358bb484fb298bceb22781aae7700af84228b42bbef307619fa46519029e4215d8e3a57ca7d5afbb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822233, "uuid": "04018225-56f9-4e00-8688-c134b4997d61", "value": "02D4021437AC4525CA774B3A50E0D250D77EE133BA0ACB0931A952AA0BD7FC19E53A7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822233, "uuid": "63ca5863-2b70-472d-848f-b1f76d7c0d64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822233, "uuid": "b99eb342-08bc-4496-b22f-83fb5b8c80e6", "value": "12288:PMKDtdKBKfv1De9GUG7TFZAPCKwzDlCJOnckYLByJ:0K1fbFTFGaqpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623822233, "uuid": "618e741e-79a8-4462-a498-6947d6234e3a", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623822233, "uuid": "dcae2bc0-7cca-4e5a-af17-4bbb12de21a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623822233, "uuid": "3a743742-747f-484e-a4bb-f2b247dfee1f", "value": "Remittance Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e123b2c3-cece-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1623867350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867350, "uuid": "0b6856a5-d071-4b67-9d59-866fc764ccb6", "comment": "Malware payload (BitRAT)", "value": "db50bae866c3535549c653b500ed51d5", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867350, "uuid": "722f03bc-bcb4-4f6d-80fa-ad42fa1022f3", "comment": "Malware payload (BitRAT)", "value": "dce7bd6ffb24e1022633df291493bc759eda61266bc34c9753ab7912c31b7e96", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867350, "uuid": "84268097-83fc-4513-af7a-f0f38652167a", "comment": "Malware payload (BitRAT)", "value": "9371ca9ab7f5ec41ee547b972318a2d587ed0cac", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623867350, "uuid": "bf7859c5-9d6a-41c3-8fcf-471e0e5291a8", "comment": "Malware payload (BitRAT)", "value": "60a2e86afbe917982a5eac6fb56a4b5369a29e9cc1867b7b77e3f588e6c1c922881e82cec823b203ebeb61d195d59829", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867350, "uuid": "8b07da47-c144-4513-a25f-7e3f691da12e", "value": "55F46C6C62625C72D8773BFA8D0AA658681F7E517468AC8D27F43E493E313D0B42D09F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867350, "uuid": "f4b5ea25-3372-48ad-935b-0f7354946019", "value": "6540183ada623b7b6b50db50745c1536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867350, "uuid": "0049077b-a333-41b5-8754-c3afa1b4aedc", "value": "12288:kTF0R8yZK0xXeFiP26TlLlosSXu6OKYqX0uNb+T0HXX+jBnnXLVgKR3ab:kT2u6Ai9lxK+6OKYq/XQBab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623867350, "uuid": "67d1a53b-25d9-4d8a-96c0-3243e29051ab", "value": 767056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623867350, "uuid": "d67fa139-b3d5-4bd2-be76-ea068581d1ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623867350, "uuid": "d9c8bc6d-1716-4c0d-9e19-5c3050843282", "value": "Tbnqyzlrekaqeayosqbqcvfjhnkosgclvf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a664601-ce80-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623833730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833730, "uuid": "18b3c992-7800-4de4-8232-1ce9f849d344", "comment": "Malware payload (RedLineStealer)", "value": "95d6191fe51b92ceaddf89b4192d9bd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833730, "uuid": "9efa9c71-e3b0-4efd-b3e0-1bde0479c5fc", "comment": "Malware payload (RedLineStealer)", "value": "dd15fa8b6db91590b0a8b2ae8b47ee274adb8f095a04d56997b1406e3a376627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833730, "uuid": "92b8aca9-f7e9-4127-8d7d-6a50334b7da0", "comment": "Malware payload (RedLineStealer)", "value": "1ec3745fda3fc876d9b3b601ce93f578c667070e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833730, "uuid": "10770d46-3b4d-4ff8-9127-549d183ab73f", "comment": "Malware payload (RedLineStealer)", "value": "bdc1107789beb6b326bc11818d88be186e1edde660ad576b93b8e64a62376e1396bd63763338500dde9aed668dda678f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833730, "uuid": "1c1e9a0d-c77f-4299-bc7b-2efdaa51f116", "value": "1674F1283FFC4A16E9BB5FB894E05A42C77671273A23F30D155151AA4D23FC2CA416BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833730, "uuid": "f63fa9cc-542c-4f42-af46-be63ad7c9a94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833730, "uuid": "8f42adc7-a82e-4e23-bf9d-d7991778801e", "value": "6144:Gq0f9cppo/6QZTMTXxyxOr13+DbcezrM8Wb00vZCLYDmP4C8IYXb1t:Gqu9Spo/6QZQTXxy0d+D7o00vELYS4Br", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623833730, "uuid": "9b958600-41aa-4c36-a19f-fab8edff3ba1", "value": 365056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623833730, "uuid": "adb96269-bc3f-4650-bfba-1789f785ca85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833730, "uuid": "6fcd361c-8fc6-429f-ac98-8e8815ba0d0b", "value": "Injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50204af5-cee7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623877844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623877844, "uuid": "c3ec0be7-cd75-4280-8320-41c1b5dc6258", "comment": "Malware payload (RedLineStealer)", "value": "35489261d5b68ca3d59b3ca7f26bc711", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623877844, "uuid": "0486387c-1407-442b-9444-d28c8a526211", "comment": "Malware payload (RedLineStealer)", "value": "df45f560bf26f3aad3f2b51230c2e0d7313848edf4d10ee18938b5776abd5a68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623877844, "uuid": "8a609742-bcf2-42ad-9dc0-5e1d84186548", "comment": "Malware payload (RedLineStealer)", "value": "5bc18aa39fc26aec66a7ae3d0267cd66d828aac3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623877844, "uuid": "b4cf8a8a-929a-45e8-a6ef-c06674e8a4ae", "comment": "Malware payload (RedLineStealer)", "value": "12066dbd21a1bfa726ea51c64b411bdc876aca66beff4cb23bddeee9836d3bd165f47f61b2fd8acbf3c80d781e0985e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623877844, "uuid": "f20051cc-b6ba-4c06-94f7-a4b8d86fe677", "value": "C184BF10FA90C035F5F612F84AB6A379A53C3AB0572461CF62E52AEE56346F0ED32717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623877844, "uuid": "238d1065-a5f6-4657-b9e0-1d4dfcfcd505", "value": "0f54bbcbcd51554020d535d750596e1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623877844, "uuid": "ad4031ac-1639-4a97-9061-72584fda683a", "value": "6144:HsjMsIzdlG+ONDcxm9rgooj+XDbzGZMBawH6PsfXL+FnVtL82C:I4BlG+ONDcWrRc4vGq6P+XaFVC2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623877844, "uuid": "5de7939f-c27e-49c2-85a7-deb77e4f033d", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623877844, "uuid": "82cfc828-87bb-44c0-ad47-edb7afbcf514", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623877844, "uuid": "624ada73-f438-4bc3-aa4f-bb1c4059a140", "value": "35489261d5b68ca3d59b3ca7f26bc711.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6322eb3e-ce96-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1623843086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843086, "uuid": "489e2f61-a6df-4327-84f7-e7add286ea3f", "comment": "Malware payload (njrat)", "value": "0151217566248dbf444cb9e0d41aaebc", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843086, "uuid": "23bb0f65-e0c1-4977-beda-68268ce9e494", "comment": "Malware payload (njrat)", "value": "dfae88da49ab8e4d80b46bb9682b195dfd018c97e8e9ee63aedaaee5c64bbbd0", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843086, "uuid": "d9286010-df6c-43d9-809c-cc9e47c0a820", "comment": "Malware payload (njrat)", "value": "8a42275ed41f878500e4f0834c5e03b81b7545f1", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843086, "uuid": "de874200-ae5a-42f7-8c0b-b2b45d3cce30", "comment": "Malware payload (njrat)", "value": "e9f6850893b81c2cd85c038fac961153715d5a723f5172491f08abd68cd20c5cfda5c951cc7d8fb82aa10c0d1e2df069", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623843086, "uuid": "afed7256-0406-4608-acc9-bbba517f046e", "value": "08552344F9D93762D5DF29B580AAF110212DEC0DA73E40D7737A7B2CA4BE0620AD179B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623843086, "uuid": "5a560673-73cc-44c8-a996-0411e33ce0f5", "value": "24576:5ml41TIPNQBjavSa0vxHgIVBiXzFXYDxLdpMrqWvjzjP9Q:5841TyQ1rKAqzlyDs7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623843086, "uuid": "ec9286f2-14e0-43e5-b2ce-6efdb9ea3318", "value": 1318400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623843086, "uuid": "db95668e-50a9-4a69-92ea-b1bdb35ff349", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623843086, "uuid": "fdd8bbc0-6e0e-4d34-ade0-8415842e2315", "value": "SC 21-0149.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0b6e11-ce8b-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1623838620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838620, "uuid": "f9a0cabd-114e-48a9-9ef4-8ac1fcb82203", "comment": "Malware payload (NetWire)", "value": "91514b3627e78e42cb05bc608737a47f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838620, "uuid": "4a7ebdad-0219-418a-8772-d8c2ff4bcfec", "comment": "Malware payload (NetWire)", "value": "e0e0ca8ec324752ed823c7e503992398e817663828f94b4ca699ff1965095c31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838620, "uuid": "917cfb0b-0477-4d49-b79c-ee377f576fa6", "comment": "Malware payload (NetWire)", "value": "b48882a3d656068e30b88671aee71010e5602d32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838620, "uuid": "5b9fac42-ca4a-4d46-9f4c-50b5f4902f0a", "comment": "Malware payload (NetWire)", "value": "067566bda5c8f33101cb9b38f43ee60a21899308e45a7f8af4d65961b735052cba2ce48c76ce537d84eae1234361233b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838620, "uuid": "96a8562b-371f-4f9f-9410-f8875ca52dd9", "value": "952412263FC0A4B3C0E346711AADCA68C7B5E66503B8592F73586FFE46651D3C623682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838620, "uuid": "d99e7c93-4e13-4900-b40d-6acd9eb3ecdf", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838620, "uuid": "c0fb0e15-6bd1-4ace-bc10-01061a4e0d92", "value": "6144:cQqTMHNItf88WBtvd9r4nmKNeyPObWhqxD4cft:yMHCtf88WBtvd9c5NJhAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623838620, "uuid": "a2fa9cbe-bbe4-40de-9497-bce10bb7aee8", "value": 218807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623838620, "uuid": "ecd86f7a-2d37-41e3-a948-41c27ce11c0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838620, "uuid": "858355d9-fbfe-44ee-b0b6-fd68dc4b1e97", "value": "91514b3627e78e42cb05bc608737a47f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ce5ef7-ce6f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623826337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623826337, "uuid": "8ef59787-f9d4-4bc0-bb5a-4bcec6682339", "comment": "Malware payload", "value": "ddb3f92907bc12d0dd986e156bf519b1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623826337, "uuid": "446c0bf6-af33-4fe2-a828-f8fac7873fbf", "comment": "Malware payload", "value": "e27179f833231296d3e0cf41d418c6e8575c5382b1ed447de7fd27c4b2d65e7f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623826337, "uuid": "62841911-d33d-4d15-be08-162b7feae869", "comment": "Malware payload", "value": "f936c7b00fa598de504d81d5c2c64351af658d79", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623826337, "uuid": "47b7a050-83e9-46c2-a368-dccd0ece09fb", "comment": "Malware payload", "value": "ed09b60861461a327f71f45b41218f0fbea4aa5a05a0fc27c45d6dbdc5c03a4dd09b64c255af1bdb4e08c33eb3f8bfa4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623826337, "uuid": "416a235a-6777-4c30-bfa5-0cee841a09ef", "value": "7E818EC05EE51391CF3D4CF1C38AB60AA5EA9D2CDA5DAB20C41AC4146481B5B6A3AA30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623826337, "uuid": "8c00f368-8439-44c2-b84f-5159bbd0bfc5", "value": "48:9UPHm1ynmN8bPwuHh+BAxQAcAilSMvrxgwjIBlxpCD7OhEpp9mFH6ok86XgthB8C:mpzNhQA1YwBlrCDgoIpY0TGs6l89AJ6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623826337, "uuid": "529c74d6-de07-4949-a9f8-4e8032fd7ce4", "value": 4051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623826337, "uuid": "1836d4e9-14cf-452f-aa81-92398045aa8d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623826337, "uuid": "055bd2ec-da0b-4d69-8475-089dfa45baaf", "value": "AZ2066 Elektronische Zustellung.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63398d51-ce8c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623838792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838792, "uuid": "b1aff869-12d2-46e8-b57d-e17bfe98326f", "comment": "Malware payload (AgentTesla)", "value": "42520170fe48af70b3711bf86bde77b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838792, "uuid": "24dab923-5a82-4027-b40d-a364877b7be8", "comment": "Malware payload (AgentTesla)", "value": "e4fcc9753e14eba1107da53046098456e353efdd9f81d88bd7199cc262e43e64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838792, "uuid": "1ce38b3a-9316-4237-9d4e-8bcf6790ca91", "comment": "Malware payload (AgentTesla)", "value": "8af1983adff968d63d210145629f12edbb4d1292", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623838792, "uuid": "0704fbf1-af9f-4aea-8227-0ad568dced51", "comment": "Malware payload (AgentTesla)", "value": "6045f5a58c82625406fe0c3ae6d824a6c19765fd17a0dd6c661e5604655c3f813419b652812184eed7cdbae0f982e166", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838792, "uuid": "10bcd83a-8763-4326-8095-5b5d5f8eda55", "value": "F1357DA1B1A0C4C9E9AF0AB1AD3A943011F7BE5D69A4C20C159D770E6AB3343615FF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838792, "uuid": "2a5f8a6a-5204-4b23-979c-132a14e8ef9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838792, "uuid": "6551b7f5-7557-4538-9e9a-b34d69da9f93", "value": "12288:njjwxQMYvquwaHpLN39wfDM5prFXcZl+w5PTK787vEtC0pEyXEiyV4Gq:gxGquPHpLN39wfg5piR9KI7IiyUiyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623838792, "uuid": "cbaf5e28-9ad0-4e8d-b3f4-bb16fb033526", "value": 1120768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623838792, "uuid": "85341264-9aec-4797-816c-f3a0923a96b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623838792, "uuid": "4ec96d5a-a1ed-4f89-8261-013ba312627b", "value": "42520170fe48af70b3711bf86bde77b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46c5908-ce96-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1623843223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843223, "uuid": "13887261-3b43-4cbc-b47b-366c5fae1563", "comment": "Malware payload (NetWire)", "value": "5c3358017eb0fb29e034c6fc596f562a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843223, "uuid": "3a313292-d401-4b47-a129-1a733b1d2486", "comment": "Malware payload (NetWire)", "value": "e7a98f2a24a517532dfd29f15bba52c4216da9eee8b848f6c50bab2a4f00cdf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843223, "uuid": "ccad0233-5c24-4fd4-9059-3f48a688d863", "comment": "Malware payload (NetWire)", "value": "fbe1a3bd59c2245cdef3e94d080be8e644d94a7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843223, "uuid": "4e1c2be7-9901-4c3e-be24-1b47143bd16d", "comment": "Malware payload (NetWire)", "value": "f00ed81d64d43c3d77fb54f600b7e77075ca5b54230588959767652aa059f18b44d6cfcec4efe9be8e57d51186ead374", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623843223, "uuid": "33727760-d1d0-4a04-8721-8c1872a7eef1", "value": "2B24026736C004A7C6650D7018F367BEE73BBB56463041DB63785E7A3A126E3C54B2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623843223, "uuid": "f1e10040-3540-4a90-82aa-77c5d4fc6873", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623843223, "uuid": "d1e8aa68-95b1-415f-9b24-964191d0065a", "value": "6144:cQqeIKqlsN6eXc2zmWpjZxVQh4sHrT22mt:PqlgXvmqj1gHrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623843223, "uuid": "d4a2020d-0695-4b40-b232-9bc89e20f6a5", "value": 223082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623843223, "uuid": "fb41be5c-5f98-453a-b966-8b87732c5880", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623843223, "uuid": "a3e96ece-e44c-49b0-a162-a65269286043", "value": "5c3358017eb0fb29e034c6fc596f562a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a44bc19-cef3-11eb-875b-42010a9c0053", "comment": "Malware payload (Pony)", "timestamp": 1623882988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623882988, "uuid": "3d35402d-0df8-4e08-ac0b-4e30885b7d98", "comment": "Malware payload (Pony)", "value": "9634a80228a6d385b70c74db6f22118e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623882988, "uuid": "74425fb9-de22-439f-aae7-b54a0c736050", "comment": "Malware payload (Pony)", "value": "e89ac7128c7460388550f814595e09ab596db0f6f6c0588eb6efdac0e3302637", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623882988, "uuid": "86a7020b-c37a-4cbf-8f39-c88909f1eaa0", "comment": "Malware payload (Pony)", "value": "9efdd367643baa158e5d51ca26553313bc6dcd27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623882988, "uuid": "a973d1a9-1154-4ea0-977f-3ec794980c70", "comment": "Malware payload (Pony)", "value": "0fc610b2ffc3d9ce614d01ebef367f52e4d88076fc6171038a988b7b9e0ea24b3cd277078ef1ca5639a09cd491a461bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623882988, "uuid": "3e9f24ab-2279-44be-8b93-2d92dcc38203", "value": "D2649C5331468AB7E2131CBA4C1EC2B215D7AE24142AB51D75AA331F19F232613EFB5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623882988, "uuid": "03c88610-3b1f-4508-9b62-55ae71df18d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623882988, "uuid": "7cf5729f-1252-4073-9f8e-6516d7791047", "value": "6144:HuNt3ej7WrLJ0z3j5KnUxtVYg9Gl6EYKjL8DPP:Hu3evWLJ6jYnM9GE9KjL8DP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623882988, "uuid": "7d3aa815-e334-4448-be7b-14ffd246f055", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623882988, "uuid": "deba057d-23d3-4aeb-ac30-0c59ae3e1040", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623882988, "uuid": "5978701e-bd93-40f9-98d0-b9ac06aac6ab", "value": "9634A80228A6D385B70C74DB6F22118E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f68a6de-ce7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623833255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833255, "uuid": "2c236bcb-1d01-4e1e-9917-1d6b326579de", "comment": "Malware payload (Gafgyt)", "value": "d2f635dbc6f4aed4b8a1bb3e8b069eb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833255, "uuid": "a90cbb59-874a-48a8-951a-55b76c4e077e", "comment": "Malware payload (Gafgyt)", "value": "e9cae1bd1e844e06ed99f151244ccd5a161ae1db1d8d9d2e49624a6c21d14e3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833255, "uuid": "cf475841-ed33-488e-803d-e2b31000cabe", "comment": "Malware payload (Gafgyt)", "value": "920bcb69c600469b97feffba9849a791e54df91e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833255, "uuid": "2da67a4f-9d4e-4960-bff2-6163ab2cd6bb", "comment": "Malware payload (Gafgyt)", "value": "54b29be8997cad58cbbceaf650a238e323ad662334ccebc303bae33085bbb39f3235323f9bfe6554fd6b3da2d2433a8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833255, "uuid": "4d7d9ac9-c946-4d22-a00b-398bdd178727", "value": "CCB32B79B241C173D14309B61187EF110D31FAFF164BEA4AF3692DB49E2A4C67522FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833255, "uuid": "1726cc9e-e294-479b-b489-387561e376cc", "value": "3072:WGmoETwquoUGsUAB7tq7h24O6Qn2uLuSIhtzSmzF40/DFGnc+UG:WJT3uovsFvclC2uySMzSmzF40/RGnc+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623833255, "uuid": "c13dbcb2-d0b2-4794-b81b-6a0ff43606b0", "value": 112506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623833255, "uuid": "48af5209-6ef1-4736-839f-5f34b90c4d37", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833255, "uuid": "19c0a3b0-4e94-464a-9ede-d51ef0b6cbac", "value": "d2f635dbc6f4aed4b8a1bb3e8b069eb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92acc75-cec8-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1623864813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623864813, "uuid": "d2375984-830d-4954-bbbb-48c826174811", "comment": "Malware payload (CobaltStrike)", "value": "2ca9fe6afe9e879e88d02200a538e800", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623864813, "uuid": "180aa34f-886e-4c9c-bdef-085b4cfe8670", "comment": "Malware payload (CobaltStrike)", "value": "ea793bae0ca410fdc008a67c243895c70c55d1204d30c2a853ddb90fff24264a", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623864813, "uuid": "746ebe49-ffbc-42b2-afc9-a57056448f2c", "comment": "Malware payload (CobaltStrike)", "value": "3767abef5771f4b917a3e3afbf4b5deb177eba66", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623864813, "uuid": "7ef858e6-5d54-4ad2-bec2-895568009c43", "comment": "Malware payload (CobaltStrike)", "value": "9d1fcf72b166e94171d0f9c8f41f0c3b071de39fb4e38593e10bc61e27e406a58a896853c83bd4ddeb050d1c99e2382a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623864813, "uuid": "52394c0a-e5ca-4f9a-8909-19d36ec26803", "value": "4024DF92F5D4E84AD51507314DE3C2E66B35FC13AE52430BB784B72F2E32A84DE23662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623864813, "uuid": "d17b5b61-bd65-45ab-a6cd-4af854fe569f", "value": "6144:mxEtjPOtioVjDGUU1qfDlavx+W2QnWxuXg7zerDpWPN06gRdDO1TpS+:SRzeHp+N0RDOFpS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623864813, "uuid": "2d32d4f0-d2da-4b6d-81b6-97c05cc96686", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623864813, "uuid": "64532951-5aa3-4da2-b077-f4b36ef248b9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623864813, "uuid": "db054fb0-1f5e-41b7-b93b-6ea38eb85c7b", "value": "Document_38047842.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01168aa-ce8c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623839028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839028, "uuid": "fd1760e7-697e-43a9-8b3f-b6e58419a624", "comment": "Malware payload (AgentTesla)", "value": "0f3b9aab67b44eb89af6aee7d419b2c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839028, "uuid": "127ffb65-e5ca-4e26-816a-1cca795ccc4f", "comment": "Malware payload (AgentTesla)", "value": "ea983195b6eef23b19fec78fd5dbbcc7ac528f65a3be84d66230df5ce321f333", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839028, "uuid": "2cfcd1bc-1bcb-434c-8f1d-cca993bbc52e", "comment": "Malware payload (AgentTesla)", "value": "63ed9710446f62efde038230200f418eb2977cf8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839028, "uuid": "45cd3262-0234-4314-bb3e-2ad6b994744c", "comment": "Malware payload (AgentTesla)", "value": "b09e96f6c3f8468326112b0628538c066576b49202fcc9ffa1746df433cdc50a404e496c9dcb5a9b4a9a7764df5705ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839028, "uuid": "330c2b14-0ff2-40df-aeed-9540d8a85903", "value": "D015C1F13B959B64E5210275C41282638B1BAD7AF50F80963042BA175EFFBC368D76CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839028, "uuid": "3d869774-45d7-4e9b-8b47-03558cab3778", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839028, "uuid": "9d348148-f151-477b-bece-d52a2209bd9b", "value": "24576:gK+woedflMoQ1mI03i33H3yd2OluON4fA9uC:8mez1hOinH3yd2OluON4fA9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623839028, "uuid": "b174aad1-611a-4612-8acd-d902c845e1db", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623839028, "uuid": "eb102ac2-7b87-40c5-a009-cbadf15aeb99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839028, "uuid": "2bc07c2a-9ce0-4ae3-a6a2-c640217639a9", "value": "PO=T2Q4ZoQTUBTUU007 -XLS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d60e67d-cef4-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623883557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623883557, "uuid": "1a2dbb9f-83c9-47a6-8f62-1366cde6a4eb", "comment": "Malware payload (RedLineStealer)", "value": "787c6670b67b330801325c94e361e0f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623883557, "uuid": "22382763-1ae6-44a7-b1a7-3de237c4bb38", "comment": "Malware payload (RedLineStealer)", "value": "ec54f91b74fd7baa5c9167520c4a3a4689bd7a75db353af20c86f63394a053dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623883557, "uuid": "ad5ae016-b124-4004-8ff4-a092729840ed", "comment": "Malware payload (RedLineStealer)", "value": "2f11a2cfc880ef0f8319252e3957edccabc30f24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623883557, "uuid": "9380aaac-7571-4608-b4bb-bffe4270f039", "comment": "Malware payload (RedLineStealer)", "value": "f885606322248765688f84c399543191ef9da683812f08eb5f64fc106de01a44853a6f30b3bd05902baaa288f6213527", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623883557, "uuid": "ff40cb0e-bdd4-4073-955b-ca8da8ab627b", "value": "DD84BF10F690C034F1F622F84AB6A378A53C7AB1672491CF62E55AEE56386F0ED31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623883557, "uuid": "e8f9c7b8-d83d-45ca-885d-e319e1e97a25", "value": "ed103d03110ecdb36297492051b4e917", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623883557, "uuid": "e18baf3c-a68d-40bc-bb14-ba0b1368c3a6", "value": "12288:DTDYRXAiDBqr5M75dURvF1VylqAzPhFE4Ci:ERXAHM75SRvjCqmFCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623883557, "uuid": "92ca0ea6-bbad-450c-8c07-15a52eca30a3", "value": 394752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623883557, "uuid": "bf9a19e6-c20f-4677-90ae-507fbae6837c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623883557, "uuid": "13bc14e1-f644-406d-bc26-4ac501b0b358", "value": "787c6670b67b330801325c94e361e0f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264e88ea-ce40-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623806048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623806048, "uuid": "e6bf4717-5020-4374-85f5-f4e88a4c1172", "comment": "Malware payload (Loki)", "value": "f35e3b19dd1a1522795bea451201881a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623806048, "uuid": "4ad24c90-2623-41d1-8b0b-1149c31abc82", "comment": "Malware payload (Loki)", "value": "ecbcb560b5d6a6a0d82e6230af9a41c03a1dc7fe41931f37d207d764e4c3cafb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623806048, "uuid": "a33b50c3-d1a9-4181-adbb-e66596fd8212", "comment": "Malware payload (Loki)", "value": "c5fff848246e8721e235821d1b5d816637c3ac39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623806048, "uuid": "2304ebef-cfc2-402e-a367-72367d246fa6", "comment": "Malware payload (Loki)", "value": "350fa5376b7905e113c8c8a23102ec342b2d9d6adef4044d75f5cb0dd043f50e57c3aa9103ff611f1ab7871b354cd227", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623806048, "uuid": "c6725a46-7a66-43d5-aa92-119fc52430f6", "value": "F5E4BF3036EA5248E9BA1B301974D1D413F7BB7B7F14CA2E2959524C9E336838B21B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623806048, "uuid": "e311f452-57b4-42fb-946d-02941ef892f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623806048, "uuid": "420497a8-b875-4a98-b000-c342b46223bc", "value": "12288:dsOObvquwaHp4yO9/bzWmcXgrXFPJwYnCF6NE0l:SLquPHp4yONvQqFqYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623806048, "uuid": "e6a986cf-4708-4cef-b8b8-b86ed6d9bbab", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623806048, "uuid": "81c0f179-a705-4a76-93df-6db0f6d265d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623806048, "uuid": "23728d59-35f0-43eb-bff5-050d5a2276de", "value": "f35e3b19dd1a1522795bea451201881a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca842ea-ceaa-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner)", "timestamp": 1623851531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851531, "uuid": "4e3b31f0-8d8a-4046-aff9-a7e977dea3f7", "comment": "Malware payload (CoinMiner)", "value": "5940ebe1b5ecdd1b1836dd93451ed4ee", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851531, "uuid": "dfbdbcb9-bb54-41bf-bdf2-74d87fe389b2", "comment": "Malware payload (CoinMiner)", "value": "ed4cbfd724dfcd5029fea047bbe12287fb7c277e5d89e0c828e6e69f209adfa8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851531, "uuid": "a99ba78c-8cd4-410d-8077-5b1b08cbe897", "comment": "Malware payload (CoinMiner)", "value": "de6a1057249a089f9f0431b3b6221ec30d317560", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851531, "uuid": "6bd660e3-891e-497b-915e-6134c4c6f62b", "comment": "Malware payload (CoinMiner)", "value": "126db84b56289485569271e4d18f5aba68ee69bb2e5ef6ff143e564dcec1ddc6221e4992bec81d6af1e63dc8b3ef826a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851531, "uuid": "5522db4a-3688-4641-b2d6-7a2d4fdf3fdb", "value": "7715A57E4F843D56565B1A5878FA0C293FE1652D2CE0E58F1E6200ECEE76FE7092314A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851531, "uuid": "490228a5-caef-416d-909e-b80adf1f8660", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851531, "uuid": "788c1513-f186-4fad-82b3-22145ae114c5", "value": "12288:TK/TmOuIwIvVAIz5hE831ScRsH7nl2fOX7D5iAU9R8S2tQBOahqzei:VIdt5h31Sc6H7nYOHgAU9RF2SpHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623851531, "uuid": "65bc9388-16d8-4228-8af9-6134d6c82405", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623851531, "uuid": "00fc113e-46ca-49fe-b4bb-2a656be2de2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851531, "uuid": "12039ccc-b0ef-4b7a-ac9c-6098bc69996c", "value": "ov7yHleMxubVfTs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826cd930-ce7f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623833260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833260, "uuid": "fd97bba6-889a-4d14-9ba7-4da4055d4daa", "comment": "Malware payload", "value": "5c503f766b32b45877700b980606c667", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833260, "uuid": "bcad0306-ac38-4184-8acd-8a90ff6ca53e", "comment": "Malware payload", "value": "ed932cb991c7464a20aa848a60d5584dfffe8a496c7104ea5af746df0f90d245", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833260, "uuid": "5c98f0fb-4be2-431b-9684-ded9c548412b", "comment": "Malware payload", "value": "67d151a6fa1c0ba9b88d21de7268806e9db0cacb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833260, "uuid": "08d4a92d-d2a3-4f87-9425-db2448a603c6", "comment": "Malware payload", "value": "b74bb0df8aa833b9d2e0a349e0e1012b894081e1dd634bd258b757366976310acc1cdd7dbbc44378621942a27f2b973e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833260, "uuid": "4f55476e-0cdc-4d88-a437-831db2d5b884", "value": "B7E3F83B77230A33C1C5043111E32731BD69D6CB35BA92C7B9E16EA95F1A9843856BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833260, "uuid": "b5a921a3-7915-4377-9ff1-6c576a2e12f5", "value": "3072:CGmEmIu+QePqoPxrhwEcgUcWmz/9kz74ZTcL/NO:CKu+Q94xnnBWmz/9kz8ZTcL/NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623833260, "uuid": "e6fe1cee-be8f-4457-bf4e-58ff96dd682a", "value": 146622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623833260, "uuid": "ffb66d84-b0c0-4788-8c78-08db47acf107", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833260, "uuid": "70dd6590-33c9-458e-a7f0-cfe9d41de7b8", "value": "5c503f766b32b45877700b980606c667", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cfa091-ce7e-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623832969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832969, "uuid": "5765b97b-b2ba-4cfd-922e-a67fea2293fc", "comment": "Malware payload (Gafgyt)", "value": "b0bd8389aa347e07717bd9d7a3a020bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832969, "uuid": "86df0460-ca31-43f3-9886-02b4b6865594", "comment": "Malware payload (Gafgyt)", "value": "ee52c16d53e08af2aba541cab956748b9c0d185a33256ef4bf95a2268f40f209", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832969, "uuid": "8e658456-7c6b-4e97-bbc8-6fa193ba7790", "comment": "Malware payload (Gafgyt)", "value": "125d3e8224b1e5d6eff9351c5fc479e7ea2f3d40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623832969, "uuid": "2eae49b2-0959-4495-90af-e0fe6c96ae1f", "comment": "Malware payload (Gafgyt)", "value": "6a23105a5d2375a0aef8c4c0314ede752d4c655707160571cceb44ba72fb20a1745c560b3200cef8d622896e32fbbae0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623832969, "uuid": "3e25b35a-9ead-439c-986c-ff74e80b8c0c", "value": "FCB3F97DF703C2B3C6830AB1124BBA264E21F9AB456ED94EF3281DB0AA27CD53115F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623832969, "uuid": "6089b54a-b9cd-476b-b0df-afe5e984ef25", "value": "3072:OcCm60cfHI4h/oKkXEJ/m7iyigLKxdGwfYJJJJJJJJJJJJJJrOJJJJJJWJJpJgnm:OxofKvGYEmzF40/RGnc+UG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623832969, "uuid": "a9443626-b2a7-43f0-9848-80855f4d47da", "value": 116602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623832969, "uuid": "90c4288f-8648-400a-9867-78cf77dfdbb3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623832969, "uuid": "ab0efcfe-e4ae-4633-9c6b-9e37afc94625", "value": "b0bd8389aa347e07717bd9d7a3a020bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7916487b-ce7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1623833245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833245, "uuid": "bab637c6-2deb-4ef3-be1f-cec17f93ad52", "comment": "Malware payload (Gafgyt)", "value": "1e784d5c2d9e53e6c6be097eda5efcf1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833245, "uuid": "9961ad37-af9f-4bad-94a8-1f7ab8be2f4c", "comment": "Malware payload (Gafgyt)", "value": "ef3326050b7e66addb015a7cc35a03772bf4679b728bc9b872a69ff7db869539", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833245, "uuid": "5b1fae1c-77b2-49f2-9aef-f5885485559f", "comment": "Malware payload (Gafgyt)", "value": "685b7f750068568d849ed156113fe42d40ab4074", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623833245, "uuid": "235a4912-754f-48eb-b717-2a1160272387", "comment": "Malware payload (Gafgyt)", "value": "1261d70b00601da02f8a8a980277e6daa5207d7747493fc4fe8f6c65dd65da34e8371af85375b0f0c0c3492ddb4a4569", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833245, "uuid": "4559d9a0-312f-4665-a61c-fbd99256e106", "value": "04E3E814F404836BC3D317BAA68A428C3F395AAB53DB3315BA345D742BC5BD92D369B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833245, "uuid": "3a41216d-29e5-4f54-a2bc-1c9c4e2f8303", "value": "3072:5A1arrkmAoe0mRnZaqSTdwhim043GQRLkvbE//NO:P/bAQmRnZaqtim043GQR4vbE//NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623833245, "uuid": "9d6be25a-ce33-4397-ba5b-53e5cec80397", "value": 145220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623833245, "uuid": "ee3559c7-921a-4b0b-bd18-1c8205c27eab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623833245, "uuid": "be5432ce-e0b3-4a7b-84e9-da66cf374f5e", "value": "1e784d5c2d9e53e6c6be097eda5efcf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be1886f-ce9e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623846591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846591, "uuid": "9071ff67-f2b1-4de0-8d34-e79b81a7a0c7", "comment": "Malware payload (Loki)", "value": "1d5642afb0456e0161dde56e23b37836", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846591, "uuid": "bbb9687a-17aa-4163-924e-c7ba2a46da0e", "comment": "Malware payload (Loki)", "value": "f0201869c74fe4dba4aac66549e332d9bf27ab2347ea8a6e7525110f0b927b0f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846591, "uuid": "a6a8fd8b-2691-4ece-aa4d-1f0a565aaabc", "comment": "Malware payload (Loki)", "value": "675997ba543ab32f0c47b7f8a1988cfa17e3ccb9", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846591, "uuid": "51057016-a8eb-4bdc-baeb-9b70bb4a98e7", "comment": "Malware payload (Loki)", "value": "d4058949729e8a236274ce08c524fad5f0574d91da47dddbef2437fceedf0009963103709ab33ec7ee1841b1044294fa", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846591, "uuid": "563d3f9d-5237-4e36-9b3f-212485717ba1", "value": "546533291BC67F09D16F1ABE0226D1B1981ACF655E06ED621336F78D807BD3169CF30A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846591, "uuid": "9f2685a7-93c1-4de5-bf73-945367c725f2", "value": "24576:+zFb4W4K4MtyWf/WG8P1FGhcXHzc8yeSlY17++vPDLo9vzXBpSv0ui:+JbO3Wf/WJP1AcDIesH6PD0vT+vni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623846591, "uuid": "89bb8b8e-c247-46f3-b947-90eab47bce9c", "value": 1510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623846591, "uuid": "b6e4a43b-fd1b-4b5a-8efa-4f5979b5c50e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846591, "uuid": "01a4ab14-3fb9-4e15-855f-05b9e779597d", "value": "Payment -SI-T2-068837 AND SI-T2-068858.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613b55e6-ce9f-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623846949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846949, "uuid": "7cecd8a3-a3df-45dd-a1e4-6eb58c030a50", "comment": "Malware payload (NanoCore)", "value": "1f2b73ef14f90fa0203944ecd4323af5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846949, "uuid": "0c8962a9-31f3-4947-8467-ac4dce735d34", "comment": "Malware payload (NanoCore)", "value": "f0fd4187f0a243a44965e40cce649a1756b3f02821827dc876cbaf640b25cd5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846949, "uuid": "c9ff0e1d-86b1-43c2-9f8f-a3547dfb3138", "comment": "Malware payload (NanoCore)", "value": "37d5eef0fced2bc24cd4467d1a0cb8130730adf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623846949, "uuid": "4aafd251-a8b8-437d-8493-05daa7024342", "comment": "Malware payload (NanoCore)", "value": "68e6362471a6329cf403188a2a3944e01fffe9be37bdcf831c0ba88f523586c879ee1dacd0ad67fd13917ed9c954379d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846949, "uuid": "9610462b-36d5-45be-8781-8e076691b705", "value": "2F251202F6D188B2D57229314A39BB25AE7E7D205F28D61FB3E4586CDF354806724BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846949, "uuid": "b448f7b3-5125-442f-9aa7-75a6889083a3", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846949, "uuid": "fa61f029-cb95-4e55-b523-0e86683a9d5c", "value": "24576:BAOcZpJ2nUYXpTmPK66hmR4H9H721x33+A:bzUawd6kR4H9Hsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623846949, "uuid": "9ea8c4d5-d192-45e6-97d8-be80f68c0ce3", "value": 992097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623846949, "uuid": "9ac5978a-4efd-4a36-b70d-403f08412cce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623846949, "uuid": "1bc49191-1d8c-4f67-a90b-b37a4b345213", "value": "1f2b73ef14f90fa0203944ecd4323af5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c172884b-cea9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623851405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851405, "uuid": "076992f9-24c8-43b5-9992-8a96378b387c", "comment": "Malware payload (AgentTesla)", "value": "443c07e45efe7794c6a7a8d5faa45f3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851405, "uuid": "7ac739b0-b522-4a4b-9394-09830cf69203", "comment": "Malware payload (AgentTesla)", "value": "f2585278fae207e76f61468c8db5cfb93a517cfb81c926da631182723e6c6fd8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851405, "uuid": "5f0a1747-921b-4155-a2e8-9375f57bf400", "comment": "Malware payload (AgentTesla)", "value": "05b09b54f046b32cc835a82fb4a335c79d476474", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623851405, "uuid": "91425ad0-0d64-4706-be68-da6867ad81f0", "comment": "Malware payload (AgentTesla)", "value": "74951424adf7ec4dc86217f52b61d1b30a482e46a3283e26446bddef25c2cfc316450667a3287e2d693adef19322b03e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851405, "uuid": "c4c0620e-558c-48fa-91b3-9f7dbee7c104", "value": "C2C423BD4C61C515B6CFFAAA536F110B5B84C8756B107A134E230C15AD3E86CC29E2BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851405, "uuid": "cf288b18-f4b6-4db3-bc97-3c13ed6b79fe", "value": "12288:eVieG28iv373Zzr8dkdQQqkdJ267EpJgP8fQBN9IU4PTUrfHL8:UieHfrnxHEngvPOfLULI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623851405, "uuid": "7cc4cfa9-7670-4775-963b-bdaf469c26dc", "value": 570822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623851405, "uuid": "1667eb92-4d14-4905-a9dc-1df0600329c5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623851405, "uuid": "b72374ba-df6d-4792-b2dd-48c080ded57b", "value": "70654 SSEBACT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611ade17-ce60-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623819890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819890, "uuid": "01965b58-1514-408a-845b-c784f0eceb1c", "comment": "Malware payload (AgentTesla)", "value": "ae2d103b6c3ba7db84af69ff3788f855", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819890, "uuid": "1c50c950-6b8b-4707-b17f-cfc1b9b9eb66", "comment": "Malware payload (AgentTesla)", "value": "f2919e2555974e4a0732228df78fbcf02ed5602bba91b20cbfe6a2c59badaec7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819890, "uuid": "c4c7cc0b-6432-4da9-802c-d83b04176b1a", "comment": "Malware payload (AgentTesla)", "value": "811f034e522fd1c9f4ad99d28daa680a649d0379", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623819890, "uuid": "9c12fb52-2324-4e48-9959-7d01b4032360", "comment": "Malware payload (AgentTesla)", "value": "ca22631b59ec496eef11e5a44304c5adf6a5779c90667ee377fb7f9a3126e66d45a8dab211b28e299808c19732c941c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819890, "uuid": "7a5563ae-2653-4389-b074-07f26788c34e", "value": "4AF4BE303AEA524DE5BA1B30097492D513F67B2ABB14DA2E2958124C9E73743CB21F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819890, "uuid": "b350855a-7ad9-4c47-ba9b-52ccc89d8b46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819890, "uuid": "fd15897d-07cf-4f66-af3c-eddedc0d57c6", "value": "12288:asPSbvquwaHpNtFkfBv36TMGTTgUTxF02BT0p2N4dvwgrw5rHU0BJcmN:KLquPHpNYAMiTgYx7A25b1HnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623819890, "uuid": "f3f5b030-c25c-46ff-afc3-70879759ff8b", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623819890, "uuid": "4bf5a868-680b-424d-bde3-1272462912ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623819890, "uuid": "723b7694-9a2b-4014-9835-e1b4e4cd30be", "value": "jqJ9rVHXq0LCZ6R.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5883e0-ce8d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623839483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839483, "uuid": "1a7512c9-3075-46cb-ad86-ffcd30156302", "comment": "Malware payload (AgentTesla)", "value": "a6fbe4fdaf0b91ff1149aab407b7faed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839483, "uuid": "086f0938-c4de-44ad-807e-ae17118d6a0d", "comment": "Malware payload (AgentTesla)", "value": "f35ea943961db78e81a0f568f05afac9500ec4f093aa4bb543fe25ca1722f59c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839483, "uuid": "da8d96e2-4ffe-4ea2-8551-0bc34d435208", "comment": "Malware payload (AgentTesla)", "value": "aef6222d308065bc89cf79d23d9f0ae0fbbbb6b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839483, "uuid": "a33e1c7a-6e3e-4ee0-bda1-c5a11808f66f", "comment": "Malware payload (AgentTesla)", "value": "451f23294633dee739531c2cd3c407708d6786c0ba19b2bb78129dc48334f87da4e0c5c9129ae2d59d713fc86d3fbedb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839483, "uuid": "966d7d8a-5216-4b99-8ca2-7011ae0f940f", "value": "9915D4303FB867D6E47AEAA145ABB447C9ED61FA260DC8CD5C5007C157326CB4AF2D28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839483, "uuid": "84aabe15-5aa2-4c4c-960c-5e6be8282afc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839483, "uuid": "e9aa25ae-8032-440e-8ed8-f1666d280595", "value": "12288:UKRFrBamCUqXhlm4S4F3M9y450Tynbf27f94iXgNxfRigpYVdn7MpoMb2/4060W:zRDamCnWzGagf94iORigqXRr33W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623839483, "uuid": "35ae16f0-f83a-4a97-885e-cb7348d176e7", "value": 924672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623839483, "uuid": "04f470a6-4262-4b1a-b22f-40b2ce97ce4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839483, "uuid": "577eae52-480e-4018-9f8f-9daf9f1f09b7", "value": "s0Twu0o3h84ZVXq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ae6739-cea1-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623847929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847929, "uuid": "5a8c0012-9943-459a-8d4d-14a362901065", "comment": "Malware payload (SnakeKeylogger)", "value": "60a8ab38ccc6c6d4b2d181bbf3e60cd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847929, "uuid": "8d568e70-10f4-4475-845d-3dc806412326", "comment": "Malware payload (SnakeKeylogger)", "value": "f3dfb1674daa417cb203423b8bcca979b47c97dc71aba3e0dffb995a11b63e33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847929, "uuid": "4d10dc89-4b96-407a-b3aa-b2833b8a69d7", "comment": "Malware payload (SnakeKeylogger)", "value": "02e6b17391b3ec901b33964e9bae087e39e0d126", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623847929, "uuid": "8a6844cf-2f4c-468b-b7f9-d5542388a470", "comment": "Malware payload (SnakeKeylogger)", "value": "4405f8f77f8f67879a45d69867fdf3292ebc0812459560b8dc40ce859635f360614557bed136adf05bdbc84354497689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847929, "uuid": "98ca178e-de40-42d8-9b6e-83e9fdd899db", "value": "2815D3303FB963D6E47ADAA145AAB847CDED61FA260DC8CD1C5007C157326CB4AF2D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847929, "uuid": "96c0b2a1-78fb-4d7e-9983-34407026d994", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847929, "uuid": "f9913b3b-43d5-4391-a63d-084c764a55e8", "value": "12288:V0hUrb+oWhlm4S4F3M9yAujiraMyRkAdYqb3suwKnjS0D5bU1GS+hhc+i:yEb+oyWPfeMyV6qbFBjbbUZO7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623847929, "uuid": "eeac1b56-4e98-4bc5-8685-bcf26063e604", "value": 880128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623847929, "uuid": "8221a409-9821-4b83-a6aa-02c2d4fea548", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623847929, "uuid": "56884f6b-0923-46b6-a8b7-85270bbd39fb", "value": "SOA_16.06.21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898c59ec-ce96-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623843151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843151, "uuid": "b2ed55ec-fe9b-4ede-914a-e4d6ccd1d165", "comment": "Malware payload (AgentTesla)", "value": "94d14490ba29a15e41576c25ecbd37fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843151, "uuid": "0233b5ce-f944-4083-8f3a-892e45e64cac", "comment": "Malware payload (AgentTesla)", "value": "f43f79d434a5568542cac2e86a63a1a3b06e7d3200985ae0311eef75cd6c2ece", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843151, "uuid": "f9228c10-0573-40ca-9218-91136f1db942", "comment": "Malware payload (AgentTesla)", "value": "d70bf75671345efb6dbb7c9f00fd3fc933b96c7e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623843151, "uuid": "212bb78e-debb-49a5-bf86-3d454c42c748", "comment": "Malware payload (AgentTesla)", "value": "1e87e72a2b1e74d7cc2ff973c9e6319e6b5ae131840d8636c7136a7f5fbb8917e1badf4715109ec4a01aa228ca58df28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623843151, "uuid": "27f0b5e3-909b-44b3-93a7-0b04f257b471", "value": "BF55AFF876047DE6266F576BCE96ACED13B617229ACBA4CC40647BC305A3375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623843151, "uuid": "64d58fe8-4684-4b77-80da-e4110917bbf2", "value": "24576:HBFeohGLeQWeXVJWUqXAVPsq7tuVYoI6RQb22Yy/bM671OY+AUvqHYCJeUTjDlRL:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623843151, "uuid": "346d086e-8cc5-4891-81dd-4a9a428df883", "value": 1323488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623843151, "uuid": "9fa40483-155b-400c-8c34-7b020eeca928", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623843151, "uuid": "57276cc5-7f8a-464e-b791-4ba519817034", "value": "PFF_FK_2021020040.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948d0759-cefb-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623886548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623886548, "uuid": "6fd9f27c-f4f4-4007-9d35-3a738d08d3f1", "comment": "Malware payload (RedLineStealer)", "value": "b87e45be7af4348b04e55e92afb7d4ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623886548, "uuid": "f3a723d3-944a-403b-8c34-3c29eb48c0ee", "comment": "Malware payload (RedLineStealer)", "value": "f450655116b9f90d2428f5cba9913c48079d390ce065d5c1d6ac158b1e262458", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623886548, "uuid": "71b6a47f-656e-480b-b326-f57866de0db9", "comment": "Malware payload (RedLineStealer)", "value": "68d950e2389751be923b80c44e0f11d69602fb01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623886548, "uuid": "4ed4b7dc-b398-4c47-a5c2-a6a7040056c2", "comment": "Malware payload (RedLineStealer)", "value": "50bcac4b3075f527f47db6cee9ace2bc5849b30be03900be4aff5607929ca4277f46492ca03b1940bef0a3180c7dc77c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623886548, "uuid": "202cc682-ebbf-44f7-a0e4-1532fa429cfa", "value": "2F84BF10FA90C035F5F612F84ABA93B8652D7AB1573491CF22E51AEE1638AF0ED31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623886548, "uuid": "a95df15c-5b73-4f8e-aa7b-128fcbdf134f", "value": "364098e961c6433a5f030e6d84a48050", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623886548, "uuid": "b4562213-26db-407a-a371-7442d2b095f5", "value": "6144:O1T6sIz7TOrP2DN8m6rtPBi80Od8fSLyX8LJe40F4Jtim/vlk:kCPTOrP2DNOrtPT7dLLxLJeLFIlvlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623886548, "uuid": "d381bb53-af86-4fda-8d15-dbbff1271f41", "value": 395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623886548, "uuid": "0c35d9be-2ede-47df-bde6-237696f015df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623886548, "uuid": "db1149e9-4691-45de-89c7-37c3290562f9", "value": "b87e45be7af4348b04e55e92afb7d4ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d051bf-ce3b-11eb-875b-42010a9c0053", "comment": "Malware payload (Glupteba)", "timestamp": 1623804080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623804080, "uuid": "0bbf6137-0ae5-4bd5-9b10-35a3f77f462c", "comment": "Malware payload (Glupteba)", "value": "4da006c3ae2c486c41f3007a2b7f4782", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623804080, "uuid": "c49d4fbb-80fe-4306-9d34-56e8ad6a686f", "comment": "Malware payload (Glupteba)", "value": "f454ea9fa15b20582eb0311beea5cc20e03e643a0a87b7c4e3fb848148873acf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623804080, "uuid": "ae087a0c-bfa2-4696-bf47-f0bf5788a1fe", "comment": "Malware payload (Glupteba)", "value": "9b7553d6c7b0786b7db1032440bd0eeb48cc6e5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623804080, "uuid": "8930fb67-9eae-4542-bf71-acf46f344ccb", "comment": "Malware payload (Glupteba)", "value": "5090ab5537eb31be56c63fcaa62c5d5e53409b61cb54c5cab5ed33af670630611e3992111547bb49361d755baf8bbe96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623804080, "uuid": "13555706-4a62-4ac3-b15c-6a295f738c9a", "value": "19263301A671D430F6BB21B49A750276E82C7CA0AF64C0CF75EB6BEAD2757E06831747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623804080, "uuid": "bfda8e35-c56b-4324-8f9f-957d1425935a", "value": "22d54580109f0c9a62e58d52129bb603", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623804080, "uuid": "21a21d70-042f-46cd-90b3-393d484563aa", "value": "98304:aDYM9XRrFXIaO2HHcZhIIBxAQiM6wEKxg+oIXcy+wONr:ETBrFXI5gmeFM6wQ/IXP+w6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623804080, "uuid": "5d10558b-3d00-44ce-bf18-c2dc71d954b4", "value": 4708392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623804080, "uuid": "b8b412e0-b3ac-405f-9172-8dfd61e16afa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623804080, "uuid": "2d572434-48c9-473a-9f7d-a408b815a1fe", "value": "SecuriteInfo.com.W32.AIDetect.malware1.3553.17710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abac2e4-ce8e-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623839690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839690, "uuid": "2ca7e0a5-177b-4741-ac5c-a41241658fd2", "comment": "Malware payload (Formbook)", "value": "355df45fcd248bbd5c89e579e9fba960", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839690, "uuid": "eb7c8882-614f-4f43-b16f-95f0d343e64b", "comment": "Malware payload (Formbook)", "value": "f49cfcb35472df4416a15ef2fdb156eef71e8b483d39811c19ed61d804af1da4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839690, "uuid": "316f36a0-9074-44b2-a4f3-299a2a6b8b8c", "comment": "Malware payload (Formbook)", "value": "75117b9075ba9cfe9f5f3b660428a1be63c16fcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839690, "uuid": "7aa0bc8a-fdb6-4da9-8167-ba70966db3af", "comment": "Malware payload (Formbook)", "value": "92bd1eb626ee7086d91a808d5b13dec152b8a93188e0043ace743e116c182f258e4ebfc0766743517bf9f59d8418aa38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839690, "uuid": "2307878b-3e82-4301-b710-eda5f51d4af2", "value": "7C34121A2EE5A5F3F0B58F384A736725CBFBB6050605017F1B6A6F9E37101A384A7192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839690, "uuid": "4ea722ac-31ba-4a3f-8f1a-2274cc73f72e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839690, "uuid": "dd0309e6-8529-496a-bad1-d189c7504ff8", "value": "6144:cQqTLg9qTLzjxDIArZdrenyoOTnIoShY4K05LRt:yk9oNDIwZdqSIoSw0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623839690, "uuid": "8b0da3af-fbed-48a1-b144-0656d8a72a80", "value": 241123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623839690, "uuid": "5ce59fab-d9c1-470c-a1b3-bfe4dbfdd36b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839690, "uuid": "878da18d-1fcd-48ea-9e3f-9ebfbd51752a", "value": "payment confirmation for our 30% deposit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359b5e2e-ce83-11eb-875b-42010a9c0053", "comment": "Malware payload (ServHelper)", "timestamp": 1623834850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623834850, "uuid": "6b40130c-df4c-4ab5-ba9f-9271f59877d5", "comment": "Malware payload (ServHelper)", "value": "1cd5d1139a357149489a5d6d081c8a5b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623834850, "uuid": "6bc0c152-8c52-40f8-ac41-abaebecf7142", "comment": "Malware payload (ServHelper)", "value": "f83900a393fb8d8318bcf8d1afe880bc482b83284fb74b0b99c66240caa0eb8e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623834850, "uuid": "6818333b-15a3-4eb3-a195-d0d6d6c7b0d7", "comment": "Malware payload (ServHelper)", "value": "e3fa09a37d0ebaa272226fb3bb905b40a93f19ea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623834850, "uuid": "9a52d704-14a8-4dba-bf51-31be23a86300", "comment": "Malware payload (ServHelper)", "value": "a26d8209130487be54741215e68cb36ca177b4800512bde311f0608f4e88630247efaed54bfd889111d3c6e7b8a433f8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623834850, "uuid": "233b0466-f292-4b29-a0b7-26c6f22ff3bf", "value": "7FF4234813C6D3B3F97A58719A402E68052971C9EBEFCD03937C6CB923360DA19DD0A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623834850, "uuid": "405d5f68-f551-48f7-b9df-ff861d417cf7", "value": "eb7697ac38be5e4fdd7bfeafa886a0ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623834850, "uuid": "dd4c3591-6b59-49de-a03a-8070a58dced9", "value": "12288:/6V/j5YFjRUR7xcWV1q8tp2iQUZy4KiHW2Z1P6JPp7STC6A4wFUkGl7V8IJo6Co9:slY1RaxVdtVhuAET2knIJonQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623834850, "uuid": "fb4f2ef5-f72e-4d5b-963c-6cde12601b58", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623834850, "uuid": "dc2ed181-a3af-43c8-a61e-f2f263d6eab4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623834850, "uuid": "9de051eb-f74f-4e92-ab8d-2bc249a133ae", "value": "1cd5d1139a357149489a5d6d081c8a5b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2499a57a-cee0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623874764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623874764, "uuid": "2f6ade36-d9f3-400b-a9a1-40de9209ac25", "comment": "Malware payload", "value": "57d941c6c2b1425ff9b9679024b8738f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623874764, "uuid": "43fdcfd7-fe8a-40ff-90e5-b40c4931b7aa", "comment": "Malware payload", "value": "fa9d1664ef9192b50228d7c21589f4fe9f3002faa503b39666a8a3bcd03ed635", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623874764, "uuid": "8fc05501-a552-466f-8f1b-0ad72cd5264f", "comment": "Malware payload", "value": "b502874681a709e48f3d1ddfa6ae398499f4bd23", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623874764, "uuid": "b6fa3e82-7d84-4bd8-9540-66a6176b3f9c", "comment": "Malware payload", "value": "cf40b11bb58ff76649e3bc3fe78898e1230e28848bfb9d7d720b053071f708c3b4af726c428069f3a0a57278f9e49653", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623874764, "uuid": "34b97a80-28e7-457d-9527-972a2b4674cc", "value": "EA762386B7C9EC2FCDB780360BA6472A41558C618A4BD753756CB12C8BBBDC05E46FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623874764, "uuid": "7b5c939e-984e-4834-aef2-648db6f326f5", "value": "196608:b0Z+QeHQ3zcTK77FMQ+V+Y4Bz/JdLdJ3nh3IwNdu:4Z4H60EJEv4h/9Zhz7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623874764, "uuid": "09a26adc-d54a-4ba3-ba54-6e3e83633339", "value": 7166633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623874764, "uuid": "015ea751-2ca4-4251-863e-119884006d9a", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623874764, "uuid": "37e3f219-dbe0-49a4-b71e-bb275594220d", "value": "fa9d1664ef9192b50228d7c21589f4fe9f3002faa503b39666a8a3bcd03ed635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102362b2-cea3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623848531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848531, "uuid": "7fd96b57-ca50-433d-8954-6f4574e85749", "comment": "Malware payload", "value": "981c541cb4dd9921a82c85286c23451d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848531, "uuid": "672a4fe6-4bb2-4f32-8b34-44f018f57983", "comment": "Malware payload", "value": "fad987a365400592f66296ab1a99cd7b77786b6e30c74d217646e94e8d111f5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848531, "uuid": "42cff3b3-7b9c-42d5-b996-236f596e86a7", "comment": "Malware payload", "value": "9cf1be9d49e998c16d0d33b85ac3ddac83d441ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848531, "uuid": "c9afa013-86c4-4f75-9043-c63e9aaba245", "comment": "Malware payload", "value": "49485bc7ea5c19945b0c489eb81d5abfa3063f6454d9f3bb9bfd5cb12b4a30943a1d81a2d364a48ea70b783c4147f4ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848531, "uuid": "5de9c61d-e08f-4a4c-964b-f2e47b1cd597", "value": "1525D01175B2C032E5A191B14D7DEB61917DBD340B620ADF73C01A2F6E20AD2AB36E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848531, "uuid": "162377b1-6979-45b9-a6b1-ced2a8ec1b64", "value": "af32313fc3f12018e1ca631ff1044218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848531, "uuid": "1bb9cb05-3780-4d93-b2d3-2f6d81743466", "value": "24576:DYCFCdoKbl2cVdrAXIwK3+XSTNkdBAnlXG6+Z1mbX:xsbl2cVdrKIX+XSkUlXF+Z1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848531, "uuid": "6df0f8a2-0efd-486f-8ae7-c25d70d59035", "value": 996352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848531, "uuid": "ba264625-3a04-4bae-9065-db0c318149c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848531, "uuid": "6276739a-370d-45a7-9521-0a1115d8ae57", "value": "gaoou.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac0990f-ceaf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623853756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853756, "uuid": "dca2d5ee-be2b-471a-856f-e17f832c1296", "comment": "Malware payload", "value": "ecbec27d80bcd8ff9f8a7ecdf98f2386", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853756, "uuid": "2b1dcf4e-23cf-4cb3-9c2d-9484342c73cb", "comment": "Malware payload", "value": "fbad8ba63b330966510ffc0e73d0b8cafbe51576680cc48c085af6fbdcee0edf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853756, "uuid": "414a5da0-2c9d-4afb-afc5-b25428a1ff98", "comment": "Malware payload", "value": "a2381db38c55c4ef43501b0de7a4a1674afea167", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623853756, "uuid": "8a3658bc-003b-4abb-844f-b9affe74d5b9", "comment": "Malware payload", "value": "adb162b2bef3f0b298a81748ab5b3e91f626cc03e129523d9dbe1173ad5797379d1fb83c566d3c50dff686889b9f5063", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853756, "uuid": "95a376a1-6154-43f7-9fdf-686ac0e16b1d", "value": "44A32A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853756, "uuid": "fedf9200-2bfa-466a-930c-1c6db4e79f35", "value": "3072:VSx+i6mqaObhN3nPNKV+qKmZuqQ4DPwXXtse:y6mRObn3nP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623853756, "uuid": "6f6f36f4-3e22-4aa7-b8b6-09db42e70cea", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623853756, "uuid": "f69bd264-e464-4879-97b0-dac17baeadbf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623853756, "uuid": "7934aab2-9366-4a1e-9323-b16536dfc491", "value": "ecbec27d80bcd8ff9f8a7ecdf98f2386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10dbdad8-cea3-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1623848532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848532, "uuid": "fbe70e64-f235-48af-800c-7ec6a4c5eda5", "comment": "Malware payload (Smoke Loader)", "value": "a6dc8feea9fcd0fb5b5ffe10b9d345a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848532, "uuid": "6aa36133-a0b3-418d-b236-5fcaf3670089", "comment": "Malware payload (Smoke Loader)", "value": "fbfa62c89bfaaed698109746a79c019e2143c497371f5bd2a8f7ae95cec195f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848532, "uuid": "3885e50c-5215-4130-9b38-e5ec5e60439b", "comment": "Malware payload (Smoke Loader)", "value": "6a886ae6078d84f242b1dafbcdf8d7623ab8829f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623848532, "uuid": "f6d3d41e-0244-4c0d-8b5d-65924d24d6fe", "comment": "Malware payload (Smoke Loader)", "value": "fba1838afb4523902c84dbf1381a7b9b32e907bfea22fad48aed4b9a378797a55f5fcce4b96d000cb3458f137f232e37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848532, "uuid": "a2a9a7fc-6b91-4069-80d8-67739f852259", "value": "C7748E00A7A0C034F7B316F859B99379A93E7AB1AF6490CF56D11AEE46746E0EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848532, "uuid": "8419a2cd-1d73-4b56-b039-e0b53ec87577", "value": "f15a946d6e0659432dc9b8c464554438", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848532, "uuid": "6cc2e460-b8cc-4c61-950b-6969dc800969", "value": "6144:iO09zN9kcvZTeWPaxPXc88SXc16Jiecj:i39zN9kcv4WSxPXc0Xhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623848532, "uuid": "a823b294-9e9d-4087-b99f-7dc79779a1d5", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623848532, "uuid": "570929c8-7497-480f-9ac6-6f4fb2008958", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623848532, "uuid": "eef0b05d-0afc-4543-b84c-7a8fda939345", "value": "toolspab1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b14b31-ce88-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623836967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836967, "uuid": "f3e35655-4e0c-4dc5-990f-ce1cb0b56e19", "comment": "Malware payload (AgentTesla)", "value": "b6d32254c5e3faa7fb26cccabddad2f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836967, "uuid": "f88d179b-1fcb-440b-988e-164d5fa7e2f3", "comment": "Malware payload (AgentTesla)", "value": "fca7f5cda93c9f473a6c3e9c3857d19d69c25835fd71b21d8b1354f78b102397", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836967, "uuid": "bf2f7a22-98ab-4434-8e98-0b6d7c4d0ddd", "comment": "Malware payload (AgentTesla)", "value": "abf474e378247ebeb3300de929a50d0996286c01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623836967, "uuid": "e707cdd5-3439-4d94-94d4-9f99dbeae69e", "comment": "Malware payload (AgentTesla)", "value": "8d8c90404ce972cba982a4cc381d69c32615922ef47668ed9412b653a140aee1074f204df080d8c83a3ab36fce09b6d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623836967, "uuid": "7a8e5d0a-3555-49ec-97df-3ad7a604898c", "value": "2B552326F2E6AB6FC46BEA35115A963590BACE446318820F3C3C3F5C30762B61BD7754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623836967, "uuid": "fb1c9539-ea2b-4d37-a880-d97a89e84c3e", "value": "24576:Iw3AyaaFIkkLcYNbKkk7Sao4tdu4KeoSds+bpU988T6CB6u7Vz7Fnsdl:/z8lADdu4gas+bpi8y6A9VvFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623836967, "uuid": "c56202a7-8481-45cb-a7fb-3697d761552f", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623836967, "uuid": "2df5da54-a8dc-4e2e-a083-037a82f2a46a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623836967, "uuid": "ab776c9c-bf5c-43bf-b992-b58d16efd366", "value": "AGG POWER RFQ.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731ba8f0-ce8e-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623839677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839677, "uuid": "69e21610-cc6b-4e5e-b37f-caf56cd96273", "comment": "Malware payload (NanoCore)", "value": "3cc1fc44528e15dc74b28142059376a9", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839677, "uuid": "6d6c7c43-57b6-48ea-a0fa-d9c016d55bd9", "comment": "Malware payload (NanoCore)", "value": "fceef2124ae276c4eeebdeb15194e3aebe3cdbbcd58d7d4e24f5d102b17c4845", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839677, "uuid": "fa0eb2f6-9d19-497f-aa7d-02fff2b6aa8c", "comment": "Malware payload (NanoCore)", "value": "46623fee347e93c9e86771c9f7cdb8785a12eebb", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623839677, "uuid": "e0f69948-77c9-44f9-8cf7-93e99be1f250", "comment": "Malware payload (NanoCore)", "value": "153d421723d5c435db9ec45df173d6beb26f64ec4d4170bb7856f93f3f08abf97e3fd1ce5242c38db426319225d92f80", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839677, "uuid": "e8eaa0f8-68fa-4762-aeef-552b9813a940", "value": "C605334EC46A4CBF974DE4BC472869C6D3F36F7B6118C113A416A48DDD6EC188BC9C4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839677, "uuid": "2a731fc8-6d29-49fb-bfc7-d5adbd5c9aa8", "value": "12288:MdxZd1QO+AgHPIrQyunU7SRZXT30Fab8P0OhHKtT6/kHx63HdBR9UO37FKUg1PPm:Qd1EtnUMXjhwPatu8R6HFL7M1PP3+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623839677, "uuid": "144d4aeb-d09f-4e6d-b5d5-3aa93ab63746", "value": 873284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623839677, "uuid": "d36e392b-48f9-4b2f-984e-997d3ae34f36", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623839677, "uuid": "fcb37a04-d75f-432d-8d89-ff419744d0e9", "value": "3cc1fc44528e15dc74b28142059376a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc10f482-cea4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623849302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849302, "uuid": "d717eeb0-fd02-4c35-aeca-7b7f187bfb4e", "comment": "Malware payload", "value": "a0e3744d73c48d87c308bb7ad55ee126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849302, "uuid": "b5ed8259-dc51-4034-9988-0bb02b14002c", "comment": "Malware payload", "value": "fd1b8e92a7096cfe5761de6fd47aa9aec2d4f544e69c513d40057d66e0000fe7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849302, "uuid": "f5f69a7e-03cc-4ed5-9914-785bbbc87e86", "comment": "Malware payload", "value": "7854b43d58196a9c3ed2544acf7624af6a687ff4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623849302, "uuid": "ce91e6a0-22ad-459c-b18c-2d8dc7b31a4b", "comment": "Malware payload", "value": "872b3d7576ce4ef09915b648a6d474a4367fdd2c04c4b89919b1e4782b28f5506dcc6480b1b739f23766627aa17b52cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849302, "uuid": "d9a361be-7dee-4255-bdc9-b5f525a483e6", "value": "D4F423851F4E0C6DD16B04FCEED5A7AAA3D54E08785C1890FFD872B464B6CAF21DE212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849302, "uuid": "de24f12b-30c5-448d-8262-18beeb0e532c", "value": "e683988345840af6d99d27f0f11ec866", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849302, "uuid": "85c8b62d-8800-499d-9fcd-f5a54b50634a", "value": "12288:Jzwg9X9rE6I+IMXhojs3Eoxp+0jRQyBTDO+lGhZbu3dy2Pquce8SmRkiBdVYd7:Vwg9tr2M0qE6pZjRCZ5Ace8dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623849302, "uuid": "8abe6286-32d4-450a-a577-a216c4d26371", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623849302, "uuid": "c8cdfb5b-9ad7-4c10-a58b-a3fc2938b9a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623849302, "uuid": "6a655573-10c6-407a-adcf-a17d94419d80", "value": "md1_1eaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e656fe-ce88-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623837179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837179, "uuid": "7afb5c4f-5a4b-429f-97ec-143f759de895", "comment": "Malware payload", "value": "c811bfeba8f5ecd3fa4fe6e65dcc46af", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837179, "uuid": "86c05a96-bd71-406d-9e63-850c69dd3ae7", "comment": "Malware payload", "value": "fe5b31f0bf9c8a120cd21da9a474ca1b083af0e23ee0e29ca42939009aa4e149", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837179, "uuid": "d4ad72eb-b1c4-44da-8371-c41a54f61ec9", "comment": "Malware payload", "value": "32bd41b37872d0bd3d6376abbb29b8d0da47f1ac", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623837179, "uuid": "42d1837c-e5db-4ae5-8181-960d1e0229a8", "comment": "Malware payload", "value": "d1d445b7cc5f5b7f8ffe0509464fad4211d01890b229433682a494ecf21698b8b006f35992752e28e467b727348cd156", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837179, "uuid": "e0845b2a-69e9-423f-a486-054d7cccc2cb", "value": "C78557F0AD01D4C1F57A5B6AF2FD3A48A1343217EBC94A4A00E7E6551EF6A11F90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837179, "uuid": "0d2df617-7eed-40f0-82df-eee0ed271b51", "value": "12288:2NpPfQ5Q48Fr8jzOpbXW84abtMCF2XdO/hTtGL6oRkrG2X4:2NpPfQe4ZmpbGs32XdO3GL7+G2X4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623837179, "uuid": "cd1c21f1-d162-4401-bada-225fd867ffe3", "value": 1710047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623837179, "uuid": "97b4a071-dcbb-43fc-b017-d29c2ea92469", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623837179, "uuid": "aff5d244-8150-4980-838c-bc099160fb61", "value": "PO-0814.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb0fe78-cee2-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1623875830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875830, "uuid": "c30a83ec-2ae3-47e1-ae48-95890fbb05bd", "comment": "Malware payload (Hancitor)", "value": "9daff85ab2407899c068c2bab8ac8124", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875830, "uuid": "01d4e93b-c036-422f-8b7f-440f73ae7c08", "comment": "Malware payload (Hancitor)", "value": "ff86817badae0c38882911f4ce944b3429a2b6f9d0c9a87503f18b2a491c8984", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875830, "uuid": "0d40befd-8ccf-4855-87bc-f3cd0fda9e44", "comment": "Malware payload (Hancitor)", "value": "b5dc1182d292a35b84a482c11060797ab4dcca3d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623875830, "uuid": "4d2f7767-ebac-4ee4-afd2-e262d4ee8b38", "comment": "Malware payload (Hancitor)", "value": "8cedba5857ba91ef245b879d527b7150fd5b5d63c786c973873b8d635cc08d29dc37627305607a5688a792c6615ffc5a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875830, "uuid": "73fb2022-3125-416d-ae28-1ecf6e154282", "value": "7BD45B00F651C139F4B741BA46BB9668AB387D706B2881CF73C57A9E5E349E29C31B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875830, "uuid": "2c6c15a0-5392-4bc2-861d-919393c46256", "value": "37fafb473194256b2b713a1bfe22a425", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875830, "uuid": "24b6b676-8b83-4d90-b906-a0da16fae2b8", "value": "12288:AZf+1ahU6QgtvG29kDGlBkJI6hxzee4LK2pFKkTRb+J0:AZf+UAgtv8DGDiIwJePe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623875830, "uuid": "420bdfa2-37e3-4bde-b071-482f1d37d00d", "value": 625554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623875830, "uuid": "2475fdf4-d207-4b1a-a203-44a90f9682d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623875830, "uuid": "fcd2b5b6-0cc1-4767-9891-0c38f584e54a", "value": "ff86817badae0c38882911f4ce944b3429a2b6f9d0c9a87503f18b2a491c8984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }