{ "Event": { "published": true, "date": "2023-10-31", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-10-31", "timestamp": 1698796981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "dff83cdd-4efa-448d-88f0-60ec7e935a97", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de3f05f-77bf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698737295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737295, "uuid": "d20872a7-5ad2-4646-a7b8-ee07e7cfd09a", "comment": "Malware payload", "value": "c85ba8556fa4bd3a31095d15cd07a324", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737295, "uuid": "32762df8-d443-477d-8148-5428da71e791", "comment": "Malware payload", "value": "012bab7af9766c9f97951aee276cbe3d640ec8af8916706d8a21c724e2b01748", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737295, "uuid": "5c06844d-77db-4b4b-bac7-f0609f57bf5d", "comment": "Malware payload", "value": "43750651e24f704b1e581d2d657b272a5963930d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737295, "uuid": "c7bb39dc-f745-48ec-a6d7-5e2559ae448b", "comment": "Malware payload", "value": "d4df2c5ff3cb52a6faa69a16b1b0fc9d73b52d5db0b15cbbcaa2778d8efaca1aabbe9489307d3661128382b8bbde4834", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737295, "uuid": "c45de840-3bdc-45e6-84df-b391c5b898f7", "value": "T1E2836CF5DB99161D0D4B2AEAEC024951C9BD802D5623052AFFFD438E620799CD3BEB0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737295, "uuid": "7429449f-f72f-4ab6-a88d-4020dd17850f", "value": "1536:DOLViIEfAPQ7DNpDTBqPQg/72ooUlPofyuz47jlk6:OBEftNpDcP//72onlPorkl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737295, "uuid": "cc54b5da-99df-47cf-9ddb-7a9058a319fd", "value": 85043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737295, "uuid": "2b7728c7-d428-4c6d-8df4-4917da6ce22f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737295, "uuid": "5c174835-c8fb-466a-9086-9e57fa347f63", "value": "Pedido Novair-MTA Madrid 2302970 D10B S 18,25 O 506.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9979c2e8-77a7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698727221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698727221, "uuid": "291a4f91-d67f-459f-92be-72207b426f44", "comment": "Malware payload (AgentTesla)", "value": "f2e06185fce9eec9da284b85d34a130e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698727221, "uuid": "449cb177-c3e3-44f9-bcde-ed4d1803b6a0", "comment": "Malware payload (AgentTesla)", "value": "024cc35017b7cf3e59c195fe45d3fd56ed418035fe7cd157d18ae2866632fe1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698727221, "uuid": "5618e38a-f005-4d6f-8e9e-04d7770b41ad", "comment": "Malware payload (AgentTesla)", "value": "cf40b9eee68a3a8a057adb94dd584714f95cd687", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698727221, "uuid": "1d31bba6-b170-4862-9961-aa0bcb540516", "comment": "Malware payload (AgentTesla)", "value": "32831f02859d875d8127636f7bc5f036f1a4f6758f73e2b8d853edf52b819f6a4d5775a6c06e61e4013541537c880341", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698727221, "uuid": "d6b3db56-3a96-4a3d-ab5c-983868cf1ec0", "value": "T183D423106798DB76D53403FE99707C10C7F0A5236A26DF888DA3A9CE1B777C51BB40AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698727221, "uuid": "16727961-6d09-4f65-9646-30d651519c5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698727221, "uuid": "0f79313c-7185-4a92-8c12-2a3845fe86c0", "value": "12288:eUR6voa0w33PtcIkezhlS9qVBNhC7aNoXOGIf042Hr+4cwWVP:eUR6FamVR6QfsH2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698727221, "uuid": "d6f3637e-8288-4a9e-80f1-28aea7e45129", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698727221, "uuid": "60b54705-b1f7-451f-b754-4fbcd9d6e6d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698727221, "uuid": "b484ca30-c7b8-4539-b2ae-793a3ebc8c92", "value": "SecuriteInfo.com.Win32.PWSX-gen.27382.275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8656f6f8-7785-11ee-8907-42010a9c0042", "comment": "Malware payload (RecordBreaker)", "timestamp": 1698712586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698712586, "uuid": "f8f4a4e9-6844-49f9-82c9-4ce5225e7843", "comment": "Malware payload (RecordBreaker)", "value": "98a324a53aa5215cfc1de54749c4f6d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698712586, "uuid": "cdb25a91-8c0b-4fc0-96ac-f0d672058b2f", "comment": "Malware payload (RecordBreaker)", "value": "04836b7086652d74ccafeb84f7da6145fca82327358fe38c7f787190213a3b2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698712586, "uuid": "23332d64-2afc-42a6-a02f-5114f6b8db6e", "comment": "Malware payload (RecordBreaker)", "value": "f7070df7f3e1129f0d2dcaf79f2e6e3827472162", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698712586, "uuid": "cb5dcbb2-fc2b-48d2-b07a-16b394c10f4b", "comment": "Malware payload (RecordBreaker)", "value": "da1928e131ed808e411ee0c0fd555907ba1d459b92b368c46ebe19f9664530a03cd94276f5dd34009591e58b15078692", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698712586, "uuid": "b20e4839-65f9-4671-8d44-a7ae16a7059c", "value": "T1DC752366E5E0C072CDFB437898B751432D36BC7748B04AAB2A5AD40B5DB32D8B931727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698712586, "uuid": "73879dd6-20a5-4b7b-8af9-f0a8b03c95fa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698712586, "uuid": "409a037f-457b-48bd-b3ab-d5a3dd3c6e96", "value": "24576:KyKdMVERzAu/WgKJygLCFrH+0+4ZMDtb1L3og8zHaiZHNkV:RKdfp9/WgKJxOxmXd1Ll8zb/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698712586, "uuid": "c360b68d-39cf-4c64-9591-570a5d0bb8b6", "value": 1612288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698712586, "uuid": "986890a2-ff34-411e-81d7-24e86cd869ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698712586, "uuid": "e33989e4-9b7c-45e1-84be-2e5ff3da4cda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43b46a5-77d7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698747962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698747962, "uuid": "17745673-35e5-4e64-a5f5-1fd9d49867da", "comment": "Malware payload", "value": "2042c36a089ff5785b36b9ad67c809b5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698747962, "uuid": "e16f23e5-07b5-461e-9d42-7d2bbce39901", "comment": "Malware payload", "value": "04f505a220f64514e905c0ce0f6a4897b0f52edabf29c9e26154098002ce502d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698747962, "uuid": "a74bd4ce-0a85-4d51-81de-03fb7391fc59", "comment": "Malware payload", "value": "7e96ec63f372ae90ba2cf5a11246ffa959dfa124", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698747962, "uuid": "f7e7669d-1f19-40f3-8cab-80f0d472dff9", "comment": "Malware payload", "value": "b3b1a3c1152d8687212f85bf1f391189fa04196c4033c7138a82e84d5f9d7c3620d3985706d8788140ba756d5b4954b2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698747962, "uuid": "84905272-16c3-40ee-9774-3a89649545b6", "value": "T1A7B349EC7643B4F508B730A7566F7146B93248A6B40C8850D40AD9E03E3CF9A6577FEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698747962, "uuid": "911aea35-d28f-4449-b6bd-edaf0ef98a31", "value": "1536:76L9P7O0olzok2TgP9q5v3oIviG5UDLp1Us7Fvb/l5:2pOO1oIaGWD5Fvb/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698747962, "uuid": "bfdd682f-b8c5-4cdd-90e0-2b1e8b6e5186", "value": 114317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698747962, "uuid": "458910d1-0105-4e45-aa5c-d46870176411", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698747962, "uuid": "b8d89ef0-a15b-4913-92f0-ac9985c9f8e5", "value": "Voluptasl.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0d97d7-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698734985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734985, "uuid": "798c9850-7c9c-425f-801a-182e3c1a2d5d", "comment": "Malware payload (AgentTesla)", "value": "78ada50ce36766f99bb926a03b08da24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734985, "uuid": "b7a3e169-b980-49cf-bbb0-2bf52d0b7060", "comment": "Malware payload (AgentTesla)", "value": "054c022a4017ee1e3eef08de62cb63fe07364414eff467796071bb8b734a755a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734985, "uuid": "da85cd6e-2c84-4f57-88b0-195ffdd1569e", "comment": "Malware payload (AgentTesla)", "value": "cad406eb61d182ff87b2a9543868b3e5805fd5ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734985, "uuid": "2ba98741-c90a-4745-8f81-88702dbbeacd", "comment": "Malware payload (AgentTesla)", "value": "1d88968ab0dfaa62a0b17cf8580876387ca8aea129ac2659ecbf776a9e2844b29d55a4f32dc153db01369fdbd466ca24", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734985, "uuid": "557e550a-b86f-4fcb-990d-54c146091c3d", "value": "T104F423C049785EC4AF8C5355AFC479A90F1718F8A659092BB1FFD88D4AEC8C88694F4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734985, "uuid": "19c5846e-bc8e-43b5-a688-355b6e0a00b0", "value": "12288:TYJnW+aaYdD1OpWtwRUMqx79U2858bjqtw/UoCQxTlIhVcY48nz2wmbxkjcCsjlq:0iMItF9UZ6b24wQxiDBaxknsjFA/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698734985, "uuid": "c28aa929-96df-40aa-87b4-9a4d5f0bdfdd", "value": 775422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698734985, "uuid": "5fcf7dbf-ffde-40a3-bd89-d05df6a34671", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734985, "uuid": "92f0a354-51bf-4c4f-ad99-ee177cb07e4d", "value": "5Night-6Days.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d726f512-77bf-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698737632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737632, "uuid": "15313588-8c6b-4cac-9635-6a32b7a8307e", "comment": "Malware payload (AgentTesla)", "value": "8f0407eeda0d3b174b1e7311af6a2672", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737632, "uuid": "f541ff1e-18e1-477c-bb53-02d474dbe2b5", "comment": "Malware payload (AgentTesla)", "value": "063e4b63caf9681bcff01fd5c7c9f0e7ee5d0b3fc35d79438137f721bc1e3c7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737632, "uuid": "e4a28585-d3c6-48e3-9533-fb9717a1a2e5", "comment": "Malware payload (AgentTesla)", "value": "cd5e92ad0e94e6d693493b23803e2410109a609d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737632, "uuid": "52a0d94f-00f6-4a68-9dee-801bd6062dc8", "comment": "Malware payload (AgentTesla)", "value": "a6ee086e2afe40e8575608a0ce845278ea52a3dbd1603530aee62cceeb907fa010f2bced872c88de22d02696e62ae6ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737632, "uuid": "0dc7e593-8111-46ab-978e-7cccf2c2686d", "value": "T10B55C003E940CB83D41C83F46EA34EE91B56BF04E9965ACF205ABF4F3E706621D5B51A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737632, "uuid": "f2216b41-ee51-4261-a358-a6735ec86648", "value": "24576:FuBSw6/uZyq3bV9kw6/WZy43bV2kATo5oThYJf+hlkyn0TLROdCwwx:06/4b3bVF6/AP3bV2TTht6f+hX0TNbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737632, "uuid": "b1bfd63c-bdae-445e-b55f-b2b14677e0e2", "value": 1301504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737632, "uuid": "8f2dba0b-f7da-4ae7-9909-348d8f09c638", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737632, "uuid": "2f47657e-d433-45f4-9851-b73d9a2a5e49", "value": "Payment details.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0449a3c2-77ce-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1698743721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698743721, "uuid": "26541cde-d289-44af-83ef-a5a53e295755", "comment": "Malware payload (Loki)", "value": "d9742026719e39649e6bcf5a9966080b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698743721, "uuid": "a8d60540-8f3b-4665-bb8c-f16e0b074cd5", "comment": "Malware payload (Loki)", "value": "07177892c2c47e5827bf6504ad8b7047771674b164fa8a026b9250f831560cfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698743721, "uuid": "6764b07e-c3cf-46d3-b0f8-a0ba5f38dbf1", "comment": "Malware payload (Loki)", "value": "d637b4ac4a2e0a73b8b80c62943bbaec0dc2777e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698743721, "uuid": "11be6f74-822e-4a1f-868b-e100b70bc721", "comment": "Malware payload (Loki)", "value": "4a76f021618805eb85a2ff6fde4bdb361c20ce9fb84c3dec14497038184141cc4352e10adb05368654b8eca912968097", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698743721, "uuid": "9095da65-007f-41d4-8c45-9445787d0223", "value": "T1AAA413B477AC562FC77E18F9141BA400C7F092F31592E7D38DE2B0F562AABE40A5524B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698743721, "uuid": "5090e0f8-00d5-4239-b80e-774cd306e582", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698743721, "uuid": "a67240d5-f4a0-4e77-aa66-b0aa77df1d81", "value": "12288:LZoa52c6bFW2NU4vVKKzmN5ALp6jTB4rmbZ9+Q9IjN:dcbM2a4AN5AV6+rhqeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698743721, "uuid": "1d79b5bc-2186-4e8a-8c7e-0ee63c5d250a", "value": 456192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698743721, "uuid": "1a77acfc-f56e-4cc2-8a52-0d3216cb34e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698743721, "uuid": "29ec8ba5-6c90-499f-ab06-54f8a7f6fbf4", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e7ac57-77b8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698734669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734669, "uuid": "5421b774-aa0c-4c27-ad41-cba192c6b8bb", "comment": "Malware payload", "value": "0be3f3bb55f7734ade385f01ec838cb1", "object_relation": "md5", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734669, "uuid": "8a5bc00e-dd29-499b-bb02-3f3290e769bc", "comment": "Malware payload", "value": "0793c68895b8d7f60a6dae506ac1d4c15c6106978d3ef0fc4c4ecd4d7f9897ed", "object_relation": "sha256", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734669, "uuid": "f17ab048-38f9-482b-83f6-c49a4d31bc21", "comment": "Malware payload", "value": "7ceefc71039ab559b8f736f3bbe16f8e0680d795", "object_relation": "sha1", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734669, "uuid": "a8a6fec8-b054-48b3-abc2-b4433d73c5b5", "comment": "Malware payload", "value": "c6137cc6413d5467ee843ba595a7b7add7475f56e47eb821800b7aa3086256246135f9c3d5cc9c8a29ccac2bd0948eb3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734669, "uuid": "0d9948d3-bf0a-4903-aee9-2e5125791f40", "value": "T1C355C003E940CB83D41C83F46EE34EE90B16AF04E9965ACF215ABF4F3E706625D5B51A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734669, "uuid": "021e0f2a-e5cd-4306-a317-42f47357cc25", "value": "24576:vuBSw6/uZyN3bVT6w6/WZyH3bVQkoTIpw3hwJfuntMyn0NLhidiwhx:a6/483bVh6/AO3bVQDTpxCfunH0Nd/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698734669, "uuid": "2d074d06-2044-450a-805e-abde78c8f00c", "value": 1300992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698734669, "uuid": "99ac71de-8c93-45fa-adc4-f75973f927b2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734669, "uuid": "a3947906-d1f2-49d3-805d-c31ef7abedf2", "value": "BL.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586ccfb8-7811-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698772638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698772638, "uuid": "8eeb8684-7863-4c17-be2a-54382a608a53", "comment": "Malware payload", "value": "51162ded57e5aeda4eb0bbe6ed5d52f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698772638, "uuid": "b7617228-3654-4531-bfca-ce18f34bdce6", "comment": "Malware payload", "value": "0796818dc3510e88a966f0aaacd201ba162c46e0bc0f7c670ffbd43df485f5a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698772638, "uuid": "c585ebd5-bab9-48bc-870c-755e5ac12d4f", "comment": "Malware payload", "value": "2ecbe066e991d04d41b1143ba316027ba58ab816", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698772638, "uuid": "de9dd70d-b5b2-41d8-94bf-9d22497eb239", "comment": "Malware payload", "value": "5d4186debdaa52970451eb846a48ffd7dd7f71b7e967486fa3aeaba0c05d049f679bc7f879176567119ad6b77abc296a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698772638, "uuid": "11ada592-38de-4e41-9551-69bdcd7914ae", "value": "T13C44E01263A2C8B2E1A786766471C9A55D7B7C321A71C1BF3328173E8EB13D09EA5713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698772638, "uuid": "f1a8fb37-13cf-48a6-88ea-cb4856615a4d", "value": "1a18a9d4050d7d94c088092fc252cc06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698772638, "uuid": "190400ce-de31-492f-93ab-fa3e2db59f06", "value": "6144:M7WsA5vWxbjNZYfrMChNhGd2v6GWscKX05j12:Ma9WtZiftWVa0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698772638, "uuid": "6e045a4a-ce32-4c83-856d-e00c4e7001cc", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698772638, "uuid": "fb235675-078b-4d05-a0d7-ebbc2a9572a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698772638, "uuid": "cb7870ca-342d-4403-9b07-cea064dde5e6", "value": "Hunlipaos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d26703-77aa-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698728260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698728260, "uuid": "96a2c122-267f-4e92-a84f-4dfa7a1d9768", "comment": "Malware payload", "value": "6bdc955082c6e6be03060a1e599e633c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698728260, "uuid": "b564171a-a9b8-4b37-90ab-6563e02d8f6b", "comment": "Malware payload", "value": "0810679151ad00c322a2f8d0f549dc1dd4d09fb65428cd91efd81fdd95e1db10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698728260, "uuid": "a85830de-e8a6-474d-9490-a91316cca209", "comment": "Malware payload", "value": "2b3b0abdbcb7cc363ba52c8c0c3fb6840092ab30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698728260, "uuid": "f969c739-f159-4e95-8d88-2f802fda11e1", "comment": "Malware payload", "value": "c04f29f1e8939678fb0334fb3acc055786fa68563a51c616cc5288d3d28b0526139458ebd69fec74bee87719c35c0351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698728260, "uuid": "60189901-7f3b-427b-af7f-bc860759a4b7", "value": "T14EC52300B241DC42DDB906F41C6AE2BA50743FBB641EB56337817AFE2AF2E31954F256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698728260, "uuid": "84cac872-bae3-4a32-b24e-0ddb0591c026", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698728260, "uuid": "4fc10005-3411-48c5-9968-8c3887e4ece5", "value": "49152:CT2s5FXQ4EmojLjCRELVf7Avil+dHIsLp1thIikN+6u2hs4:CBzX71oDCRAZUviAHImDqia7hs4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698728260, "uuid": "ae4dbcb8-b46e-4fe2-8be0-aadf7b080955", "value": 2671886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698728260, "uuid": "df4517e8-f81d-4277-a344-ee78184e3093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698728260, "uuid": "fccf0ba3-0d12-4fda-9403-41abd8ccb898", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5eec1e-77ea-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698756106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756106, "uuid": "5518d7e1-7ce2-4238-9ba8-17256539dbc3", "comment": "Malware payload (RedLineStealer)", "value": "26b43cadf6622b3d0e50bf3763cc5180", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756106, "uuid": "9d31051f-e08a-4f15-9ef2-7c781fe0aeea", "comment": "Malware payload (RedLineStealer)", "value": "089fe1a7004a07e2fa5a8e706359b2d8d0b141bbc4719db9bc378e33b0771764", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756106, "uuid": "4f9b642f-c6d2-4fea-ad49-f5cc4a03ec17", "comment": "Malware payload (RedLineStealer)", "value": "d84d2f83975f74767e7d398e8ad039be00c47598", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756106, "uuid": "b9affef6-7cc1-4878-bede-8ef480829fe6", "comment": "Malware payload (RedLineStealer)", "value": "3d0178c5553968175cabfc10ca4ef12209b6a4020bbb200aebc20fa080e13c932511e7c12f62d61756d2701c2065a07c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756106, "uuid": "d102d3e4-93fa-4a3d-89a9-77f4ee9bfbee", "value": "T17085232072A484B3C4B6217095DBCE31AD797431876935DBBA9D7A6B6E603D433B30CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756106, "uuid": "7107bade-2fca-49a5-bb25-441754310ab5", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756106, "uuid": "8d02b8b2-f425-44ed-a8a0-f731c4905d99", "value": "49152:xkQTA+5XkXJqDxHtrZPfnV2gAUCkSbVRb0ilg7/mHHH:xa+9kElHrIjU/CzG7eHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756106, "uuid": "7750aa64-5328-40d5-9c20-2c2904db450e", "value": 1847584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756106, "uuid": "bfffa3bd-7f9e-4dd6-a510-f06501254d0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756106, "uuid": "e400509f-6132-49ca-8ac0-5aa80e95694f", "value": "PO 1100620230526.pdf(39kb).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25df6d0-77e8-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698755180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755180, "uuid": "7f2e9acf-36a2-4243-8511-08abaaa2b4c7", "comment": "Malware payload (Formbook)", "value": "3fb1914f0c07d6c0d435676bbb56661a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755180, "uuid": "03ebf173-e494-4579-83aa-e75fab3f1c61", "comment": "Malware payload (Formbook)", "value": "08f858c188cfd3e620b156b53c1a9fb49d67445ffc6b5c004f87a93f44aa15a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755180, "uuid": "954ef79b-9d3e-4357-b2f3-a9da33892d25", "comment": "Malware payload (Formbook)", "value": "ae81cd3db0498a1113c93eec298c53f36caaeda5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755180, "uuid": "561cbef8-ed63-4647-8223-55d98d17bbe2", "comment": "Malware payload (Formbook)", "value": "1da24272886df042a21cd881b6f2e8fed1c6d5b030b9c3cf9e9eb4b14e7783140fcec4cd6be99c66303ec17c5b4f463e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755180, "uuid": "4c936cb8-0075-4dd3-9200-c5915b3f0cc1", "value": "T1C9D423E1339C66AFCADD5CF8245954007BB54A332881F3E65CB3A1F23A5D7E04AE215B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755180, "uuid": "2e0c7f65-f2b7-4373-9236-10dff091bd38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755180, "uuid": "28c5e542-846f-4540-b411-0f55645f310f", "value": "12288:5MZoamEa/IC8uZVVDRbIMFpl43H9zcfrNBL5bBSyznT8aYJh5QBp:51QC9rVVb5pl4VcfrNN5bTznYBJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698755180, "uuid": "66824776-14c0-4b17-acd4-98fc51fa12b5", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698755180, "uuid": "d11a7e1c-7d97-4215-ba11-dbfed91bf0ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755180, "uuid": "5b1de221-e7f0-47c0-bd13-48544b649c6a", "value": "Shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c72c9511-77bf-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698737605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737605, "uuid": "8cfa33c5-3818-4f60-a790-d9827be7accc", "comment": "Malware payload (AgentTesla)", "value": "68b879be204b03f9a594a25014a1b232", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737605, "uuid": "cefd8226-b966-4f2e-9152-9d0990d1698c", "comment": "Malware payload (AgentTesla)", "value": "0a05f095a607b11fec6ad7e90f87cbb51d41b3b2911c54630e819c84ab6900b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737605, "uuid": "06727fef-e065-40ca-826e-b1f67ef4b5e0", "comment": "Malware payload (AgentTesla)", "value": "b7fe021e563304860847286323ade58d5fab175f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737605, "uuid": "4cd86c1b-9c53-4cec-94b9-135d556c6b50", "comment": "Malware payload (AgentTesla)", "value": "dbc6fab0ba8d86210a0fd85f4a3c6c623d77fe4ebf626bd7c5d96a18dcf22de23e8e834874c71623714e50ee431d5ab9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737605, "uuid": "5480907c-f96c-4059-8d33-a30359168f0c", "value": "T1CA358D50E2F5674DF4DA56369E3053E4A2B26863B726E34ACC00E55A782C7D7CEC07A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737605, "uuid": "adf877b6-9864-4cdb-a520-fe51c7e42b28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737605, "uuid": "8008a815-a46e-41cb-8db1-75949dd23d81", "value": "24576:qbrZD0QxyHwIwAeTd7xdDcpATJcZpWhC9FaqmRh3o+RZF:qlPIwAeTd7xdYpoYvdmFRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737605, "uuid": "64faf9be-6d86-4f14-b5ec-246c4c01e4e2", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737605, "uuid": "785f7a98-7e3f-4aa5-b3a9-a8271b5f48a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737605, "uuid": "cc4abe35-99e6-463e-9c2c-22fa593037ca", "value": "Quote#2310303384.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98319cc8-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698734950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734950, "uuid": "afc2933e-b16d-4df7-9506-8772e464923b", "comment": "Malware payload (AgentTesla)", "value": "1024a690a0cdbf2505121b0d14b70125", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734950, "uuid": "7f9d73e9-6c9b-45f0-89c2-02599aaa8849", "comment": "Malware payload (AgentTesla)", "value": "0a7523a33dbf8a15afdcef5a7efbaf4a2ed53706c8b0daad1ad8c69962180566", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734950, "uuid": "5cf07317-60e4-4264-aae9-744581ae2d00", "comment": "Malware payload (AgentTesla)", "value": "a048b94a8ae9251b61e3348438ff0f3f2c89b33a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734950, "uuid": "44fae476-a38d-492c-8797-843babee03c5", "comment": "Malware payload (AgentTesla)", "value": "70487836f453e6f2707b922e27c105e9058a42c288ac4f2a90906af061867227e9fd2aba219684340a258f20bcaf652a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734950, "uuid": "35218f20-084c-41ff-a4fe-c9036ce8e5dd", "value": "T167A3E12EB200F84DC5639CBD8CCDD0DB92183C669D91EA0F3294BB5D2D76683479B74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734950, "uuid": "b868a424-3b24-4518-bd17-b3300f062bf6", "value": "1536:lpQDZbuylO9AKt9+CASVnmLIMPXHI8d+xpgFlIoOcbF6KUHJHuJPMIdTd:8Vyy1Kt0GdmBP3I8MgnIPwFtWHIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698734950, "uuid": "9d68385c-f1da-4f25-917a-e93a8392850f", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698734950, "uuid": "a808a8ff-34b9-4ba3-9256-1447a1b9c311", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734950, "uuid": "84a782b5-39de-43b4-8968-0836dbaf9f0c", "value": "Orden de Compra##.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb817b9-7808-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698768919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698768919, "uuid": "28a03db5-316c-433a-a9a3-78888d6bb9fb", "comment": "Malware payload", "value": "27affd0e79d540663bf99857d38e8d7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698768919, "uuid": "f3acc2b7-6a8c-44b1-88c3-06477931a3d8", "comment": "Malware payload", "value": "0a83d0d2312389ef06b761afdbbc213888ebba51bcd41ef53d532485e1bc0600", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698768919, "uuid": "ffa2a39f-939f-4d12-b0d1-a01dfab5fb72", "comment": "Malware payload", "value": "8ca357e6e71e0aa00b2ef11f5323c89efad0cb9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698768919, "uuid": "093351f5-5e9b-4b8b-a2cc-2d5f690d2bea", "comment": "Malware payload", "value": "4ea673e57a3c2029a445ea1220ef88b280accf711ae1049e559e53b71307bb5271b20be8302f9492e7c2d2ae6fd13443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698768919, "uuid": "fba9d64e-eca2-4a4d-89b8-30dcd4bdb439", "value": "T17FF40121E2F4AA0DE0EA97B58D7462D4637278237A32D31ECD44E19A346D7C78EC4763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698768919, "uuid": "d4dc1a12-96be-4137-8ca7-a3a3f9f04cee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698768919, "uuid": "a47a1332-2b63-4fda-a7b9-698b94718bf1", "value": "12288:5cz3XmCuEn2xmfHFMBpoi27u7Y2p7n6WQoSov1I9Rt5Tykj4kK:iqqOaHyjI296wSOI9b5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698768919, "uuid": "79e0fada-e578-49f4-8bdb-cb1910a979cc", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698768919, "uuid": "643af6ba-68b5-4250-9b7f-b17b997065f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698768919, "uuid": "48adc226-c0eb-4d35-b12c-ec4ceec40b96", "value": "ORDER DB-078003417XXXXX92015572.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea6e731-77db-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698749698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749698, "uuid": "dee3d2b6-6e98-4a8c-997f-d9e28cf2e41d", "comment": "Malware payload (RemcosRAT)", "value": "a26bd3cad5532960669496443fca1aa8", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749698, "uuid": "e7a6ceb3-5fe1-4a55-90a8-e18c1d185464", "comment": "Malware payload (RemcosRAT)", "value": "0ee699b7df38822530b27f92eeb59904b6c580003c8e4c5e1cf675150873b2e2", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749698, "uuid": "0a4194c7-468f-4993-a7f1-a4f6a3f6aa56", "comment": "Malware payload (RemcosRAT)", "value": "5b8619a5d8dfc8cd98728e71be51ca44c3b60373", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749698, "uuid": "2dd22c6f-e63d-4648-8980-4d233526d203", "comment": "Malware payload (RemcosRAT)", "value": "39d7e4e0b6dd7d3cfd4a53b956931756b59be649639a38adbdb46f0d4c5899dcb6ae4a00ffeb088a576e266549c25248", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749698, "uuid": "9ea58bfd-48fa-4f58-8126-ea44bf212d6f", "value": "T159D2F13331415959972207FB22280A6162D2C80DDA9F437A5DEFE9F54D0F3E4AC837D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749698, "uuid": "17941d59-91d9-4c78-a3fe-7c12d604c3f5", "value": "768:In2vt4J5aHXGoZCrdVkAHflBf49kSXLBa/eik7Z/Xh:IwGja3GoZal69xlkeDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698749698, "uuid": "56708a67-6ed3-434f-a27c-823a52550455", "value": 30385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698749698, "uuid": "fc8703a7-d9f0-4440-bc41-3f7e3bd0b655", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749698, "uuid": "9aaba650-3afa-447f-b9d7-1742a2699846", "value": "n23-72688-BL.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da899fd-782a-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698783465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783465, "uuid": "2541478b-a394-42b3-96dc-fb924afabd42", "comment": "Malware payload (Mirai)", "value": "fece0c2b117e3ca27364fcc91fbb468b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783465, "uuid": "ec6788c3-d94b-49cb-ae9a-a1e65cc5d00e", "comment": "Malware payload (Mirai)", "value": "101be3feef695a7d65703d9028a14f4c79a9dfbd3fbdaec74a4dc5ce0fcb7e0d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783465, "uuid": "5fd68767-d181-4692-91ab-bfb83488813d", "comment": "Malware payload (Mirai)", "value": "3679610b53a8a498fdab1c75967880a29762a324", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783465, "uuid": "16d0fe2f-fb5b-4590-973b-8b15d9d01ccd", "comment": "Malware payload (Mirai)", "value": "00f550c7e2a1d6f8095ecf08ddf98b858d34010517482e9ef8499d94140fcb2831ef08e6e0cdfdcc484bef5527c400e9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783465, "uuid": "e0973469-c623-47e6-be1f-726bd3d87a87", "value": "T1C2334BC4F543DBF9D84900717032EF369B33F1FA226DD997D3995A33AC92602A506A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783465, "uuid": "f7b2286a-8fa3-4539-bf18-f14fa81ba26d", "value": "1536:vbxZ+QmM0P+IWFWidh8ds09p8ukc0iIBYF0x5L:dZ+QmBto9dPBuEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698783465, "uuid": "7fd27385-17f9-4328-9f6b-06bec1698d4d", "value": 51508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698783465, "uuid": "8ee8e333-4208-4a82-b0b9-b794ff00fd55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783465, "uuid": "98fdab94-fef6-45f4-b8ed-9cf7567b07c4", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe556cb4-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698735121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735121, "uuid": "beb4bc99-237b-4582-930b-84456efebe60", "comment": "Malware payload (Formbook)", "value": "1f46639a92ebaee74c4e79074646a99c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735121, "uuid": "530d55f3-a268-49ed-8564-38394ff973a5", "comment": "Malware payload (Formbook)", "value": "12361d47524fe20ebca655db20945642b53f37ce38ae73c415cda2e0c88173a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735121, "uuid": "354f4045-2560-49e4-8b83-b248ad1de0ae", "comment": "Malware payload (Formbook)", "value": "0510dd7909764f8a44e2c9f290fd61f6f57eb011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735121, "uuid": "b7493a46-8541-42c1-baad-1d626a095e4e", "comment": "Malware payload (Formbook)", "value": "94ce58122aa635b899b30cb832f799b4e1ed602baefefe9e5bdc55927506e44cbe36bea99689106919cd81307c7f10c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735121, "uuid": "1141c3b7-7b97-4a58-96aa-4e2b1a464ff3", "value": "T122C4231017F4C37AD06EEBB1A5B2055BABB15276B141FF094EA2B8D43DB7FC289901E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735121, "uuid": "98b04c9f-2dad-4c47-9e24-6905124d99bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735121, "uuid": "28787eaa-ba93-4595-91f1-cbbcb7b3417c", "value": "12288:XUR61zoalGY8gmq6BRr621/AP3w0OuOV25PV0SIGHN:XUR6xeUgr6uw3w0z5P6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735121, "uuid": "fd742540-abec-4d02-8655-fd5470876413", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735121, "uuid": "31b3cd12-1f9d-4c23-a16c-05b07103603c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735121, "uuid": "8013d9d5-23e0-4d3b-8286-1c3df9a7b80f", "value": "INVOICE REVIEW_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad06e57-77cf-11ee-8907-42010a9c0042", "comment": "Malware payload (Meterpreter)", "timestamp": 1698744322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744322, "uuid": "14919709-25bf-4b47-a876-1154dc557bb2", "comment": "Malware payload (Meterpreter)", "value": "1e86c07a6a1fd6c9326ec6b2b2492ea6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744322, "uuid": "6f056945-5787-473b-9dca-676ce83967b6", "comment": "Malware payload (Meterpreter)", "value": "12a5d1fb7696d10b4088b5f3d3b1b4444eea5346f7fdc509dad9eda48a8db2f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744322, "uuid": "9ddfd644-3a30-4759-a8a9-3ab321cae876", "comment": "Malware payload (Meterpreter)", "value": "888e7d1f6a46ee261196ffcca1ad42fb533ecad7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744322, "uuid": "5714fc91-8c03-4788-aa6d-63f17d9cd7ef", "comment": "Malware payload (Meterpreter)", "value": "f99e7333ee75b6e8a039f7d128831da0aad6010f04b225cd9d4de9de7dab411b6e3ef8bcde76a19f52b5e8957381237e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744322, "uuid": "505c25bd-e0d4-4f57-8b2a-60b92b1b48fc", "value": "T14E759E52F29140F2D659547754AA673DDAB09F5F0B22CBC39313FD286C329E0EA2B12D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744322, "uuid": "364c764f-2925-42d9-a3bd-efba912c268f", "value": "d45317193763b38bee079b79bd430ddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744322, "uuid": "75dd03e4-5b6e-4d4f-8604-b492bf7ecc04", "value": "24576:5lw0N6i6kL9yHr0CzKyvWIigZIRWHFjAbMbGIhLqBh3SWgSklWEG3c:56OMke0CH1vCsF8whqBST1WEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698744322, "uuid": "77898909-0c18-412a-9245-a462592cc0cf", "value": 1698304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698744322, "uuid": "78808d20-14db-42ef-bc06-cafad000c2aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744322, "uuid": "fd9bf70f-9ea9-47ee-8c12-569ce9f10844", "value": "1e86c07a6a1fd6c9326ec6b2b2492ea6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe82af9-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735499, "uuid": "96212d29-0778-4b16-b566-0554d3754851", "comment": "Malware payload (AgentTesla)", "value": "c8eee297c0f5949ce919c6ed6ecbd13f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735499, "uuid": "3a11dc1f-4556-4b82-b597-e38a0ad3ae8e", "comment": "Malware payload (AgentTesla)", "value": "12ce7f3f07157d625b5731f16f2f395f859b58b31e7e18abaa5fe409e233661f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735499, "uuid": "68bc42d1-6a0f-4124-b01e-4c0feb19343b", "comment": "Malware payload (AgentTesla)", "value": "e29520637c0762bc292c002ecb23c2316283c7b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735499, "uuid": "1c326d37-dc5e-46a8-96da-1ac2ebbe0cce", "comment": "Malware payload (AgentTesla)", "value": "5373f28e57870eb7beb94a6790ea3189fb1ee4b84774d309e3f45548c5df18b4f232741e11df2d86db344e9a19871924", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735499, "uuid": "757dfa88-c549-47ae-9677-30e02ed8c3b1", "value": "T19BF4E09225595ACBF82D137214720DEE17725E3EEAB0B91C699FF06287733472212D2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735499, "uuid": "fbfa9cf6-17e0-4bba-b1c8-cd50ac9b20f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735499, "uuid": "31b61ce4-d33d-43dd-bedb-8364735b1e6c", "value": "12288:7+Ebtn3GuSkDPOdZNwj0NxTcmLeMh56LMfv7/n/Ps:Z3GuSkGdZe0NRcmLH6LMfv7/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735499, "uuid": "409a1675-faf2-4948-9f61-485c3aee7277", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735499, "uuid": "c33dd121-c879-465b-8c67-334742a22264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735499, "uuid": "804762e6-b8de-47e5-a7bf-87a0b0d2c3b1", "value": "PO-00112023062752.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b975b5-77bc-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1698736041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736041, "uuid": "637cad8f-e5de-4a58-8cca-15438c0d944b", "comment": "Malware payload (njrat)", "value": "4147636832178d0029c0728397c563e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736041, "uuid": "0b5475ef-4181-4976-8328-84fc1c8ef8ac", "comment": "Malware payload (njrat)", "value": "138f3ba0bc1a8074a50b7c2d6c219c573987495dd897e594549bd2950f5d4072", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736041, "uuid": "65207621-1a9d-4570-9f0b-56e4fd38c4c4", "comment": "Malware payload (njrat)", "value": "4caa679de73f4733eef673228164f0e2da433ff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736041, "uuid": "8af3112e-2ec2-40a5-9089-4d392ccff683", "comment": "Malware payload (njrat)", "value": "59278edfa76b6831bd7f0641b0fa8aacd44b341aa4afb76dc603666e22b99f24c4fc4e4475ac90ef6dbedaed100f94cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736041, "uuid": "32a57bbf-c58d-4720-9804-8d1e80978607", "value": "T199B22B4E3FA98852D5BC1B7485A59A5003B4D1874423EE2FCCC550CBAFB3AD92D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736041, "uuid": "b53a0000-b7cf-424c-ae49-ff461a0c24b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736041, "uuid": "99a3c065-d725-45cf-9e9b-33ca83b4e36b", "value": "384:boWSkWHa55BgDVRGipkItzY6vZg36Eh7FpmRvR6JZlbw8hqIusZzZPF:0Juk9pHRpcnuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698736041, "uuid": "2845fcb5-ea2a-4aa2-a932-48066ea14204", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698736041, "uuid": "ce35bd58-4807-44c4-80b7-be343f62fc5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736041, "uuid": "0b853d30-140f-4611-869d-e3e9657de486", "value": "bRcl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bb2996-77a3-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1698725260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725260, "uuid": "448a5c94-7182-469c-8661-3ac5bd139cdd", "comment": "Malware payload (njrat)", "value": "dd305adc604195ee7359634b75e0feed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725260, "uuid": "48eb47fd-4480-4474-be10-96edeafc89bf", "comment": "Malware payload (njrat)", "value": "139e5efedb66089c573c4b528c2f6619c8076f6b0bfe406cc82f14379ff6f5d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725260, "uuid": "7e767224-6e42-4800-802b-9a654221a342", "comment": "Malware payload (njrat)", "value": "3b827f9128b9380499c8f8c9143d0968f8dd8eea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725260, "uuid": "5e3a485b-7a99-4fe0-b4af-9ef570542e01", "comment": "Malware payload (njrat)", "value": "db227f8cfea5ccafa3e7f65f6697ed50dc33040401a433612a20c0e07dcdf48a524ab3db91c153884183647b40947d19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725260, "uuid": "0f3bc5e3-f988-437b-b381-761f1b764ca6", "value": "T174B22B4E3FA98852D5BC1B7485A5965003B0E1874423EE2FCCC550CBAFB3AD91D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725260, "uuid": "cfe3bd8f-ec1e-46b4-8ef9-0caeec223e68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725260, "uuid": "5afab876-487a-40e9-8afc-7eac409163a2", "value": "384:LoWSkWHa55BgDVRGipkIgzY6vZg36Eh7FpmRvR6JZlbw8hqIusZzZFO:kJuk9psRpcnub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698725260, "uuid": "593e5a82-b04e-4587-9b7d-046552718f9f", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698725260, "uuid": "5c35a7cc-2b33-451f-bc9d-58b16533c32c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725260, "uuid": "15fc2ff7-8e09-4091-93e3-e70a3f2f61bb", "value": "bRcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7d0060-77da-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698748887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748887, "uuid": "d9d01c2c-f1a5-4cd2-a2a4-459cfc7fdb48", "comment": "Malware payload (AgentTesla)", "value": "76662bcee3147589243d84d9094b903e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748887, "uuid": "4dd34ffb-3f0d-40c6-9a74-762d23132e40", "comment": "Malware payload (AgentTesla)", "value": "144aedd58d972d1bbef9120358e0bb300e1d736d6898009719738e585e25bc04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748887, "uuid": "b9ba9643-0923-4b0c-8aa2-4b8800a15cfb", "comment": "Malware payload (AgentTesla)", "value": "571a61db8fbe08fae320163251445b53abdd12f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748887, "uuid": "ed470a92-3dbe-47d8-ac14-7ec191333c95", "comment": "Malware payload (AgentTesla)", "value": "f98ce524d1d015b7ebcf034a7e525d27ddce1e485ef9406a6dd735b68dd31d58d1bb988ea19bd7953cbfcb40fa0108a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748887, "uuid": "8ba05d20-080f-4f15-9522-6b9501b6b309", "value": "T136C423B83AD976F1CFD0242AB42DC2E73B0265345F5AF2CC45F78E192D780AE619548E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748887, "uuid": "f6689bf3-7f11-4a80-96ea-8d9153d2e992", "value": "12288:pIPy0qVk44q8aq282srL0E5pGLwmIn4vrGtZZ:pN0Dzq9U2srLbrGcmbvrGtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698748887, "uuid": "ea8eb5f8-e0a2-4370-8c69-5fe4bb0c73e2", "value": 588417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698748887, "uuid": "36497db7-3a38-4695-b58e-da2646b15582", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748887, "uuid": "fae47d90-4625-4f23-a3b5-0c929e506d2e", "value": "n%BC30%C1A1 %C138%BD80%C815%BCF4_%BC30%C1A1 %C138%BD80%C815.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b359b4-780a-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698769847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769847, "uuid": "b03a26b4-2ff1-49a6-900f-cd3acfc19484", "comment": "Malware payload (RedLineStealer)", "value": "a2f2d56555fd82c8d3a49eef17ea0022", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769847, "uuid": "a6437a17-0fe0-48b8-9013-36cb9d39d7ad", "comment": "Malware payload (RedLineStealer)", "value": "147e3b92e142b17b4fe60713499d0288ec9f99b06bdecb3c1d591413b81412ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769847, "uuid": "1068b993-2ea2-4057-bc53-4d68cf5c753e", "comment": "Malware payload (RedLineStealer)", "value": "a0455febe427ac0481257d1157fbc2271661642b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769847, "uuid": "65110911-895d-422a-ac2e-e9aa83cf1e4a", "comment": "Malware payload (RedLineStealer)", "value": "68e9ea34c804a91a4ccdfd35606d52b6c26069726897656e83f2b38ae5f5ff08c18231ef52e1fdaef389ad9e2c012eb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769847, "uuid": "dfcdaf18-43a9-49af-b7a0-45813382414e", "value": "T117752313A6D80072DEF013B048FB03D726367C62C5B5925EB385E8272DF758A69727B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769847, "uuid": "41b134c2-4acb-4b78-8f6b-0b2712bc8bdc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769847, "uuid": "8b67eb26-5da7-4017-9c42-36746e8d0045", "value": "49152:2IwUhbgOYMTxvEfwstSY5RhaiaC9FKv9rUq:QUhbEETs35Rhar8FKdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698769847, "uuid": "6cd7d2ae-2179-4eec-9a47-8f591abd599d", "value": 1617408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698769847, "uuid": "c3a2f07c-ae8a-4234-aef4-59603d9f7a31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769847, "uuid": "ef3501fb-f7fb-4550-9a75-92038cc9276a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7166bd3-77ea-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698756100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756100, "uuid": "1acfbf5e-9a0f-4ab0-a359-5f541ebf2fa0", "comment": "Malware payload (RemcosRAT)", "value": "ec66e9275cccab12be65ef824dcbf4b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756100, "uuid": "ea66595b-69a2-40ab-91c2-bd4a96cf26b9", "comment": "Malware payload (RemcosRAT)", "value": "15e37410e9086af3f838de53c781d2f9cdaaa65eef62a6ab53ac5cb096bff65d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756100, "uuid": "79201ac3-4b2a-45da-b0fd-a502903e0806", "comment": "Malware payload (RemcosRAT)", "value": "73b38771814c5f125b645b4dddafb0f3d7dedd9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756100, "uuid": "15d23979-e0e5-4a2d-a89c-c1152d1fb9be", "comment": "Malware payload (RemcosRAT)", "value": "caf32046a20274bb67c0f360bd12d02bf7048b4686831522c1403a392f03b45f5847cbc558ebf7ca4c24106897f148a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756100, "uuid": "8d110cb3-2204-451b-98fe-de9bd37791c5", "value": "T1C005F1D1228C6F33D175D3F6A6B4620843FD722A2991FB547EDA38DA8471B005A4AFC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756100, "uuid": "4b4ae551-198b-49f4-9698-c1b7d7fd362f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756100, "uuid": "07da41d7-b66a-4517-8594-58a3d6faac63", "value": "12288:nuYF8yEyS4hd2+bErP4NePjN0znzXs4uqa4I1y1IEmHDoz5frqTYrOiqo:nujEhdu44xqnbs4uqfI4SEmHDoz5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756100, "uuid": "9f2ce3b7-fe35-4d83-a944-f79382808eda", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756100, "uuid": "395f847d-06cb-4e58-9cbc-478745f213c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756100, "uuid": "e183dfc5-08e8-4b98-a056-6e9d2939b738", "value": "DF0987654479REM.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8aac2eb-77eb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698756479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756479, "uuid": "59517f39-4894-44e8-bf13-5692d3584ac4", "comment": "Malware payload", "value": "5c80dfa02c503109cdae7142b4a1a9cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756479, "uuid": "fe084595-8cd2-4c3e-b3ca-f8e696a27003", "comment": "Malware payload", "value": "16c16e0fdb885f7d1d7377d3cd7297b212966e45f384a5252cfd9e8ebcdcb702", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756479, "uuid": "e959b5e7-5574-4049-b2ab-10738e2efa97", "comment": "Malware payload", "value": "89ecc81ac0093168d470804098920492de3fd536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756479, "uuid": "44cd9e8d-801d-427d-b0ac-c8121b08e15e", "comment": "Malware payload", "value": "c36ec0b6df4d9485943e214d68c6d5b648c4d6cf44830ab28aa021cfca3e6d2c3fa2cfe1ebc8c794d98efeecf0ba530a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756479, "uuid": "acd360cb-9c7e-4da6-8c69-473dce98d3ca", "value": "T1F2563380BAC216ACDE0446B11A03BF7C70F51FB0A4A3AD1DB4953FC7BCD66A4A97514B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756479, "uuid": "e0b744ed-f5d9-40d0-bd2b-4647d24d4a9c", "value": "0d0546185239791e3ac977a371dfba41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756479, "uuid": "87d3084c-998f-481a-a1b2-980bc9c35ad0", "value": "98304:YsiPpiBl8min2JOWx9Z2meuDoojojdMdw1FgNMkVMP+Y2n3MPnNwsvpxN2jw:YsiBol8C2me8jfe1K8TbUjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756479, "uuid": "7dc54b4d-6cef-46cb-8818-e5ec94e99717", "value": 5998592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756479, "uuid": "e3e6d8d7-6ddb-4daf-97f3-cae5871a0d72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756479, "uuid": "81abc43f-992b-4edb-a9d3-91ae212430c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a07ea11-77c9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698741637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741637, "uuid": "030c8ecf-e637-4ae9-89ce-6449301d9b64", "comment": "Malware payload (AgentTesla)", "value": "9c126d7f671be39c77ec57d95badaf41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741637, "uuid": "51a7161b-2ea7-463b-9314-debee886c7c0", "comment": "Malware payload (AgentTesla)", "value": "16dedce171f3affd6583ad5ab803aeec9f0608105fba73756e65e72c01f9aaa2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741637, "uuid": "30f5d00c-af7f-45a7-af2f-82b40f7a5362", "comment": "Malware payload (AgentTesla)", "value": "027ea0c8b69f939850801b9a723a451e66e7d3c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741637, "uuid": "4a1598e0-1f19-4546-b5b6-a3b654b9b844", "comment": "Malware payload (AgentTesla)", "value": "8a3339a63419610b8ca4e913cea8ac2b39e150442d4615800e7289368a658fb23efcb241dd60db7c381e833e4044aa07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698741637, "uuid": "01aef2bc-e0b1-49f5-9f88-ed5554714664", "value": "T1BFB4236005F56B58FC4A2A6B7F3C0E46115BF764DC9E2EE6482E9ECD80C64CBDDA2017", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698741637, "uuid": "711c3746-0f67-4f8f-a9cb-4a9a0c6093bd", "value": "12288:6C+pjJHdz2RyItNZYLxYBxcBg7H9FJp1ASaNbAKpUOMd1WhA:FQJHdqRyeNZY1gw+dFJrASaNbAZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698741637, "uuid": "e0a631c4-bcd8-45b7-920f-a3d815639c1d", "value": 509504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698741637, "uuid": "845f15ce-6828-453e-8cdd-9774062e54e4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698741637, "uuid": "1b3859b0-4fa0-4f70-99ec-9e425698e158", "value": "DHL DOC 74653898.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73d3da9-77da-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1698749148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749148, "uuid": "f7765870-78c2-4893-91a6-0685c9da599a", "comment": "Malware payload (Loki)", "value": "c836d738875782df067bfe6ff6a25657", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749148, "uuid": "29708d69-b3ec-4c32-8d3e-a28c019c9c2d", "comment": "Malware payload (Loki)", "value": "17784804b42643f70dcf9332eee35837b1b4b91452a9c25e27bb409e957e12d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749148, "uuid": "87f87b12-b4bc-465c-8304-a7aa0547c164", "comment": "Malware payload (Loki)", "value": "13c813354996df672a80ccc0f5a11884982accc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749148, "uuid": "64844114-a247-40ef-a725-846f04fde266", "comment": "Malware payload (Loki)", "value": "16399c2283173e639ae688f1aa71397e5bb47d1f1c66d4edc84f4bafa239b31a461931308a3ddb7ac719286068125a20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749148, "uuid": "0a5d54c4-3798-4157-ac41-2f57b6ad8dc8", "value": "T18BA423555BE5C232C02E5BFAD0B444368BB920993182FF1C4FB5ACD43E66F928B35366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749148, "uuid": "e89f99d3-38ea-4c8f-8172-72ca321182a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749148, "uuid": "9ba179ac-4c15-41a4-b024-575b2a90211d", "value": "12288:OUR6rwoa2XV2GoSrKLDFU2OqP6kJxLrXdei7GN9c/Zm:OUR6HY4rKLhUwJxLrX/7GN9OZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698749148, "uuid": "2230682d-218e-490c-806f-58fd6687c25d", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698749148, "uuid": "3344a0c3-4fd4-493c-b1fa-ba996ebcbfad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749148, "uuid": "3c11b1de-61a4-48dc-ae39-792b9449fcfd", "value": "rPO-3785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dde0600-780a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698769748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769748, "uuid": "34a7dbf0-64c8-4d73-b0d7-73a2faf301c1", "comment": "Malware payload", "value": "0cad32c3c77609d6ada51c16d28ce8d2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769748, "uuid": "edf2e1bd-ffed-416d-8b0d-cd7d57f40174", "comment": "Malware payload", "value": "17f5441fcab918993e225bb5eec7acbea00aa2a2dbe8d52778468666c84b061e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769748, "uuid": "8bebd719-9d37-4edd-8bc3-96de8bb9c359", "comment": "Malware payload", "value": "a6e6138af76f0946e601ad30ea1858066e1a9e43", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769748, "uuid": "7be5c6e8-582e-453c-bc5f-9a94b813b530", "comment": "Malware payload", "value": "68edb395fb0b2c1e9fd888f3aa16563db9e6f7d79cfc3985b30de7be41e577ffa3b027f2f58f229d49ec4078d36919b9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769748, "uuid": "a777f313-b06c-45f7-8c70-afa74110cdaf", "value": "T1E8E2370167FE510CF2F36FA95AF965A54E6BBE616939E15C006C120E0BB3E40CDA2773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769748, "uuid": "28b04bf2-0dcd-43ab-9674-f9db2026e0ad", "value": "192:44bHOYZDT6shFZwVawlDXkVbdbfZiGxxEiGciG1qiGliGAiGHm8b3+mwsfu9i39N:44bHOGX/AkVlZA4oR0TnuSXsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698769748, "uuid": "c1e19b1a-9870-4c54-822e-0bc0ce74b7b0", "value": 31484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698769748, "uuid": "82c02b34-ffa9-4b9d-a132-8b475b02e84c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769748, "uuid": "e59009af-ab68-4b89-9d06-fdcaa066222e", "value": "REQ_FOR_QUOTATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdb55ef-77db-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698749721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749721, "uuid": "e02552bf-f403-4a3c-a0e1-5df9ac21d647", "comment": "Malware payload (SnakeKeylogger)", "value": "bf6133744240674055bdd0b7783cea73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749721, "uuid": "2748a538-241c-49a8-a262-475903698247", "comment": "Malware payload (SnakeKeylogger)", "value": "1997d0db749ed1dfc24d90ea0fcf6af634aa34b5bd2b9ad35932493f67e9fdce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749721, "uuid": "c9aaba28-eb8c-430e-8d43-36133f41b8b7", "comment": "Malware payload (SnakeKeylogger)", "value": "790fe9b655289c7379cd100d3401a1d08da199e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749721, "uuid": "c419aea1-e5e0-4d47-94c6-4eedb9292fcc", "comment": "Malware payload (SnakeKeylogger)", "value": "556a1f790a41db02daf3cd105ae531f8bbeb784378db317c5ea4a9305e898d91e8976c980ea4e9d7213bd0b5ddfc58ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749721, "uuid": "e3b6dff6-9ba9-4d3c-9bab-ff710a5af841", "value": "T1A07412E7DA5407B2E53353F5B238A1E8123AB061710CEC56AF42B8C444BE75EEF51BA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749721, "uuid": "b861805b-ae66-454b-b2c2-909147f028b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749721, "uuid": "968de4cd-d6d7-4d14-bc8e-1c634593ec41", "value": "6144:MCKABMNiti0sBlU5gKB1lwPnGPLes5sOUvszaMzyMFsPe35bgaG/QQD:MfA6bhu8noLes5sOUvsziML35bgaGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698749721, "uuid": "7c5e5732-4b41-4098-aef1-323a9881092e", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698749721, "uuid": "34560933-62b9-4a86-bc50-fb2da1ba2859", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749721, "uuid": "b04a6e61-cf97-4e8d-a290-2644a50eb113", "value": "rCIMB-Transfer_Advice-202310301849809.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecfe855-77be-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698737189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737189, "uuid": "aa5196fa-6593-4664-ac2e-a10298c0d768", "comment": "Malware payload (RedLineStealer)", "value": "b78f4ee8c6a5c7a0c882bab8cc230246", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737189, "uuid": "93388066-aaf3-4e33-b42b-e2d0a3a1f6ce", "comment": "Malware payload (RedLineStealer)", "value": "19da55e79b51f767e1d73cd00cfdee786c42420ac4426c641a9dbdb29791c3bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737189, "uuid": "7ddb93f4-f820-4a75-9728-c6e458f874c8", "comment": "Malware payload (RedLineStealer)", "value": "a823a688c53789ad26e0ef7f77fd67b90d9b5035", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737189, "uuid": "de93354b-c0e0-409d-899a-ec27473cbbae", "comment": "Malware payload (RedLineStealer)", "value": "8136f49abfc7821aac784a98727bdaeff49b3fccee02e6ff1a6d211c58115422a365e01ef2b41cae5e9c5513074af782", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737189, "uuid": "c72626b8-201b-4544-a385-5909219772b3", "value": "T184652313B7E44433CCF50B7055FB0283577ABCE26824C74B3746A96E0CA2685BAB5B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737189, "uuid": "fdf2d94b-591a-4e8f-a8b0-806ed5656b08", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737189, "uuid": "50c1dd8f-d24e-425d-bd07-828583226abc", "value": "24576:Cyj/APcoljZfq3BMnSQgPXaeobm2YJSSuqG92VgiNKTOB4JC/RQYgQTJO0+kV3:pj/APcK03BioXaeEmnGYGOB4qVTJO0++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737189, "uuid": "706bfea4-a0be-41cb-b450-8b97dccd49aa", "value": 1531904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737189, "uuid": "899d5b58-d9c5-439d-a599-26e09cbdae3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737189, "uuid": "4b85a895-e5fb-475f-adff-f541db6cd267", "value": "b78f4ee8c6a5c7a0c882bab8cc230246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f3ba8d-77cc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698743272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698743272, "uuid": "b14a4a82-369e-4353-9b08-9cb128121caa", "comment": "Malware payload", "value": "3519d24014159969d328df173c6e19c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698743272, "uuid": "c10ae556-abed-4679-97be-f7007201a3ea", "comment": "Malware payload", "value": "1ad7e9d0372e2784702d59f13bca94ae7c5985faad2c7035ba834d5f2e9d27e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698743272, "uuid": "8b8fab62-826c-493f-98fb-82cb316d2e32", "comment": "Malware payload", "value": "528a6c581713e7d81e05e2185aaa2ebed5470db1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698743272, "uuid": "44a37351-8341-4912-89c6-2383febde5d4", "comment": "Malware payload", "value": "8c75f8235855b8f1901bb212f477313f4dbb787ba8da688fabcf7f0866c5b800f461212ee150aa08c5f67395bbf10d41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698743272, "uuid": "7ecce6d0-d259-4db4-a5bb-0ff45f498a4c", "value": "T151A4CF0B26BA2D66D6EF02FC68DF4E1DE52397445573FE891D90005F6D80F8A894E3CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698743272, "uuid": "f71230d0-6ee8-433c-a09b-65427c648a9b", "value": "12288:er7r0EW3fefWrz7A7t0815s0tOuk5NjaeHwNQrq:eHAifS7A7mkOysw6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698743272, "uuid": "419d91cf-6076-4813-9a33-22070f100844", "value": 473680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698743272, "uuid": "8cc855d9-0bf4-48a3-b9f7-c052c3573801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698743272, "uuid": "2ba83cc3-795d-4095-a16e-c718d0f35815", "value": "RemedyAdvancedQueryGenerator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fc97b4-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698734996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734996, "uuid": "43e3726b-8a4a-4af0-b0ae-ed11e3805d6e", "comment": "Malware payload (AgentTesla)", "value": "a44a25e3759e4d1bf801e878d6c1abdd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734996, "uuid": "28c12397-6418-4463-b81f-60466f94cafd", "comment": "Malware payload (AgentTesla)", "value": "1bb83b2fffae62e82b5f13afc6b44d371998398f2758ecbd54033c537b0dfc9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734996, "uuid": "b1adf71e-1779-4596-b943-c61bea1af067", "comment": "Malware payload (AgentTesla)", "value": "cb8ed9bf12fed784f36039f931cbb0ad49bece6d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734996, "uuid": "b558dae3-2cb8-40f7-ab1d-087e3e3ba9b8", "comment": "Malware payload (AgentTesla)", "value": "ac623029fa6e10d3a9c2282ae361016d491e7fbaadbc3c3ec68b1080ff02860fa5b2ddaded304a5f4cb17b3ec8c78758", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734996, "uuid": "bd2cf8dc-c65d-4214-af45-2bee101e4e18", "value": "T108D423C976D3868DDB053CB6BFE87C48A16D84998238F2DB35A1E9034FDB4F34958258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734996, "uuid": "043b2501-494d-4325-bb5a-f9ff9bfc4dea", "value": "12288:6VnWqgoWCcG3/p7IwATH6/udyPN6U6IPpiW9IFCIclsFIcq/iCWS8RAE17rLjRXV:omoJcG3x7BLNx6g90g6IfiCOAE17rL5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698734996, "uuid": "ca96f4b5-361e-4076-bf3b-4af9b8fc24ed", "value": 629576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698734996, "uuid": "3bd9c6b1-5a89-4743-99c3-a2194c93c076", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734996, "uuid": "7e238496-4297-4764-9390-ab9bb2a0ecbc", "value": "SKM Swift copy.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d976e167-77ea-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698756104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756104, "uuid": "61437589-2f77-44e8-8390-2a04fe3cfad7", "comment": "Malware payload", "value": "48d0c0688541a655586aba628bb61494", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756104, "uuid": "83b38cfd-8fde-4178-abbc-5aa8b3d7b7a2", "comment": "Malware payload", "value": "1c0ef411d7be934980367ea886ff463e0afa7af87f3cc954b729d42a9b30c63b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756104, "uuid": "19b5920c-4416-4556-9b51-8f44da85dffa", "comment": "Malware payload", "value": "9fcf5a987f51607ea53c448791ff8ea3c5405bec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756104, "uuid": "26cfc940-6f80-4d9d-a81b-ef3c09f7c6a1", "comment": "Malware payload", "value": "8439251baf59032a03734f4561a6c6d02b34fb97a241a605ed1fa92b5edfda62f2e50bc649d53589de58a74acbe9e561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756104, "uuid": "f2f0c018-ae2c-462f-bc1d-7b9b1742229f", "value": "T101E4128C335E5BA5E6BF1BF4D5C4620193F2BA1B2931E70C1C4A60EA0EB6B055A05F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756104, "uuid": "c4c2ad4d-62e2-4f05-b7c1-006778dfc162", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756104, "uuid": "f83ad2e4-6085-4c1b-9de6-e81374332cbe", "value": "12288:owmTrkTvjq8D+/Cbt/7fp5Wkp/BEXVKMJXAUIlX:ow2rkbjq1/CbtTfic0VKqXUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756104, "uuid": "6c36708b-bbc7-4fbc-9613-a9c39e56301b", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756104, "uuid": "b3de549b-1ad6-4e23-a62c-fa33f50aab9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756104, "uuid": "8cfb2c2f-e3e8-47e2-87c5-e9555fa6c335", "value": "packing list - Delivery note - Commercial invoice Norma 5968-00420.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99371f19-77f1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698759003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698759003, "uuid": "c5912d16-83c6-4210-9991-f70d92db713f", "comment": "Malware payload", "value": "c4bcade9988b3fb4477f3b943bc400b2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698759003, "uuid": "8d7dbe32-b747-4720-baaa-95a10099eba7", "comment": "Malware payload", "value": "1c2c31c40ae257bc24794806c150d3c7a08467db5008dd4338ff65f434d39d54", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698759003, "uuid": "8d44b8bb-2e64-4460-a1f0-9e160f43e5a9", "comment": "Malware payload", "value": "d2ddb8491dd068d66e6b9e7300869c1658d6755c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698759003, "uuid": "900d6ecd-a600-46a6-83f4-ebbff80d93b7", "comment": "Malware payload", "value": "4bb4003d4407c87c1a4ae53e6d72f867131405675033208340b6fc85ac984eceaa0954b304316894aefe57c60e000082", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698759003, "uuid": "fa093f81-ecea-4b84-81d8-19f41ed7ab16", "value": "T130253334ADDBEEEF450D7A35F21B075E16658EE4000AE8FF1361756B12FE1A0A42C4A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698759003, "uuid": "21887e3a-13d9-44bd-9ca8-8f9809eb4c03", "value": "24576:5layStrRwLnT68YO5Z++yPCkP0E47yCjDqaoGncetGTO:fRCMTyICPWzD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698759003, "uuid": "425bd392-aed4-4d49-9ce7-7b2f2cd37616", "value": 1032774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698759003, "uuid": "d11b75bb-f7a1-49c2-8757-8361c9d63c8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698759003, "uuid": "bde782eb-056a-47fd-a52f-85f37f9aa17c", "value": "SHIPPING DOCUMENTS OCT.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f8424c-781c-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698777565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698777565, "uuid": "09e43c73-9ba5-4eea-9150-b8c198762f8b", "comment": "Malware payload (Smoke Loader)", "value": "12a63faed25cd5bc115446ecc3e54897", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698777565, "uuid": "f04ca493-27a3-479f-bdba-8e69fb60273c", "comment": "Malware payload (Smoke Loader)", "value": "1c42bdf6438c73d6f16d7bad5e9601e21dd92a7222e3c42761dc0f6d942b1a3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698777565, "uuid": "6ad624e9-676b-4e37-a485-9149e26e171e", "comment": "Malware payload (Smoke Loader)", "value": "a88fa37b7e24b10ebf110f1442aafc7a0388fb40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698777565, "uuid": "d4cc07e1-f59d-4228-923d-2f5583f2ddb7", "comment": "Malware payload (Smoke Loader)", "value": "95eda93bfd035f32d2978f97aa374b3b6aada35481d4cb86eb0cbdf3a2a87fec631f413bc223025f9d0fc6995a94571e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698777565, "uuid": "ad7475e1-7e80-4ee3-9406-a636b53ca146", "value": "T14A047D0363A03CD1F9368F319F2EDBF8B6AEF5608E19776922485A5F04B12B2C563711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698777565, "uuid": "0cfc0696-e8cc-47ae-8f63-08b7de67ddd7", "value": "0c9d3ff66162daea31cb3f02591d560a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698777565, "uuid": "57dbe055-80f4-4a34-96e4-a9d24149ae45", "value": "3072:BkbA6yRdgjy0993y00m2OY5O9mm8IPEBl8MtPUYkc:YA6yzAB993/0mlT9F8IP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698777565, "uuid": "37e3ef65-169a-4adf-b448-150463aa44a4", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698777565, "uuid": "b6d63c41-cd6a-4fab-86b7-8e6feb3e921b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698777565, "uuid": "8dc23bce-0d35-4d92-80d4-420618ca93f3", "value": "SecuriteInfo.com.Trojan.Win32.Crypt.6433.3246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af121a5-77fa-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698762657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698762657, "uuid": "98653f59-1552-4580-9942-616196de6147", "comment": "Malware payload (RedLineStealer)", "value": "2fdc0b7c0abb0f36fd640c7b57fdd074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698762657, "uuid": "5d894419-ac79-4c6d-813f-916bb4dfb6d3", "comment": "Malware payload (RedLineStealer)", "value": "1d8f6bb53fb3bf0122803f53d768746f1c21e3c82547179d84a439f5ba09cb50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698762657, "uuid": "9d374207-b731-4754-8f88-e23236d62afd", "comment": "Malware payload (RedLineStealer)", "value": "e59816247aae7b06218e5a2a0969f0580a9c93a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698762657, "uuid": "0796a443-5991-48b0-8160-bdd3f83dd66d", "comment": "Malware payload (RedLineStealer)", "value": "c5e767d1fc7ef02727246146c37605032c16f63bcdcad48ea08d06e5a50579e6c60c9a7c4708c956c6628bfb6b8be5ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698762657, "uuid": "e85d46d7-ecb2-4763-91bb-b595d8614e2b", "value": "T159D533D4A7674D9FFCF09B344AEEC9129221701296B283CCFDE9360D4B19A5728392DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698762657, "uuid": "47934f03-93f8-4230-9ee6-acfc4c3e8b7e", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698762657, "uuid": "d3e3edaa-015d-4770-9213-575b69ae206f", "value": "49152:5GBK4xl0vOH3w/0BdRchURPdbXJj+O4YegH6nItGEBEYQPzmMHU+Atmvd07P:aHxlmmeQohedbXZVaItdBEYUzmYjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698762657, "uuid": "c3575830-0995-4f6d-9d09-4dd55ded37d7", "value": 2902528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698762657, "uuid": "f360e8fe-165e-49ed-b132-62da72e26058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698762657, "uuid": "bd984324-ced8-416e-a6dd-1b7e909b13a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8acb474a-77ef-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698758120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698758120, "uuid": "1d0de21c-635f-422c-a53e-5f5671fd6fe2", "comment": "Malware payload (RedLineStealer)", "value": "edf9c207f671004240efd6a67776e97d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698758120, "uuid": "a141fa72-d04e-4ff6-9bbd-522800d6fdb0", "comment": "Malware payload (RedLineStealer)", "value": "1fa85ca368710acf455a21f0f6bb30cf7f561d8ac7b8254196642e548c0bd8b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698758120, "uuid": "4123c50b-65c6-4382-aeeb-ecc0de7f938c", "comment": "Malware payload (RedLineStealer)", "value": "d8578dc89f3354f40cfbed9d4fbaec3df0c093b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698758120, "uuid": "8148e3ff-11a4-4a02-8322-99fc098915a7", "comment": "Malware payload (RedLineStealer)", "value": "e6753a40b5892145dc09ad48ef78a9a915fd999c2435fbf83234e9e8465b5d2c1ee5484619aebba3c0d8d3479f2d0678", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698758120, "uuid": "a0bb7223-c0b8-46fd-b191-e1c0d8e37aa0", "value": "T113D53393BBE454F8E0C55B78CAA21E77A5F5D2201F2095C34DC0291C2DA67E899B27CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698758120, "uuid": "5e38b6b6-5ad5-4cca-8dea-8d8bb93a9698", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698758120, "uuid": "813d0936-bae3-4421-9701-50297af0028a", "value": "49152:x15VwPa+9sa4QfZFmTb8sNBIkEBsk+OCfu10OrKig4JH57o5Dp:x15VwtKaLmfhk+OLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698758120, "uuid": "4f33d16b-ede1-4ac0-b602-3b78be595ef0", "value": 2755952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698758120, "uuid": "9356b00a-9644-4f1a-9ea1-3c15455b1910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698758120, "uuid": "97d606f8-c617-40b7-b5c7-b714a4ad5d36", "value": "edf9c207f671004240efd6a67776e97d.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f738153f-782d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698784931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698784931, "uuid": "bcd19f06-964d-4aff-8aef-8c70878d6f2c", "comment": "Malware payload", "value": "65d5e3563b16700225551d42aced1910", "object_relation": "md5", "Tag": [ { "name": "alloy57.firtoso.ru", "colour": "#7DB217", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698784931, "uuid": "f26f3708-cd3d-4803-976a-4ac49f727782", "comment": "Malware payload", "value": "207cc5969b7de393461ead79404ff541e75665d448e529ba0087127d40dfe066", "object_relation": "sha256", "Tag": [ { "name": "alloy57.firtoso.ru", "colour": "#7DB217", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698784931, "uuid": "cebc2efe-6f28-4aed-8cc6-73a437bacbc6", "comment": "Malware payload", "value": "3d3ea787eb3b00162352e0b060334e861957ba6c", "object_relation": "sha1", "Tag": [ { "name": "alloy57.firtoso.ru", "colour": "#7DB217", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698784931, "uuid": "f4fadd1e-dcc3-40c4-bc79-2341b2ba4203", "comment": "Malware payload", "value": "6391868fd2cf693d30e058768302acb332f00333bda83734b72b72c407321ae7c28128245e711b88be843fbd947f4393", "object_relation": "sha3-384", "Tag": [ { "name": "alloy57.firtoso.ru", "colour": "#7DB217", "exportable": true, "hide_tag": false }, { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698784931, "uuid": "3c29267f-db3c-4e36-be37-e751f1ac9cc8", "value": "T1C213740BF267E925F039E1341515139221637FE2DFBE5A93E0AF7A2871F21B01E0935A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698784931, "uuid": "bef52549-016e-487e-92cc-e598f6219c82", "value": "192:G8CkUaWzwgnxaOIxsgAmsSQQk4EiS6NS05e4Q6/6rHuT7+DkinrsbD26g+g:HCkUaW5aOIxskZA0eiSHuT7UBnrsbW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698784931, "uuid": "84fb8b8c-67f3-48ae-b9fe-f13243baf94e", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698784931, "uuid": "8ee51842-c1f1-45fa-9449-8ef4bdd9ea91", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698784931, "uuid": "9635a7b5-677b-4f0b-98ff-53f546c8c5ab", "value": "dod 1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f537749b-77b8-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698734676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734676, "uuid": "70a0c0d3-b8bb-4e2c-b990-c026eef61db8", "comment": "Malware payload (Formbook)", "value": "f8455483273ee9c638a26cea10e9e863", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734676, "uuid": "660e4567-99bf-4c37-9292-f94ef9700737", "comment": "Malware payload (Formbook)", "value": "20e5ab7bcccf860d84743d7949340e507f2e0746fce2defb3cdbeb871565402a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734676, "uuid": "716ffed5-f5bf-4221-ae06-074ce4c089d1", "comment": "Malware payload (Formbook)", "value": "c14e36c6d12c5020fc592bdd218db24f950b7018", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734676, "uuid": "abd2ec8d-718a-4222-bcff-3d59e07f3dcd", "comment": "Malware payload (Formbook)", "value": "8aa13494731016bb4c262a98681bde20f768ef3d540050b3b60adc4096cb6516177df48a79fa1b6abcd798a56d31729e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734676, "uuid": "2d06ddbd-d87c-4f56-99c0-7827b08cc5dd", "value": "T126C4238E3284D8F4F45BE7EF83DB8A1001DD8A9287347929C6518DD753DD0534ABF62A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734676, "uuid": "e36e5660-22ed-49da-8afd-fa76952b7577", "value": "12288:7ZESUAPKS7pAU2iPw4NWxi0DP1Sg7BKHPbCY1X623RH:F6tS7SUfPxNeX1Sg7oHPbbRBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698734676, "uuid": "1bf31243-11d7-4790-8a44-c2f923a5f52a", "value": 596439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698734676, "uuid": "4721afc7-cae3-4e1e-85d8-f0eb604432d9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734676, "uuid": "70b62d6a-1529-40e7-b769-554558b29033", "value": "Documents.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bb18bd-77bd-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698736736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736736, "uuid": "eed3e1c0-a573-4a1c-8285-3c8893f56ac3", "comment": "Malware payload (AgentTesla)", "value": "d5b2afe64e07785fe2a51becc16680b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736736, "uuid": "dcee6281-07d7-4eee-95ae-458f03849140", "comment": "Malware payload (AgentTesla)", "value": "20f78468cbe906b01286a7c6052f2f6f9d4144cab93e543243d512ff5385393d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736736, "uuid": "884d0646-feea-4d5d-b5c9-d621ec25348b", "comment": "Malware payload (AgentTesla)", "value": "cf727209962457862f1271981e366fcc0efe402a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736736, "uuid": "d2f7bf01-b6ba-4f92-a5dd-bb6b7313e926", "comment": "Malware payload (AgentTesla)", "value": "91a5963601e2c6a727c05170ee45d5f04f23d6c985c4dbc7f0b669c47d4a849aef0a5af88bfc67eeaf12543bfd6c5879", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736736, "uuid": "11ca2241-779a-4b29-81d8-265fb965f558", "value": "T17D856B457E79DA23CD00C23090E6C9F266479E4A96D292231BDCBDB732723BC574B2D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736736, "uuid": "46c26d1f-059f-496a-afb0-9dad605169d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736736, "uuid": "3195f7be-da38-4514-b7c8-7a89e57623ee", "value": "24576:02ivhLAWFZMv5mHbHgUCKbngy6ee/EFaSQOMHxZK:ak6ZMxmHbAUC0nz6ee/EFaSQfRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698736736, "uuid": "d6f59228-0701-4923-ac78-d21aa2771abe", "value": 1732048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698736736, "uuid": "2aaa3e56-95a2-4ac9-b798-8f2dfa9260de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736736, "uuid": "4c7fe1b0-a59a-4a4d-8fc5-6e1f13705a3a", "value": "ORDER LIST_OCTQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22c909a-780f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698771957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771957, "uuid": "593e366f-05bf-47ed-9e81-a4c6820598f6", "comment": "Malware payload", "value": "8d6acf7e794e921af2151eb96899c702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771957, "uuid": "b67dffbd-1c9b-44ce-bfb8-c02749c39c1b", "comment": "Malware payload", "value": "2136edebc65afda73955d8e16f59f4830d48312927766c3821a116089627785c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771957, "uuid": "e88c35c6-7069-4b78-8fae-d1e2e88d02b3", "comment": "Malware payload", "value": "0d11c4df4cbb9a6c059a6f3875a1f7e53c1e3cfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771957, "uuid": "127195c0-0ce8-4304-b780-f79322060004", "comment": "Malware payload", "value": "8e228dd776f4dd0bd9cb8a92547672f8d267ba0731bd47918d639f7c236866d6b2d13618b2fe8d1551ceb361aba8fcf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771957, "uuid": "eea054e7-46e0-4fac-91bc-1878bc138d0c", "value": "T1DCB4E05932D60CBAEDB38234C8535A45EB777C150630DA2F13E0475ADF3F390A96AB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771957, "uuid": "c4e8e88f-b677-446f-99bb-6b809e19556b", "value": "2b7a9aebc96c6a333ecefa34efe5a8e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771957, "uuid": "9a43f027-ec73-4e9b-b0ec-dce04ab49049", "value": "12288:HRVUlL/eR64RosvF1Lo/3FJIPvIUnZufPoNr:HoekSosvF1Lm8YUnMoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698771957, "uuid": "ba204f83-0a2d-45af-bec3-ffdbb1e50899", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698771957, "uuid": "391e85e5-70b8-4961-8b11-733f43e0b6cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771957, "uuid": "679e4cdf-a20c-4bda-a8a0-c6eb97c8397c", "value": "Vystmxrnay.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d97774-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698734993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734993, "uuid": "b6bafd49-e977-4b5e-89b9-332f7c8231a6", "comment": "Malware payload (AgentTesla)", "value": "d0ef40c3dfee17c704afa1266a4ab81b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734993, "uuid": "5c9c48c1-14c6-43ea-9081-7c831a8c30d3", "comment": "Malware payload (AgentTesla)", "value": "2216084b1dcedc5692822c14bd845226de45cbc6a46752cbe587cf9ed6462b29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734993, "uuid": "57d6491d-2d86-4a01-8ac9-d5820bf86c43", "comment": "Malware payload (AgentTesla)", "value": "ec7ec0b4f8b6426e95f01a507bdf16713b3c427a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734993, "uuid": "6fe9fd37-a2ae-4111-9f9c-ef3c64b6ad40", "comment": "Malware payload (AgentTesla)", "value": "13aa7fe23a4959a534c04b9aa56893a7ceb37fe2cace5dcb5e75526cf456774abb7cbea74704e68d1d50b4d80ff8869a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734993, "uuid": "c1ba6c32-725b-40e0-b4bc-10982d4c6db7", "value": "T15FB3DF297251EC0AD0135C7EC9CCD1CB62097CA29F86E60F35407B2D1A79983939FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734993, "uuid": "c629a73c-82bf-4c1d-ada6-3332a68f0350", "value": "1536:CPP5RC9IqpQDyYO1Mg9xKt9+CYdRVnhSU74yqFntybwKsNmIgw0FO5aKb8mbYvS:qTZhVOGGKt05RdhSU0ysaWtuFgrb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698734993, "uuid": "aa26c2c3-afcd-45bf-a8a9-c20a0c6fc35f", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698734993, "uuid": "047da11b-43ba-4da6-8f2e-cbd7d7e1b09e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734993, "uuid": "2f9a28f7-5f48-4335-bb7e-d1c7284f68f4", "value": "Offer details.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0e3ed4-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1698735063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735063, "uuid": "bd8fb112-ffda-462d-88b3-6b7051e86a20", "comment": "Malware payload (AveMariaRAT)", "value": "9275bce938cdb90155bfcac0c4dc35a0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735063, "uuid": "220efc61-466f-4154-b4e2-2986c95714cf", "comment": "Malware payload (AveMariaRAT)", "value": "243da90881574b0764dfe3d508c31b6d825bf822c11f0e91f3346b4abfbe206b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735063, "uuid": "f376cd05-ba2d-40f7-bdea-db2dc95779d9", "comment": "Malware payload (AveMariaRAT)", "value": "cd0beaaa1911aeef5c4037cf9b6f5cb1f7e9f20b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735063, "uuid": "400d7424-1e74-41b5-80da-f07e06b5a367", "comment": "Malware payload (AveMariaRAT)", "value": "608844035f404df85afec6d79f5a2d1d207073c2cecde97ea20d8a6a4e878cc3c9ac4d65dcb84cf38466e42f357abf60", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735063, "uuid": "c3d7504f-9b08-4732-8a60-056f3fa7125f", "value": "T131558C495F4BDA23CE100271D457C6F72A49DE8F9602A3736BEDBDB3308738557882A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735063, "uuid": "857f2286-f746-4f4a-b84c-3edd464fc1a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735063, "uuid": "4ef636ad-e80d-4c01-9605-74ed239e1806", "value": "24576:O5gmMu8oH4ETBxqVr54Ga0a0AP8+A9tDXEf:+aoH4ETBxqVdxa0a0APEtzEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735063, "uuid": "d39ff101-45fc-47fb-96d8-de0ad4b86f5a", "value": 1361408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735063, "uuid": "a83fa040-6e0b-4974-b387-648aa8469aed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735063, "uuid": "d71ca032-966f-4ccd-b563-4254da8f7079", "value": "DHL Documents.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0d6cef-77d9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698748861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748861, "uuid": "52c5c9c1-9dc9-46d1-9ab8-a9b9f4e1b24b", "comment": "Malware payload (AgentTesla)", "value": "1bbeafcdcb16f61884618a73faa95a47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748861, "uuid": "2f746607-ce91-49b0-8114-a0f364de9448", "comment": "Malware payload (AgentTesla)", "value": "260530d11183d7baa980862009361f80e8bcd3b4539713ca4cc7d8106dc59420", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748861, "uuid": "b019586f-2eaa-4566-a717-45f479ddd238", "comment": "Malware payload (AgentTesla)", "value": "89453a9f1b3a064dfa7ffde094dcff30aed6fc4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748861, "uuid": "5adeeffc-3e5c-4cf2-9e5e-c243e395d9e0", "comment": "Malware payload (AgentTesla)", "value": "4ffe5858f1b6db470e41cf56405a3a99b26b51e42011b646bda7fd9fb4424af08c4ec763b08d3f65c46315119daec07d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748861, "uuid": "b8a6e9d0-c6fb-4687-a07b-77329c6b88dc", "value": "T1DDD4237D13548975D0FA5BFBAAD0207197B5821B7643FB8C0DF1F0C92D723A368662A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748861, "uuid": "b968284a-346a-4d2e-80b4-4bf8956c53f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748861, "uuid": "46c48ef5-714f-4b38-8351-5df1443bbdb0", "value": "12288:8UR6zgoaekpXHZCLACq1X05Li2DajtEu1GfdPZAFE/:8UR6Mp3ZCUCqyi2WRN1MdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698748861, "uuid": "6b347b3f-2902-4840-a817-d802b5b3110d", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698748861, "uuid": "e850c19e-8612-4ad0-b0e3-4cb32feff64a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748861, "uuid": "6e80f2eb-beae-4eb6-ac90-61d45839681c", "value": "r\ubc30\uc1a1\uc138\ubd80\uc815\ubcf4_\ubc30\uc1a1\uc138\ubd80\uc815\ubcf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dddd8ab-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698734959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734959, "uuid": "bdf5730c-ff17-4408-a873-9554ad07e925", "comment": "Malware payload (AgentTesla)", "value": "077ac3fc93b551211b494ebd7c0e739d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734959, "uuid": "199b5dd0-ca3b-4b77-a47b-ba7052c0432a", "comment": "Malware payload (AgentTesla)", "value": "26962f7aecee61f2b2dcda1be63257ec8c4a02c9f1a564bf0024e0f5c38a727d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734959, "uuid": "2c90ce8c-535c-4d4b-8e7a-46ea33592a35", "comment": "Malware payload (AgentTesla)", "value": "3c0161473404be0c081c7b503ebf7c04ded646b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734959, "uuid": "3c5d8f1b-7d17-4a42-9ddb-2994242bba37", "comment": "Malware payload (AgentTesla)", "value": "f48b44000b5b36ce98a935ad8ef9f18e079d77d654360c8d5a21b8bb04236563c6698914d4dae75fff8d5fb20bd020b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734959, "uuid": "0968d38d-4072-4dc2-ad88-f4382bc48d76", "value": "T104E423816B8B54DEDBDD5513CDE22D82CFF2681E427B7626AE463A48C8ED781C24FD04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734959, "uuid": "d48bce56-bfa0-4c4e-9502-3755f1c4c878", "value": "12288:fVnWHibDoYDo7C9l+uKLc/OO0oa6IPWZ0EOmBNnofVcMestska+hpjJ7EiGXOy:drgYD798Nc/OOCPWLOmByfV3e0skDhpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698734959, "uuid": "326d899c-c95c-44d2-bd75-53e7abed8859", "value": 683989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698734959, "uuid": "4b495788-f7d7-4273-b769-222681b2bc59", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734959, "uuid": "13371112-a3d0-4590-90f5-e95efd8fc622", "value": "PO-35720.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30e8a23-77dd-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698750510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698750510, "uuid": "7b2d39e6-38da-43ba-9a16-a0b4ec6a4032", "comment": "Malware payload (Mirai)", "value": "1e7a5d4efd8621f9683341b600168be6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698750510, "uuid": "71e8eb10-ca6e-4539-ab28-36b6db9313a6", "comment": "Malware payload (Mirai)", "value": "270cd025f525165fe798b53ff0d6f5b2a1c0190a89e6e322c014650b9557f080", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698750510, "uuid": "37dd3c35-c266-4c4c-aca7-3728d5560a5e", "comment": "Malware payload (Mirai)", "value": "8cbfc83e26570fd759cebc75d96facd2d67400aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698750510, "uuid": "6a6b5d78-aefc-4d60-995e-44313da25bad", "comment": "Malware payload (Mirai)", "value": "4fd692f231fb3f9664ee7dea5782a6d4b1f2ea2b26353e1a9bfb8ca1af41d5c9a4b9f3ac104e8a0d4018456ff1f31d44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698750510, "uuid": "624c0fb2-0a2e-4361-9b3d-ad04d727ebad", "value": "T1F2534AC8A5C3E5F5EC001D79307AABB1A973F53F2035EE9BE79A25639903603E10169D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698750510, "uuid": "965b342b-388d-4c55-b7d6-bae8345ebdf3", "value": "1536:V5Vn4pXoqVExGxRP3MFnKiwjGKO18HKaPWGUJUnDx8AG9A:7R4pxuxGxB3MFnKrGHCHKKw+dK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698750510, "uuid": "9f9237e4-ef7a-40c1-9aab-d6dd97193a54", "value": 63696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698750510, "uuid": "9675fbde-44e9-42e2-b8df-24a0eea962c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698750510, "uuid": "d162dccd-cb33-461d-a490-6913f0a73540", "value": "1e7a5d4efd8621f9683341b600168be6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e31fe867-780a-11ee-8907-42010a9c0042", "comment": "Malware payload (PovertyStealer)", "timestamp": 1698769865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769865, "uuid": "f31aecba-b650-4f7a-91be-1b5452074b67", "comment": "Malware payload (PovertyStealer)", "value": "fdba618ccbd485f525934e71f78f7382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769865, "uuid": "07c04375-ef08-4582-94c6-4e99dbc33067", "comment": "Malware payload (PovertyStealer)", "value": "282f0892d8977725fb05f09f42633396f297dcfe4992e0e4fa6b8a7231cb8504", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769865, "uuid": "871fd6b8-2d17-46c4-b061-c601187586a5", "comment": "Malware payload (PovertyStealer)", "value": "16f017f2d5eab8d85771b872358afecb126bf1e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769865, "uuid": "9517d9e7-868d-4272-9cf1-b471acfe5114", "comment": "Malware payload (PovertyStealer)", "value": "e8b6df75b176cfb832c7336c658b69b69a148f1f1036e25af9830dc7bc9f33dcbc6f92e6dd0f79a2eea2308ebb1c60e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769865, "uuid": "7f83380e-fdbf-4913-bd76-b8700da4a875", "value": "T193564BCBB85050E5C0AFD37185269753A6317C881F2123D76A50FEB83E76BD46EBA324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769865, "uuid": "80f707dc-427c-4f1d-9228-9961c91c1e26", "value": "85cddd6092e65c1a58dd1e6e9ab9fc63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769865, "uuid": "03fa30bb-828e-466a-9578-e373dab6a652", "value": "49152:ArBjISKhD+7Zrb/TGvO90d7HjmAFd4A64nsfJTs8jIoqRCRMea8q356UhLN9IO8+:v+7dkpRCG35fIOFbEKbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698769865, "uuid": "24552bac-7015-4941-b398-b554b1d1247b", "value": 6368256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698769865, "uuid": "1560475c-2b2a-4c2a-9350-5b7efa67b4be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769865, "uuid": "282c6c10-94a5-4e00-9ffe-fb30321cd9f6", "value": "SecuriteInfo.com.Win64.Malware-gen.10725.8244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8041b078-77ee-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698757673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698757673, "uuid": "737d2952-6fc1-45d8-87ba-79e8b5f7a7a6", "comment": "Malware payload", "value": "92a3bfc56047114baf8e52d4c0a7dbe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698757673, "uuid": "213b3aaf-89a0-487e-a2e3-b248658d8bf0", "comment": "Malware payload", "value": "28f46d936dbf0c6a27993a483c00b6dbbe8a17f9751be9b0efb657d95b4d9400", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698757673, "uuid": "dce6ff8f-4350-4b5e-9e6a-9a6fb8f25043", "comment": "Malware payload", "value": "b87aa007f7bae56e8b34ebbcfc58d2fbbf0f25fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698757673, "uuid": "f3a2e339-a74a-4163-aeda-bd9a745455d0", "comment": "Malware payload", "value": "882dcc378b993188cdbb48b74c1fffa4fbdf743dd3b101f1a9e6e87bce99451148266e94a2228aabdd38fce527f46ff6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698757673, "uuid": "e1df56a5-28c7-442d-9501-37f1afd671b6", "value": "T1B7853352BAFDAFB2D8A0CC35993091D4586A7C865432C31DB5906F8EAB4C4DB1680F7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698757673, "uuid": "62417a3f-6a7d-4233-973e-c4c7ff2dfce2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698757673, "uuid": "2d9c037f-0b6b-4f61-940e-cad8bcd8cab1", "value": "49152:6NnN64pBAqbf39/7V5Vq1MT4sJnzjZtzpCcfQVu3tLjojZ9BLy:qnNpBbPn5ViMP5568/oFLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698757673, "uuid": "db2e7c23-1189-495b-84bb-1a11fe219d85", "value": 1797632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698757673, "uuid": "26294680-0226-4a7f-a39f-6ce1457f44ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698757673, "uuid": "13a505da-c15e-40c2-9f7a-9d94961a8c86", "value": "RFQ2610204.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d656cc-77a4-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698725852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725852, "uuid": "6e957008-2e50-4e35-91c0-cb9b24850d56", "comment": "Malware payload (RedLineStealer)", "value": "106037425c3ebbea9bbaa7b5f4afb991", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725852, "uuid": "a5e5488e-a170-49aa-954c-8210664341b5", "comment": "Malware payload (RedLineStealer)", "value": "2a9b3852b7f12031702400476992c1a136872b5e15120cca65f61f843b05e810", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725852, "uuid": "9f69d7a2-527b-4ed6-841a-a82404b5b3d8", "comment": "Malware payload (RedLineStealer)", "value": "91972b2bf8eb974f0dcdf7f24e2fc161770aafc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725852, "uuid": "fefa2b0f-c522-4632-9a61-2ef867aac6a7", "comment": "Malware payload (RedLineStealer)", "value": "6443e1923470cb54869d03049785467b6c97fe4f4fc73716e536c60c626118b0c5b9a2f29bf70d0db06a70df2174012b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725852, "uuid": "cc6c7370-cb01-48ed-9861-94e11ee6ccc9", "value": "T14D752367FADA4432DCB7577018F201D32B797C6568A8E73F331AEA966C71186313270A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725852, "uuid": "db1609fd-e244-4d2b-8851-e5b210c52235", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725852, "uuid": "63e59d15-fe1e-432b-821d-823dc52adc0c", "value": "24576:ny68R/0+Vz7vZJiiAoRy9l7taavQrt9R9DQL/GXL6bORz2DzR0AvskEwCmaE5hXC:y6S9VzdJiLoA9xQrnPQLgzRSBbskfaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698725852, "uuid": "d56bd7a4-609e-443c-b149-fd6a2c07a8c8", "value": 1615360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698725852, "uuid": "7f77038e-a97b-45c7-aee1-6a92ed4cb3ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725852, "uuid": "05be7772-3978-4b0b-96b4-339af96c9614", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb00d85-77d9-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1698748780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748780, "uuid": "6c29b58c-436c-40b1-82d7-407446d5bbe1", "comment": "Malware payload (AveMariaRAT)", "value": "e9827c21abbdaab4af77b2a66627636f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748780, "uuid": "af2edf56-6118-484e-bd20-45eeeb30bdab", "comment": "Malware payload (AveMariaRAT)", "value": "2c861a0c26c365f6cab8bce7e890b4fb86daf261db04187f9a5bfabedad80d03", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748780, "uuid": "b5246293-7b1e-4c6b-8343-1c9dd4f4e683", "comment": "Malware payload (AveMariaRAT)", "value": "971921900e2a263721a22cb9c9a219f94e8b2bf9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748780, "uuid": "2cc6176f-f84c-4df5-a9ac-7941dd2d96ff", "comment": "Malware payload (AveMariaRAT)", "value": "d658274d1d98579379eb060d1b16e7628bdee352003fda72697fdba7dbd57550be1748171e2bcc05a29022df40654c1d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748780, "uuid": "5b9902d8-f928-415e-9abc-a75656e06121", "value": "T124830E1663FD0568F0F7EBB8ABB591118A3FBCE71A11C44E25A111DF05B1E88AD62373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748780, "uuid": "99075984-80bc-42b1-99ce-116b38671dca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748780, "uuid": "96718c81-0571-4e59-a858-83f1ead90dbc", "value": "1536:7H9yLpxVdTjUWk6Ga778CT3krT2mYjdYnhH0Y:7HGfZjBv8CT3krT2mYjdYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698748780, "uuid": "0f7ce664-2163-48ac-a41b-12a518e1f0be", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698748780, "uuid": "a709cc6c-4a16-4f6c-9b3f-0380770b277c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748780, "uuid": "fb99950f-fd8b-44ec-93df-f7a882c3fccd", "value": "rKlockner-Pentaplast_Companyprofile-Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35faa0d0-77bb-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735644, "uuid": "af9b535d-17c0-4da8-a467-e9a46dde13cf", "comment": "Malware payload (AgentTesla)", "value": "ec630c6c6763c8516b5ec37c887f004e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735644, "uuid": "db00fb9d-5d60-48e5-86d6-981e6a6db4b7", "comment": "Malware payload (AgentTesla)", "value": "2dc33327459addedb7432844f2fb7f77f971c7b50542b77d7343c7b205b8d9f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735644, "uuid": "8efbad34-dd65-4eaa-86eb-85183afbc72b", "comment": "Malware payload (AgentTesla)", "value": "1cf5c126937f9cdb2300643f3a383b5793b0bd27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735644, "uuid": "eed8d4fb-9c91-4983-851b-8b4d713c67ab", "comment": "Malware payload (AgentTesla)", "value": "9709c79697d59ba9217932941be57ac7245c93915a3be8dccbf7dfa42797826e7fef8b91177f441051833076e768a96c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735644, "uuid": "30454e67-261d-4f35-99ab-d77c214088f3", "value": "T1F025CF2671D75DE1DB2A0373C0BB44A443715E56A1E5FA0B128E70E29233BDBF50A78B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735644, "uuid": "3d6850a9-121f-4894-98b0-866917b3d3a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735644, "uuid": "954f4bbf-c5b2-4786-905e-5300e17ddda5", "value": "12288:wFgxjVtJTiL1ZYrD6NDOxWk2bPAj+Bzy9hYaNFROKFLltcPMz2tiUW:wq7TiL1Z6DCCx2zAjQ67OKFbhz2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735644, "uuid": "f48b7884-09b9-4e7e-848c-7e828c54310d", "value": 980480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735644, "uuid": "3188411b-9144-441c-8238-9d28a0b0b0ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735644, "uuid": "59898189-aeb2-49dd-abb4-5b8ea169ec74", "value": "PO-002112023062700.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476545a6-7813-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1698773469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698773469, "uuid": "0473353d-12bc-4409-b2cf-ed042f7ee24c", "comment": "Malware payload (njrat)", "value": "4e4859aafd131ec0d377d927d9101c9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698773469, "uuid": "4dd1064f-1fde-4631-adda-2977fb640e55", "comment": "Malware payload (njrat)", "value": "2e4aa0e3181c96b6001135a8f5cdf00a041ad0e0cb6f61385b5942aae3e194bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698773469, "uuid": "cbbaacef-7d22-4eda-8d70-b5baf470de42", "comment": "Malware payload (njrat)", "value": "c82c4ae9d598cd470d79a720e9e7fda359679ef9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698773469, "uuid": "a8ea99a9-b89a-4959-aec8-21d43a10bf2c", "comment": "Malware payload (njrat)", "value": "26fdc0970f778a83b423c6679bf0c36f9966b12c4667a35f6a8fe02ad15febeaa043742b2f728fad695893662b9f1e0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698773469, "uuid": "215c5df9-1806-46a5-b516-e33c777c0d4a", "value": "T1ED032A4D7FE18168D5FD067B05B2D412077AE04B6E23D90E8EF664AA37636C18B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698773469, "uuid": "6af1b6ea-d1b4-444e-857f-da6e33fd6047", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698773469, "uuid": "c6c10820-c723-4c9b-b833-6e25ef955a3a", "value": "384:cOSvEiTbTvpWNcZ0y8fvCv3v3cLkacparAF+rMRTyN/0L+EcoinblneHQM3epzXf:dS7TZ38fvCv3E1cQrM+rMRa8NuNRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698773469, "uuid": "7bc5768b-673e-4718-a453-41a76cf864c3", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698773469, "uuid": "d415bdfd-df11-43b5-82bd-93256cc2cddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698773469, "uuid": "24ddfd10-64c0-4293-a8a4-897e23193fcc", "value": "filename.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3f0c48-77fa-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698763038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698763038, "uuid": "53b80e23-c05f-4590-a7ac-c2d350629543", "comment": "Malware payload", "value": "d369a9901bdcc62c4f21920b824d10b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698763038, "uuid": "90e9e452-14ec-4245-8230-23ac95c0d691", "comment": "Malware payload", "value": "2f3164d5cb78cd7c382dda971ed394e0209734c76491e3a1f6e96310aaffea93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698763038, "uuid": "6c0d2bda-05b8-420c-b661-c89c8d02357c", "comment": "Malware payload", "value": "1a38f6f96b08ab819060fa634858ff8ff974527e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698763038, "uuid": "2dd42ee2-6014-402f-a0ec-f312136ed7b0", "comment": "Malware payload", "value": "9ff8d51f797c4e836168c96dabd3266199bc6449dc74c3da74ad2f855cf131fbb29d6b64a08f1cf9b36fdb57595e5801", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698763038, "uuid": "4ce86162-31d5-4191-a524-b4d5ea690658", "value": "T164E56C57B9006DA6CF4E51F3D3E6470CAB03C44A574693DA2AC6D0EBB34D2DA6A0F1C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698763038, "uuid": "4a3dc530-6128-4638-bcbb-0375cf4b6715", "value": "49152:ZmLgfa1tdE3PJdJQeT5i10Jf2qeZqSPse68GXiHdcl:GUa1tdp0JWp5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698763038, "uuid": "bab4cffb-cc4a-48e4-b52f-0536a76abeea", "value": 3075072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698763038, "uuid": "5895e8ac-abde-4fd1-bd93-edc01d3b9855", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698763038, "uuid": "e4c7016c-8c09-4744-b851-ba55cc2c5bd6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ec4ffc-7823-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698780315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780315, "uuid": "4d564a05-8d14-486c-8e5e-4f6af7c1518a", "comment": "Malware payload (Formbook)", "value": "cd3ec269704050b2ef952e8d68d9e011", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780315, "uuid": "b6d25dc9-cdc7-484a-a336-b8a2206e23a2", "comment": "Malware payload (Formbook)", "value": "3106ab616dc892b43c8d9c28a9fc9f83b3e4676b5e4e61dc0dd97bab8d6072e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780315, "uuid": "bb449822-3d89-4de6-a236-20d461026b8a", "comment": "Malware payload (Formbook)", "value": "c5fcc4e5d9936dd28b13d81dd8f51bcdab294f94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780315, "uuid": "51308467-1489-4e98-9b2b-e82b1e2ee60d", "comment": "Malware payload (Formbook)", "value": "4e9b9746d403f8921825a3953fccc0d5cbabab6a08ae5c228d9fd831e585e34f0c8a9e1c373faaec202e9f06226b8975", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780315, "uuid": "cc177642-e72c-4628-adfb-ccc20578789a", "value": "T127C41345BAB69F02C97D96F10AE180102377556F9631EB9E3D8D22DE06B2F5C0736A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780315, "uuid": "00a44fc8-55fe-4410-b07e-b60343a1c7a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780315, "uuid": "f90c4c89-23d4-423b-b4b0-7b878880373c", "value": "12288:p8i69yqL86aK8aP5MwXz631piSjEOyidgdMCNcEjv9l3HIbk:T6XCK24zE1p94dFcGFl3HIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698780315, "uuid": "d0b45e17-8e05-463e-8ddf-444c04bb9e8a", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698780315, "uuid": "e5bce00d-dfec-4035-a1ff-3f40f4a2135f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780315, "uuid": "cd6eb555-114e-4a1a-b326-2d1a5821494d", "value": "SecuriteInfo.com.Trojan.Inject4.59820.21926.10504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61891cdf-77c7-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1698740871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698740871, "uuid": "bf63a409-b938-4992-8496-6aa52ad811f7", "comment": "Malware payload (zgRAT)", "value": "c07745eb39de5a4c568de93d1e264840", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698740871, "uuid": "62d447dc-528f-4132-9d74-38c10277e5f2", "comment": "Malware payload (zgRAT)", "value": "32262aff24a9e3e222ad809c83cb4abad0d8c1df3e4559c760a2c26bd00290f3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698740871, "uuid": "22e59007-02cd-4536-8295-f0296172612e", "comment": "Malware payload (zgRAT)", "value": "6fae33197e2c49b1ccca554a1b2e11925b137c90", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698740871, "uuid": "cfce568e-051a-47f4-9e82-9d80bcdb9547", "comment": "Malware payload (zgRAT)", "value": "32b86e26ffbf4d878587dd405ece172d2d21633f659dda73350fcc5b5d382acdfb6475c5ca8649ada9cb4c1f3f70005e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698740871, "uuid": "8dc3ce74-0e6a-4eed-b361-17b04871231c", "value": "T149F5CF56A692EE1BD394773AA2A3512C8335D2027703B70F1F7D512A7C933764D223EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698740871, "uuid": "7bb4478b-925e-4c5b-a1cc-a3f48ad64447", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698740871, "uuid": "2c19f407-bfc9-49b7-8cb3-265406ac87d3", "value": "98304:f40J5NLw+OalshCM3lc9VyCGPnOWYume:Q0JHSalrSc9Vk/OX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698740871, "uuid": "3109bcd4-0221-4334-b298-a94d5d6cf3b1", "value": 3471360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698740871, "uuid": "aed53260-8f95-4af0-ba57-04216c1731c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698740871, "uuid": "30c4f01a-c837-4d91-8d21-be2e3e346f1e", "value": "binary.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f307b208-77d1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698745410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698745410, "uuid": "931258b5-134a-4724-b3f3-bd9808738848", "comment": "Malware payload (AgentTesla)", "value": "80879bff6cd1deabdeccc98174fc2b6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698745410, "uuid": "0661c61b-595b-4792-bdde-86da7941bff0", "comment": "Malware payload (AgentTesla)", "value": "32c76a3f890ebf89d49934851b64eb3aceeff0bfc78ef38d14a9d2d43d357b89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698745410, "uuid": "395927e1-97ee-4625-b2c3-fc50eb13d727", "comment": "Malware payload (AgentTesla)", "value": "61c471ab222c132d28557461831d07b844c2950d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698745410, "uuid": "ad247491-fefe-4d20-a04a-523f58d34ee8", "comment": "Malware payload (AgentTesla)", "value": "a0e04c6dca58ed6cd8c96c7ea8c048994d9bb41a91bd967f0eb4a2e475a0daaee405ddc94ba5aab2d5fce2fedd1c7f17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698745410, "uuid": "6fd90d22-22fa-497e-9852-0c1268aed50e", "value": "T19EC4CF66F7F0650EE5DA8576CE3063E0623368A3B613E369DC54E596382C7D78EC04A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698745410, "uuid": "7a0653b9-8454-49f0-b44c-f406591462b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698745410, "uuid": "95f97b39-7f10-4396-94a1-c95c8a7cdf4a", "value": "12288:q9BphA3ecIn0a95VdlNlcjtnsARBzN4oiJ0738xeyk63D64PtLZw:qDDAucyfjVdlNlcjtnsO4GiDvFZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698745410, "uuid": "fd4377e7-3b3c-4bc5-b5cc-375cd03edbe2", "value": 581496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698745410, "uuid": "35e4a7a8-2232-42b0-90ad-4b2000355aee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698745410, "uuid": "8239133b-ad5e-4cbb-beb4-37064488c955", "value": "Quotation Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7c6ddc-77e3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698753075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698753075, "uuid": "de64ab0b-2895-4b8c-90b0-4c490b2c4ae3", "comment": "Malware payload", "value": "9e29b5938579bf6a0aa5059a0d77bee8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698753075, "uuid": "752554a8-256d-48ca-9289-db96fd36f474", "comment": "Malware payload", "value": "34ec07236969404b1de5cda886bf09c4a43e8cd027bf2421a9ab8ecd9259745a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698753075, "uuid": "d3a534a7-0524-4f19-8d27-a6bbf83c6012", "comment": "Malware payload", "value": "565a35e00790b3af16ae9b8c6c89297495983eca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698753075, "uuid": "226b68e7-808b-4eea-b444-0d44b1899da6", "comment": "Malware payload", "value": "6c9f1c3962b2835059ff689182ef4d162666f473ee0e16b570e1f13dc9ec4ec2bb9d3adcad289ea303463352ea28a6e4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698753075, "uuid": "d6cc0245-fd06-48f7-bf5b-beef4c23c028", "value": "T14E65CF337996C87BC3BAC27D584DA71A14E6F9730E322D0762F8335A5BF89425318E46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698753075, "uuid": "5c0bbec8-22a2-437a-88a4-66833f83c58c", "value": "4454df7b8d68533ee996d945d002a4ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698753075, "uuid": "b161d93b-6c18-498f-a1f4-db27b1c681a2", "value": "24576:yPrfF8CAhLZmsVmaKaq6Kaq6KaqoDuZ1La/HRsAy/bMKbHIzhLE8K3xebjkSKP4J:6r9pAhLZmsgaKaq6Kaq6KaqoDuZ1La/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698753075, "uuid": "59a095dd-548b-4ba3-9cd8-4684bf12cca1", "value": 1469386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698753075, "uuid": "18baad58-8ebf-4695-9370-9b93e6ed2495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698753075, "uuid": "aabbb54b-e811-4166-a8f6-d5cbf57cb4cc", "value": "XE3.sct", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67f6740-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698734974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734974, "uuid": "9dbd6fa5-a3d3-47c9-9afe-d7eaaf88d776", "comment": "Malware payload (AgentTesla)", "value": "686cbfe0e0d53f686f355d61747f08f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734974, "uuid": "a87953f7-ba58-4074-b777-42473702ea5f", "comment": "Malware payload (AgentTesla)", "value": "34f6cb2299cd0dc60b2c14b9ed7279da711262a31c70c3ca87c7b5ee270ff3ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734974, "uuid": "3f3b0198-3742-424d-b4a4-6e9be94e4d5a", "comment": "Malware payload (AgentTesla)", "value": "cbe2b5b4d14be0f2822519ac15b38482b23c84e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734974, "uuid": "d78bf167-4d27-4f93-8589-c3012460c845", "comment": "Malware payload (AgentTesla)", "value": "e3e69dbc5b1370a4e0510d6622e9707763b1790a09b7357d93c64591a106f13e86713d1f1598a136236d85ceb5c6215d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734974, "uuid": "1b767be0-811f-4400-a35e-17ce22c18229", "value": "T1CCD423E4527844CDCF88FD979D382E0AE3D1707BB757E9212A3C04281D276A24F5AE4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734974, "uuid": "942a3027-9619-469e-af82-ad981dedc48f", "value": "12288:hUX9uxPnvl8JXXIQVT8sh3r/0qsxu8upFClNnegjZyB/U6V5LQNR/qSIcnf:hU+ngYQVT/rBmu5j6XA5LQjhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698734974, "uuid": "714e659a-2199-474c-8526-66205b33dc0f", "value": 609418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698734974, "uuid": "10c3ac13-67fd-43a8-a137-1115bcd0701d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734974, "uuid": "535af96d-f09a-442b-a3ca-cc779857ba76", "value": "SWIFT26794306.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29769850-77ae-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698730039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698730039, "uuid": "23763768-62cc-4579-972c-9830f606454b", "comment": "Malware payload (RedLineStealer)", "value": "ce1c3e28bd5b64bc28f9a8d589f82b1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698730039, "uuid": "0a037fc0-bf59-429c-9e30-797abf3498df", "comment": "Malware payload (RedLineStealer)", "value": "359b38c384b3b2140bf73ac6038e1e19b09e8a8d602d19778cf7973b3c052a61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698730039, "uuid": "150cf3cd-9714-44ab-aaa7-cdfaddd2e3a2", "comment": "Malware payload (RedLineStealer)", "value": "143f36884ef1c6edd99348e701dd6edb92738280", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698730039, "uuid": "e56b8b69-f17f-498f-82d1-231310567ad8", "comment": "Malware payload (RedLineStealer)", "value": "2ab1c840775949790c94a19de2eb90fb868c83dfeb5efade10c2fa76f7d643a3827a7746bfdcb3f8dd3d66ac0aaf7d96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698730039, "uuid": "7079e2c5-88ba-47ce-980e-a7a2c1866b4b", "value": "T18E752342E3A68123ECF93770ACF95BD31B76B8604C3687A63325555A1D3368471B0BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698730039, "uuid": "559e6015-eafb-4e9b-8c03-97b53c929ada", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698730039, "uuid": "e7b52139-f549-4005-9416-2f556b08a92e", "value": "24576:NyR3bH80dQodwg/k+/a1qV1BSDDd9TsPya3KJcaH5mZsbpuoTq0XnR6uHm:oRAWQoZ/p/aMVeDzsPL3qcaH5xG0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698730039, "uuid": "cfb7cc47-f680-4be1-8a00-fcb0db134683", "value": 1618432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698730039, "uuid": "5caaf0e9-f042-4a2a-b1c8-9a3113be1d93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698730039, "uuid": "deef00b4-dc70-4de8-921a-0e625f0f33c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3623048a-77c0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698737792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737792, "uuid": "14003a6b-4425-402c-9397-d2651f1db5fa", "comment": "Malware payload", "value": "75dfc8aeaa12107ef917fc737be736c4", "object_relation": "md5", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737792, "uuid": "294cfb30-11b7-48ee-a681-95eb7a51429f", "comment": "Malware payload", "value": "37965676bb8e05c9fd3a19407b936725c2c56e4fd2585aa459cd7709bc4b61ee", "object_relation": "sha256", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737792, "uuid": "22a8a9f8-4f1c-4e25-83ed-2057c01613be", "comment": "Malware payload", "value": "409d07ba25c2a66235a5defb2d3e53dba7f600ab", "object_relation": "sha1", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737792, "uuid": "bc175a50-6531-43e4-b1e5-5a9cae82a117", "comment": "Malware payload", "value": "f7b5ab683cf8b7c39fb71a24d0807600efa065a2b786675a913cc18c0e3786e1a4ccb4ff1eb5a8aa3b7764780dd0309b", "object_relation": "sha3-384", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737792, "uuid": "181ccf30-d996-4352-bc4e-18844a95f498", "value": "T1BEF31A5198E62F5A5749DBC38A0D53D8FC6722BA7B27254A9A122B51FFEF0F3DD02100", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737792, "uuid": "92ad9d43-140f-4c96-8f74-b0b5e87ef73a", "value": "3072:THm96+l08/vD988lb+FEt1qOeiPHOv8/1xsoAbPMLZJ92avxxV7UbqQgI9nwgnZc:THm9zl08/vDS8lyFuXe0HFtxPAb0LZzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737792, "uuid": "a8bdbb5e-52ee-45c5-a55f-95fffd5717e9", "value": 160294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737792, "uuid": "6739aaf8-dbfb-4869-a1e5-4fada2f49bde", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737792, "uuid": "003c695e-91d9-4402-b368-e83dc3b4c997", "value": "PO.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373eb46c-7823-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698780314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780314, "uuid": "863c6f96-0d62-409d-8984-60c89335725c", "comment": "Malware payload", "value": "f8cfd1a3bc18498c812ade7422f2fe57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780314, "uuid": "668afe3b-4b62-4c9c-8a14-740e6eed5f37", "comment": "Malware payload", "value": "382866d2f2304ef11667ff45961e9586f65be0fe498dac88786f1503d1bba34e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780314, "uuid": "3e71f78f-b788-485b-ade3-cbfe069897b5", "comment": "Malware payload", "value": "deb977ad561e9bb6cfa543bb9a5697ade5da1caf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780314, "uuid": "db63ad93-3ef1-474b-b1b6-d58dceababd9", "comment": "Malware payload", "value": "c3177097dc85de88d8d052508760b8de5caec2f18ba11cd9db6cc2175fde9ea51cad0d730e57abbf25852590a9eb2388", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780314, "uuid": "bc03b034-e49a-4b88-b728-813e7cc59be8", "value": "T1BBF36C41B4C08071D977193219F0CAB09E3EF9704EB6AEAF67990B3F5F702C1D625A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780314, "uuid": "b6f8f9f8-ca1d-405b-933c-6ec3d13466e0", "value": "4962683fea14d8677b27271b978ee1d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780314, "uuid": "e938f73b-b268-4c00-9494-4fb75c06e6ed", "value": "3072:Fn2jd5FsmJrFguZY/gSrqWJZeY8PIZeTaTWVL7h3oZShXug5Ecp:92jd5z4SY/gRyZelaeLCShJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698780314, "uuid": "acfce92c-b325-40d9-ad8d-ef16f5ba001f", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698780314, "uuid": "32e76daf-244b-4698-adbc-925b93e4d775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780314, "uuid": "102961a1-e523-4e03-bc13-7c5674a97bc3", "value": "SecuriteInfo.com.Win32.InjectorX-gen.4790.17012", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7cde389-7789-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1698714440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698714440, "uuid": "9d1cd2c7-f430-47ea-84cb-59e34b4ec705", "comment": "Malware payload (njrat)", "value": "7456d393f8b3d9f7055d4b8a162109af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698714440, "uuid": "8ab21817-cb1d-4141-a99d-6607ff4db114", "comment": "Malware payload (njrat)", "value": "388325db8b3ee1efceb9be9796c047c8b686fd58c6665fb1ee3d33d682267876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698714440, "uuid": "81048411-ce48-4212-9f6b-686f1e325505", "comment": "Malware payload (njrat)", "value": "a73fdee4e77cd1002b7659697b7f220b2d9e80f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698714440, "uuid": "3f6b0870-8c6c-4150-bff0-5bbff2489ef2", "comment": "Malware payload (njrat)", "value": "a9b481cce53c7911e40e67ff2591580d9c468ceb33277a7cb4c6d4e637abfc87a6200f30bd1e8f46a38826cdc7df6500", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698714440, "uuid": "2f4d1674-d51e-440a-ae2d-34fd2eaf8aa7", "value": "T1A7B22B4E3FA98852D5BC1B7485A59A5003B4E1874423EE2FCCC550CBAFB3AD91D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698714440, "uuid": "b6bd80f2-b3e4-4b69-bf8c-9a8a3e92c681", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698714440, "uuid": "5c7f34d7-0c83-46d0-9858-2b5c37ef56fe", "value": "384:6oWSkWHa55BgDVRGipkItzY6vZg36Eh7FpmRvR6JZlbw8hqIusZzZCm:dJuk9pHRpcnuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698714440, "uuid": "fd8a1866-932e-467c-9da3-564bab368481", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698714440, "uuid": "0a671166-ab45-4ec3-b5ed-73bf52d3fced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698714440, "uuid": "a738aafd-9135-40b2-95db-ffadbafde1f4", "value": "bRbX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a8fe24-7822-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1698780095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780095, "uuid": "9e03b89c-a37f-4f5f-ae3f-ec500397a1ce", "comment": "Malware payload (RiseProStealer)", "value": "450783b6304d896d217b0a816a3f4853", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780095, "uuid": "7187bdab-7fc6-4e81-87a9-d34e848eb492", "comment": "Malware payload (RiseProStealer)", "value": "39c3cb4761ba5fbb081b564c592a3f01c461b72277fe6baaff24907208eae99f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780095, "uuid": "0f4a802c-1753-41af-9569-c1777c8f6b4a", "comment": "Malware payload (RiseProStealer)", "value": "535b2eb77aaadabb2c7696e026fcb64bf7d244c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780095, "uuid": "9e50b044-14d0-4a3f-8861-b896fabb5cf1", "comment": "Malware payload (RiseProStealer)", "value": "110785ac7fdcce451f77b7ac2905736722d6e44003a034d164562a60d1090faedcd44d57da8c852a73015367510a1501", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780095, "uuid": "5ab6f9b1-0df8-4bfd-b8f5-38220efaaadf", "value": "T146B50212B7804637D533367C9C0B9369DD69BE203F24984B7BE86C4C5F7A78275292A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780095, "uuid": "8ab64cd2-ed0e-46fd-b228-2582f85a1f62", "value": "41250a33d997f95077d374af20f0b887", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780095, "uuid": "8d2e1c74-1fcc-4ca5-a41b-7bfb8ecd8a4c", "value": "49152:CD96aQpIPAMnqnQIQ0z4DMRu29DMDd22:Cx6aeI4MnVIJtMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698780095, "uuid": "7e0f6a84-47c8-4676-a7b0-e102f27d4bf3", "value": 2311680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698780095, "uuid": "d1f635c4-ada4-47e7-884c-b1f181b3450c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780095, "uuid": "68e8ff91-1d50-432f-98ec-a7ec608af91f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649208ca-77ac-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698729280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698729280, "uuid": "a801e23e-f7d2-4ab8-ad48-888141aaa277", "comment": "Malware payload (RedLineStealer)", "value": "594dd31f747dc1484fe9587a2fa39204", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698729280, "uuid": "c80f3bdf-d5ec-4b25-865a-342606f687d0", "comment": "Malware payload (RedLineStealer)", "value": "3a071af8776381962c5745510d8311f352d887bd255d0632a2d75260cf35db75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698729280, "uuid": "f3f781ee-54e3-4668-9b50-12aeb96d93d7", "comment": "Malware payload (RedLineStealer)", "value": "f43a521cd6018bfbd16992c3aa546fec00942110", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698729280, "uuid": "9561fc2d-7db2-4a8b-a6ab-fafa57664de8", "comment": "Malware payload (RedLineStealer)", "value": "cced7b6ac935202e3901a6b5f2b4f2831aa7b9d4a8a618f27d1f44a8761219441976cdadba00d38b85bcd9c0f7377aba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698729280, "uuid": "109750a0-ac3e-4248-90c8-0f81198ca23c", "value": "T113752307F6C464F2E538677048FB02432E76BE42D924979A23DAB9164CB16CCAD317B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698729280, "uuid": "e5ff1b38-9694-4ad2-aee9-8c13ad53c28f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698729280, "uuid": "793b2682-826b-459d-bfc5-4c657a656970", "value": "49152:531I66F9PZxgapAVwwn86JDj+uy6tvOrL2EmrAxy:86ofXaXBsUrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698729280, "uuid": "f1f6e65e-99e8-443c-915c-140a855dab78", "value": 1617408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698729280, "uuid": "1c67ac4c-73e8-4ce0-aac1-fb939e5d3c83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698729280, "uuid": "459c12d1-de41-4d43-a8a2-b18ded1e1e92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00c48e1-77b8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698734668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734668, "uuid": "24af9f1e-8d39-48d4-9a82-6550119839de", "comment": "Malware payload (AgentTesla)", "value": "3aee5c2e960e22bfa2e77a7774e0fb97", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734668, "uuid": "c67fe88a-145a-4130-86ee-2611e4e6473f", "comment": "Malware payload (AgentTesla)", "value": "3a8adda754d974bc64425aecb644c325516c191f1d6445661b4f8fac0d56277c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734668, "uuid": "fcea568c-fe34-4e53-8993-d8a3bb7a91ae", "comment": "Malware payload (AgentTesla)", "value": "2877694b016abcc5c445698bd83d1434c798bc02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734668, "uuid": "bde14d3b-3da3-4a90-8165-d3cc61d349cf", "comment": "Malware payload (AgentTesla)", "value": "590dd2d2cefd1a77e639f3e672b6917bde986199ee050af59bb0221c004a990464115f9039f5dc93bd469f5a1baa116d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734668, "uuid": "c4a18085-c31e-402b-837f-e903c8ea5ad7", "value": "T18724346DC34B41A98F565336AB1B4E0502BCB72EF38192B234AC433533EAC3D55666BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734668, "uuid": "ea0c5e8c-dd43-4329-a2fa-5945286760c2", "value": "768:LwAbZSibMX9gRWjTMJhL1NuMOWK3B0e1sCZmZByfhsghR+2RNP0:LwAlRaMJhLfYlNOzTyfdJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698734668, "uuid": "7b1231cc-4d11-48c0-bfe3-27b05277c9fa", "value": 223538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698734668, "uuid": "00d76123-87cc-40c4-b357-61f9802134a8", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734668, "uuid": "18a3b3d3-60a7-47a7-8aaf-56f8d9202982", "value": "ORDER 001.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3bde6c-778e-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1698716518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698716518, "uuid": "333c1a98-4f3e-44b7-a71b-de088840d50b", "comment": "Malware payload (zgRAT)", "value": "c8e01ca4cbab714428e060a075c81053", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698716518, "uuid": "05d0dd21-6713-42ff-9f93-4ee720f4dddb", "comment": "Malware payload (zgRAT)", "value": "3b3f1907062e032efeb84aa177974a3514eaf8380c3b97d9368ab534ef493b0f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698716518, "uuid": "59c1808f-f58e-47b8-9fc1-91a8ba851f59", "comment": "Malware payload (zgRAT)", "value": "dd2a48e6572d587e6e412d563f83d4ff41226a83", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698716518, "uuid": "ae80b15e-286f-493f-bd03-fbee6a623782", "comment": "Malware payload (zgRAT)", "value": "556043b9e27d73388f8b7d27268a9d5d2e797cfd9e4a0db300ae270d559ff554ffde3de675492c5eadf904fc580bf1a4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698716518, "uuid": "0e6f2a5d-02dd-44e0-b67c-bbb3b711bf46", "value": "T1DEF5DF0AA662DE1BD7A83B3AA45740189772E6017703B71F1F7D017A7C973B54E023EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698716518, "uuid": "ee6a2561-22c3-4ee9-ac88-470a29e1e112", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698716518, "uuid": "9f76f9ed-f18b-48ac-8800-07275e0c2654", "value": "98304:TdG5doA5Rs3D/SOJsXwS25gllrUXiI09:TswA5RsDSxAStllrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698716518, "uuid": "05fa825e-ee32-49dc-accb-0163f824e1dd", "value": 3421696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698716518, "uuid": "7e7605d4-312e-4b76-a9be-1f19f2a338ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698716518, "uuid": "0b603239-7632-4a77-852b-754c33aa786f", "value": "uwp4098452.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad900e2c-77ec-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698756890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756890, "uuid": "37c15fd8-1474-4f17-a23c-cbdd68a9d710", "comment": "Malware payload (Smoke Loader)", "value": "20da57cb28250e73c780ca3b8a77e249", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756890, "uuid": "588e9d43-9918-4ac3-bda4-d01a511b9b8f", "comment": "Malware payload (Smoke Loader)", "value": "3b8e8d855e714ca23dbdb2f30665dd6d3e810c7aa6fa43e1d2dcb0b0bd6a3ed7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756890, "uuid": "d969136b-bda9-432d-b7f8-54bffbff5df3", "comment": "Malware payload (Smoke Loader)", "value": "45711aa65ffd658c568389f5fdccf2822f75da4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756890, "uuid": "e30a4a7d-b832-432a-be3f-559d6d47158e", "comment": "Malware payload (Smoke Loader)", "value": "ecce99755eb63f0a1ddd824ef0c726212ca2cfe53fe29871dfc69ab12a20734a324fd19146d16778ca1bb47339e7e026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756890, "uuid": "58ba1cfd-c23f-4dca-b100-d2a212ed7d32", "value": "T11724291393A13D90F9268B329F1FDBF8369EF5E38E597B6912589A1F04B00B2C563711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756890, "uuid": "a23de572-ffba-4ecc-9f62-59f5494f6ed7", "value": "e0361317ba2ada8e7d47765f45f5ca50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756890, "uuid": "68b1ca30-0932-434d-9a05-810d502b7a54", "value": "3072:PwTPSBuOeTNZauZaq4GMluzlwrEhDEGkybBNK0NUc:qPSBuVTNZaLKMY6rEJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756890, "uuid": "f9b5bd79-be19-49a6-b268-7afb7b5ff030", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756890, "uuid": "28aeb2fa-b805-4270-9a25-10bce8a8f62c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756890, "uuid": "e9092702-513d-4c6b-9977-0cc0591f5503", "value": "SecuriteInfo.com.Win32.PWSX-gen.32663.6951", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31c3f06-77ea-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698756094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756094, "uuid": "7e513d5b-2e62-40d2-b43f-f4e960170d75", "comment": "Malware payload (Formbook)", "value": "88977e359b702abcdcbcbccb113dc569", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756094, "uuid": "3097debe-2d28-4c15-b7af-04be38ca8a9a", "comment": "Malware payload (Formbook)", "value": "3d84d2e22a18f6199633dced4d56afd020e16463b2e83f0113f1a14f994506e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756094, "uuid": "2b599031-c177-4ef1-b3c3-ca813854a9e0", "comment": "Malware payload (Formbook)", "value": "1c43c81de9f0e58684df640cf0354ebf02440456", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756094, "uuid": "032606f3-e31a-4474-96cf-7a1b35b002db", "comment": "Malware payload (Formbook)", "value": "4022c212a4d0f57919bd6867a042f11b238b45ea69cf4a3c9419f6ccbbf315a631352886bb1f136094eb667758360a29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756094, "uuid": "21dc40df-b2b6-4db5-9e63-2ca63d889278", "value": "T16A04AD32D641C031F2B252B5B6BD0B7B483E0E357254A0E9A3E516A06EF19E6F47931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756094, "uuid": "04548e1f-db16-458d-9d24-9e422a4cf281", "value": "3072:kFNzEvBdJt9i3cr5pnYP36cFjvsdWN8ZVbJt5KqhiCR42JrcRQsneAENgOW:s6FUcV+v6cFj0dPFt5Ds+mLRZOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756094, "uuid": "a509eba1-fabc-4ef0-ac20-43329998ec69", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756094, "uuid": "ffeed908-f937-4985-bc87-db268627b5f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756094, "uuid": "fb069be7-aaa7-405a-b939-27f11065964e", "value": "3d84d2e22a18f6199633dced4d56afd020e16463b2e83f0113f1a14f994506e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364bfaf1-77e9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698755401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755401, "uuid": "9f030788-7985-43f7-a1eb-bccac64d6748", "comment": "Malware payload", "value": "940554231c360640d34688ba960f58ce", "object_relation": "md5", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755401, "uuid": "892ba328-20fd-450c-a949-726644697e2b", "comment": "Malware payload", "value": "3e6cb3fdfad32561dc17e7b5a4c4bfb794ce725abcda114900a04fdcc5ffe704", "object_relation": "sha256", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755401, "uuid": "3a1ef373-0af6-4a03-8092-f25ac212a310", "comment": "Malware payload", "value": "576abe2c7ee5cc7fa863e762798bd8e9593aa996", "object_relation": "sha1", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755401, "uuid": "37ca828f-86e7-47b5-942f-3c44f2dd2ff5", "comment": "Malware payload", "value": "9101b3baaaf119f916a9eca64920872f5697dc3efaa2b17bdb9402b1a7a62f7a4a51c3384971d6e628b185915232bf80", "object_relation": "sha3-384", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755401, "uuid": "48aecee6-c7f9-4dee-82a5-600133d24e6f", "value": "T12A0120A145CA8969FF068331770A099318BC494E83AD19FAD47C32660A30783FA6A4D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755401, "uuid": "2587a026-d9f2-4c5b-92ed-b23903f2dcb5", "value": "12:0hHqAC91cgL5J3zg79yVa1Qk7DBJEOoFG1qriQdAt2QfXaO:CqP99LX69yc1Qk73ofriCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698755401, "uuid": "c9ac8406-aa23-45ea-952b-24e91ac58af7", "value": 759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698755401, "uuid": "a9c27487-340b-4654-a5db-72d740cc6959", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755401, "uuid": "e998bd05-f780-48bb-b680-36629f1cf574", "value": "FACTURAkeW___atF(625).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf5008b-77c8-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698741506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741506, "uuid": "ca37bfc9-0952-412b-a8b9-26b4a27d100b", "comment": "Malware payload (Formbook)", "value": "71456b88afd252a9a3637536edfb7476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741506, "uuid": "152efe96-c519-4b0a-ad84-451cce3638c6", "comment": "Malware payload (Formbook)", "value": "3ea69a1a0c5cc196a71ab1d7754abe0683813ff321d59d731bb72d2d3d076f3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741506, "uuid": "06dff380-b04a-426a-89e9-e28a7a7de490", "comment": "Malware payload (Formbook)", "value": "e9b2966ce8be484face97f13ba31dba1e1d5e156", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741506, "uuid": "18c15d5c-a3ca-412d-b666-c3e9c5f9c7d7", "comment": "Malware payload (Formbook)", "value": "fb8415781580c461f08da174b0013822c14eacdc0adfb3f21099b853104f1f64d627d2dcc4e89a51ea32c4a54d7bcaf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698741506, "uuid": "89e9d915-cb06-4e69-a577-b3a99a28cd62", "value": "T15DD423745BEC8374DC6F07BBA1319834DF649A8D69C2EF594FB01951BA38B802B34792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698741506, "uuid": "67d6a722-2972-496c-a7b9-50889466d395", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698741506, "uuid": "91f5abec-5ad7-47b2-a180-039476fce14e", "value": "12288:HUR68oan8Kg74R03ojom7on3+0GCtTVBl8fJUNs+TNMHgJXl:HUR6ka7roL7ou0GKjl8fqYgJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698741506, "uuid": "c1aa5865-7874-4477-b72b-7b1d02e7a368", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698741506, "uuid": "67978ee7-fa3c-45ad-832f-a7f78189db52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698741506, "uuid": "2b876070-03c0-4441-b814-5c5e33bed66c", "value": "Purchase Order No.1364.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295d6b5e-77e7-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1698754521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754521, "uuid": "cfea7d35-5019-4342-827f-2fd6d09b15b8", "comment": "Malware payload (LummaStealer)", "value": "a2d3e4fd65182c4ca56f1ec78131acc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754521, "uuid": "51caed9b-8df0-4167-9770-37e1548318be", "comment": "Malware payload (LummaStealer)", "value": "3f3c3378e66bb67a7d1c45784e1d297a086abfd7591268e65d90ad10bd12d1c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754521, "uuid": "0fcede0f-a00c-485b-8f6e-59383af22a92", "comment": "Malware payload (LummaStealer)", "value": "baab9ae70a2df25c3692886fe031e8d26080aeb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754521, "uuid": "147dd8c7-79a5-48d6-9beb-cd12624da5e6", "comment": "Malware payload (LummaStealer)", "value": "3eb89ea663f0e9aa4430b65945dd48052e1de37c5861eba9979054e4f58ceacbc3c472b8adef963c4aad68ced7cab9f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698754521, "uuid": "f65a8c8a-6daf-4495-a278-837808a33eb1", "value": "T126961231BB819526EAB211325A7DD65A901CBC750F2190CFE3D86B5E2DF09C25732F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698754521, "uuid": "4ffc4f9e-9de4-47d2-80c5-2dcf131434d5", "value": "413704d931dd90675c12a0afcdbdaa34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698754521, "uuid": "5cb78b0d-b6b5-45af-a0b3-ef91a5d44bd4", "value": "196608:ErV67DFXZM2t60xR4UbC1m94O9A9ddFq/gnR:EkFXt/RbbCY9B9AfmYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698754521, "uuid": "15863b34-684f-4363-bfbf-6be9dbbfd1a2", "value": 8726616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698754521, "uuid": "679b25f8-ea8b-44d1-a7c1-e224942db779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698754521, "uuid": "f90fde2c-a7c4-4fe7-b7aa-3df7e50920dd", "value": "a2d3e4fd65182c4ca56f1ec78131acc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a8348f-7799-11ee-8907-42010a9c0042", "comment": "Malware payload (STRRAT)", "timestamp": 1698721228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698721228, "uuid": "771539f1-f05c-4321-894d-acbc43fdeebf", "comment": "Malware payload (STRRAT)", "value": "2cf29501164f6968571b555cd7578b7f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698721228, "uuid": "41ef8a57-41f4-4571-aaaf-13df6b03fcf9", "comment": "Malware payload (STRRAT)", "value": "41c6caf04f3adb4cc475f1008225b5932889cd64f886240dc2cbbb3fef6102e1", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698721228, "uuid": "45b35ccc-a851-4209-9372-21bf6d8d1a6e", "comment": "Malware payload (STRRAT)", "value": "55cb4fb5c6c04b3229ce30450a929d28506717c1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698721228, "uuid": "28eca5c5-559a-44a4-9371-61459d8f4fb8", "comment": "Malware payload (STRRAT)", "value": "6479f89e1a477979307624fec0b4557f22665d0a5284eea859c7a35164acb05340581c6185ac2a79405caecf39313d14", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698721228, "uuid": "09b0fac6-deae-405c-85b1-d59785a501a0", "value": "T1245402AF3CAAC0AAC00741765300D67778DF0686C099E12727FD2D660B34DAA5E16EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698721228, "uuid": "09c65e10-d7e0-4888-ae5d-b80bcc553a10", "value": "6144:cTqBk0WAAOpCBeBmVJMHSW2BlIOz1hPkoVsdVhacijUt:sATpCBimVuHSXBtzLZydV7gK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698721228, "uuid": "d85123cb-54c5-4ec3-8b3d-84dbc8e94b9b", "value": 281026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698721228, "uuid": "70041bab-3dc2-4530-9406-e3acc8a38df1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698721228, "uuid": "2ee6466f-7f8a-46d8-a950-dcef5e7126a7", "value": "ORDER-231030.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c455ee74-77d3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698746191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746191, "uuid": "d513fcfb-a4c9-4d30-911d-a638d6b66138", "comment": "Malware payload", "value": "6f60bccc47c7cd68041c5f06acf2aacd", "object_relation": "md5", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746191, "uuid": "c1db71a3-8393-4148-aa27-51f9fe6614ee", "comment": "Malware payload", "value": "4283563324c083f243cf9335662ecc9f1ae102d619302c79095240f969d9d356", "object_relation": "sha256", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746191, "uuid": "c1a15101-352b-4cb6-83fd-925eeec7964c", "comment": "Malware payload", "value": "c775114fb52e72865c00c2bf254ee3aa4a9f512b", "object_relation": "sha1", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746191, "uuid": "37e37e17-ad19-49c7-b366-e30d107437ae", "comment": "Malware payload", "value": "cb6c5864c7543165370b569e8435806f00cd45f63ca574d068a37cefbaf9a3ea5b45a7572578027f256507d50d1568e1", "object_relation": "sha3-384", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698746191, "uuid": "413a310f-3bf6-4f7b-a003-737438d383d2", "value": "T1066733EF18A7E22DFDEF35362FD56354D024498AF864181F4C8BB7CDA00E4B6509C2A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698746191, "uuid": "561b938a-7836-4bb6-aa54-660f48fd8f59", "value": "786432:FX24krZclsEcTznscqDv0v7OAi3HOE91qvjuyfLS:F9krFPjwDcDj3E91qLuyjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698746191, "uuid": "4659cc70-e12a-42d2-ae53-53b1bfb32dd6", "value": 32166624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698746191, "uuid": "9c97b1a5-1318-48fb-9681-026eba1a995e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698746191, "uuid": "73bb838c-fd4b-44fa-8aff-4c39fe7128db", "value": "Webex.msix", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa77a687-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698734980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734980, "uuid": "2bb57312-57a7-44fa-8e86-cc1fa551ce9a", "comment": "Malware payload (AgentTesla)", "value": "a507c54d665203aa2f6d9a77bb64fe4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734980, "uuid": "7ee7053a-eef0-4063-84d2-fb873064517f", "comment": "Malware payload (AgentTesla)", "value": "42b0dbdc1b173ac91896db9c33267f2e529ce896917dd8c209679fa8679cd96b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734980, "uuid": "97a41816-8a28-4012-acc8-ffa7f307d79d", "comment": "Malware payload (AgentTesla)", "value": "2543581b58cafc3a38f41f2c05a8e15cac1e814a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734980, "uuid": "7b40de9e-e93d-45e5-af99-2474d6b5c99c", "comment": "Malware payload (AgentTesla)", "value": "a95225a89464f38cca1f7ac84ec24bc73275df098878971145253f3e1e5b8fa474171589dff3fdf0c3da1d43910d5ea8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734980, "uuid": "9353aa3e-abd6-4dba-a666-2522e51b5a9c", "value": "T198E423EB6D2CCEA66702FE61487259C4B7D3EABF54DD849C63BB8C68134073164C8987", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734980, "uuid": "13e38395-160b-49a9-8d7a-c3701751ce21", "value": "12288:wo32rb9js9Uxa6heuBo/C8wzfspo/WvccphL6uM43ymbG1MIMAlbEoUYca:130js9UxXVBo/C8IHUrhmuM4imbcbEoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698734980, "uuid": "29ef6746-87ef-4ab2-88d6-afe96690a291", "value": 679259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698734980, "uuid": "10edc25d-b3a7-4445-91c3-08ff8bfba2b6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734980, "uuid": "11ae22cc-6515-4925-85cf-140826a32630", "value": "NEW ORDER AGAINST NOV.DEC 2023 DELIVERY.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c164749-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735251, "uuid": "4d5974d2-6f8e-400a-b9d5-d4d4f4076bf1", "comment": "Malware payload (AgentTesla)", "value": "74cd7fa5044d790915fde83e9ce0d3cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735251, "uuid": "dd6d32e3-6540-408c-97f3-4dc0afb90603", "comment": "Malware payload (AgentTesla)", "value": "44743d9b7a94a21bcc060122cabdb5bfc9a2467f54943030f53707459da17b9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735251, "uuid": "3137da26-e2f7-45c0-8c0f-732c2a4f563d", "comment": "Malware payload (AgentTesla)", "value": "ba3af810c1fb4e4cbe53aa63256cf65f6109d5f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735251, "uuid": "cffa4ca0-4864-4e4d-b0c1-b46b2ecf4559", "comment": "Malware payload (AgentTesla)", "value": "3e44a807aa7a3317ac65283122c32cdf722ebaf6b6304ab7ceecef051135a455a82ae9ab8546718c20bfb1d217e84571", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735251, "uuid": "ae410a9c-dbd4-4ace-9b5e-40731920e6c9", "value": "T16E05F19275581ECAFD2963B258B708ED03725E3EC6B0B95D189EF16687B331B310291F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735251, "uuid": "7a61d738-f7e8-4989-9c80-afdc74431f10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735251, "uuid": "8a319016-e559-44a9-824b-317eab0c34ea", "value": "12288:n8L69yqLas90MqSBVha+65NWGSwtL/1XTmLkBmBCsAU88p0B8Ic7CmaMWw:s6XWG0YBfsvfTOam4sAUZgjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735251, "uuid": "7248243c-9439-47be-843d-d514f091b482", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735251, "uuid": "9e20189d-f90a-46c6-90bf-11beecab0ea1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735251, "uuid": "3a0ecff6-0642-40c1-afa1-171da59519d7", "value": "Yeni sipari\u015f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffcb4d8e-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735553, "uuid": "3d0b57af-73ce-4155-8e56-9b4bc60b4686", "comment": "Malware payload (AgentTesla)", "value": "a354ce0eee6d57053d703ebb683006e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735553, "uuid": "67d4e424-67eb-40dc-9b7c-51e06f68409c", "comment": "Malware payload (AgentTesla)", "value": "44ed47b1d9b377ed27d2c5541a4d1cb1e82be3e2d80750784dc476f08de5ed85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735553, "uuid": "2228f4e5-de10-43b6-92c7-6b6608e3cc80", "comment": "Malware payload (AgentTesla)", "value": "9c9a3eb21d02634ab73fb5331b32f442d5e97d3b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735553, "uuid": "599031ea-3b6c-45ab-a644-e98193210aa9", "comment": "Malware payload (AgentTesla)", "value": "be543a5e3ff718311222b52aad0d5a82f470cbaa26cabd94390161499aad7ba71ef0f17b9ed0105694e65297b9b8ae52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735553, "uuid": "fafb0c3a-c85c-452e-82b3-5b5a537bd5af", "value": "T14115E15371A88A9AE41D1276543548ED0F332D2FD6B0E96D749EF47A4BB23432207E2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735553, "uuid": "fdefe1af-1626-4b66-a601-a034f1c1a884", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735553, "uuid": "ec634b72-5718-4d1e-9b18-3c290b373523", "value": "12288:ok0WWObWnjmXWEkx6cctAJN+stEYJMuHw/bl6gMkzTl:i4RXWEcz4ufAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735553, "uuid": "e50e4870-833e-41a4-8e62-5e3e3081e4c7", "value": 883200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735553, "uuid": "7e961e63-edec-4c26-9aa2-428589de91bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735553, "uuid": "d0629120-a02a-4646-bc30-611e29dfe4ed", "value": "New Order No. 24370451.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93fbbc65-7803-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698766725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698766725, "uuid": "a12424d7-10fb-4340-a688-ef887e0891d6", "comment": "Malware payload (Smoke Loader)", "value": "df429b3513893fd2391a5937defbf044", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698766725, "uuid": "9ecaaedd-c421-4ef8-bd4d-e708253ad05f", "comment": "Malware payload (Smoke Loader)", "value": "44fa511765693f9d912b3dce34be85c13be4fcc241d8ddc82fbab23852a6d174", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698766725, "uuid": "af985cc7-acd1-4ded-b211-f6828386db17", "comment": "Malware payload (Smoke Loader)", "value": "418444b42e15c6927273d4ad0645698e464ac003", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698766725, "uuid": "fc4c2ed4-dcbe-4cad-94ae-d07e43c76f77", "comment": "Malware payload (Smoke Loader)", "value": "7157e9b75f0f8de88d7577e388d36c7d7c57f30e3ea490e3863711c03ba19053d9c2b580da19bc55e74f67eeea5f9a25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698766725, "uuid": "f7e24988-3aed-4e19-96d8-2d4687069428", "value": "T103242A5393A13C90F5268B729F1FDBF8768EF5E38E597B6922589A1F04B00B2C163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698766725, "uuid": "7f2497a5-cdf9-49ea-b5ea-d7a8ed242852", "value": "0c9d3ff66162daea31cb3f02591d560a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698766725, "uuid": "90ab26df-c4bf-4686-9fd3-1f9b7a8d9994", "value": "3072:6DDA6yRtbjEEtsjbzkyNLYOL4eLBw0ctbqHyZ2kWHMQNUc:iA6yjvrtsjbwsLYmwtcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698766725, "uuid": "f51d4356-7b73-4657-8c75-1a8d80193359", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698766725, "uuid": "f044ac9b-811e-46f9-9254-fda777d5a071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698766725, "uuid": "0c09e106-c6db-4e8d-b378-437a51db393f", "value": "SecuriteInfo.com.Win32.Evo-gen.17031.127", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20916098-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735178, "uuid": "b4eac543-1862-493a-8596-dc365f7c645f", "comment": "Malware payload (AgentTesla)", "value": "9fbd9136858aa82d684be61cb1a62b52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735178, "uuid": "d5297c7b-0923-4726-913a-c321f4671ce6", "comment": "Malware payload (AgentTesla)", "value": "452ff2f3fce802f46e640f429d987538f9dcf631b9488ae7ebf484f2eb3dca0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735178, "uuid": "9ed15797-69a1-456d-9cc7-cfeea9eac4fc", "comment": "Malware payload (AgentTesla)", "value": "03f0c6210e2b1aca06f17b6fcff7d78cb93feaf2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735178, "uuid": "ab538cc2-cd19-4da2-86b8-2a77f6cd2832", "comment": "Malware payload (AgentTesla)", "value": "92049667f2d3df28fd3ad2638115029bfff7c62534296cf358516245a448f5559b2461701957cc614b2f5cc3c755805b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735178, "uuid": "b4a8af84-ad9e-4dab-83b4-edf111090798", "value": "T1EFD423C82798A120F87C5B7ACA760478D7F9A02B1997FA4C9DC1F0C96D62F120761BF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735178, "uuid": "c6eb49d5-4370-49b6-a2ca-31a13035f60a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735178, "uuid": "949a9d3b-56ea-46ab-8034-d8efaad1ad08", "value": "12288:NUR6xvoaQnegVkZFbAYo+JuATfBcGIY8Fza6oJZhD:NUR6UnWRAfajqQCRoXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735178, "uuid": "19cc5e36-5b16-4661-b0d8-a6ffc8ac0da5", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735178, "uuid": "4742f0c1-36c6-4b96-9dc5-12bdbf030366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735178, "uuid": "f95d3fd1-d2dd-4bab-8bea-0621348ac70e", "value": "SOA OCT.2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55b5781-778d-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1698716128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698716128, "uuid": "3b4a9a0b-3966-42c2-9f04-58709e539afe", "comment": "Malware payload (Adware.Neoreklami)", "value": "c15d25eb7d78b2bfb137c3c41cebd06f", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698716128, "uuid": "58dcc7cf-b5f0-4350-befb-6c65813822d3", "comment": "Malware payload (Adware.Neoreklami)", "value": "45463d096e2c5f2565728a1df9bb1ffd14ce680d071c7e621744ae4208ac431d", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698716128, "uuid": "016c00b9-b551-4b7d-983e-3f3ac68ab894", "comment": "Malware payload (Adware.Neoreklami)", "value": "bf2de94de650663773f76cdb27434089766e540e", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698716128, "uuid": "f383a0e2-b015-4aa7-a09e-e4d5be5302ce", "comment": "Malware payload (Adware.Neoreklami)", "value": "8ce762c281079e56e0ac7f2b85a0e9bb0cba213caa385afb596c6636a0e2a4ae4c031e5820dbfd3fd277632896c23c7e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698716128, "uuid": "d369e6d3-b4eb-4785-b414-9752e4cddfc3", "value": "T14276334838D3D47BD315EA788E69AEDE9276F4460D13059FBBD4CB0C2BF9ACD0129225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698716128, "uuid": "8a596258-4cff-45e7-84c9-f65fce69ae77", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698716128, "uuid": "0559c094-8c67-4a58-bb52-46c295800dd5", "value": "196608:91OggGQfC0Wr1Gv4DoB926EaWE6nvLJSADzUz0RP:3OZZv4DSgaWfBzU0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698716128, "uuid": "c8932489-d8c6-4e9a-8df2-099f96f657fa", "value": 7542760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698716128, "uuid": "0a2d95e3-cad2-4bb2-b653-759eef5119de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698716128, "uuid": "e5b51514-eecd-460c-945f-7781eff9d098", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc863ac2-77bd-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698736729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736729, "uuid": "f1b0bb78-a5a9-4939-8403-b9b9c0c8acf6", "comment": "Malware payload (AgentTesla)", "value": "a1745ae5c4fe77f1067f78a74f85ae86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736729, "uuid": "4ab496a1-68a5-4ba7-932f-192041e05e8e", "comment": "Malware payload (AgentTesla)", "value": "4624b53686167fb1b7b26b044ca58172acec6e11db2508df8cdef40f232c3715", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736729, "uuid": "cb72e1c8-2189-487b-91ca-53107da32f09", "comment": "Malware payload (AgentTesla)", "value": "ea02f21758c814e59dc14ee55291bdfac34bdb98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736729, "uuid": "3bb3be87-b18e-4c23-84ea-356677dbca7e", "comment": "Malware payload (AgentTesla)", "value": "b482e3bd3a7d64f95533a9b751e529084a5e4d55810347a9fe5605f51dc6dc037710c9e58c35b5a5d08c06c35766a579", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736729, "uuid": "33000bc2-0e2b-4aa6-b8f7-dc65caa07619", "value": "T142756B447E7ADA23CD00C23094D2CAF6568B9D5E96D292231BDCBD7732B23BC574B294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736729, "uuid": "a447dd68-a432-4476-9274-4c3521ae7591", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736729, "uuid": "9edb7eb3-14b8-46d4-9bd2-062f6d51ed1a", "value": "24576:PuTT+9xn1q4UuyQq0ZaZ4UtiiOQy7aSIPM:iTUp1q4Uulq0I+UtiiOQyDIPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698736729, "uuid": "36d18ff3-6576-41a9-a526-f3be2a569aaf", "value": 1694208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698736729, "uuid": "74b4729c-ce54-459a-afaa-992b2bc8ac92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736729, "uuid": "abeec7f5-bb47-41a2-ae7a-0a00f76445c7", "value": "DRAFT Payment Copy\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53505c58-77d1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698745142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698745142, "uuid": "08857855-923e-433d-b5e1-4f4640414a83", "comment": "Malware payload (AgentTesla)", "value": "f6fa0be22f5133fefbfa51f9dd7337cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698745142, "uuid": "9acee70f-3d27-4ce0-8e56-73de4bdeaf6c", "comment": "Malware payload (AgentTesla)", "value": "478c23cab01ee3f4468f1069d0d09a669770889ad4a2bf3e572b6648a53d7139", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698745142, "uuid": "6e308302-132b-4ce6-8ed3-b8ca4c058491", "comment": "Malware payload (AgentTesla)", "value": "32da87fb2e3e2dc269011d31496559ff77334a02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698745142, "uuid": "4b86bc3b-e48f-45f2-be0f-4191676853d6", "comment": "Malware payload (AgentTesla)", "value": "2b5e4f4fdbd6a3307e58551795bc809a27d71cfcc897c53c16bbbfd9eb674a72f3bc57b64ba377b343f5ec2ee47b4786", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698745142, "uuid": "e4d20606-e37a-483d-8d07-181eb8e2e846", "value": "T1AEC4234552DCA379D9B907B1216662129331E136B482FA0E8FD5E2F3935EB42DEE0C37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698745142, "uuid": "1c351bb5-291c-4b60-81e0-6e15234c2e7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698745142, "uuid": "9aa30d44-07a8-48ec-9641-5061500e5553", "value": "12288:nAoaRvMXHRCxYKbYW/zQ0VmEgow9V5H0GfVWTr3H5kbVU4LgT1U1:+vMXcxYK1bVmEg/9V1Kr3CVU7T1U1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698745142, "uuid": "73e648fe-2b7d-4667-9424-52832a99802e", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698745142, "uuid": "29b32cd6-6047-463d-a377-a8ddd57d0ffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698745142, "uuid": "bf9fde35-1faa-4fb7-b471-fd259bcaa0ec", "value": "TT PAYMENT COPY - 10.31.2023.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ed5233-77ab-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1698728723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698728723, "uuid": "e8cc77e1-a19a-4e14-9a27-6cbe4cf47d7c", "comment": "Malware payload (DCRat)", "value": "136f7aacdb943f96504c53cc46b1689b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698728723, "uuid": "660bd4bf-45d1-4a23-945f-e2e720f223fe", "comment": "Malware payload (DCRat)", "value": "47fd6a36eb7cd550e810e016a97a64a2291cc0082d03a6fb62570f42256d55c5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698728723, "uuid": "31e396b6-6e07-43fe-ab16-9ee0c3ff43f8", "comment": "Malware payload (DCRat)", "value": "07453199f448b1a6c4ba4fa382bdce1276106d07", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698728723, "uuid": "5651f52e-0f8d-4173-bf15-6af61b1728c5", "comment": "Malware payload (DCRat)", "value": "2243b326d98391a6b29e155d79096c667a7da3a9499bf835a093a3a08f06383a851a36efb45d3c2635a66a72f8584119", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698728723, "uuid": "21e415fe-a4c2-428c-b45e-b9e08bd16af5", "value": "T13C752361B6A0C1B3C4B3147055E5CEAB8A75B1A15B6482E7B7CCA7729F301E1B3362CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698728723, "uuid": "fb4a71e4-1abb-4f6b-a849-b684bb2e7ca4", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698728723, "uuid": "d6f33120-6824-467b-93d4-73c751e9ed09", "value": "24576:Qk70TrcLoPJFXqmf5boIor7tnnSFDFx7+QaBq0nOoZpSyP6R93yOw4HXG0ce:QkQTALKXZxbror7wzd+QSbOo4TiOw0WQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698728723, "uuid": "c7869f9f-07cd-4dcd-921f-6b3e033138c0", "value": 1564144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698728723, "uuid": "5b662885-606c-45e0-934b-d13f44eca988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698728723, "uuid": "3927098e-7e0d-46ef-bc67-189568d11918", "value": "136f7aacdb943f96504c53cc46b1689b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8e61d5-77e6-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698754123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754123, "uuid": "f0036c6c-7879-460d-93d3-99af4023844d", "comment": "Malware payload (RemcosRAT)", "value": "195787f942427352db785fea42c93f43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754123, "uuid": "eea06eb5-c091-49ca-b932-ce5877071061", "comment": "Malware payload (RemcosRAT)", "value": "4957fb0faa66fa85bd02e198c98d741a6edf5f683538601bbc7099f88aa4ac30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754123, "uuid": "5b881a74-e0df-422b-8ea6-bbee253ca160", "comment": "Malware payload (RemcosRAT)", "value": "11349f0aa5059663c99bddb4b1d4925b0795d4c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754123, "uuid": "94cadce4-3e69-4c50-8ee8-2963b66fa0d1", "comment": "Malware payload (RemcosRAT)", "value": "8575c9e0d23873634a41c29d2c3089dad2b708e5532d59bf578973afaf5f9231e126a26a08cb3cbc1f511efe91191399", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698754123, "uuid": "26120999-43c4-4401-8dac-ac38bb4fb5fc", "value": "T171350880E2049A66ECC71FB3D83BDC725427BE6C4978871D255F772A1AF334610BAE49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698754123, "uuid": "d3a52017-35f2-4d7c-afee-0f9f1baf6030", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698754123, "uuid": "026dde4d-4833-4c09-92ee-b8b245436515", "value": "12288:Ec0xoWbGGh7p/pMSC8grbTQJy4Uwjh5orvRNDRDVu4YT9vZTWbay6spuxv:Ec0xoWNh7pnd6Pey4dXor3D+DWK/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698754123, "uuid": "bfa12014-b816-43ae-b5bd-e032817c6787", "value": 1091672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698754123, "uuid": "dd61cad3-8f7a-4d99-9c76-b17f3ed919c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698754123, "uuid": "a8daa5a9-b92a-48e6-b43d-a2321eebe294", "value": "18001787_down_payment_invoice_90002104.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd36b61-77d3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698746149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746149, "uuid": "dbfc5f1e-aa27-4a1e-a6d4-873c51dd73b1", "comment": "Malware payload", "value": "b7ac60ad0d11e265e54a5de42bd2a879", "object_relation": "md5", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746149, "uuid": "93a55364-c068-40de-a9f5-41fd39f1f7f1", "comment": "Malware payload", "value": "49e6a11453786ef9e396a9b84aeb8632f395477abc38f1862e44427982e8c7a9", "object_relation": "sha256", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746149, "uuid": "162af674-1087-4224-a45b-e06b25e4ac05", "comment": "Malware payload", "value": "b95ec4d6ff5f4610a994f17b71e98df617601854", "object_relation": "sha1", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746149, "uuid": "7fd7a9e2-55cf-4d39-a38e-82a5e03016c1", "comment": "Malware payload", "value": "c2315c02fc2f925b61fc721d14528876d69fae4388d71a7ba606a284df5e4150c7e7b2cbeed5bae9e86f8a1da46d7bd8", "object_relation": "sha3-384", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698746149, "uuid": "9181130c-cede-4e22-a8e6-6982cbd134ab", "value": "T1F1D5D05AABA800F9D477D138C9A29617F3B27456172097DF03A0876A3F237E15E3E760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698746149, "uuid": "caf344c0-5b81-432b-a7b6-237154753892", "value": "49152:u0qhK7FViommCLxDcMUI75oJMIOlenUVWXc+EsyI9HTm5uNI:IK5E5RcBI4MlenU2cx8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698746149, "uuid": "4829de88-ec43-48ef-a950-a0477e3aa5c6", "value": 2898432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698746149, "uuid": "00376e81-31ea-48b6-a237-200335f3bd21", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698746149, "uuid": "97f994b0-573c-4128-a95a-89009a0c6d5a", "value": "10.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79351f19-77da-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698749071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749071, "uuid": "a473f782-7ae6-497d-b038-a93038cb15d9", "comment": "Malware payload", "value": "17ffeb3b190b89aeb084d01e2f4e0695", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749071, "uuid": "1684a585-b9c1-4ff7-897b-e25c88b74afd", "comment": "Malware payload", "value": "4a5f4738220a209e57735b23b1e7212346710a5301ae7da88cd58417e2bcab0b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749071, "uuid": "d9ac763f-5109-4c99-9a45-cb147bfcb85c", "comment": "Malware payload", "value": "6dc8a2ddeef704f10e0a65daa05fe475047aebee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749071, "uuid": "04edcdd7-b09f-46f8-b0b3-ec29b3f500c8", "comment": "Malware payload", "value": "639bff25423452f3657da40abed814a7846afbbdd4dd69191cc045e499bc28a1db1931a94e1a984c1d4c896a31602c50", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749071, "uuid": "e6547948-ea80-4b09-ae3c-d447315554b3", "value": "T19E65CF337996C87BC3BAC27D584DA71A14E6F9730E322D0762F8335A5BF89425318E46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749071, "uuid": "02ec6531-6de0-4c95-b402-53a8a124fc3b", "value": "4454df7b8d68533ee996d945d002a4ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749071, "uuid": "a210d9f0-e84a-492a-b1df-2cb0325c3bb0", "value": "24576:yPrfF8CAhLZmsVmaKaq6Kaq6KaqoDuZ1La/HRsAy/bMKbHIzhLE8K3xebjBSKP4J:6r9pAhLZmsgaKaq6Kaq6KaqoDuZ1La/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698749071, "uuid": "116e307c-0095-4dbf-bf72-3cf1ecff733f", "value": 1454700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698749071, "uuid": "8601bffd-371e-462d-80d4-8093fa07c84f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749071, "uuid": "614ac58a-4d4d-4493-8ed2-3ab856ad0750", "value": "IJC9.sct", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8f494b-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735494, "uuid": "68c933ab-8262-4920-95ac-229d89cdcaa8", "comment": "Malware payload (AgentTesla)", "value": "e402b86636a5da0672381d152249dbb3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735494, "uuid": "6a688bed-649f-4a0f-9eb3-fca3c453a028", "comment": "Malware payload (AgentTesla)", "value": "4b4f00b944e3a1da3396f3f572f4e04535e64b9111f8790b0a05c541e5d56e85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735494, "uuid": "050ce55a-0722-4b99-b2e5-cf6c1b09e81d", "comment": "Malware payload (AgentTesla)", "value": "cfc29593dd275702be48fbd1eba42002faf7e505", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735494, "uuid": "52d6530d-8a3e-462b-9ce6-43c3044fa6f7", "comment": "Malware payload (AgentTesla)", "value": "200cad87eb3e3176f4e6ae8bf7cf1b19c60a1b0cd402f90ccb051c4007d4b82c0af762d0d3be8fb2ab2ade915240a058", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735494, "uuid": "0184c321-d2d0-4b54-b6cd-d87055b35256", "value": "T16505F15365945ACAFC2D63B264B61EEE0632AD2EC5B0AC5D289FF52657333433212C1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735494, "uuid": "4de43a06-06f3-437b-adb1-13d39ce6b81c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735494, "uuid": "4b8d6e90-8ca1-475e-89d1-cdc765747324", "value": "12288:JY2iNNEisUH/kdljNTTzcDGe2l+aY/NsBHLZ3KaYac206r/jbdDchQVa7N13Yv:W1XEW4n4PaZY/NyHZKpa1rrbmCuj3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735494, "uuid": "dbc757cd-5e9c-4dd8-8926-d8b8edf44e80", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735494, "uuid": "ebfd2c0a-f845-4ef9-82a0-e88ff0908ee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735494, "uuid": "469e7a77-cda0-4cc3-bb46-d484600f2836", "value": "PO-02112023062700.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5199de-77c9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698741644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741644, "uuid": "c7e53592-5a8d-4a42-9fd8-f81cca42ec4d", "comment": "Malware payload (AgentTesla)", "value": "e7e3b860f326d45d5e7790664436a726", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741644, "uuid": "ad4653d5-abf7-421d-9a32-10eafa9c675a", "comment": "Malware payload (AgentTesla)", "value": "4bd728557c59a4ab89a5d3bd881603e69fa41247bab33f22d95404e532b21b24", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741644, "uuid": "7892b087-3c35-437b-bb96-06459c00f764", "comment": "Malware payload (AgentTesla)", "value": "9abb1e7f948105d526245122cebf33b1130ef2e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741644, "uuid": "0a6db12b-aa71-486c-880b-9d8eacbcd74a", "comment": "Malware payload (AgentTesla)", "value": "63674051214c2a4756853f357a0855cd18ed929ce7c9c069127638081cfefddba062130a1672c329dd6f5c69ac6c0837", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698741644, "uuid": "6232e81d-ace4-40bd-8645-913ee2464145", "value": "T1F0B42381366DC797E16883FA7B3D41A043B1250A9472D35CADC831D36BB1B650AF6B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698741644, "uuid": "98b1a338-a0bc-4147-8c09-412d15c8daf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698741644, "uuid": "f6d8cbf3-4e87-4b37-8a91-1ff2b8900787", "value": "12288:Iqqpoa2hmb5qoXyLETdWW3qPlVLXkh/5GYol5:IN2hf+ys9EIhhy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698741644, "uuid": "d466e5d2-6f01-41a1-85e6-18edbf9717ba", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698741644, "uuid": "3c7fc8f4-b283-44ec-b680-a4411bd1463c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698741644, "uuid": "9f89ccb9-1fbe-4286-b040-a919f86cd6cc", "value": "DHL DOC 74653898.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2c2be0-77ea-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698756086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756086, "uuid": "ae5631ac-97c2-4355-a3cd-2ca3bb00cf45", "comment": "Malware payload (RedLineStealer)", "value": "fb5a632a4dde38c1db0b601d135348a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756086, "uuid": "dd99c24f-f9a5-4b2c-92fd-8f44ecd82a8f", "comment": "Malware payload (RedLineStealer)", "value": "4ff195142aeb3566ac2a4143a016dd14f57f62d6ea79d72037762eaa1fe3eead", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756086, "uuid": "ce510928-6604-4667-be52-3b8ad2a1a1a8", "comment": "Malware payload (RedLineStealer)", "value": "c18202c85a3077ceba3a59bd72241f61bbe2109f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756086, "uuid": "b40bfbad-66c8-4337-9b1f-e03f89a9b9dc", "comment": "Malware payload (RedLineStealer)", "value": "af2c4018df593848c643b7098391e4be190cfe18e954eac63ffe8fbf9585cbfa312a5e3a46ddd358ebc6ae6165fbd287", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756086, "uuid": "21bf096f-8105-4ad1-bc72-f7a3eef287a5", "value": "T1AB75234628E8D959E5A8A7741CF793C30A22BDAA19358F163387DDDF0C725C8B271372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756086, "uuid": "032a3ae1-bd23-48c9-84b1-797167cef1fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756086, "uuid": "89146f80-dde2-45e1-81d8-82b3f867c5f8", "value": "24576:fyXbF/UntYIT6zb7QMTZFOUh0jQenftQFti6ZaxqNnA:qXcadzb71TZFOUh0jQenFOtPZax0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756086, "uuid": "fb575359-84b8-419b-ab25-35e8fc317290", "value": 1614848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756086, "uuid": "46507226-0cd3-49d3-a0ae-7c970569875e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756086, "uuid": "5d972cc8-b570-4ead-8b77-6092f9d78b04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad758c5-77bf-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698737531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737531, "uuid": "43e527e4-8280-4924-9fbc-fc715c3c41e1", "comment": "Malware payload (Stealc)", "value": "d1de3bf5cc50ba862563283a02ef78f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737531, "uuid": "f1fe4c88-a927-427a-bdb4-8ef15da41c8f", "comment": "Malware payload (Stealc)", "value": "50df521fcf74817c9a42f044fa19649b3830844265e62d9ce4147a223f435de1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737531, "uuid": "4de5014a-35be-4f15-8bf2-0ff2e29fc365", "comment": "Malware payload (Stealc)", "value": "4e5862cdb3b0e5ded076d2e125a14251e1862c23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737531, "uuid": "f2edf18c-56ab-4e58-9281-f6a9c003e89e", "comment": "Malware payload (Stealc)", "value": "266dda091fc17210c500afae552974357770cf6af598f80b07e06b2f0cd4a6a7ed36757121d956b95376f1b50f2c4f6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737531, "uuid": "a413c18c-6453-4264-9108-47293b013485", "value": "T131242A5393A13D84F9368B329F1FDBE8368DF5E38E593B6912589A1F04B10B2C5A3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737531, "uuid": "24cfc3c7-46df-4ce0-9333-ccd6397b7180", "value": "e0361317ba2ada8e7d47765f45f5ca50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737531, "uuid": "e4fb81d9-eba2-4f84-97d2-4975eb7f8f84", "value": "3072:oQT+yBuPeTNK6OMiEAo156cWJ07/oueRzFFyUiTB3NEZ:d+yBu2TNK6aKb6LyuRJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737531, "uuid": "8ad894bc-7fe9-4756-addb-f7a8020f88af", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737531, "uuid": "b92f9ffc-fd83-49a2-9a1a-baff2b924b45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737531, "uuid": "2632b55e-a996-489b-9a6b-e0ed67bcca4f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39d323b-7813-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698773677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698773677, "uuid": "0a608fe1-21ea-43b4-8354-69fd3dadaec1", "comment": "Malware payload", "value": "ea79371755c6c00e452a72aed3f359c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698773677, "uuid": "cb16ad79-14d4-49d0-857c-d5312b99996e", "comment": "Malware payload", "value": "50f1b23470a8a346c7ee3172a03b6da4de44593130582f4f9d06f03ca26b5873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698773677, "uuid": "f96f34fd-ae65-48d3-a6d3-c4090bd290ac", "comment": "Malware payload", "value": "d1a03b8b134840549451f71ad5245630bd678d2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698773677, "uuid": "c22f500e-14d3-4b72-a873-cd0d128b2bd2", "comment": "Malware payload", "value": "c0c954843dbdaeac438c1a15b2361017da13b96e61a57ed0dca96c023cf8079292f3b74efbb31ff3a46588f6c7243171", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698773677, "uuid": "655e6feb-b592-4dda-bc44-dc4836a9897d", "value": "T1A8A4AC5E729436E4FA037174EB2BABA0A97EF071037F4B857E5C41F06B22246DE147A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698773677, "uuid": "443e3a2b-f4cc-49ef-8553-1b3064c79307", "value": "f6afeb5ada6af6de9a4dc3af47cee35c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698773677, "uuid": "376be6b7-1e3c-477a-8f19-e725fd0d6e9a", "value": "3072:Tcq+yKa7CXhSnLsGOkf1mYHRBXN07Bh+qTqho+0CiR47yWA06qt5RMm0KtCpqDX:n+RSLsGpfc4RBXNWoDw09YYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698773677, "uuid": "67a284cf-d3ea-4f1a-b62a-fc77dae5932e", "value": 456192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698773677, "uuid": "17b114f4-c4e6-4511-a2b9-0d26aee4587a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698773677, "uuid": "d3aa5e74-4353-48c3-86b9-168d523e54ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1851e42a-780a-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698769524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769524, "uuid": "d8d0bcc0-c413-4d59-8a16-2b4f7b71b7b7", "comment": "Malware payload (Stealc)", "value": "89e0078eb5a4153ea077497f5a8973e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769524, "uuid": "f414caf6-5e9a-4df4-8daf-e74226b1e6c6", "comment": "Malware payload (Stealc)", "value": "513c3c2f07c8455f6d465bf22bfd8b11ddfc4c0ba27e231cef4d70a935162ae4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769524, "uuid": "063ea281-5148-457b-8eb7-7c66ea724dcf", "comment": "Malware payload (Stealc)", "value": "84934d112255e6f4dcf555c76f922cde6cb23cb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769524, "uuid": "31cc214f-6f7b-4f04-8f1c-0c53c5af2442", "comment": "Malware payload (Stealc)", "value": "612ec6889c753adb2d46b4fa3d54fba25173bf918a8722ec75ed97648c5d191546b685bab3e84638ed8377c5bbf6cbd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769524, "uuid": "75a48e6f-1395-4481-9f82-17e107ce986e", "value": "T124048E8363E17CD1F8368B329F2EEBE8369EF5608E59776922585A5F04B00F1C563712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769524, "uuid": "7fa2af0e-7c98-420d-95e7-fa47ffade58d", "value": "0c9d3ff66162daea31cb3f02591d560a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769524, "uuid": "8265d90d-da5d-46ef-bc60-b3436e18d464", "value": "3072:WUrA616dgjCk9qOGPtS+iOXgXaVBSxJggD8B8M5Akc:HA61kAh9qOGPriOXia20u8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698769524, "uuid": "f4289df0-ea86-49aa-bcde-2e1e80eff325", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698769524, "uuid": "79b87f86-9a0f-4538-a9d4-d672dabadf35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769524, "uuid": "e98cb3a9-14b1-47c1-a1e1-baadaa412fed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7351244d-77fb-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698763235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698763235, "uuid": "b4d2547e-f608-4454-af38-561fa6855758", "comment": "Malware payload (Stealc)", "value": "f9969ef3805249fe3fd6f6ffdb0723b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698763235, "uuid": "edacbbca-a42a-40b5-9cc6-dd95cf7da072", "comment": "Malware payload (Stealc)", "value": "51690da60d1c2bfe20e0e865240193bc3d9e2dbc3e5727de8891976b01b83fa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698763235, "uuid": "039fcf40-8201-44a8-b878-67b5fe382154", "comment": "Malware payload (Stealc)", "value": "bb3c689bc0837515cb82739d0efb92441f7c31d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698763235, "uuid": "64eb7f09-a4f3-4cd3-8694-edc656e2781f", "comment": "Malware payload (Stealc)", "value": "1116dba6dd14e8e5e4e25f399cb795b284b7d808f3b8dfafee1cf58bff05daadb8ded8aa91c13a45e5893fb9c17b928e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698763235, "uuid": "1e4572b0-ef8e-4692-80d3-5f1c3a972dee", "value": "T19324295393A13C84F9328B329F1FDBE8368EF5E38E597B6912589A1F05B10B2D163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698763235, "uuid": "e4216b14-f2cf-4e76-815f-7bd2dc3d7631", "value": "f90e29ae4efabbc6b498b140aa3b7a65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698763235, "uuid": "baf2de2c-ffcf-4cc6-b286-6e864de87fb8", "value": "3072:oBTRRddkirFSMB6V8JURZFY0hj34h/wDtfDpmwA9AFnJNUc:WRRddDrFSMUeJURnv4O7O9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698763235, "uuid": "3c687b61-1e9c-439f-90b9-5528c37d5b74", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698763235, "uuid": "11b803ce-0342-4339-bd62-7257eb9d5b25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698763235, "uuid": "62065fea-dfda-4378-ac4e-a4f8d73fc3be", "value": "SecuriteInfo.com.Win32.TrojanX-gen.30478.3222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9e2861-77be-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1698737239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737239, "uuid": "ea754ff0-67ed-4f3b-83e5-ab59ed873935", "comment": "Malware payload (MysticStealer)", "value": "15c906e9e53c500703369f21bc9fc5f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737239, "uuid": "553bc2f9-8685-4a7f-a902-e1bfe630bf94", "comment": "Malware payload (MysticStealer)", "value": "51e4b37160aa4d5edecde5c2113a1e0a10f08880e403aad2ed0b27dbdf0acaf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737239, "uuid": "a8df63b0-8987-4638-a6a3-6f6cc66f2075", "comment": "Malware payload (MysticStealer)", "value": "d2ba24979ca7b6a2900dbdfc02df9efd27ea443c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737239, "uuid": "eb9958b4-225b-4686-b6e3-56dd4d42580d", "comment": "Malware payload (MysticStealer)", "value": "124dc486f978950eb3ec833d4bc95a99dfa33725e9dd91fb97804ae5c086a3e2f4f075198b56aac79d87f5edcabffde9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737239, "uuid": "e22c7d2a-1cdd-4a2d-85fb-d6846bd3e22d", "value": "T13E35AE3174C191B6FEE320B746ACB526426DE0B4072856DF0AD86BEFD7606D17B326C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737239, "uuid": "5ddb84ca-77c7-4e37-82ea-c537a23732d1", "value": "b6874b762c445425cfcea5128380cca5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737239, "uuid": "e80719f9-691f-41b5-95d9-a77be0014fce", "value": "12288:qe68kK9/AYmtww5o7a0dYbNGK+8/yiEmIZH1Pfrmqgbu+C8muZgBazwp5GpoFr:qkJmtww5o7a0dmr5/yTZ16wuqOpoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737239, "uuid": "dd545131-ea50-487d-abca-e16061a12ea3", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737239, "uuid": "90dd8316-9d97-425b-ac9b-5e40997d170c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737239, "uuid": "9747f42d-da2c-46a8-a43f-89942c9b1431", "value": "15c906e9e53c500703369f21bc9fc5f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e17e02-77bf-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698737548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737548, "uuid": "3e4a74f4-dd10-4255-94ba-ca1a5666af3f", "comment": "Malware payload (AgentTesla)", "value": "6485ab9e7419d280912b934fed2b627b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737548, "uuid": "482cb8f8-90f0-407b-9048-c80472f6fd27", "comment": "Malware payload (AgentTesla)", "value": "52820dd69036a968d34e5182c5ad7746041c0eccc3f164013ed348e371b9b1dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737548, "uuid": "563f4dba-b3df-4f5c-9e88-a03d66dd58da", "comment": "Malware payload (AgentTesla)", "value": "d4cc0284dcb00143e2b04eeb38e8a386e463f694", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737548, "uuid": "122777c0-f0fa-478d-bb05-7b4de0eb7f3b", "comment": "Malware payload (AgentTesla)", "value": "59f97bb3ddbf1eda5aac9e3ddfd985f1da349d2474bd8d0d9da6fd5144b72e2aee98c4a7831552447025fc744091b1d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737548, "uuid": "76f731fb-6c44-4258-bf61-518ea025f3f7", "value": "T1CD558C60E2F4A64DE4DF96369D7093E0A2B27462B763D25ACC00F65A386C7D78DC0763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737548, "uuid": "63685fe0-7937-4eb4-982e-822fa48b2b60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737548, "uuid": "7d8ead4a-a34d-4ea6-a991-677b38dde507", "value": "24576:meAEiiqqTOrn+ppBN4bmx88UHD4eq77R/z1jZ3fIgPvYVQjR2:WEQq8n+DBj5RfzQCjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737548, "uuid": "57616b64-2677-436e-9a11-43573a5dbe62", "value": 1281024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737548, "uuid": "106f33b2-5ede-4522-b3ff-0f286e33954f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737548, "uuid": "110caa49-840a-4d84-84cc-63a6232f070d", "value": "Quotation2035759.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25e3958-77e8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698755153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755153, "uuid": "16d63d15-1783-4922-aabc-804c200585c2", "comment": "Malware payload", "value": "fae9ecf178a652a5872def100226a20e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755153, "uuid": "30317ae0-8dca-4bbd-ad3b-f8fcb87601bc", "comment": "Malware payload", "value": "5396139bc3f61c18bbf57d1e755aaa29b6f8300480f9e327c6af367c4dd7e2e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755153, "uuid": "918fae0d-cf79-4f88-9c39-46365b834289", "comment": "Malware payload", "value": "5ab136fd814e54ac0ce7212cc3e98433380ad727", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755153, "uuid": "2a77fc5b-c581-4a86-8eeb-dc83d57eed2b", "comment": "Malware payload", "value": "7fa70a71bd6d4245dca2a13a2e64ee3073da986b7bd5698849fa62311a51f1a0ce92072a811a8bd7e80e79a8dcec01ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755153, "uuid": "a26d593f-f744-4a89-9161-cb5040e5b556", "value": "T18AE4F16C722039DFC8ABC972CD586CA09B71E0BA430BE317A45321D9994D69BCF156F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755153, "uuid": "059ada5a-32b1-4602-92bd-c97a7ce5e28c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755153, "uuid": "83b28ad0-7f63-4e74-b2dc-55cb0201dcb6", "value": "12288:m04lrr8+1PesjYBeSpeDqu+xF69I5i/xzGTWDZvhpZAXNiynm9MEUksqVQ:34lXT1WsEeGeDq/D3mxzWWDR/aUQm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698755153, "uuid": "54f2f72f-3278-4ea8-81b2-bb87e7ac0922", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698755153, "uuid": "8aef72f3-b564-4a61-bb08-1199969416fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755153, "uuid": "c815e06f-7ba4-44f0-964f-2d5de7bae0d1", "value": "DHL Delivery Invoice AWB2774038374.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1f6161-77bb-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698735679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735679, "uuid": "9379ad5a-124b-413b-a165-31b94590e096", "comment": "Malware payload (RemcosRAT)", "value": "aaf268a210670e422fe8c05c88c7f6e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735679, "uuid": "86ce1c3c-c255-4a08-9dc4-089815baf131", "comment": "Malware payload (RemcosRAT)", "value": "54481a325fd753ad4d2217ffdb95058c1a7220d305600340c3ced465b1e0b265", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735679, "uuid": "14967fc8-6c7f-43ce-9e80-f42367e59575", "comment": "Malware payload (RemcosRAT)", "value": "5320c71a3335830809bd8b0b28b6929db89ac19d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735679, "uuid": "70407deb-d52a-4711-838f-4f355e04042e", "comment": "Malware payload (RemcosRAT)", "value": "64458572430e16b464ad67ea5df026facdc6a5780e45f457c8fc6cd98a97f6840894757675740b674372d5a85d6e71b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735679, "uuid": "83743e7b-0c77-4139-b184-721811c22542", "value": "T1CA650196B960A3A4D7D84872EA17E7760D255C9F590210633BF8BE273FFD023DA16630", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735679, "uuid": "25c614e8-cf1d-457d-8331-798ba0d9952c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735679, "uuid": "7d689f15-bc95-4e0b-b899-74adc43388d5", "value": "24576:sIGbY3AAeKDtDOrm7OGwJJyBsGk+MiTZWkpXcXxowimEO/sv/iPdHaaLS2QwK:kyXFO8OGgNSTZWSTw2vc6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735679, "uuid": "cd4b71f5-1d2e-4bf3-b0fd-fb8474e7ea9e", "value": 1439744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735679, "uuid": "2a12ed06-19ab-4cbd-9946-405d948e40b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735679, "uuid": "074de74b-889f-4c93-a849-5a7edda066d4", "value": "Yegdeajzb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78e323f-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698735056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735056, "uuid": "c3805163-1052-4e5f-88e8-d6d61a9b95ae", "comment": "Malware payload (GuLoader)", "value": "ff820b4ac62e6ed755c46506799deaa1", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735056, "uuid": "7decdfa6-cb2c-49ae-ae0e-598bfb565b0f", "comment": "Malware payload (GuLoader)", "value": "54c7240429ee64da1baf32ed9f9dd7d21e67002b93969e34b953b32f4c9203a3", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735056, "uuid": "9aed4b3b-19e7-403e-a520-4441dc291957", "comment": "Malware payload (GuLoader)", "value": "ced27643d262bca02a6e70f27695125acbf61a78", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735056, "uuid": "443b6ef5-5f81-4a31-9435-63649fbf23f6", "comment": "Malware payload (GuLoader)", "value": "3c382b90dc55269886f9ac67a0180d21ecf2e7c953f9e1f7aad7ad11e6a6180f6d25563184bc839ca19acbd69463fd81", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735056, "uuid": "14940689-0fb5-435b-b629-5953348801b3", "value": "T166935DF2DB94161D494B27AAEC424D62CD78812D3627063AFFED078DA20794C93BFB45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735056, "uuid": "ce999992-262a-4ab8-aabb-c7e8c4ed7707", "value": "1536:3ZtWVQKDzxbhcPljwk7Ptb7ZRIIS+HWjweQy+iyEQXXnP1giwjZOFeBajpy4:3TORzx1c9jwk7N7nS+28nJrEsXPKiwje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735056, "uuid": "16ef925a-89e4-42cc-be2f-15a0cc142dd1", "value": 90803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735056, "uuid": "44b85921-c985-441c-8e88-9120e4ce75c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735056, "uuid": "23c547c8-5ab3-414e-b998-f0b5d7432304", "value": "Kiire hinnap\u00e4ring 202310_30432NYCUEE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6281c003-77c9-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698741731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741731, "uuid": "8a820d11-adad-41f6-b786-548beed48843", "comment": "Malware payload (Stealc)", "value": "ab1e8e71aee66762de19b41c2910c629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741731, "uuid": "71e58cc5-2f4a-4aa6-951f-9e8e6585e9d5", "comment": "Malware payload (Stealc)", "value": "566bd76c6e87fc1d7c40588e4ae6277f32b80fe5829979a0467ce568bc2b25e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741731, "uuid": "6c93a175-6d2d-4a60-a3c0-a6ba480fd0f7", "comment": "Malware payload (Stealc)", "value": "6359223953a3b9904010741f93b3dcc24cab1ca3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741731, "uuid": "51277bef-659c-4345-8e48-2b0a300df889", "comment": "Malware payload (Stealc)", "value": "56b1cc3d1b7e63e389765c2fdac6a22e542182b4ca09f994b337c061c94f990da3a2a182f6c8136f8e118fc319d05a94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698741731, "uuid": "e7e2afb9-bd73-4f50-a6f0-2099d584fef9", "value": "T15C241A5393E13D84F9268B329F2EDBF8768EF5E38E59776912589A1F04B00B2C163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698741731, "uuid": "c3414c45-6916-4389-94b6-9ac480c79a5d", "value": "e0361317ba2ada8e7d47765f45f5ca50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698741731, "uuid": "74ab5a15-c012-4536-8938-469883dc0e5c", "value": "3072:02TemBWkezLN+SabSk8aaVqGOBeVDjE4aqcyyVZBLGNbc:vemBWHzLN+9Sk1lzBeVw2cnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698741731, "uuid": "fc72e979-7fa0-44eb-ae7b-1b784c90cc7a", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698741731, "uuid": "71d1de78-4276-4783-90ae-6904f3474e36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698741731, "uuid": "e3ac5f7d-9640-48ec-898b-4c7d16dd9676", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de59251e-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735497, "uuid": "d2194e37-497a-4e3a-89dc-f6236348b537", "comment": "Malware payload (AgentTesla)", "value": "07a5b63b59ac611ccdacdee52c452ef1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735497, "uuid": "e91e00b8-8ab6-4c3f-b54e-c59b10074bdf", "comment": "Malware payload (AgentTesla)", "value": "56d3b9b155d9638efda3785f3e71bf29dcf162346d5e5d5481735f53bd9e64fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735497, "uuid": "60d8e63c-447b-4424-bb4d-b049d5a96b68", "comment": "Malware payload (AgentTesla)", "value": "866dd894bef26395f16e55dd0cf2486c4fe8d398", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735497, "uuid": "490a7267-c06f-4529-8d5e-8c12ec440662", "comment": "Malware payload (AgentTesla)", "value": "7691521881b8ca243ab2b3ac6bb3b5ad2e0d35011848d18a2aacbf9667fc5cb45d643107dccb7626521388e5ac80ba94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735497, "uuid": "d6c5483d-b265-439e-90a6-3d1c83e737f6", "value": "T16505F14725988E9AFC2D137264760DED07369E2AD6B1B91D689EF0738B73343310A85F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735497, "uuid": "9a596807-c9fc-4931-b797-8528765f6a4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735497, "uuid": "f0f480c8-c523-41f3-8d02-ddbeca103704", "value": "12288:NWqEisUH/z++1Y0KRq4eTYCvP+Tl+3jHDUifeO+kb:UqEWCr0K6TYCX+Tti0kb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735497, "uuid": "e291637e-ad3a-495f-bf48-c39ed8cdf7a2", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735497, "uuid": "4419b1d9-4555-44a0-aab4-04c7a23a3fb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735497, "uuid": "aaf06271-446a-4b19-880a-aad770c6ce9b", "value": "PO-00112023062700.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc9a857-780f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698771706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771706, "uuid": "b61c1e95-d08d-4d9b-908a-845d60aef8dc", "comment": "Malware payload (RedLineStealer)", "value": "46d94d716c58e2da156612f859145215", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771706, "uuid": "bb66d8fb-c319-4574-9768-8847fe62404f", "comment": "Malware payload (RedLineStealer)", "value": "57d2044bd63b380c7600b1d8d6b396197c6d3b8636ee6ef7ee74f57695a69bc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771706, "uuid": "47da03ee-9020-4680-b8cf-6d318669ab38", "comment": "Malware payload (RedLineStealer)", "value": "9d5810b3c1e7167a3f6afdf740080947585f4d3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771706, "uuid": "3f203476-daf0-4a37-9c0b-8620f629d365", "comment": "Malware payload (RedLineStealer)", "value": "28ae66f4ae74f19e9ca2502396f5d4d90c4c24cdeedd316ea819c1378f72f8ef95aeaca376684b9517237db12903df80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771706, "uuid": "c36e8a92-43ec-48fc-88c2-a50336d21d22", "value": "T18475339AF3C8C877C9E56371C4BD16C21A37FDC098A95F262745488E0DB2DC49872B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771706, "uuid": "89e70b57-8280-480a-b244-ad86d4ebfdd7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771706, "uuid": "08f58594-14f8-4e88-bcc1-f94e1b9734da", "value": "49152:VNeeldyS3eX8snW3UY5eqUm5Rty8fyY6kJ+c6ZYSq:iqdF3eXDWx5fRtyVZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698771706, "uuid": "c23835dd-1ea5-4449-9979-2ea2349c974b", "value": 1619456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698771706, "uuid": "2470dc74-cd90-481a-b438-7964839f293a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771706, "uuid": "222ef307-090c-453d-9349-729de1b045ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1affa47d-77b0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698730874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698730874, "uuid": "d246d0ee-138d-47af-8cfc-4e8637ca67ef", "comment": "Malware payload (AgentTesla)", "value": "6e71d1341f06cb33dda52d035574d293", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698730874, "uuid": "b0af1ac2-d41a-45b8-815a-2cb106f5f133", "comment": "Malware payload (AgentTesla)", "value": "5825bde73102349f8a9ba272fce964413be3563bb4c4ef17dff41c2fed460932", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698730874, "uuid": "96344dfa-8331-4a9e-9824-87aa249ac110", "comment": "Malware payload (AgentTesla)", "value": "e21ce158a417057fca0340d07e5037217f4b4e6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698730874, "uuid": "c6c82bfd-3cbf-41af-8137-0547da0f8eb2", "comment": "Malware payload (AgentTesla)", "value": "2f89b4a827b4be2c7c06a40ba2ae4e11aee2bdde349728b48adcf57645900019a41089298617535a64ed9941f953ccc0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698730874, "uuid": "93eff058-e6fd-4c7d-b7cd-ec6fed6e4f01", "value": "T142D4232026458732E67427B7107114328FF5E06BA9D0FB395EA67EC97EBCB5292D0723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698730874, "uuid": "40a986fa-2b5d-47bb-8325-eb6a3dda2e8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698730874, "uuid": "10a13f24-32c1-4db5-8e60-9b3c1f787767", "value": "12288:PUR6LLoaXdUjv7covBAm6/LADPRiN5nkFt3ycMByvZxj0qLLe:PUR69ijv73i//LYElUlQwvRLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698730874, "uuid": "b03ce8f1-d103-42ad-a6c9-d420d9d38910", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698730874, "uuid": "84b72d97-8cc6-413a-8ba7-9dd8f5060a07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698730874, "uuid": "699ab2ce-7069-48a7-ab34-520aa4ea856e", "value": "SecuriteInfo.com.Win32.PWSX-gen.265.9446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34bbf232-77f4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698760123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760123, "uuid": "184d3acc-5636-437b-8ba7-b3774868aa1b", "comment": "Malware payload (AgentTesla)", "value": "12eaf84b10400df008e0643f19ae8df4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760123, "uuid": "d33afa25-622f-4bf0-a272-dec9992cf3f3", "comment": "Malware payload (AgentTesla)", "value": "5960d043c0b3f18e43855fd37a9452db44fc1e5dc64647d65b0c6f1ee6d18e33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760123, "uuid": "a6a0b9a9-065b-4bc8-af46-8e6292d4b5e1", "comment": "Malware payload (AgentTesla)", "value": "e130629af89b37096d7790fee637783a97762173", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760123, "uuid": "d9931825-7be8-49ff-a1de-4db96a1bc777", "comment": "Malware payload (AgentTesla)", "value": "38a84d43f223ea3584bdcd23eeb6048bb8898050043704d2adea229885f253a6450c5f7b3a7557bd07120eda4e7efc49", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760123, "uuid": "03bb6f4c-67c3-49f4-8c13-46b824e7ac0e", "value": "T19773A307756AC5B2C2780739CB57950023A6DF85F673EA0AF89F735526333EA884760B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760123, "uuid": "754438a5-63f7-4213-9247-f68f5447c399", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760123, "uuid": "40a921e1-2b37-4297-ace1-bcdc26a955bd", "value": "1536:Kvi6/W+j29YNg0ZxFPgFVrNF5du729tZCi:/6cgPu5uS9PT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698760123, "uuid": "60f55b59-bcbf-44aa-94a3-7c04033675dd", "value": 79360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698760123, "uuid": "9fb36fae-9dd9-4024-a200-76d3b76f20fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760123, "uuid": "84a2d511-ca24-4c7d-91e4-59f8184b9c4a", "value": "Doc_5102_7185_000186xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e202c70e-780a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698769863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769863, "uuid": "8eaf7421-8720-49af-9f45-7ab77ffec4e3", "comment": "Malware payload", "value": "34ee43b0ce680bd84e6b8271d2acae56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769863, "uuid": "53e21639-87de-4e49-8dba-76fd7d031c30", "comment": "Malware payload", "value": "5a194ede7d0067815b86deff35f0e42c7bdc23a3926e547c5a8ed2cf2e9a04d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769863, "uuid": "aa1eac10-2e18-440b-bb62-99646969f37e", "comment": "Malware payload", "value": "e87a97be24839616ef5221d63ab95866c545574f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769863, "uuid": "949d95a5-75b0-47ce-b9d6-48a99dac0c12", "comment": "Malware payload", "value": "8f60f04940846edc9a5b1feec12b921f256773bdf3bb413b845eee0dfb7e4b5422968cc25072abed216b18138ad087bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769863, "uuid": "d8f00cf3-40d9-49c2-817f-bdddff42b61d", "value": "T11FF36A11B4D0C072E567153209F4CAB0AA3DBD754FA69EDFA7940F3E4F301C1A636A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769863, "uuid": "23d0e6ef-e522-44f2-9417-c1a74678c2bc", "value": "5a23357764f0c833dcd1a07cf87f8149", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769863, "uuid": "eece1998-983a-4844-8482-e06d8d6f7f25", "value": "3072:HcHzLc80p1GMNFFz3cXqia95mCVJGF9J7qwZIf4D51rIOyQag:HcHsnVsXqzfmiGdmidgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698769863, "uuid": "60f718b8-d515-4804-8d06-7c580101cf97", "value": 166912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698769863, "uuid": "7165d23c-7612-48f8-971f-c84f4c7eab2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769863, "uuid": "76cb7314-69b7-4eb1-8d20-b31e0e4606c3", "value": "SecuriteInfo.com.Win32.InjectorX-gen.25801.7286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbf30a2-77bb-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735654, "uuid": "46ac7a94-dfbd-4d5d-9ff9-2bb49cab9db6", "comment": "Malware payload (AgentTesla)", "value": "6de85190847346d7a3fdf0fb4ac1d9f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735654, "uuid": "26209da1-6dab-4bf2-89c4-c307324ae84d", "comment": "Malware payload (AgentTesla)", "value": "5a2c73516c221e21e5fb720078cef912600499b036109ca6975588d993a1cbea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735654, "uuid": "052f0d8e-5b75-4f29-8277-06c24d5b9ac3", "comment": "Malware payload (AgentTesla)", "value": "469b3fcd477b2bac9ae5c4956a68cf2f8aa09dde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735654, "uuid": "c4aa6d00-5979-4bfb-ae09-c4ac13d0ce4c", "comment": "Malware payload (AgentTesla)", "value": "28e9e98050599116cc6e8230c39afac166ea50b00241d0c4b70237a6a84adb15d34e0a92890bf870b4efad87defe6dc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735654, "uuid": "e569ac70-3039-4141-bea7-0c410c06bfea", "value": "T10705F05126A9AE9AF82E13B1587659DC03722D3ED670E95E1C9FB0F343733132612E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735654, "uuid": "d707620d-6b55-4ccf-8d99-ff9f0212cf86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735654, "uuid": "9e3a70c8-c3dd-4365-b967-ff5b0807ea9e", "value": "12288:/yPnKsOS9s9DVUq0jcTg+izFsReU8zwxE6TB9pkTpxKJVm63yVTHjnaDy:/yPKY9s9G5jccXzKRezwxVTTS6C9Dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735654, "uuid": "802430b8-8ef5-43b2-996a-6aa9cf596808", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735654, "uuid": "684749ba-3bc6-4900-a617-f14544b43992", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735654, "uuid": "fe0b49c1-15be-4091-b8ad-143bc7f4319a", "value": "PO NO_0001254632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea62e8a-7820-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698779333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698779333, "uuid": "2943258c-e86a-4c1a-a1d3-4183286dbd23", "comment": "Malware payload (MarsStealer)", "value": "270fbd197cdbcca79461942c4a014579", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698779333, "uuid": "8c31db1f-77d6-40f7-9939-05a0d5e4e981", "comment": "Malware payload (MarsStealer)", "value": "5b122ee4042d6674264625bd373c46910047160fc946d3e55058269056b31638", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698779333, "uuid": "373643b5-5f6f-44bf-87d6-1293dde8cc70", "comment": "Malware payload (MarsStealer)", "value": "7fe0055b5045d94781d1cc0aa72a8ed938928cb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698779333, "uuid": "a1ebb188-bdf5-4c7e-89e0-7d9cb6b886ce", "comment": "Malware payload (MarsStealer)", "value": "19e2edb2fa43b7c10de0b7bfb58ebedf852dd25b0e27a91818575dceba8612a2088514c28f5ed62d787f2c5b0d208998", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698779333, "uuid": "a5b18ce5-3399-4773-9045-f901d8faf9f2", "value": "T1F4046E0353E13CD1F93687329F2FEBB8769EF5618E19776922889A5F08B00B1D663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698779333, "uuid": "0e4f8b85-58dd-4c48-abda-8c9e91f35f07", "value": "27d0318c65bb365aada52341c06e31a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698779333, "uuid": "9296c02d-0b20-49ae-931c-de5ec8fe7d8d", "value": "3072:etsyAavyjWPPM2n4jIn489I37F82X8mae8QvHkc:6syAqWqPM2SF89I3e28mF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698779333, "uuid": "9b9f7473-bdbf-4a42-a048-46d02aeb77ca", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698779333, "uuid": "4197c038-27d0-4b51-a8c4-1b6c9944cba4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698779333, "uuid": "330e854b-589f-4c51-bd84-0fa10c4ca4b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369bfc86-7823-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698780313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780313, "uuid": "59207003-bb27-4927-8e63-dbea08b2b29f", "comment": "Malware payload", "value": "ca8aa09e923de7294752f13d5180eac9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780313, "uuid": "1efadbb1-eca5-4fc8-8aa6-5048d017cefb", "comment": "Malware payload", "value": "5c58a49c4390a1727fe88f652d72f5362b60aec3f3d53f08039a40e83a3bd0a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780313, "uuid": "895bd199-995e-43f8-ae66-6f7387378543", "comment": "Malware payload", "value": "83a1dbfd12ae346913b55e1e5cb8370159197033", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780313, "uuid": "226298a6-d291-4de2-899a-9366cc80df68", "comment": "Malware payload", "value": "f7472e0f9a2a9de6ef2b432e07329c9ae3b8edeb51f8e124b2c5b58dc4dc2c93066e883b642ba701b24118871b9ce72a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780313, "uuid": "447120ad-2dae-440c-ad9b-a8a9a036512e", "value": "T13325BF417290DC4BD4E319B25C6ED5E05131685FA163CB0D6E81FA2678AF3C368EA7CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780313, "uuid": "f048bd89-4a55-4b40-a02a-33fa5dcc2969", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780313, "uuid": "9bf2fafd-dd3c-49d8-9c2e-3bebd368c65b", "value": "24576:Sl5n0c6GpGxB83tDsCMsBkUzcJNlGCd8:Svn5pe4MsBJYvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698780313, "uuid": "ba8d42cd-2ccd-4b50-b818-41d3731b5ff9", "value": 973824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698780313, "uuid": "62154c1f-97f8-4d8f-83af-4f30c1283bd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780313, "uuid": "9a67e055-b2d5-4a75-b493-3c665c5beadf", "value": "SecuriteInfo.com.Win32.PWSX-gen.3524.4949", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8cb79c-77a3-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698725511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725511, "uuid": "e08c1419-6305-48a4-8066-c54abcd33606", "comment": "Malware payload (RedLineStealer)", "value": "969a710007fd00d573ada14feaaaed2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725511, "uuid": "e2bfb28b-1d07-40aa-8517-ef56d2d3207a", "comment": "Malware payload (RedLineStealer)", "value": "5cd85e92a489a6b42345424414f7ebe2d84d0438df7fa76e31bf413f018cad60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725511, "uuid": "64b47a92-0586-4d29-ab25-7307f4790ae5", "comment": "Malware payload (RedLineStealer)", "value": "9834eebd14e4c10a8d7336b756a6d361a98e90a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725511, "uuid": "63075c71-7b98-4a9d-b451-9202d87e2e2c", "comment": "Malware payload (RedLineStealer)", "value": "bdecfe8bae9c328ba07d3a1ed8439079b1f18d3a03f461249dc1e6cf30c3d27f90bbee07be709b230a117dcc4484cdef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725511, "uuid": "a19d72d0-30ba-444e-ae3b-4b2d37f2a378", "value": "T1747418C13B84C8EDEC4F89F5602159799670C943BA4BBB537C8BACF63C1A35A5B051E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725511, "uuid": "2c21f200-008b-4e0b-b5c7-1f87366aa31f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725511, "uuid": "3cdb97d1-02a5-4ca4-b5ad-6a02e4f3ffdf", "value": "3072:wurtqgDGRY+63Kay6SWRxM9feZEUCf2ct2WVKrmLr6OO1Urkabi/GLwRomcFN1XI:wmtq7YoLly1NctQOOebbxmcFN1KbTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698725511, "uuid": "b67a5f3e-e38f-4f6b-b9b4-4eda0d2a03d6", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698725511, "uuid": "726e1556-13ff-4a7b-ae6c-ac9a801578b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725511, "uuid": "a30c668f-13b7-4b14-8233-fcfe9c619108", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab6f772-77bd-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698736726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736726, "uuid": "cfb6d1eb-b359-4278-a1d6-df5689051046", "comment": "Malware payload (AgentTesla)", "value": "2fed510e680b7ca6e4eefbf308ff05b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736726, "uuid": "41df8fbe-e331-449e-af32-6902aa365e0c", "comment": "Malware payload (AgentTesla)", "value": "5d23eb13f7673c76e4a1c301f2f0b2b30ea6a758620e7fc5c2a8e6f16b097b65", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736726, "uuid": "72a8eb53-ae2c-4d0a-a7c4-4af56aed55c6", "comment": "Malware payload (AgentTesla)", "value": "4cd14385b6d4c39f43e47ec8d322940d822728ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736726, "uuid": "d5094359-b2c9-427c-af5e-286c94e0c2e0", "comment": "Malware payload (AgentTesla)", "value": "ca742bc398c52b197fbdcc24915422b7f0fb2b4a963a5d7277e849cfa2b39ee13177d6e8419c7ade6da0d5c62d12a19f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736726, "uuid": "d949f9fe-5cb7-4e9f-867c-dd11b51bd062", "value": "T1E0858103B67689B1C1489733C6DB8E0403A6DFA1725BD61A758B337919733BB4B4A327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736726, "uuid": "048fce55-273e-4c55-8c48-188611289765", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736726, "uuid": "edda68b6-b739-4e44-b2a5-20a89a9e9fde", "value": "24576:SGBv5Ph7fudVQVKTGi3CZWi+Z7vApzTpoOQVZa:lNjV1loOQVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698736726, "uuid": "2b8353b0-1b30-464a-8069-fc322d1a6585", "value": 1862656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698736726, "uuid": "c6a068b9-1b76-48ed-a106-21b71fa7de8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736726, "uuid": "57eae82c-bd9a-4621-9dac-241270abba92", "value": "QUOTATION_OCTQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8407985b-77dc-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698749948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749948, "uuid": "6241dd4e-b799-4566-b2bc-18c3752575de", "comment": "Malware payload (RedLineStealer)", "value": "0089b9e80287ead4af77cfba59fc1eea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749948, "uuid": "46bd93b2-4b69-4e60-bd32-cff8b597564c", "comment": "Malware payload (RedLineStealer)", "value": "5d93a9281bf0948f49e9338435a1099ea347af058718bd1cc536da0491cb40d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749948, "uuid": "671ff8fa-1a71-4179-8119-130cc167f42f", "comment": "Malware payload (RedLineStealer)", "value": "97f7d6cfcb553e88f2dcf591acf43fa5ebb15a77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749948, "uuid": "dab34efd-aa5d-446d-b7ab-589cc9b68514", "comment": "Malware payload (RedLineStealer)", "value": "941dc7031ddad06db2ebed5d335c02883b4631cb05ddf784a92e74ab79ae475ee7d58f2af6b714a9085cf417df13dac8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749948, "uuid": "5c7a7bcc-1689-488f-870c-c81723ef436f", "value": "T1AF752313F3E9C42ADA7527718DBE03930F31B8625D38834632DEA64F06F2699A535727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749948, "uuid": "e4d15404-eaf8-4652-8a4d-7c540ed0f7fa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749948, "uuid": "37096164-1ced-45ca-a9fa-b4b003d1abab", "value": "24576:XyBvH1yKAE0PEcMYQNnhhmiCJ2gCKZtOfLf5qjeam5CIRr07Z0/pkxdddl5:iqhE0PEcMYqnhX2ZtsjaybrGQpkVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698749948, "uuid": "014e550f-8bb9-4b04-9f1c-23c69fb65eca", "value": 1615360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698749948, "uuid": "616fff22-8ec9-4d37-b6f6-daeaad3963a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749948, "uuid": "58449340-e630-45c6-b0d9-3d227750666d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4267092b-77f7-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698761434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761434, "uuid": "2e27d34f-490b-4df9-926a-024942351126", "comment": "Malware payload (Formbook)", "value": "b4778690922345db939d659cfd8cc5f5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761434, "uuid": "55d24a66-4faa-43e1-b9e2-c071e9f17f77", "comment": "Malware payload (Formbook)", "value": "5db9ea7f8c549eed7e8483681ed9b43cad75484ba6a089c741f513318cc318e8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761434, "uuid": "e066c9cd-308e-4c50-bc7b-b387c52e201d", "comment": "Malware payload (Formbook)", "value": "db71666a27951e7d7e84acedaa970bacbda5344a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761434, "uuid": "3899e43f-ecbe-49a9-9f90-dd015a4c229a", "comment": "Malware payload (Formbook)", "value": "584357c59a1e2e94133dd6d001c5ae19f417b2c83e8b801dc7b8a35f768469840a10f5e6ba7f60f04fa2d7ca6163e095", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698761434, "uuid": "4e4fdbd6-8ac5-4cae-b365-24afa041bc9e", "value": "T191D423C426AB63D6AD9C2FB8C551910DD348BF6DC3242F75B7FA23908970BA63919313", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698761434, "uuid": "5993298b-af5d-4044-ab7c-255b35ebf79b", "value": "12288:ovO1JLEwa9sItEH59zZdcTi6/womT80AAksRf0+zQW:d1JU99t09zvcTDIo3WRf0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698761434, "uuid": "64c77caa-10d8-47f0-a1ff-05d8540b37c9", "value": 604935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698761434, "uuid": "be8b4ac2-c91d-40b3-91f0-264cde964ef1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698761434, "uuid": "80e46f74-e773-447e-849c-504d83b50112", "value": "ADVANCE PAYMENT FOR ORDER #249390.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41689c6a-77cb-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1698742535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698742535, "uuid": "ade5ccaa-30b7-4a51-9e81-412b6257600d", "comment": "Malware payload (Adware.Neoreklami)", "value": "73f710d81b59ed0489adba5e6d79acc3", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698742535, "uuid": "76ebf1d1-f849-45b1-a906-71dad3b828bf", "comment": "Malware payload (Adware.Neoreklami)", "value": "5ec255777b966d3d8c63602dc9149d861623f2f4d274c90fb31f851d99a20ed6", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698742535, "uuid": "c9837001-cf43-4c61-aa57-7389ce5cfab2", "comment": "Malware payload (Adware.Neoreklami)", "value": "6e9e604bfb2fa691fe705e3e4846c87f2ea57fc4", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698742535, "uuid": "e4cb9436-28fa-439c-a833-d0e2b770b179", "comment": "Malware payload (Adware.Neoreklami)", "value": "f97279f67ddafc2853af7a22f2d3d1c004e28af5a737125e35124da062834ed0551e286d414a24de43ce41432b04dfbf", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698742535, "uuid": "ae5c57cf-941c-4fc0-9002-f8bfbc9486d5", "value": "T17F7633973DC6C57BE6B16833C6982BEB60F297B01F30646717D258866F3F854807E18A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698742535, "uuid": "e8ecbcd2-3aef-4809-acb3-c810ff9c7c6e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698742535, "uuid": "a81b5a0a-39dc-4fdc-831e-79b2c43f21f1", "value": "196608:91OLv3SyofyUO1xuskeAXrZrx1y6PHH+x82qUFriRrYQYW4:3Ob3foK1+skdtxY6PHHofDW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698742535, "uuid": "d35eaa03-aa5f-4fe2-b5c1-2e01ab5d776e", "value": 7500510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698742535, "uuid": "97dcf391-2336-4ab8-8d12-b623a84d33f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698742535, "uuid": "b9ce5e60-2c69-48dc-bc32-f5a558f34f90", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db5e4a2-77f9-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698762286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698762286, "uuid": "3ec1eaf9-1f26-4f35-aa39-44b82d774f88", "comment": "Malware payload (RedLineStealer)", "value": "99e4bc849c500f4d00f508717452fbda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698762286, "uuid": "95d43ff1-8c63-4e38-8c0b-efa5fa835b94", "comment": "Malware payload (RedLineStealer)", "value": "60666e296e627bfa30fcb125abb42da679f5c4c088842214edfa573b009621a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698762286, "uuid": "d9cbe6af-f523-48b1-b7a6-4c91775196cb", "comment": "Malware payload (RedLineStealer)", "value": "a310587385d241d5ae116a4dd167b351ce06d6d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698762286, "uuid": "6ab11c6b-278c-49e8-a889-fbcddb4c03b7", "comment": "Malware payload (RedLineStealer)", "value": "ca59bde4401633eeeb4bda15bde4f0ee6b6467206ec124a288619fb11115ededbc738dc5851eadb9e4e0fad604f75267", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698762286, "uuid": "6cc8b1bb-b466-42a8-a86e-136cfaa9b1d7", "value": "T14B752309B2EC59A1C870277558FA1B531B367CC0EC70571A3B069E7E0DF26898375BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698762286, "uuid": "7f75292e-df31-4288-9443-c151e976e5f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698762286, "uuid": "aeaf7ef9-24a0-46cd-93ad-3796c495afcb", "value": "24576:xyX0+kGqYzhEjPcBFNLWnmO7GdXTvEVbfS6nzMP+0ZSwcaN3CL24:kDkhYzicBFNLWqjkRQP+spV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698762286, "uuid": "126eaae9-83c1-437f-b575-6d9faa77736d", "value": 1622016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698762286, "uuid": "142bb387-edbf-4850-8e2b-bc6cefea963c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698762286, "uuid": "32366c52-7662-4be3-a6ef-20d30c0a487a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b520468-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698735223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735223, "uuid": "8f759447-d1be-4c4b-9fc3-b6b8abb0b9cd", "comment": "Malware payload (Formbook)", "value": "5ffb0767198d3dd48ae15eba2800cc89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735223, "uuid": "d1f59c0a-647b-4dc3-a193-8d9ef6a37f24", "comment": "Malware payload (Formbook)", "value": "608aa86a359a3a8cd3f5e51e98331376cb9bdefeb7d7a68e543799d253ff6da7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735223, "uuid": "e14cfa04-729d-46c4-b323-411658daccba", "comment": "Malware payload (Formbook)", "value": "7096c78223977e3e177d3a37815a84f5200d4585", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735223, "uuid": "0bfcd39f-c828-406d-9f72-7099dd21cfbf", "comment": "Malware payload (Formbook)", "value": "0f751c92bf757733e6b5dc2c5547663a5ca90c1b28eb5b5c2d5ab0706ba19e82ae83d8400e9768d169c7e9fe08409435", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735223, "uuid": "09f02a4c-203a-4a09-92a1-9f31ad420907", "value": "T1E8E412A0668CCFE1D9BD17B34660E92893ACED39C406FF5C5E7933E8DA76601F600856", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735223, "uuid": "2ae61bf3-962c-423d-8a87-330a4fa1c1d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735223, "uuid": "bacb344a-eeae-40c9-b50c-c0920b6214ba", "value": "12288:OUR6HOoa46nUH0dLP6kYedd1JK/ZG6XK/1/muj/MZVmb33p4d+6FG:OUR6f6nUUdblLddPK/ZhXG/mwMZVmTeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735223, "uuid": "29d3f762-11b5-4b09-b2ff-d85715c54935", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735223, "uuid": "d1cbb1a6-dfea-4a6c-a844-84410c973527", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735223, "uuid": "e0a65ff6-8339-40cd-90f9-de3638e391f9", "value": "\u4e5d\u6708\u58f0\u660e 40981900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8cf9d8-77ea-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698756111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756111, "uuid": "06052f4f-efbb-4871-a884-a5450a8b9396", "comment": "Malware payload (Formbook)", "value": "a3638a8d5d42b287cfd46ef95c8cd858", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756111, "uuid": "e2e315bd-f2e0-4da9-bcf3-94bb9004e3e9", "comment": "Malware payload (Formbook)", "value": "64a99c3141dd1a5e927a5bfd592ca25384c1eb00d21741f66ebb4ba505785926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756111, "uuid": "d1c60a1a-1486-4902-aba9-09ab1f237ba4", "comment": "Malware payload (Formbook)", "value": "fbc6a276deae109bad22072eedd6ce0e75584915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756111, "uuid": "6a1e5538-cad3-4c89-8ae9-6a60107735c2", "comment": "Malware payload (Formbook)", "value": "4e191fd7c24b39181ffa0bffd57864d16a1c05b93a4ec8eaa519ff5b98764c10b40c31969499366e8feefd42c408c8c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756111, "uuid": "ed60e92b-e9e1-4762-b907-6c03e0dde5e5", "value": "T12A154A3C48BD1627C1B0EFF59B954426B3E0A56B3255AD3859E318D6C212B06FD83A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756111, "uuid": "9f91e5d7-775c-4b08-a2c9-031dd84e4aab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756111, "uuid": "0e68d7c4-043c-402a-860e-f6474391abd1", "value": "12288:fz941IhC3rzVxZaADMWdxvFgNTMzLsZYi7eJweIVOswTFMYz3jSi7O7qs2nO3IIC:fp3hC3rZvgWvOFMzLNJw5wFMtkO283", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756111, "uuid": "ede519f3-9a56-40a2-94f8-82fddd3bf436", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756111, "uuid": "c1da34e5-8c7e-4635-aa0e-b3312cb4fa85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756111, "uuid": "aeb6e801-5d04-4cc9-8d00-579e87f5e237", "value": "Suntech Inquiry P43030.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c473cdc7-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698735024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735024, "uuid": "4f6e98d4-ca4c-4e83-9a39-211990311c29", "comment": "Malware payload (GuLoader)", "value": "4683eb47db48e423c97b4282938de2c1", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735024, "uuid": "19fcdcb5-a972-41ad-a28a-90ee57d0199e", "comment": "Malware payload (GuLoader)", "value": "651141d0fca06747c6420c95ac38c20267d9b62f8c6bf6d65f3152e5e0c59c05", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735024, "uuid": "0c4de75b-8e9d-408d-a18a-3febc54bc69a", "comment": "Malware payload (GuLoader)", "value": "ab29d50c3b9eece7b5f0284a0c76d0e8198831e9", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735024, "uuid": "182bb866-e1c6-41ae-975d-84a7dc106987", "comment": "Malware payload (GuLoader)", "value": "f7394f9eb90493726913a3b6dbf19f97f39c1e0edc76b11f9f3aeb745afff9cb4f4a10558cf9e5cf3aade9f7e880b9f5", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735024, "uuid": "3ff47634-9f6b-4bc1-9091-4e8fa2a0b1fd", "value": "T195936DE2DB94161D490B27AEDD424962CDBC811D3617063AFFED478EA10B84C93FEB49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735024, "uuid": "8e06ebd7-a339-47a9-b005-0e118780ed95", "value": "1536:ytWVKKDLxqacPljwHZRrbLZXmID+qWfwGQmYcxrX3v1jTiwbeyOFeB2jpy4:4OnLxpc9jwHZ5LfD+Dov1cx73vBTiwbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735024, "uuid": "a1813793-b080-4c7f-b3ff-7e801e849055", "value": 90581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735024, "uuid": "aacfc77c-501b-4484-b9f7-64a7cb47281b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735024, "uuid": "371bd542-6d62-471b-926f-ee8bfc756083", "value": "RFQ_10004.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c92dc7-780f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698771929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771929, "uuid": "96d9057c-ebf2-4515-87e0-afbf0d322eec", "comment": "Malware payload", "value": "3e89ed95c8e7fc7ef996ba83297556f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771929, "uuid": "bc2ffbfa-2f26-415f-b7a2-7201c05e6a0d", "comment": "Malware payload", "value": "66544c0d152db0cd4b46d6571381faafae70ce85f309a7e1990ea1bbb3b99017", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771929, "uuid": "c2baa3fb-89fa-4bf6-baf3-9ff5545d6a30", "comment": "Malware payload", "value": "62ccc389f89c5ea0cb42673c75dc395b36037fb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771929, "uuid": "f5f2b9d4-39b9-4c33-b333-4c24fa00eced", "comment": "Malware payload", "value": "26f4c683e73ad04c542961ba6525f5a4cedad28805bfd19c2c6ce2d89de23e8474218c99d403e9ea5d94ba57f1d7bda9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771929, "uuid": "c867fa46-a7ff-4678-914b-5bce1fa4de6f", "value": "T1A0D4F11877984CB5EC728139CD63A946E7B3B8264661DE2F03A0579EDF2F3606437722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771929, "uuid": "63a9e239-207f-4a99-b132-3f370f13d68f", "value": "b31ea98cca713b7e0ebd77013bfa9149", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771929, "uuid": "49eb8265-392e-4b2b-a744-b4b5fe197017", "value": "12288:e/cYjwx7s0zXoBA5ozd6IDqk0MzkC4sEEqtQGfbjcED/l6ZCJj:XYMx7s07h5ozdDntzTPEEVGfbjRD/l64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698771929, "uuid": "4a254709-3be4-4a61-bf24-f4bc437f34bf", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698771929, "uuid": "1dd5a045-4eed-408f-aa58-e33f68de2c3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771929, "uuid": "a0d4ca3c-d36e-41d2-a6ab-b8aaaacf5701", "value": "Opdopbsaed.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1fc692f-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735503, "uuid": "ebe4037d-6b7d-45ef-826d-8e845e890e04", "comment": "Malware payload (AgentTesla)", "value": "20d8a0b91eece28982e245d5b8bf4930", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735503, "uuid": "bcb3a9be-0d0e-4b22-aa9a-07270b8b5b7b", "comment": "Malware payload (AgentTesla)", "value": "68f6a5d1e90ce94fbc1fb4fb8d4a809dcb4fe8af2ab66e29fbe7678672949215", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735503, "uuid": "59d81a04-bfcc-4513-86f7-d90a51f98da6", "comment": "Malware payload (AgentTesla)", "value": "547587e2b9d30491a9e6c47ba0b041f4bc2ececa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735503, "uuid": "28ea907a-cb43-4b4f-9d9e-784fe80777e8", "comment": "Malware payload (AgentTesla)", "value": "e46560f77804d9b3ab60487df4beb536917b56385e3f7f4a8cfbb46e835d4af7306db6643c75b6e3f43d840b0a9760f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735503, "uuid": "63eda484-9c04-40c9-8b6a-e73eec148ae3", "value": "T189F4E15325946B8AFD6E13B2A47A0DDC47725E3ECAB4E81D1C9EF16683733032116A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735503, "uuid": "a22e6df1-603e-4097-b0fa-c5c279a741e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735503, "uuid": "8fcd2340-8c96-4780-9135-dca3f729c682", "value": "12288:VvYj8FwLm/S0hGiTYTkCoW+D43YZnuwUniwOVHzHj3k/Zu+J4QqeUK:Vgj8F68oEYTZ8nuwpVHrQ/wy4Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735503, "uuid": "30f60f52-d1cb-42bb-b987-5cb9553e5e7d", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735503, "uuid": "553cb26d-7dff-4bc7-a5a1-57b4f3d18ea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735503, "uuid": "0c3b8ec1-31aa-4c6e-ab42-5e2d2ae2ed45", "value": "RFQ-000112030687.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7109699f-77bf-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698737461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737461, "uuid": "08b66803-7dca-4583-887a-1b9a3755de03", "comment": "Malware payload (AgentTesla)", "value": "af5e58491fe4a139b63a7a632e62c6db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737461, "uuid": "26ddd5f1-5095-4228-94c8-af620cbcbcdb", "comment": "Malware payload (AgentTesla)", "value": "69b893ef6bcb3a609339321a763b2044962b5330856c73a38a9651905cccd836", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737461, "uuid": "9f848524-d1f9-4cb8-8a16-1aeda24585ac", "comment": "Malware payload (AgentTesla)", "value": "3e370361942ae9838126e7f1d216aeddd5cfe217", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737461, "uuid": "0b5be70e-6a6f-4ff9-98b4-89bc5cadba8d", "comment": "Malware payload (AgentTesla)", "value": "d260c8ed6983dd3cf7ca1a521fadc652baec73177e7f6dc3024a575cedcf512b80fe6e342406f792ea7f754d782f9e40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737461, "uuid": "d872e1be-0024-4271-a516-3ce3c6fdb62f", "value": "T15D65AFC1E3F4A10EE8EF46798E3852E4A2B124527B76D74AED00E785745CBD7C9C06A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737461, "uuid": "94bcfa3f-2ed3-4f76-8dd9-263b40c6f443", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737461, "uuid": "f73411ac-b6f7-44f7-90f7-338b4997d2ac", "value": "24576:QpRKsitOR+5aHUrOiDXzKJBDzpeX9dto0no9HaUADG4Xoo4dfJ9D:WgsitI+kHUrOiDWDzpki+oQUeGO14dfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737461, "uuid": "3c109029-557a-47df-afbe-30700377ac78", "value": 1445776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737461, "uuid": "230ee167-705f-4b4a-9549-29a87d2618dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737461, "uuid": "1778163d-fcab-49d6-b807-7eedc924a0fc", "value": "Fluke 810 Vibration Meter - 1 unit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e535b9-77bf-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698737362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737362, "uuid": "d14e9a38-1a7f-4afd-8191-14105fd2627b", "comment": "Malware payload (AgentTesla)", "value": "627ab3c72dc8e1ecfe109b2cb7d3bfb1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737362, "uuid": "8acd830c-c023-4d03-b14d-5bf6e0c7cbcf", "comment": "Malware payload (AgentTesla)", "value": "69bafffa9a3148df9565fb20eb776878b21d0d9b8ff8cb94fb4040150ddce238", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737362, "uuid": "f6684458-9b19-45b1-9bd3-e3be3b96951a", "comment": "Malware payload (AgentTesla)", "value": "f2eefd9752ab5c987589c31fd71f097aa7d14b05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737362, "uuid": "0b69bcbf-73f9-4254-aa2b-323c8abc1595", "comment": "Malware payload (AgentTesla)", "value": "04fe43472d25dba51a3036d1144f6fce916c896b50e5df31da1d9624ce8fb8fe86f9a3ef2dfd445c166dce8a3b4c2868", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737362, "uuid": "85499477-e547-48db-bef3-2a9ad72f0adb", "value": "T15FD423643A18C37BD41483FF96B01BA167F4815E3586CFAC0F7491CAFAB2B450B8A576", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737362, "uuid": "99e5d90d-bd98-4d11-adf0-32a56f450d4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737362, "uuid": "57fc093e-ce66-4590-9b46-6001939c634f", "value": "12288:BUR6R1oaiBZSps2XHXbpVCLZrvh2pw5+w26BySxQYQfoehAj7:BUR6E0pf9Vyr5awY62fdhy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737362, "uuid": "21b8b8b8-dc2c-44c5-ba65-cb509a4c44f2", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737362, "uuid": "bab79b3f-b190-4d62-a864-eaf27d330baf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737362, "uuid": "b3532a40-1688-4eab-9ebf-77b44dd0e4f8", "value": "Loan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4761ea-77e8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698754906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754906, "uuid": "a5e39e18-2e1d-46d0-84b7-149d351d2dde", "comment": "Malware payload", "value": "2d0b80e34c60515277d03ea90fa64be2", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754906, "uuid": "61bac9f1-e7ec-4ae2-bea2-a68402860ea7", "comment": "Malware payload", "value": "69d5c2220b32ffcd29fc35f3a8807e2efd0a76a6ce13cda0683a8a65c5773093", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754906, "uuid": "f4deca16-15ed-4178-8762-d7ef0ede775a", "comment": "Malware payload", "value": "83648fc0baf74a82440313df80c25b7d30f0e99f", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754906, "uuid": "cf15169b-6870-45ed-af52-6a7a4d07e110", "comment": "Malware payload", "value": "e7b7a4a22d90f51334ab07339fc476e12174794b072e48fe8f9753fa7b6da8551b1d4ba16a388a30d8f0cfb74b414296", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698754906, "uuid": "b98dc18b-10f6-4186-861f-7a45fdeac994", "value": "T1A9B4227E1E00B36037D626C96D5BB506320DB393B3768CF95C86AE183E59AEC151CE93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698754906, "uuid": "7f1ad276-3875-4241-8df3-4764c93b985d", "value": "12288:XeNrOmxFW+NUZgxJH97f+surt3rJaGHfIUXM0V22DPaiRogQlC:XexOEW+NMQ5f+smJHHgdkJDPavgQlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698754906, "uuid": "dcee8c4d-8a7c-42aa-8631-c2c3d049c9a6", "value": 494656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698754906, "uuid": "4da47a58-2c6f-4537-8de4-eeec8f378dac", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698754906, "uuid": "e2b5e9b4-3def-489b-991a-fd219066fc22", "value": "IogvoayYhe139.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4e3057-77cf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698744249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744249, "uuid": "cb1c07b0-00b0-45c1-b65c-0a8e5eb6f3ad", "comment": "Malware payload", "value": "8e2e739c4d82679045abc9913b67d306", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744249, "uuid": "228bd97f-6fac-4f22-83c8-937fb6a78eb0", "comment": "Malware payload", "value": "6a5c52a0506c17e85b2e86dcaecb33f9d4464fb8ff3ea27b4e1801bd7d6eb12b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744249, "uuid": "c3850ac5-f6e8-49e5-9101-fccf7d0c38f1", "comment": "Malware payload", "value": "5902e8d5e9c5a31e5198fec86a1070cb413add2b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744249, "uuid": "2d60ceeb-c2c5-476e-afa4-5877145cc4ef", "comment": "Malware payload", "value": "3d7be173087827b3e2c9ca1c6f53bccfb8ac31d9691c83edf66cdb0cc3aff0553a4e4d4e0df5460fa222e9857a71cfc1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744249, "uuid": "4efc62d0-b98d-4c33-a10a-3cd4f2e1e455", "value": "T1C9B339D87643B4F505BB30E6156F7186F97245A6B80D8880E44AD8D03E3CF9A5137FEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744249, "uuid": "da7f3afb-4677-4cac-821d-fee77f43f460", "value": "1536:7r+CP7O9wolzok2Tr0/+AIviC5UDfp1UsNdvb/Qv:ntO967AIaCWDvdvb/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698744249, "uuid": "74cd24bd-b040-4e36-9d19-bd368d2ec4df", "value": 112846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698744249, "uuid": "a4bf8366-9711-4819-bbc1-aa5a5468e17d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744249, "uuid": "7607e28d-4a43-4488-9e42-419e625bc32a", "value": "Accusamusb.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779240e5-77b8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698734465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734465, "uuid": "13601687-e6a6-4777-8b10-9e35fd5a90a6", "comment": "Malware payload (AgentTesla)", "value": "45538422fffc54d75fc2c0ec5ce44703", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734465, "uuid": "7a971d2f-60bc-4ea9-b545-c988feecbec8", "comment": "Malware payload (AgentTesla)", "value": "6cd6c7e615f5d4992222e908247be025287d7ca769fad30c8f4b439d5113221f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734465, "uuid": "3a8cc133-e3d5-4f8d-90d1-040b4d9c961c", "comment": "Malware payload (AgentTesla)", "value": "fcd4378ec746b6b78a930b979cf904affa6c5be7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734465, "uuid": "cd726698-f9ea-4789-8b4b-f6f8f490ab15", "comment": "Malware payload (AgentTesla)", "value": "f5234f753849a9ac79eb1ecf6754281ed988fb96d074437a0f8f4bae72678cdcce933e62353b5c2e5f7d78f26b97e5da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734465, "uuid": "a6748e3e-19d0-49a3-86fe-e9c3fc837ce3", "value": "T1AA15CF4172E9988DE0D31DB64C6ED2B020753DDE9122EF0D2E42FA1A70EA38359D675F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734465, "uuid": "0e24fccf-150d-4589-9c85-a804e22324ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734465, "uuid": "4aad59da-d4f3-4aaa-84f4-75d90f07921a", "value": "24576:pSO0gF6ec4W2KEhflazwQ6RPBZXWOrd8:pYgF6J4vDhk7of1rK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698734465, "uuid": "8877cd4d-d012-4de7-b4bd-cfe05a4d5281", "value": 912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698734465, "uuid": "ae41383a-2716-4005-9872-f7e53ad84060", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734465, "uuid": "3f802407-d638-4c52-b218-0af5d42bb976", "value": "SecuriteInfo.com.Win32.PWSX-gen.24688.20404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc508310-77ea-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698756109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756109, "uuid": "ebd87a58-6277-42f3-ab5b-03f365fc1ba2", "comment": "Malware payload", "value": "6ebea473523c44132e5e5a30bedb1a43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756109, "uuid": "11c27fb8-1904-409e-84ce-10c5f7ea95e2", "comment": "Malware payload", "value": "6e158f16f07e8ff0704f797423eee56096fa51306fa8e74ae0034559f9cbe81c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756109, "uuid": "3270ab7a-1a98-4071-b202-9c7048c82d5c", "comment": "Malware payload", "value": "b9777c487d43c43cf0a46b104f2912d7f6207f1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756109, "uuid": "6dbf3c7b-a6fb-4d4d-8f5c-878ae67ef6a8", "comment": "Malware payload", "value": "737a4955b7e83d1686d8002606dfc7cf26fa6f47b8053e7dc530f767ccf88093d8e622d62184b74a28b57814a148873d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756109, "uuid": "2869f97b-addb-4b04-b538-0bbe7a51d97a", "value": "T1A105CFA1F2892E55E86753F8583A9910136B7E6E6478D64C1D8E71DE4BF338210A3F0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756109, "uuid": "08616050-cf54-4fa2-9095-ee3a094a19fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756109, "uuid": "f1f2474d-2ba9-43aa-befe-a97d5e7c0666", "value": "12288:9XWvpnJ0UQAq0PO5ECGoNw5BvrpBlbL6n3POr5y9W8Di0mXtSC:9IJ0Sq0mC9hBvrtbLEyeHDjmXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756109, "uuid": "40839228-3db0-47f9-8ace-424136c7eb5f", "value": 870400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756109, "uuid": "8374394e-dc76-4989-9ca7-4c5e845b7036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756109, "uuid": "25019a0b-4153-4a83-b27d-4a87f0d62d01", "value": "RFQ E3297510.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725a3be5-77e9-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698755502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755502, "uuid": "e4eb1c43-7d92-480a-90f8-9bf5c848b6a9", "comment": "Malware payload (Formbook)", "value": "ad9d9a05e659f49b8a6d7dc2d115d251", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755502, "uuid": "8ec53248-4f9c-4b3d-86be-9a32e3828c11", "comment": "Malware payload (Formbook)", "value": "6e52b529cc351446e3b8da16381a1232ae152f6fd2d1778e889df0b2ae93c1ae", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755502, "uuid": "afa83888-a9ee-47be-b355-1413ed7256c8", "comment": "Malware payload (Formbook)", "value": "1779108585c8a0bab1e23ec8cb78aafdba449ea1", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755502, "uuid": "f3778979-06ee-4bda-a37b-46928c99e309", "comment": "Malware payload (Formbook)", "value": "5b8f2d84af370319ad67da9e52f1d9d2f3cc195422f1f2f1052dcf147b6f84dcdfde4999b3763bcebf40751e5d7793de", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755502, "uuid": "12f93eb5-c02d-4b88-a700-34271489b100", "value": "T1A9E313018E51773CA99E8D2B92F071967F86BBD16784D2BB3304C51DF90E64B64CC98E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755502, "uuid": "e2abb8e6-0e87-4842-8c55-384417b39aa8", "value": "3072:lg4Udy1l782fzq5jkGsHV21nSAljc4jvsevq3iVUwsVxCjfo:lg4UelfzujkGs1YjcSvawWxCjfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698755502, "uuid": "5ba24e86-1e2e-4858-9a64-ae8ba60e8a27", "value": 150376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698755502, "uuid": "ac58e01b-5242-481b-9415-99ca82679570", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755502, "uuid": "5b76d7df-d28e-4e98-843d-cc5cd426d5a7", "value": "document_issued_ticket_278092.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6e02c8-77f4-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698760186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760186, "uuid": "20fc92a6-1cf9-437e-90ca-0d0fc1677d83", "comment": "Malware payload (RedLineStealer)", "value": "99267c8824d4b28161a2ecec030ec588", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760186, "uuid": "8ff51fda-d546-451b-8740-6aa93d825804", "comment": "Malware payload (RedLineStealer)", "value": "6f12232e159de661dadd56f6f17a36a0d4e6ae24eba5c06f54fd2f7a8763feb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760186, "uuid": "013c08bb-4071-4716-a0b8-ee1c33cb0712", "comment": "Malware payload (RedLineStealer)", "value": "e478b1ab1733c6116edd204a3cf2c2ee7db49b4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760186, "uuid": "248bfd9c-3cc8-4c6e-b60c-fdf6ed6c4f06", "comment": "Malware payload (RedLineStealer)", "value": "73d43699243ccdc6125bc999306205d84771c03472d3dea2c8cdbf390b1005c53d166a821cd7e3057be662134aa65f79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760186, "uuid": "34bb120b-967b-4fea-8025-6af681ab8586", "value": "T121B43985818790B3CD911E7DFE8C2AE08EB2AC3829A57DC61FCDF14525B76B1736092D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760186, "uuid": "f2646768-2bd9-43d9-b2cb-d79df9b8bcb4", "value": "eb635207a6a2b3afb249bbb2249779f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760186, "uuid": "df281d69-f10e-4edc-b8b2-0c87795751ce", "value": "6144:Loe+sEqmLDWZlb3uaGtqY/huvbjTHjW6koaQWkCkXqUekNh:se+sfUDWZlb3Qtq2cjjTHjPkoaQWsXVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698760186, "uuid": "9b6a2ca8-4deb-453c-9ecf-cb6e6d18ddd2", "value": 513012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698760186, "uuid": "526db29a-07bc-4472-9b6a-78d8e878cc73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760186, "uuid": "327f3d67-0370-4901-9173-fee99d7e1b74", "value": "SecuriteInfo.com.Win32.PWSX-gen.21782.8011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a85409-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735163, "uuid": "557b3ecb-3503-4659-a1f0-56c9cddb9347", "comment": "Malware payload (AgentTesla)", "value": "adafad4cabc96834501a0d2021b8df29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735163, "uuid": "44d4dc59-6950-4c98-bc28-c0f6c461078a", "comment": "Malware payload (AgentTesla)", "value": "6ff6a733cc30a557c4f3dcd10394f6613e6c06f694d14ae25ad719e2d9701c06", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735163, "uuid": "575add70-714f-435f-82ca-a1270239cfa2", "comment": "Malware payload (AgentTesla)", "value": "2dd1df9b738b357f79e6616f230082b83ecda526", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735163, "uuid": "41dd276d-0f6e-4cdd-8021-72774234ba11", "comment": "Malware payload (AgentTesla)", "value": "403478f69a05acfb162ac0e7be0a8a7d4aad4793840810a86ec31cf5808a5427dc918c69c7c79dc583ffe201d9e21b32", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735163, "uuid": "bcdcc773-3112-4806-86c0-a2a07195376c", "value": "T126D423210E7CCB21D8B06F7AE8F8513243F5E16977C0FA6D4E45B5C82663F81839A666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735163, "uuid": "600e4c69-d6f7-4384-b698-4fc417c798da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735163, "uuid": "a4edc006-5519-4663-812c-3993ada5d7be", "value": "12288:rUR6eioaOz+0/sTNfUns7mP8f69VFlffsn1CtH4jqyuN93nX+fiaVJSVaSqQB:rUR6yz+0UTxUnImtL0nKMAv3nXUPS0SJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735163, "uuid": "6155d0e5-dd4e-46c6-93e5-159b19c0daf3", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735163, "uuid": "00572771-5c1c-46de-b3fd-671fbb4bdf86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735163, "uuid": "bedca665-90e5-4248-950a-5eeed02f1258", "value": "new purchase order-1023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7b49b0-77e1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698752241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698752241, "uuid": "080b1467-ead2-4e58-ae36-eef821f0b83f", "comment": "Malware payload", "value": "9905e68bb39d455dffef2c16376795c6", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698752241, "uuid": "8bf0ee49-6e9d-4907-954e-554b1ce5dfab", "comment": "Malware payload", "value": "702b7493808e0d0366dd3e8d1af0dad062704810cd511948c8c068b8ab7719db", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698752241, "uuid": "b52c1bf6-dd9e-4202-9003-d5b521b92134", "comment": "Malware payload", "value": "4437ce58e3735bc3c3905e9648ecdebace0fe324", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698752241, "uuid": "0df5d868-7150-4b5b-84fd-fe7225fcf6be", "comment": "Malware payload", "value": "bd53d816547a5047b1d7ad6c80ff467f9cb29e99c1f3bea419c23a5575dae3c1986db146f9ea2e09d91a52245d9ca745", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698752241, "uuid": "49861bc9-f37d-4345-adeb-4c36953e27f7", "value": "T1147423631F61C3611FBA792A836650E3A7F6BF1575749FDCB02B7CF653B08212482886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698752241, "uuid": "458e54ac-cd21-4338-b01b-a976e3fd6113", "value": "6144:RaqiXYoBri+yFtCECwRKn/LgxsqfrV2uylUs22EOhtjle0ocrU9IbeUUC:RGYoY+NbOsqTWlDaODkqmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698752241, "uuid": "764dd3d3-732a-48c5-92b8-0f8f3b6cd0e5", "value": 345177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698752241, "uuid": "6f92a3e1-6e79-41d9-a708-f491db70abeb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698752241, "uuid": "82a05285-b187-480e-90d1-a94bb214412c", "value": "PO-000001306.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b656fe4e-77bd-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1698736718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736718, "uuid": "348b3768-f110-4006-af97-1f148c38b48b", "comment": "Malware payload (AveMariaRAT)", "value": "6e031a891f11c76cf07320ca1d95ea4b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736718, "uuid": "4d34ca64-5d0f-4edc-831a-9de366571a3d", "comment": "Malware payload (AveMariaRAT)", "value": "71dd14cb3199ae728da438bc35550f88d7986b165c364e2cf9d473151cfeeeb2", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736718, "uuid": "4218cb4a-35f2-4a5b-9e7e-89cf251644f3", "comment": "Malware payload (AveMariaRAT)", "value": "cd36102cc2cdb1a21074957b623eedf9701634f1", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736718, "uuid": "f55d3944-d051-4849-9a7a-853ff42f28ae", "comment": "Malware payload (AveMariaRAT)", "value": "c2975ee2309ce7ff28f947c86b5b0b59722a60227d2fea0844dc9de9a183dbde87a114f0c66c62936f60b902d04bb087", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736718, "uuid": "a388f49a-f5c7-4b93-a541-86bd4c357190", "value": "T185755A457E7ADA23CD00C23094E2CAF656479E4E96D292231AECBD7731B23BC474B2D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736718, "uuid": "60507c19-9975-44ba-981e-79d99d522cf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736718, "uuid": "3156e0b6-632d-4751-9ec2-6a1985258fa5", "value": "24576:Y9VpY2DShJ6iAFic4DbrguoG6u592DsNokfR3XhlIbAK:MmhJ6iAFicebrvoGj5UDsNoUR3Xhl6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698736718, "uuid": "8098a7f5-fb9b-4449-b12c-9950eae532d0", "value": 1686992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698736718, "uuid": "4a3a904e-194e-48d9-8f7a-ce94ea1a2192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736718, "uuid": "cc6ff9ed-276e-4f7d-97fe-22a1364b48b1", "value": "QUOTATION_OCTQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e0e2e5-77ea-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698756095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756095, "uuid": "c26a9f06-df80-4f87-9393-63a1b7d9c62d", "comment": "Malware payload (AgentTesla)", "value": "553711f3e7926ede10a14410f9b1805f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756095, "uuid": "61562d1f-c9ba-4eac-a027-48ce2d54ffbc", "comment": "Malware payload (AgentTesla)", "value": "724b387b8762c245969c80ade0c3984d3ba47f5ca060308e12034f770195c45c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756095, "uuid": "7333ba4d-f2ee-4274-bbff-f7e2d9a07cbe", "comment": "Malware payload (AgentTesla)", "value": "0f91313c2ecd749d11ca8942fb5dba0100927c5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756095, "uuid": "05090273-e00a-42f8-a4dd-bcf99e851d1a", "comment": "Malware payload (AgentTesla)", "value": "d1ac3f194e7902f8074f089f91dc7e78524ba5c6720eb16c98500c98eecd14a68ed6e395c433c5ccd71a22942e3f6682", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756095, "uuid": "327b6ebb-157a-4050-bb29-397b974a4550", "value": "T17D340F037E48EB15E1A93D3782EF6C2813B2B4C70633D60B6F49AFA518516426D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756095, "uuid": "cc3750f3-36be-4440-a43c-1f26cc8f309a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756095, "uuid": "5a187ec6-4b5c-4d5f-8668-19210d31e14d", "value": "3072:B/yuyGCxRQfM7S3TbTluXaKvB/WCJhezd35yfzL7Pg:B/yuyGCxRQfMe3TbaNWCJUpuzLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756095, "uuid": "2f890c64-8f14-49e3-bd7a-899683f40156", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756095, "uuid": "31bdff4e-cb12-4deb-8e2a-cf1ed6f4189e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756095, "uuid": "80c354a8-5073-491d-8206-f8e9aeae90bc", "value": "724b387b8762c245969c80ade0c3984d3ba47f5ca060308e12034f770195c45c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ed20bf-77bf-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1698737420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737420, "uuid": "1f13d788-7ccc-47e0-a253-2bf120b8b1f7", "comment": "Malware payload (Loki)", "value": "4a9df12f8e9dee7bbdcf000968514000", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737420, "uuid": "5022b9be-23a1-4f15-a8b5-2c216329a705", "comment": "Malware payload (Loki)", "value": "7301968335a092472e2faa474144afa031301ceae8454a94f9b1478b8f45c45c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737420, "uuid": "9f5d7747-44fe-41eb-997b-6094ff673030", "comment": "Malware payload (Loki)", "value": "adca59634f125f76766e3a54b57abb348c2150e8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737420, "uuid": "1996b7df-a084-4210-a3fa-d511614508cd", "comment": "Malware payload (Loki)", "value": "487c30c890242e4ca5644c3728badf2747c444b81e4ccfc677304bf60fc08a93cfe05cd14b7ace53a1b55e3bf92dfb66", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737420, "uuid": "8f7f06c0-4ed3-4591-ba97-78d8ed5521ca", "value": "T1FE936DE2DF94161D490B27BBDC424972CD78811D7617063ABFED078EA20B85C93BEB49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737420, "uuid": "120df842-e2d4-4c9b-87a3-17531fd08ae1", "value": "1536:+tWVcKDgxyycPljwNBxLbrZX0I2+otWYwUQrNyZXF1/wiwUiOFeBQjpy4:8Odgxbc9jwNBZrZ2+osFRhyNF5wiwUiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737420, "uuid": "875b5915-f322-4896-b90a-cc73340ec272", "value": 90538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737420, "uuid": "102d37d1-784d-45c8-bb8f-9b99dfa4ec99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737420, "uuid": "e3db03c8-0060-458d-a3e7-b7e6acda52c3", "value": "Permintaan Sebut Harga Segera (202310_31432UTM-MY)\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206cef75-77ca-11ee-8907-42010a9c0042", "comment": "Malware payload (RecordBreaker)", "timestamp": 1698742050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698742050, "uuid": "2d3055cc-8bb8-44aa-9e80-9388f82c9d6e", "comment": "Malware payload (RecordBreaker)", "value": "259383f5e969a874bc46b9bb4bf65265", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698742050, "uuid": "35c7de28-1cb4-46cd-abfd-32f3fbbdf2ab", "comment": "Malware payload (RecordBreaker)", "value": "73e6ce2239f49301bd4735478f554c771cec1a50b0d9a38eeef1e4267c6661f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698742050, "uuid": "5c0835df-0b13-4b64-a771-4b8a4c8fa29b", "comment": "Malware payload (RecordBreaker)", "value": "ca5e6149b1becd791c316ea11ee2ad97f651b1d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698742050, "uuid": "a0ac2141-3f0d-4415-bdd0-a295419bd682", "comment": "Malware payload (RecordBreaker)", "value": "10c9bb4c1df31151d910d68eba0b67f60a042fc6d26a8d97732c55405fc29fa7073bdf00dacd499bece3ec33ccdeeb20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698742050, "uuid": "cd14c7d3-cb41-4882-ad97-c0bfd3f5d4bf", "value": "T1E2752363ABE84675DCA49BB41CF913931538BD910C6443BE2695FE7E0CB2EC19C36326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698742050, "uuid": "0078742b-8bf9-4c6d-be13-417bdef50abf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698742050, "uuid": "64407536-d967-410f-9313-c17915be2a8f", "value": "24576:QyVKvJKj0UYdaAb1Rwk4YmWFw5ulAh+ysWLJ/aJGoZaUxKmmdRAY/oLqK7wVPPU:XAhHdJWk4Y/FIu+sA1aJBZblER1QOkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698742050, "uuid": "3b9d2409-1a08-4dbd-a26f-47be74e926f1", "value": 1608704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698742050, "uuid": "f71be760-6f13-4b9b-a35f-3946a99f2514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698742050, "uuid": "271dc896-b2a5-41c3-a6d3-175da7790762", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ea11f7-77ea-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698756102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756102, "uuid": "923bc196-dfba-444d-a317-f7d9c4f982ef", "comment": "Malware payload (AgentTesla)", "value": "2cb647de9060f222424836849dd82845", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756102, "uuid": "a2f412d2-7a5b-44f6-becb-d314c73d525d", "comment": "Malware payload (AgentTesla)", "value": "73f3e5f728790bb325cf11d8bd8e5497ba4872b79bd42eb2f84fe2e30bec9cf7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756102, "uuid": "66275427-9c9a-44e8-8f43-8e294eb61222", "comment": "Malware payload (AgentTesla)", "value": "b268dac5a3063be6f75c2293bc77297879bf82da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756102, "uuid": "eb0ad0b9-efa3-4664-8e07-98cbb1fbbe57", "comment": "Malware payload (AgentTesla)", "value": "4fea64b255b0bde9fb968d3d71c394f06e71e6f9d4d0107ebff7b73ba54bc4cb46584edf6f5f9baea16118f4b8696a79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756102, "uuid": "74075bb6-406b-470c-a242-a5d5b4d87a7d", "value": "T18E351202BAC684B2C4661832463BBB11997DBD305B658EDF73D0792EDE726C0D632762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756102, "uuid": "25833e41-f990-4e8c-95f5-a6ceb38a40d4", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756102, "uuid": "8f0525ac-f3aa-4587-8805-33fe05da2ddd", "value": "24576:aTbBv5rUT1CqDn6+eyURTjUZfpaOKUSdQYvV:sB/6oJchKzPvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756102, "uuid": "79520848-f944-4408-9109-bfc4dad4b835", "value": 1070582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756102, "uuid": "f12b5e03-7a1a-43bb-b688-4082a1d79e68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756102, "uuid": "3681717c-88a2-46a1-b81e-96da351415fc", "value": "Image 294847.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955f3fb8-782a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698783478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783478, "uuid": "c5bf2ff0-e612-48ec-9315-4fa529eb2913", "comment": "Malware payload", "value": "e9ff8dc8112dc106e70470b308b189fc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783478, "uuid": "abce9d5a-b645-4ee5-9c19-0e1a396a042d", "comment": "Malware payload", "value": "740e8452c5acee12128f5877ae0887c398a0c48bd9eb2cf22be5e2a1bc9f5c29", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783478, "uuid": "07f54d3f-7aba-4e35-bc04-c6bf54b79532", "comment": "Malware payload", "value": "410e4d5b5f2c61bd114a7793255acbeb3dac233f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783478, "uuid": "14ea3884-f305-4acd-9c0f-504f8c313dba", "comment": "Malware payload", "value": "9d7cc81583dc4a0d9e384b4b03e13b31c66d62407e13b331d8b182d2d4a372d22a9807137f36892db467b4f1cc30c654", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783478, "uuid": "03078336-67e8-428c-945b-4d1339bc3893", "value": "T14173D815FF651FB7D89BCC3309A81B0628CC665A22B93B367E34C918B54B15F19E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783478, "uuid": "6b1af966-f99a-4770-8c16-76dc2d8e0e90", "value": "768:lqwATxpQ5e+y4rZi5Y7CZDSPqFOee2etJeGa7N/kWjrXilvo2KXZY10Up/:lCTxq55f7IDSPqF/74JVSN/nJ26a10y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698783478, "uuid": "4b8cae25-f3aa-4c39-8d1a-d4dd8e3796c7", "value": 73596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698783478, "uuid": "0e83f3d1-fed7-4e3d-9b7f-e9a6d995439c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783478, "uuid": "5b57d7c8-4c4c-4380-83f9-8e68fbacb391", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57dfabd-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698735052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735052, "uuid": "2859338e-eb6f-4e71-8575-c64cf0f3dd91", "comment": "Malware payload (GuLoader)", "value": "6b19a73642c8e90ded0b5dd118f2291f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735052, "uuid": "0934dd01-ecac-4d86-b3e6-c6a967e16014", "comment": "Malware payload (GuLoader)", "value": "742d4eeaf5d2f058c8e38522ef496f6fae185af750540a25fbc43c784d9f23de", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735052, "uuid": "b81a0757-4f65-4527-95df-50ebb21c40d0", "comment": "Malware payload (GuLoader)", "value": "bd9493f8b7d9624ace1c10f201d6ca713e4fd162", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735052, "uuid": "c950050d-65c1-43ad-b6c8-79ae2bcdfa1a", "comment": "Malware payload (GuLoader)", "value": "42e44867adcd844175e8f918cc2fd9794245aef2903fec2b4ebe0deb155f3be05fdb725ab997df67f7f4c5ae3065f5f4", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735052, "uuid": "033d3d5a-01b3-464b-b78d-ce208488f5ae", "value": "T12FF2D4D6CB8421094A8A26A7DC4346368D6A809C77371B347FBCCE5E6243C7C46BF796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735052, "uuid": "7300359a-d481-42ce-a455-3dc9c2dfaf53", "value": "768:vHunyZ9FF/S2MuPWqCHg2WHHKz64EuTxihFgdtCtQA8urqU:PzFLFc6CXdtCH8uOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735052, "uuid": "5e59c74e-2058-43aa-80a6-1117d2516a25", "value": 35232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735052, "uuid": "b85dea75-62f8-40d2-9b1d-433b3c532db3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735052, "uuid": "0e0931b2-8de2-4040-b9ca-00c1833ff7ae", "value": "improvizat.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4b97d8-781f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698778763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698778763, "uuid": "8f67d483-7827-4c08-a841-78801433497c", "comment": "Malware payload", "value": "150adcff6076b0e8a5fffde4efa55f06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698778763, "uuid": "627c56af-3c11-442d-8890-c6e8575ee6af", "comment": "Malware payload", "value": "74e4c41234d1c4c76416479bb5c8463b20c5dcce2bc4c1a78c649dd9a42d1e89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698778763, "uuid": "23284b87-91d4-40bd-b358-f43dcea65b3e", "comment": "Malware payload", "value": "c4e6d96f7725c236c9b85038f47d4df688c888b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698778763, "uuid": "e6c8a377-a10e-42d3-ab8b-5566c0480a26", "comment": "Malware payload", "value": "6de61f30810e9ded5db534289e595d07a90be0689058a4ce23d5ef20cf06cb6781a142222ded1d28eb952f88e51f66ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698778763, "uuid": "50540af7-e687-42b7-82ba-50800932c1d6", "value": "T171A40204F6F9CFA5E466C979C963464AA9A138894B35CDBE254C420DFF233A08739F35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698778763, "uuid": "f37b37fa-5710-4b1c-b0ad-dfb0c2e58ec3", "value": "1f3d95a82ab4255dc5d2fec1283d6136", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698778763, "uuid": "9dd23d79-969f-4d4b-81d0-38252ea718ae", "value": "6144:vrNd8Vz1C/aXRrp/sxKGr4ttKUGtjUDQyXQY3/9Cklpm3a7Y6n1ZLFFU8cUstJdo:sV5pp/K4tt+tjU7/flgK8SzLk++sGR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698778763, "uuid": "889fe4bb-6204-4043-be09-9f39d7ff54c4", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698778763, "uuid": "fc6a2997-c891-400f-ab1c-2e44c16e1466", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698778763, "uuid": "a102ea99-7838-492a-9644-3a10eb7714db", "value": "Ebirugpm.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d759dae3-77c8-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698741498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741498, "uuid": "bdd2e683-391a-4c2c-b9d0-d5c55ffc11da", "comment": "Malware payload (Formbook)", "value": "271fc31a859db6a1b3d6286e94387795", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741498, "uuid": "e3c910cb-be50-42b6-9036-1ade02ec094c", "comment": "Malware payload (Formbook)", "value": "75d902909c64280c10e4726e3b127970ad8251a10c7f3094b840695a5c5c53d5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741498, "uuid": "e8b4d300-a14a-4bce-822f-155020471254", "comment": "Malware payload (Formbook)", "value": "552d696ec821cd55e2a2de236f1e54686e4661b7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698741498, "uuid": "5822d671-ad06-4b40-91ee-900e4b947603", "comment": "Malware payload (Formbook)", "value": "86e05f2e9ace09694551e23a39e13b3ac872f532266a4ef614a4c3678826ed95348b63d4378f07fb31fbb38e909838d9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698741498, "uuid": "99990bc0-49b1-49ef-9ae9-63a4624f66ce", "value": "T128D423C426AB63D6AD9C2FB8C551910DD348BF6DC3242F75B7FA23908970BA63919313", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698741498, "uuid": "5ef79def-5cab-4e92-8f92-4cd4f297a2a9", "value": "12288:UvO1JLEwa9sItEH59zZdcTi6/womT80AAksRf0+zQQ:51JU99t09zvcTDIo3WRf0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698741498, "uuid": "ac150cd9-0e87-46bc-89b4-1b7d4e63abf0", "value": 604913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698741498, "uuid": "7adbffc0-7906-44f1-9883-d314d8038a9f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698741498, "uuid": "1b5dce67-8cf8-4746-86d7-c390377e4f75", "value": "Purchase Order No.1364.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f83da6-77d7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698747936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698747936, "uuid": "6e668d4e-1e71-4546-a49c-fe41f6cc705c", "comment": "Malware payload", "value": "a6914787b9fca0202d8780b0d2ffaea6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698747936, "uuid": "653c538e-56ce-4c4f-8540-c99dbc4da219", "comment": "Malware payload", "value": "7675c9f3d5911a75f46f3d3b6422dbe93b2c267714c6f3ed1c9f71cc97633c6e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698747936, "uuid": "d298df58-68b7-43be-9507-e72ad13b3dab", "comment": "Malware payload", "value": "93d4013a79f22cdedda715197df014d403bc30eb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698747936, "uuid": "3d308db1-e070-4f8f-95a5-cbbc3ae3a7bb", "comment": "Malware payload", "value": "add91f690f6741d8b8a0e43d57a46c4084c5515a001750a35de21e59ceffc0284ba5b11d464beacae1ed62cb92f538b0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698747936, "uuid": "8a8c190f-75d1-4554-b47c-06c86e012dd7", "value": "T1B1B338DC7643B4B505BB30A6596F7146F93384A2B84C8840E40AD9E03E3CF9A5577FEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698747936, "uuid": "2a6b4b54-47d5-4310-aadc-51e500045016", "value": "1536:73F8P7OMolzok2Ta5r0/sIviv5UD8p1UsgMvb/OpL:L+Om/sIavWD/Mvb/2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698747936, "uuid": "6d400a2c-93b2-4aeb-aedc-765d34282948", "value": 114130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698747936, "uuid": "7a83c9ea-3a25-4b61-ab1f-61cb41f385a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698747936, "uuid": "cb1841d1-6272-4240-907f-64076fdfae69", "value": "Dictarv.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee8d6f9-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735525, "uuid": "09a14652-68b1-4a95-8ea2-6e5863f1fc82", "comment": "Malware payload (AgentTesla)", "value": "5871ab71cc9a95b3aa823a69c1f00245", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735525, "uuid": "35468c4a-5441-4f42-b5fd-1768690056c7", "comment": "Malware payload (AgentTesla)", "value": "76a639fa72448baf7f3091bebf0e5c2a51cd8f793826d0d2c3c0447b87ab066d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735525, "uuid": "34a27a5f-e9bb-406e-95ee-308b471635b4", "comment": "Malware payload (AgentTesla)", "value": "c22f4e102dd0a46cebec5fb22418f6b2f6177e4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735525, "uuid": "7a5ba267-8ae6-4217-a8f1-072003219c79", "comment": "Malware payload (AgentTesla)", "value": "a118848dca5941955496c4872b1dad45acc5d6abaf8ed241eea5131843f8fb43e478d347616b53e9847d0c8011880684", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735525, "uuid": "5b02916d-6a56-4a4d-92d2-f5d19eabc386", "value": "T14515F15366446FAAE93E43B23C36499D0732AD2FD9B0651D686EF1764A333433026D2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735525, "uuid": "ffc4f9ba-507a-4364-86ca-af210b14a2b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735525, "uuid": "aa80c7e8-750a-453c-b0e5-b562f4c49699", "value": "12288:y1aPYyVF2g9nC6z3lC7HV/z+Ob16MCu+DoEjM7xkp4j1CiP2lQ1CELewJ:y4g+F2g9nCsVi1/KjMC/cb9QOmC1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735525, "uuid": "623a14be-6199-495b-8b8d-3b6c1b56ccf9", "value": 890368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735525, "uuid": "4aed36e3-44a9-4198-912c-d8c20a9c473a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735525, "uuid": "a3c04f11-b427-4325-b322-5fead27dd68e", "value": "733905431.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a5b9bc-7805-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698767691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698767691, "uuid": "24cfea54-784c-464b-8efe-90555ba06e3e", "comment": "Malware payload (Amadey)", "value": "44d2378d87fdaeb38651cb41e7648bc1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698767691, "uuid": "8369f15b-f912-4ab9-b2bb-8f48fb8a9564", "comment": "Malware payload (Amadey)", "value": "77ff5bca9f8d6f2ae496976821f7cb70140cf5eb9652d18ed1de2a7c77737985", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698767691, "uuid": "646287e8-ca20-4de7-8a87-788250c77f23", "comment": "Malware payload (Amadey)", "value": "01228c2cd256b73dea4b5e2b99877a06dd128c54", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698767691, "uuid": "6c6af3fb-7a1a-4b5c-bdb8-81af61ab553c", "comment": "Malware payload (Amadey)", "value": "014699a57da80daf2b6f5862fb9f31b51110e65c64165a2eb8e5cfaa04435422bdf87696a01e6b281f9cc655043185a7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698767691, "uuid": "452f7e50-cf47-45fe-9303-7875c367d2d0", "value": "T10B752302A6E1D121C9F3A7B50CB703471E3B7C620E74A7AA16907C0A56B36D8E977737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698767691, "uuid": "5306b973-7148-4d1d-ab01-3a330f60ca61", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698767691, "uuid": "96a9588e-334d-4f19-99b6-e8f275109ad7", "value": "49152:kEVawLNp12OUFqsc6l09BQvd9NxJuLU+:pawn12lJvSBW3Jf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698767691, "uuid": "35eb74f5-b18c-4424-8d62-b8593fbd597b", "value": 1615872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698767691, "uuid": "c771b7df-f5cf-4615-a32f-3214db18756a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698767691, "uuid": "febdc0d9-2e8b-4d0f-88c7-53a7d58ce948", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f62509-77c3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698739024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698739024, "uuid": "cf6c4e03-b8c2-4275-a5f3-2a37b497ce53", "comment": "Malware payload", "value": "b19c968d8ef12e145edacf8578f3440b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698739024, "uuid": "699cfe59-1e23-417d-833e-c9e38bca5299", "comment": "Malware payload", "value": "79c621ca4b6e73deefbd9e2c8dd69b762db796e75809cbd3ce23bce22074ad88", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698739024, "uuid": "0e91c7b6-9a5d-4cf2-9c98-1358caccfe3e", "comment": "Malware payload", "value": "022d624a7423588a52cf996f2a0cf50fc5e51430", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698739024, "uuid": "c50c7597-75ac-4db8-932a-ff92a68871d4", "comment": "Malware payload", "value": "22f04519c631c7069473cde8eb3a348003aafd4bb138f55af56d13bb31ba6ff08b55924ea86c17c1b0943c8a4f488a6e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698739024, "uuid": "4dd2f59d-6e62-4f22-ae22-1813fa95d996", "value": "T1D82633DB47C2ADF6EE68A3F6690534144F664A364781A138CA3F137608C836D4793AE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698739024, "uuid": "849c9089-d2d5-43f6-aa63-938bd96e9ebc", "value": "8d2803775af2b344d65712330e01834f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698739024, "uuid": "64f85ad6-abd1-4740-9a87-8ab9b600d19a", "value": "98304:Zht/xglJbdi6vLPnGlGXUn1k42L4NodEiAG7gbR7XMqcqYhWxtGj:ZhtxglJbgAPGlGkiVcS/+d7XrIMxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698739024, "uuid": "321bddd1-2f2d-426a-bae7-590d624c6621", "value": 4537360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698739024, "uuid": "bf4d56c1-86f6-4505-8f31-2b1f4e07002d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698739024, "uuid": "cf5be803-c72a-4173-8766-dcc91fbd120a", "value": "b19c968d8ef12e145edacf8578f3440b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910c824b-782a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698783471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783471, "uuid": "9f1171f4-e6de-44c4-8c64-7299dd15210c", "comment": "Malware payload", "value": "7557f20c90504d55874a9466e254ad06", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783471, "uuid": "8d95156a-ed24-4bf5-a10d-beb8319bd92f", "comment": "Malware payload", "value": "7ab334666c470979c9ca8f4570eab7d727d189cdfa0033822e28052964264dd4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783471, "uuid": "80a7605e-62ba-4bf9-aa65-fa054f7dd0f6", "comment": "Malware payload", "value": "55cdcc29428baf8a416a0cf21afc97d993dacd4b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783471, "uuid": "bdfea4ea-e3df-4b07-99e9-ef99c8cdd4f8", "comment": "Malware payload", "value": "fabc27862e14025107e5fefab008ec52baa2457a4ba2f01973e43ea86c73028a8fa4bee6e61e9df5064367a6365f2a86", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783471, "uuid": "3a31f2ad-1d0d-4649-b744-c4d5deb93155", "value": "T14B231996F8829B2AC1D022BAF57E995C3764A7E5D3DF3217CC601B207A8610F1E63F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783471, "uuid": "99c6bb85-043a-43f0-8f5b-d04f2c1553d8", "value": "768:liM7wTpcv2eaWDzbJ+Qxk2ilyrVO8/bMWfq8apYPC64+aBU2f/7LJiiTa77lUZYZ:2a2azb0QxkiH/bvfvapwWlFm7Ca10+jL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698783471, "uuid": "12c20c94-9897-41a4-ab23-2a44663b159c", "value": 47728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698783471, "uuid": "b6642491-bdd5-4aa0-99b1-1f680dd010ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783471, "uuid": "a9a18114-70fe-4011-ba34-bc5ffacbe23e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324f3242-77d6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698747234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698747234, "uuid": "3a6d7573-e204-4f4b-aef0-f022e6e65e1a", "comment": "Malware payload", "value": "764a2f826c91f73e77214e73cc8c0659", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698747234, "uuid": "eb894fef-c318-45cb-90ed-b3a8c4a9bb0b", "comment": "Malware payload", "value": "7abb873b28661b00ee0ca21321aca5ef14cfb11dc23e5f20c543b043536ce01a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698747234, "uuid": "dcc764b8-9c71-4245-a3f7-6b339eabf10f", "comment": "Malware payload", "value": "2d26735454a9b3a5a5684bf645891ddb6f771fb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698747234, "uuid": "3104e7af-5962-4dd3-a468-2f31f454ae90", "comment": "Malware payload", "value": "817619ee84135716979a0ef6651cfa7a2aa5bbfd9732ba8c60865041ca01e408721888b7c3a4457de1bf50c2af829791", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698747234, "uuid": "38a928c0-0b25-46d8-8239-f6da160c2a4d", "value": "T1C4950112B380553BE1771A788C0B43689D39BE113A34A98A6FE43D4D5F397C179392EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698747234, "uuid": "ea93ca8c-f3cb-44bf-b856-578185333c34", "value": "dd06625286c60e6c862bdd5b9f6669c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698747234, "uuid": "6fda448f-51de-48e1-b229-7994745ff02b", "value": "24576:ZCUOsSQcmIb/dDXzAKgkdmjzVob0UblzzdNbdzYs/C3yp7ITrnlsCKvL:ZCUeFDmjzVoRZ3dFdzl/g8MML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698747234, "uuid": "33929eb7-4a26-4d70-b78c-0631d9d127ba", "value": 1897984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698747234, "uuid": "c5448712-bfa8-4e40-a45a-5b54f62db80c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698747234, "uuid": "cea766e8-dde4-4463-be42-28687323793f", "value": "fichatecnica-30-10-2023.pdf.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85a3f5c-77f1-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698759109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698759109, "uuid": "9bc0ca11-0e19-4371-ab7c-ccfc2f485ec2", "comment": "Malware payload (Smoke Loader)", "value": "d9ebd26ee58f71cde091943042318e1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698759109, "uuid": "063256e5-c48b-49e9-980a-a8380ce42d52", "comment": "Malware payload (Smoke Loader)", "value": "7b101e4c3f86d6b121d25c79d718af9b24ad1ba2bbf9ad83dc285b8ba2e4756a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698759109, "uuid": "b4c17721-45c0-40cf-a2f5-794fb288e9be", "comment": "Malware payload (Smoke Loader)", "value": "dd769d691f1b937aa4db724c7d0686dfe09989d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698759109, "uuid": "51385110-8172-4355-a9c2-1282ec55f6cd", "comment": "Malware payload (Smoke Loader)", "value": "8adbf4cafca94c6eb6406cef7b692ec10ae7be3ab3161684a33ce32b516d5b43e08ba9898fc475ee27776bda9184de40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698759109, "uuid": "af7486e4-db5c-47c1-94cf-3aeedccd9cb9", "value": "T17CD61221B5F404037A752811B8A22BCB037176E4D776F4696AB3DB0F0D59BB48F912AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698759109, "uuid": "a6f37603-afd7-4f09-94c1-dfd3cdebb405", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698759109, "uuid": "51cdc447-1239-41de-890b-438cf7fc2894", "value": "393216:Y3Jwzzz3BmMupONDnuc6zhVu2fX5xQnRh7UBlLKcOLyjM:4/zhNiEB9Kq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698759109, "uuid": "eb8c5a08-db11-493a-b022-9f99843cbd64", "value": 13079040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698759109, "uuid": "c7145f58-fcd8-4c7b-b1f9-1901791da2ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698759109, "uuid": "bf33847e-0ebc-4ddb-9617-f13051880ef7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd123cb1-77a2-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1698725240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725240, "uuid": "a492aeb8-f304-4216-bccd-01570a445f36", "comment": "Malware payload (njrat)", "value": "37bbdd80623474e7b479915629b4346e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725240, "uuid": "9074252e-1db1-4922-a795-1ad4cb28ac4c", "comment": "Malware payload (njrat)", "value": "7b98971fec556ad5d6e994853395525da068c2f3e1cfd92b6388c37934e14533", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725240, "uuid": "a0fd174e-cc00-4066-832d-4a4e97a1836b", "comment": "Malware payload (njrat)", "value": "a6ce0e8167530a7fdd57243a1fa551364e0e1943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725240, "uuid": "d506823f-02d4-41a3-a6c7-93ac35bd823b", "comment": "Malware payload (njrat)", "value": "9e30091f7453ce906bd2a48feef78048770c4c03841d1d7ee1d06c3fe82049f9f21742ca492895a958f0cce54212ecd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725240, "uuid": "df47f2a4-b094-4549-966b-915425548153", "value": "T112B20A4F3FB98856C5BC177486A59A5003B091870423EE2FCCC554CBAFB3AD92D48AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725240, "uuid": "54f5109e-34c7-4398-ba5e-6ecab2d3cdc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725240, "uuid": "cf9d6be3-3017-4065-8db7-474f60107bf7", "value": "384:GcqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZRsYC:J30py6vhxaRpcnu0hC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698725240, "uuid": "b84a4232-c95a-41dc-8f8e-af9fb034a511", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698725240, "uuid": "d0bcee93-9d6a-4ca1-9415-6206eba1ac21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725240, "uuid": "e3ccb99f-0139-40f7-a3af-7f26021f6086", "value": "bRce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a373e05-77bb-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735651, "uuid": "65f1165a-f563-4002-b240-f41bd30bf80e", "comment": "Malware payload (AgentTesla)", "value": "86b73bbcfe5826241d7d19c3bff0b75e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735651, "uuid": "7331d12c-0010-4594-b555-defe676d07b9", "comment": "Malware payload (AgentTesla)", "value": "7d9ffe4901d60bd70a17d7b507820f79f67ce33ed933bc6c109fdb1096429570", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735651, "uuid": "5b25875a-42f0-4435-aad3-d33089dc42b4", "comment": "Malware payload (AgentTesla)", "value": "6b49867bcc04b4d3735fa426c747a5e1925981dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735651, "uuid": "5bf30995-a9b6-4925-8073-428b66d3defd", "comment": "Malware payload (AgentTesla)", "value": "81f55e37f9aa009c55cc184bf248cfa01197cb38d15f20fcc77b7c21180418a977508c1bf4fb2e8afe05b6f64286854a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735651, "uuid": "3bae6468-078c-4479-bde0-aca17488ef11", "value": "T1A9F4F16255A46ADEFC6D1373A8B64DEE46322D7EC5B0681D18AFF12747733472202C2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735651, "uuid": "a5bf7019-79e3-492f-84b6-1df541f8b079", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735651, "uuid": "8ce0f6b1-c1a2-4c6e-8528-429ccc14de6b", "value": "12288:22iNMyiRJU/WcOkSCn8COOxBPIL0Nww1vVKG5BSso7Jca3:21FFeBkSO8cBPA0wwKuBhYOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735651, "uuid": "4a36478c-d2f2-45c0-a477-ab9ef321ef20", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735651, "uuid": "10353cd9-5c06-4250-8283-6af8528e3caf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735651, "uuid": "c87e5eb8-b206-4dc1-9662-aeeff28d0a07", "value": "Purchase Order # 4001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5ca4e0-77bb-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735656, "uuid": "a91e7f75-7881-4440-8bac-91052d7823df", "comment": "Malware payload (AgentTesla)", "value": "dc93e460d18b06354f0744eeaf3762a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735656, "uuid": "3794d96c-9be3-4955-aff2-25a395d27dd8", "comment": "Malware payload (AgentTesla)", "value": "800a4827a33c8e2f3c4656e07e1694d2a15c1fd1566d3be374e66c7351751b98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735656, "uuid": "d22172a6-ac4e-4f98-9b9b-5a4cb0023412", "comment": "Malware payload (AgentTesla)", "value": "42f8e65df1ba7b870f7d74487d37a811efe7586a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735656, "uuid": "bb291d66-078a-4278-aa06-4b2e643135f9", "comment": "Malware payload (AgentTesla)", "value": "2df0e1213f5aefa9c8974e4f714a140a1a67a61ae960292d2087c2a580817deece0c01165e3385080dee7f648522b55c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735656, "uuid": "48119567-811a-4b39-a81a-ba86af87f7d8", "value": "T1A905F19366885ADAF87E137298764EED03722D3ECAB09C1D145EF43697733132612D2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735656, "uuid": "943de62d-c5d5-4702-83cf-e16a5d3a88b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735656, "uuid": "71119d13-121b-490d-b1a5-4e5c8ee3f354", "value": "12288:JOtTCrv6tvcvlj3HytbulGjY7gYInV4OolRkzn63Xa:yTC8cvlj3HyegYInF2RkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735656, "uuid": "e8b57989-aff6-48b6-b807-07ecb1531462", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735656, "uuid": "7319493b-5d2f-48c8-aee7-50a5324df9e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735656, "uuid": "9589b7de-fc5b-42f0-b994-9961337662a6", "value": "spreadsheet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a018bfb7-780d-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698771041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771041, "uuid": "30c733c6-da73-4209-a06d-1a6af3b0ab9c", "comment": "Malware payload (RedLineStealer)", "value": "ba7930bfa2964cd5c2aa491af2129b8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771041, "uuid": "1b704ea5-0b82-47cf-9a8b-de1b317a2738", "comment": "Malware payload (RedLineStealer)", "value": "807de0b885f90bfe2d06227ff66abed429321a7f729e77a5360c1448ff9ee777", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771041, "uuid": "04a79ebb-20d6-427c-bc53-156326c5fce4", "comment": "Malware payload (RedLineStealer)", "value": "bcfe04c8f0d6db4209a2f3dd5ba79d15770210ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771041, "uuid": "721daf35-d515-42c2-8c49-4992b918ff5c", "comment": "Malware payload (RedLineStealer)", "value": "7247e27ba67a139fa15c894f424d2526db23f4336cedf2af19ddf5a873fc4b557e58c40546ec1be2c9358e10fd35fa3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771041, "uuid": "f1d2db76-ecee-46b4-8585-b264778f7e47", "value": "T188752366F6E61573EDB05B715AFD02C70A32BC7149B0A2062742DC494DB36A4EA3372F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771041, "uuid": "48fa7bbf-9b2f-487a-bcad-7a979f0a7c3b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771041, "uuid": "884a327d-d413-4ee4-8388-afe138b5e484", "value": "24576:Cy0hXUQY3PmCZMTmNg6NKaZe9+uVIuy5+jsBzjgeIZdOvIx+vrOQDexlVR:p0hXUQdCZMTavRCIySzUeMYa0eTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698771041, "uuid": "e3901120-d661-4400-8357-b405d95ffa40", "value": 1618944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698771041, "uuid": "8da466fe-6f03-4da1-b30d-e89b2eb77c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771041, "uuid": "433df3b3-ac42-4662-8ce4-39e575f94110", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a51ca9-77bf-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698737680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737680, "uuid": "bd379b2f-0cd1-4993-91ac-2ec15c1aaacd", "comment": "Malware payload (SnakeKeylogger)", "value": "92877b963c90599d222a3c851dbbdaa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737680, "uuid": "ca0d86d9-f9ca-4ec6-98de-c6fa2364c091", "comment": "Malware payload (SnakeKeylogger)", "value": "80b55aa26af1c8cb84556ced208b0338313aa010bbb544cbb6a87f023b77899b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737680, "uuid": "dc1e4b0c-d9cb-4740-ab36-56e62985ce50", "comment": "Malware payload (SnakeKeylogger)", "value": "c2c4de2c7c5681f3be5c2ddca7f5ff7330d76dfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737680, "uuid": "91150e3d-860d-46d0-a201-9a459349118b", "comment": "Malware payload (SnakeKeylogger)", "value": "781198ced24e87944c7cf3ac4a7a986052d0621985b66e38f7be6c54b2950c554c2764c96941a2f7424718466be7e6c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737680, "uuid": "a3b68e95-339c-4fb9-aad2-3b24da9c8863", "value": "T16453D407B60A95F1D68C473AF69B94040764EBF6B663D70F788EA34A1D133EB884474B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737680, "uuid": "f08df83b-b093-469b-953e-c59011b88cbc", "value": "1536:lBWET/xqKbqqMaWFwRfi0BVIHrtokNgRxv4v:l7/vGii2VILtPaRxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737680, "uuid": "eb113abd-ef51-47fd-8753-29c1036723b9", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737680, "uuid": "886e6259-59ae-4fc0-b737-93eb108f81e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737680, "uuid": "673fe365-702d-44c5-b1ae-cd1be2b5ef7b", "value": "Ttwsg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56543e2-77db-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698749628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749628, "uuid": "61effc72-3fe7-4b36-872d-7c65eaade576", "comment": "Malware payload (Stealc)", "value": "405b89e06a0f2ca7b10b30cdbe7c2f00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749628, "uuid": "6496be94-ab49-4194-a9fd-9b19f4029a7e", "comment": "Malware payload (Stealc)", "value": "80cfcd7495b811cf63d893cad16758e413256b31c61987fecf840d55c565bc43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749628, "uuid": "64bcddeb-5a8a-4cb6-a088-7901317da8e3", "comment": "Malware payload (Stealc)", "value": "b8f45b2b0fa4a1834d42933926c1a008a3bca766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749628, "uuid": "b0b075cd-86b9-4d85-99f9-a63a8ca6438a", "comment": "Malware payload (Stealc)", "value": "c6656c7aacf824d31c783923004315f9801a4eb007454a737d4c3546015f74fbb80d3368c2daf652a70fca5b9e8558dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749628, "uuid": "b9e11ac8-3814-41e2-8c01-90b3e0b058eb", "value": "T17B24085392E13C94F9268B329F1FDBE8369EF5D38F593B6922589A1F04B00B2C563711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749628, "uuid": "16b8d652-b237-4edf-ad17-f4b9541f911c", "value": "f90e29ae4efabbc6b498b140aa3b7a65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749628, "uuid": "8a27e9ad-fc75-47a2-93fc-f141ec3c189b", "value": "3072:PWT5ldeviDMlAtM/UlIX4tejENYQZ3RQ1Zf3nGNUc:U5ldeKDMlAO8WITNhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698749628, "uuid": "911f49ca-579d-4176-b51f-6d5215219bde", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698749628, "uuid": "b819b163-821e-4c1d-9eb6-95e43ab764f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749628, "uuid": "3f17ab44-1bf8-460e-8a43-62d1580433b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e905ab7-782a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698783467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783467, "uuid": "721326cd-6618-4ecf-b814-29d9568c5566", "comment": "Malware payload", "value": "9bbe44cdb931cedd5f55181bccbff4e9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783467, "uuid": "0661af85-aaaa-42d5-b437-9b451acbbc38", "comment": "Malware payload", "value": "8247f61005f5416856465383e9bfb67e9a1cb4a8c9b60e68392892621c0ec92c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783467, "uuid": "a8d2f6e6-9fe2-4edb-92da-b29fa5c310dd", "comment": "Malware payload", "value": "cc70c7578260cc56c4871ba3fe89c2b9d98cfdf8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783467, "uuid": "1d013929-c1a6-4140-ab76-38a2bcdcfb08", "comment": "Malware payload", "value": "034a654d4785963338e8a30434f7378d8a87567caf7ec89fe73312777f47c0084b28dedef3a00b0f4788f23b822d00f5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783467, "uuid": "c331a4fe-2baf-425e-9eb4-94d5ec9e6b4c", "value": "T187531856F8814F21C5D512BAF92E154E371617E8E2DEB2239D202F247BC792B0E3BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783467, "uuid": "a65e5348-4453-4f68-8218-ce366bacd6c0", "value": "1536:KLnK4g1IuKUpcuDAhysy3IAM9iZTe9ZHlAa10Od:cgyu/KMTe9ZHlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698783467, "uuid": "864dd367-9da7-4c0d-ba3c-acc118d47d32", "value": 65524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698783467, "uuid": "a80ea0e4-4059-4676-8cc1-c4b579731697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783467, "uuid": "160ea2f1-caa5-46e8-a8af-ff4de880001e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4839a461-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698735245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735245, "uuid": "17a44dab-70f9-4dac-a2e5-2256fb195df7", "comment": "Malware payload (PureCrypter)", "value": "326aae5aaf738f96539c6d3e6391986d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735245, "uuid": "a6c829f5-e58a-4767-87a6-d4c88ef952c3", "comment": "Malware payload (PureCrypter)", "value": "8269e1333fd3f0439113640f308e72fe26a559f20b852bafe05547869ded34bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735245, "uuid": "da2a74a2-ed0e-4534-a313-fd426e3b41ac", "comment": "Malware payload (PureCrypter)", "value": "e517ebd34fb5e4d0605d5a8227cff9ce1fbf8709", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735245, "uuid": "f3ad3d19-0f86-4974-8116-b663af40a3f7", "comment": "Malware payload (PureCrypter)", "value": "b5a82fd6678bce6e336f53ceba2f694a8a8ce234b80348aac3b7fcc0aa87f7780f05b8b177ba2170856923b20ae1c2c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735245, "uuid": "345666c2-4122-4f3a-825c-e6d596c7291b", "value": "T107F2C6113304C673CA994E75D84B4AF00974DD61EB14922B66C4BF8EBC723B15E26A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735245, "uuid": "7154d51a-ba9e-4a8e-9441-11a7634e42f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735245, "uuid": "65868509-dd5f-4f27-bc16-948a87e6fce4", "value": "768:u8KZvkPjPAGD0AO77QlFECqpixGz9veZ:TKZvkPjRDlCG+/paGzgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735245, "uuid": "daa6cf54-7901-472a-98e6-9491a4cb00c4", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735245, "uuid": "bca92938-dd28-4860-8671-cd1bda28580f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735245, "uuid": "53a1c7a2-89ca-4f43-bc33-8dc27bbc2526", "value": "yeni Sat\u0131nalma Sipari\u015fi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67968615-782d-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698784690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698784690, "uuid": "512d9770-8373-4709-b5c1-ee45fe211f74", "comment": "Malware payload (Mirai)", "value": "fb9a3acec9b5414343ee48e1a51755b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698784690, "uuid": "5c7b9bd5-7022-4c8a-92f9-97d4bd5bb073", "comment": "Malware payload (Mirai)", "value": "82b93e466e68c3b89e6faaef04962ca5f861fc0fcc96372418ebbee06b3609fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698784690, "uuid": "cf0fd7b3-5cb5-42a5-96cf-ef5b79ec3b2c", "comment": "Malware payload (Mirai)", "value": "bf97f8fb1abb65932108eb18ee594dfece1d0dde", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698784690, "uuid": "09e60f5a-2e93-4d62-807b-3567f86dd792", "comment": "Malware payload (Mirai)", "value": "5ebcda4151d6e3ccf841d62320774e96518ae776f7e456eb444f0c629f3778a148590fee12f17db1a7f31790ad31a163", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698784690, "uuid": "7e10230a-352f-4feb-ae8d-de8763d9977b", "value": "T150337C75F8291E94D15642B4A4248F352F23E2C893933DF356A1C3B28017AADF91EFB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698784690, "uuid": "56cc554e-43e1-4ffb-ac67-16aeeff3139c", "value": "1536:GamyClrLp7wnwir4dy771oeinTXCr/3a10:GVyHkWoxnTXmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698784690, "uuid": "90b5cb92-da48-4cdb-9e41-36125ecc1744", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698784690, "uuid": "e5d80110-1652-4ba6-978c-7ded7ff086a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698784690, "uuid": "1abc3858-f020-4ddf-b363-228b6c7927c9", "value": "fb9a3acec9b5414343ee48e1a51755b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3364e2cf-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698735210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735210, "uuid": "82d63f1d-2f88-4574-b3a7-4d55e22c880f", "comment": "Malware payload (Formbook)", "value": "35c3440dde454b4393b1733c60383a88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735210, "uuid": "9cd93f46-3141-4b33-a60d-109779c12da6", "comment": "Malware payload (Formbook)", "value": "82e2999475b441f03d417b5ee9df2615ec04693e11c15fd5f6c1e444293b85e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735210, "uuid": "8e9582d3-cd55-471a-99b4-6d535b51b2f2", "comment": "Malware payload (Formbook)", "value": "dd514fa3dd060f9948bf268d2d8200aff7588fe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735210, "uuid": "c5bd35c8-06aa-47f4-9a93-aab9873fb7f0", "comment": "Malware payload (Formbook)", "value": "66b340cec81072378ac996b9eec0048869b8972cd875c7c3c82feae89f7dd083099b444ac77501ef202b99ed6cebfbd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735210, "uuid": "499aadfb-597d-42b2-873b-fee5d8669154", "value": "T1F3D423618BB99FBBD5AE177658351424D6F2E119BB83CA5C0FFAB8C01F1B7814F20252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735210, "uuid": "7f589a3e-6a58-4175-a43c-56e432b5079a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735210, "uuid": "20f12979-f292-48b9-b02a-eb9576897424", "value": "12288:/UR6wHoaTqN3eth4HR4ZRzPWq5NDtM3jT39NemQd8guwEfLxW0YLQzp:/UR6RN3ChySnueNpM3jD9NbQCLwEDxoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735210, "uuid": "c087e9b1-2ffe-43ea-83ac-495f2293d45c", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735210, "uuid": "cdf43df4-25a1-4cc4-bb1c-87102e8a8a5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735210, "uuid": "a3a8de37-ab18-4d23-a2e6-28b9d9201ab3", "value": "FedEx Receipt_AWB#817434844264.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fcd751-77e9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698755565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755565, "uuid": "a478d518-a3e3-4756-ac2e-7a62dc8d4a6f", "comment": "Malware payload", "value": "93991937ca2ce29b2dcc679fca9cb271", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755565, "uuid": "c8380606-b3b0-4dad-af42-7ec45cc4af26", "comment": "Malware payload", "value": "8381dbeb7b749e7d0662a045fecb0b56322aea446e3c04428636c37cbf7b731c", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755565, "uuid": "308c998a-316e-4ec9-af4f-02801aa93e96", "comment": "Malware payload", "value": "356c6498e712fb149e5e1d5997f4f8871671a54d", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755565, "uuid": "30ef1758-3a39-47d9-b624-dd4002266c30", "comment": "Malware payload", "value": "87896d8e035e7a0f1504558837ef73bff2bae1bfd9d85e35543b281bd4482a1b4aecf690d6a309561b684995304bd96a", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755565, "uuid": "095f6698-e765-495d-a2ab-4a09a6c05869", "value": "T1351152D088C0B760EF92A3A84B92C6FC337BD0116B61E93C9854203887866F26DFD847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755565, "uuid": "efb509f4-3fce-442f-813f-f3de763f7ef9", "value": "24:nY10alg/pdM+RyMBxFJWEBrEJORkvkl+EjmPMG6YTAX66oSk:JO2pdMSjxFJWsE/69mU08X66Tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698755565, "uuid": "51ad7a18-2b1a-4980-ba0e-b3d019ca5226", "value": 883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698755565, "uuid": "07ebb30e-18df-4532-bc47-01ecc9c1e1c7", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755565, "uuid": "b0ed4250-a8a3-413e-84cc-5a8a7787b370", "value": "FACTURAntgxhaeA_BD(032419).cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a63232-77ea-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698756096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756096, "uuid": "27aa2bc9-7a18-4133-b13c-4e5a0732eaa9", "comment": "Malware payload (SnakeKeylogger)", "value": "3f274e9aa509d90647cdba4d36c23617", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756096, "uuid": "5b4ebf36-c1cd-4876-afe3-2769b15350d0", "comment": "Malware payload (SnakeKeylogger)", "value": "85db615d02f1cdbba1b5405a19c68e97bb8fa225cd9a2938a83481189dbcef7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756096, "uuid": "958d15b6-75eb-4592-b296-5ab8da474e84", "comment": "Malware payload (SnakeKeylogger)", "value": "58df8ec73349d61137a59c2a64c4becd751c6c53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756096, "uuid": "c9affad3-3e0c-4d36-8728-d52e98c12b91", "comment": "Malware payload (SnakeKeylogger)", "value": "7db0895cfe875d687ae3dd1d0d987c2f5d3b4bde45d110e54d396b23d8916f29fdff70dd259c83b980c2ac6aed10ac3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756096, "uuid": "e9fa5a5b-e385-4a8e-b5a5-836d42233ec3", "value": "T1EAC3291D67F88800E6FF99770172A111C775FC42092ACE1E4AD0F91A2A7D6949E1BFE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756096, "uuid": "086a4ec4-ab59-4e15-959e-52d7b1f9b48b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756096, "uuid": "5757d116-3fed-407d-8a63-fdf4772c3ff8", "value": "3072:86z9Jkn2xD8if0V/KEjsdb7wZzN8wBgxtgbY:1iAI/OdbcgxOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756096, "uuid": "19aefaba-59df-4e92-a053-939d4a6d6370", "value": 128000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756096, "uuid": "63162ca5-19d5-44d4-aa00-fe2face8d4e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756096, "uuid": "4b0b8332-368b-4261-9447-5c08e45e4b64", "value": "85db615d02f1cdbba1b5405a19c68e97bb8fa225cd9a2938a83481189dbcef7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f78aa1f-7783-11ee-8907-42010a9c0042", "comment": "Malware payload (RecordBreaker)", "timestamp": 1698711742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698711742, "uuid": "98a1397a-2b5c-4700-b7d8-c0926118447d", "comment": "Malware payload (RecordBreaker)", "value": "b6ccabc72c284a7f96216f6b0ccb19ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698711742, "uuid": "6d77fecb-3313-43a2-ad5f-ee1ba09352f0", "comment": "Malware payload (RecordBreaker)", "value": "86c7b824cb683acbf1f4f2b33a4422d2c607a94b2c010cb88cbc56255ee450c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698711742, "uuid": "c9320d70-6cba-4297-8a3e-e678e8c53748", "comment": "Malware payload (RecordBreaker)", "value": "fd38f6745b90e8309e4d2a9b733d18d3d94bab28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698711742, "uuid": "0b82b61b-e2a1-4882-8c05-20f803caf099", "comment": "Malware payload (RecordBreaker)", "value": "740ee1c8bd85c7813cee7d287fcd86584a43e72c4b9f143556cdb509b8ef03a8ecb2f2d3217bb555fde47bb2b79a25f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698711742, "uuid": "1ad0e234-2792-4db8-a319-1771f2c04f15", "value": "T156752301F6F88136DDF10FF01D7B23531B357C6A8DB55A172602E89E0DA26D9AD30B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698711742, "uuid": "32f30978-83ca-4449-bb9e-f72fd9769cbe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698711742, "uuid": "3095a8ae-929a-4006-83d4-b5e6aad165aa", "value": "49152:qwE8IneBZUHbW10fqTbwxLqL8dMpsI/QC6uE:XfZUHBqmbMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698711742, "uuid": "2c76b432-2d33-4885-b584-9a57b9c55e3f", "value": 1611264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698711742, "uuid": "dda2d5c9-0a4a-46f0-b57c-32d69ed084bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698711742, "uuid": "daccee8d-6221-43a0-b61d-26968f0fc1d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc440e4c-7818-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1698775812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698775812, "uuid": "a387e6c1-6764-44a2-b032-0da4c518e493", "comment": "Malware payload (Loki)", "value": "fc36cd1e8398a2a80c73adb216e1467f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698775812, "uuid": "746eae31-0736-41e8-ba81-6b3eb2ebf4b9", "comment": "Malware payload (Loki)", "value": "8711e0e6e3e5e0b15d2998e1a5cd6843d5e6778109b74d6c68679880318b3cd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698775812, "uuid": "b8f6c5ba-f728-4a07-b154-e0d6b6eb7fe5", "comment": "Malware payload (Loki)", "value": "8b23327b0cc9a846d4403a804a4ba510595072fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698775812, "uuid": "9271fbc7-7194-4881-b857-c1a3a07a7cdd", "comment": "Malware payload (Loki)", "value": "7a753fdee7570d41ab602094a0755ba002f6dc42e9b0e078738cde56f71f0a0ff717d7251ab21c461a47d36bd45cf32c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698775812, "uuid": "3262b191-b800-4293-a8b1-f8a02997db2c", "value": "T186C4AE9D3610B5DFC82BD876CA582C64EB61647B430FD603A06316ADAA0D9EBCF145F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698775812, "uuid": "ba899958-2ae7-43d5-8775-dcaa6394d4bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698775812, "uuid": "0332f85b-21bc-4daf-ba0c-6fd897918384", "value": "12288:axauTX2lSW6RuDUva8kXdB4/itMklPg4RIKE8NK0EIWDm4:CLj2l56RuDUgHfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698775812, "uuid": "658d521e-163d-4036-aa07-01b3f3af8eb5", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698775812, "uuid": "6aec0cd1-47fe-473e-9ecd-aa1d13c4ff2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698775812, "uuid": "d4190607-ca86-4c31-ad7c-7527a3a03fd7", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9f32e2-77bd-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698736727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736727, "uuid": "89aa640c-08e3-4c06-b76e-23bb6ffe799b", "comment": "Malware payload (AgentTesla)", "value": "f802b9252d3c1993f4505aca20e55dc2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736727, "uuid": "f94f6961-1441-457f-b594-f7ff3b6b4685", "comment": "Malware payload (AgentTesla)", "value": "876009c0e57c35f1e785f2a5e816b60de4fce166609a02cbaf06630e49691437", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736727, "uuid": "91795332-7ad6-409b-8110-5a7d627a1a16", "comment": "Malware payload (AgentTesla)", "value": "8818f9552eb8c4e3c93d375c01e5ebff48cafb5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736727, "uuid": "8467832f-429c-4c31-8d8d-e1bfa46acd7b", "comment": "Malware payload (AgentTesla)", "value": "21675edcd436e447c1fdc6359fca95bd4f07a19c8a68652c9781b39f2a51c9ca6121133d14898ceb422877d594bc47be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736727, "uuid": "14cb3175-9dd5-4326-bae0-5ca345865546", "value": "T136857207BA5689A1C1489F37C9FB041403A6EFA57253D68A358F33790D733BA5B4A327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736727, "uuid": "7f1da13c-1682-400b-b0a2-ddcfbe17647b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736727, "uuid": "6e3db9df-1e80-4029-9807-415a191ffa3e", "value": "24576:HkkOIET1cYz/4K5IKxUtUjw0AMGZLw7P71v7Wy5KQ4mwp:HWj5GFCWy5KQ4mK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698736727, "uuid": "9c383907-2025-4600-936b-a817d8bdc595", "value": 1863168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698736727, "uuid": "dbf465b7-5aea-423b-8e86-9e6d38791b3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736727, "uuid": "f69fb920-aafd-4db2-8eca-9d1c7bd77472", "value": "QUOTATION_OCTQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3858caa-77f7-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1698761678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761678, "uuid": "2e335139-89a0-4239-950b-447ecf09dc76", "comment": "Malware payload (Adware.Neoreklami)", "value": "fabac66cdcce4e3db3267fb1ea13c704", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761678, "uuid": "906993e0-e56c-4030-b66e-38e1f9ddaac2", "comment": "Malware payload (Adware.Neoreklami)", "value": "87799afb483bde6820c0a5423ad6a8a0daadc260bf9cb758d00b0c55afd6874f", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761678, "uuid": "ab5edf44-c941-4e5d-9990-6567bc89f680", "comment": "Malware payload (Adware.Neoreklami)", "value": "67bde4ce421e4d035329e970c7b5135a488254ee", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761678, "uuid": "69ab5a35-4430-4257-809d-9e08236e5e4e", "comment": "Malware payload (Adware.Neoreklami)", "value": "482d85d311108127f3f25e2562724ef85b698f6ef73a12270e27a75184e11fbfffddcb1734ff7f65e6639bca68968fbb", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698761678, "uuid": "0ba9b2ab-0081-4d81-a1f6-c344917388fd", "value": "T11A7633907CE69C7FD58B0776CC845FA8A3ACE2845430CEB397D4A75E3E788609599A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698761678, "uuid": "82d249ff-2210-44c9-ac22-b7bf1fb5788e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698761678, "uuid": "7b88c66f-f11a-4145-98d9-d725d5cd2084", "value": "196608:91O+4jkpHrfoXzqlgZLeXLIB6s5i2wIhaWUIlJ7D+r:3OVkpHr8qlgZCXLfs5aIhaWU47qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698761678, "uuid": "67870cd1-80eb-4d08-a830-178e97761e1d", "value": 7489891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698761678, "uuid": "0d1cf8ac-f531-4ecf-9a00-f810dc98dcc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698761678, "uuid": "51f458aa-0fe1-429c-806c-59a130569743", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388ad636-77bb-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735648, "uuid": "2e72af27-e6f5-4d41-a6b7-204505286a13", "comment": "Malware payload (AgentTesla)", "value": "dd6b06c295b4ce8a030efc7da5587efc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735648, "uuid": "a3933434-49be-4b2c-aafb-d9fa38984019", "comment": "Malware payload (AgentTesla)", "value": "87827fe80241a3ec5bfafe80fc4f7a3dba26f016ed2d3f61963140532f4c27fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735648, "uuid": "a50a0824-ed17-47f5-b6ca-20523fdd6652", "comment": "Malware payload (AgentTesla)", "value": "2f5aa7b862d452fad32a7b5446867278f6332f8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735648, "uuid": "d84da541-66f9-4d07-b787-0bb84a5a7468", "comment": "Malware payload (AgentTesla)", "value": "2754b90bcd94da9c770e22a668044507fb082cd40a61897448aa1c0636805d26838bd54218241683371c1706a4f92fab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735648, "uuid": "492df666-fa83-410f-9edc-d35efd55fa63", "value": "T11905E05366845986F93E233264B609FD03736E69CAB4DD1C18DDF06A4BF72523206F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735648, "uuid": "156452a6-3678-4af7-95b2-69a18f4fe0a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735648, "uuid": "7189df85-e7fe-4d69-9e91-11dc0b8efd53", "value": "12288:ecnAckjC824xTkY/uZxOLHQ7vET5SMA6TRh8hSc:jkeykzYCAzkgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735648, "uuid": "ed0876ea-282a-4ccf-80eb-6277b9d56a38", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735648, "uuid": "44e1d2ed-f2d9-4c98-a3cd-8136f345a727", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735648, "uuid": "22c3b88b-4be0-498c-a618-bed847c7d441", "value": "PO 0001200546_3082021816_00000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b276edf-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698735169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735169, "uuid": "6dabe0df-ff65-4bc8-9aea-43012fecd302", "comment": "Malware payload (Formbook)", "value": "837274cdaaba106edd958c9f51e4cfca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735169, "uuid": "aa02978a-cc51-4ae8-9eb5-0fdf07ccd08e", "comment": "Malware payload (Formbook)", "value": "87f10102a623e0a9e8f37e044736a264c8948c38685ff5d55750662010e09c5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735169, "uuid": "c6f8690e-b73d-4e4d-8fbe-9f366ae0671e", "comment": "Malware payload (Formbook)", "value": "e6001b6261e1ebdbd55eff9028015d76ab6690fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735169, "uuid": "2edea509-7af9-491b-af90-44a3cf6bbb7f", "comment": "Malware payload (Formbook)", "value": "a1c0943f4d72f93d296dc16b8c86a6c6fcdea3197198f34269249f5925c9bebadeac03ba5b6d9f21a890735f6457b500", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735169, "uuid": "4a336033-3c14-4554-b72b-a9fb3224f277", "value": "T101C423445398CFA1F8ADCBFF99F0407992F1E1171541FF2C8FA995D92DB1B821B22862", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735169, "uuid": "dea38f9e-bb3f-4c50-9627-45ab251a9048", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735169, "uuid": "a554f7eb-771d-4798-b754-8946b4bb5647", "value": "12288:yUR6NkoanXvNpyrQZaESRiGzKaD1yNn5NPB1ofvdkKrvJiQb:yUR6+5HSRRzKaD0D90fxhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735169, "uuid": "e40c748d-a988-46f8-9b43-30771cde61e5", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735169, "uuid": "94398b58-3c43-49f9-a3da-ae478ed8bf4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735169, "uuid": "964b0a41-1269-45f6-8e1d-29ac7acf4845", "value": "837274cdaaba106edd958c9f51e4cfca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde015af-780f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698771976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771976, "uuid": "89614203-8591-4c69-92a0-6637354902a3", "comment": "Malware payload", "value": "ca69314f346df9292818a9f56bedb3b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771976, "uuid": "5ae54689-be24-48bb-bd74-f005d956d4f0", "comment": "Malware payload", "value": "8901e289c92449e47212b5e6e948ee1d12e9d809af9026ea39834f595bc9f238", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771976, "uuid": "6aab4f93-9509-4a81-ad2d-eba8a985f575", "comment": "Malware payload", "value": "9a326668db5cad10552a6d8e9538666fb797813a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771976, "uuid": "3a970b2b-8686-42ed-8ec1-4e289284045d", "comment": "Malware payload", "value": "151529a8ad14337536915c154caa629418b7cdffd96b8a5bd1caa49795534c40cc6a13dfb7e4f2ff2bcf5f3d9cd1bc54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771976, "uuid": "1693ec87-b2fd-4e07-a947-4ec9a15855cc", "value": "T1AB749D19B7A54CF9EC72853D8D238946E7B27C110A71DA6F03A0425E9F2F790993BB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771976, "uuid": "11d74271-89a3-478c-aeaf-5fb9f0864a76", "value": "4beb0dcae5e6724f5845d7c7d4515e9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771976, "uuid": "de5f3e39-99e1-4daf-b530-456087b1f36a", "value": "6144:FuuRSnPC1Pw/HDyFIVvmohJkhW2ZEPYvAH0yvlgyJaUY:FfsCY7yRoaEPWAH0glt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698771976, "uuid": "190a8f16-eddd-4925-9897-352351cd4174", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698771976, "uuid": "cdef6d92-19c7-4d21-a525-90418a80abdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771976, "uuid": "d9e24c51-a60e-4bfe-8afa-36ec2dbede96", "value": "Houdsqrdsu.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9014efd2-782a-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698783469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783469, "uuid": "85f151a4-b92e-49cb-90fe-0a71a47d1456", "comment": "Malware payload (Mirai)", "value": "b790d300555fb23771a6b7276818bf85", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783469, "uuid": "049005a6-eab3-4319-94b8-171503d0ae20", "comment": "Malware payload (Mirai)", "value": "8920a083a474ef630490244f8dbdbc81341220430b4768252c87c5c239252b44", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783469, "uuid": "8b6d93fa-a099-4d14-96ce-27d75fd90f5a", "comment": "Malware payload (Mirai)", "value": "36290cb71b7df2c8dc04042638433cd606f26183", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783469, "uuid": "d9fc466a-96d6-40e6-a224-6905a79c0592", "comment": "Malware payload (Mirai)", "value": "c497c9115783b40f7702a0d8edb3d53f5b58631b4782a9d89939900239ce277244f031c8ca71311695d7736aa52c3263", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783469, "uuid": "e531f0dc-7008-4306-a498-6e8b9604d9e5", "value": "T16EC34B46F7404F13C4D6177ABAEF42453322A795A3DB730659286FB43F8666F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783469, "uuid": "b877ddb7-1407-4be9-bfa3-fc112863395a", "value": "3072:HmvwHfgLPR3bczUsNEopI0B67fmM/9wkvkcOQRmWXpAsV:HmvwH4DR3bcztNT67+M/9FvmWXpAsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698783469, "uuid": "fefaa39f-8326-441b-9acd-6d64e8ecdc9b", "value": 129356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698783469, "uuid": "546daa96-4129-4adb-9da9-1dc1ee4dd1a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783469, "uuid": "d7981516-4dae-4242-85f1-43904ac63ee3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214617ed-77d5-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698746776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746776, "uuid": "103e7a6a-044b-4fa4-8efa-97fb7793d453", "comment": "Malware payload (AgentTesla)", "value": "72f3a7ffa236f1954ee9dcfd2714ab83", "object_relation": "md5", "Tag": [ { "name": "agent-tesla", "colour": "#C55402", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746776, "uuid": "1d2eea19-e0aa-4c60-8dc1-ebc61d6d5d75", "comment": "Malware payload (AgentTesla)", "value": "8b4c89c1475ac69baaad56c92d5e72a149471886ff96e3de863a43230ebc9019", "object_relation": "sha256", "Tag": [ { "name": "agent-tesla", "colour": "#C55402", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746776, "uuid": "41f5c334-c815-43c1-8412-c7e97e1ff016", "comment": "Malware payload (AgentTesla)", "value": "1d565d08087483b9831d2c9c63953eb270ab0626", "object_relation": "sha1", "Tag": [ { "name": "agent-tesla", "colour": "#C55402", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746776, "uuid": "38aaa5e5-7a99-4d1e-8e0d-c86eac433cfa", "comment": "Malware payload (AgentTesla)", "value": "451dc71b6cb0bdba2b5083bbff8feeecf7b6eac450fca7071088f33790b7b1c22a9c21c57505b103ede122fdd9282ed2", "object_relation": "sha3-384", "Tag": [ { "name": "agent-tesla", "colour": "#C55402", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698746776, "uuid": "569c2009-f9c0-402b-9cb6-0c8e3e85b0c8", "value": "T1D33429566715D561CB6F637DC01A820831F1D703A72AD28F5AA1D8EA2F832CDF90BCE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698746776, "uuid": "997eb067-8796-470b-9eac-0794b4436d70", "value": "3072:smQBMs2ppXY1DVOYmynUviuEY6Qd/dskekJ9Unp/AmwSAMOfYo4BlzYpmR:sn1JOXoUxs0ykEJAmwlYZcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698746776, "uuid": "3d2bdf63-d9b3-41bb-b657-1883b32f5258", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698746776, "uuid": "c0b6c54c-b891-4455-82ba-66e23908f373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698746776, "uuid": "5f4e6ac6-19fd-41da-a04e-9beece0485a7", "value": "8b4c89c1475ac69baaad56c92d5e72a149471886ff96e3de863a43230ebc9019", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11afa20-7827-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698782290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698782290, "uuid": "29964928-29c7-4b52-a8ef-43e74efab032", "comment": "Malware payload", "value": "8bc1516039ff6f4e48087ae01613c98a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698782290, "uuid": "1c53724f-8e9f-4ced-a22d-71c2e6d9a805", "comment": "Malware payload", "value": "8b9a3a70b676420ce03d9e6fb4c61d8d5e1eb7d342bc64064e9410efd9f802f5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698782290, "uuid": "0c62e507-7b21-4693-8405-afa0403cd7fc", "comment": "Malware payload", "value": "09a1733f83af93bcc44f8f0ec4dc43d6c7256963", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698782290, "uuid": "1cc89c24-6eeb-40f3-a677-94ef351eb825", "comment": "Malware payload", "value": "72927021f3dd7941467925f19fa510b64ccc17f3776a98d005c1f0091a54cd1e313dc4984f644add20dec4f96e1891e8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698782290, "uuid": "c176630c-9818-4443-84f7-470e399f8cf9", "value": "T16BD42211A3FD5508FAF73F806DB5A2A84E26BCA6EDB9D2AD1250105E4A72F40DD70733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698782290, "uuid": "f952e200-6ff3-4135-a7b2-e88b45b494f0", "value": "3072:e8GOE2sZO+rPAeukQ9PiLdhp2t/D84ytZhkdbBQsl817hDVsl+13kyI2cH0u6/zR:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698782290, "uuid": "fb369928-40bb-4bc2-bdc7-dd39353ebb8a", "value": 635804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698782290, "uuid": "ae3bea4e-ecec-4cf5-9fef-07fce91b0bd6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698782290, "uuid": "9b6d7965-6677-463c-adb0-f29984e909a1", "value": "BHLV1269_1949030.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8008bcaf-77f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698761538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761538, "uuid": "bfdddca5-7821-4f3f-99c6-cd76b7d1e16b", "comment": "Malware payload", "value": "727ec30f8edc0d0679e8f8196cda468e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761538, "uuid": "180ebec7-977f-4662-8c23-0c307dfb4500", "comment": "Malware payload", "value": "8c586df63a081f22735de27cd5e1a27e4915109ec4b404c383a6e8fcdf76e9d2", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761538, "uuid": "9ba678f3-448e-4792-9e11-870d451d925a", "comment": "Malware payload", "value": "251db088ae6b7a47df084d5578583d44f5178cd4", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761538, "uuid": "c5780490-7aee-4d06-92f3-018fd5fe044d", "comment": "Malware payload", "value": "bd4f2cda7d1439f4fa87af925b8ddbead801d22c4664761fdd19902c30c0070c627dd0b048cf505a2066b337445c69dc", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698761538, "uuid": "7269ea70-e0dc-4f34-8975-ae9f001f2dcf", "value": "T11B836CF1EB9906190D4B26EAED024951C979C06D5623012AFFFE478E620799CD3BFB0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698761538, "uuid": "cfc6cfe7-e41d-475c-94e4-d6f499152db0", "value": "1536:D2XiB71SfEiIlfsPT7u3yDTBDPQyo72QoUlPolyrz47Ek6:CQ71Sqlfb3yDRPjo72QnlPmeko/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698761538, "uuid": "c74dd915-fbec-4f3d-9ba5-48ba040810c7", "value": 84903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698761538, "uuid": "b4696722-7ca1-44c7-b3eb-9a1a1a6f83a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698761538, "uuid": "042af88b-c2f7-4ab3-a407-5b8667f2de67", "value": "comanda 2836811 Joris Ide Romania 10_30_2023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3511bc41-77bb-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735642, "uuid": "11d387cb-9d3b-4bab-a401-7baf9bb14376", "comment": "Malware payload (AgentTesla)", "value": "d7d087c1e8140e13ce2f8bea162d0844", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735642, "uuid": "ae6986d2-5468-423f-8f89-fa64b7a1f2cf", "comment": "Malware payload (AgentTesla)", "value": "8d767518bdc0fda97fa2de2cb1ccfaf88f99bb98f5b9d3adfe625a658a37f77f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735642, "uuid": "990e1f20-c391-476f-af51-7a8f5cf242fc", "comment": "Malware payload (AgentTesla)", "value": "9f32406d5d6b52aba9a08607678a3e28be99c599", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735642, "uuid": "37697879-7dc4-4cd7-a0d8-ee33ae7bb69b", "comment": "Malware payload (AgentTesla)", "value": "fd8a0b275e14f674dcfa6421a1afd948f778c73ccc549df5ab8c81653e4fcf3a88f446c7aef8d74532441b783567a6c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735642, "uuid": "5adcbfaf-c525-47d8-ad3b-deae504da9a9", "value": "T134F4F19264955ADAFC5D1372647A0DEE03321E3ED6B0A91C589FF5278B732073212E1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735642, "uuid": "2ace19dc-d994-4ff4-9afd-511a94a415b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735642, "uuid": "6952ad64-021a-41d9-a407-451c65d77a46", "value": "12288:n725Bj/0MHZQ7Y5X0+x1Gozsi9JMpxUqkw2HGsae:C/0Mqix1xoiv2URw2Hha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735642, "uuid": "80827302-9a97-4f0b-8bde-e4bd70dce91a", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735642, "uuid": "c8bfe9ba-d7b2-46b7-aca7-d92ad3906f18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735642, "uuid": "d642d4cc-34fc-43b8-8056-ba0931065960", "value": "PO-002112023062700.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1856a4e9-77f0-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1698758357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698758357, "uuid": "be369228-6195-4887-8609-22f30413f503", "comment": "Malware payload (Loki)", "value": "5194268d39057ad0a44e72c6a816a21c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698758357, "uuid": "392b3e6f-531b-4305-b954-9ad42c6846e1", "comment": "Malware payload (Loki)", "value": "8e7100c354e0a53a58de3c7e3646997ebf0adaa17f39c4dd92139ebd06db4db8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698758357, "uuid": "768b2563-5e3a-4215-b9ef-f4fbd4d4c227", "comment": "Malware payload (Loki)", "value": "529584132f5d70dff34b2d29da6d19cb0624d848", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698758357, "uuid": "cf797991-2f20-453a-9da2-6a0bead3d28d", "comment": "Malware payload (Loki)", "value": "c6b0ddb164c0171defad2e0027fa741e3564b6b0852e56f2362fdab2e78ba4915be00fa9cb2c046063fc474b298a4f6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698758357, "uuid": "46109762-8e24-4483-9eee-c3654f7549b0", "value": "T143A4235166BCD7A2E0BCC7F021106604A3B3A637A150D7CD6F6AB0E7D933B914F912A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698758357, "uuid": "297ce5d6-b211-44a3-9e23-1c9e239273ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698758357, "uuid": "292c2cc3-d150-46fa-8343-c3e269e73901", "value": "12288:1noalx2/V+A1P7mcBLM38/WcicG75vvO4WMc:lE/V+A1aAOrwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698758357, "uuid": "f471147a-f104-47b7-a543-5d61371d9094", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698758357, "uuid": "56ba066b-2e49-4c0b-ac1f-246de9f1fb69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698758357, "uuid": "677fc922-5354-413f-9068-b7a0dd48eef1", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b440752-77d1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698745128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698745128, "uuid": "cea12ee9-349f-4f5f-9f06-bbfb443a25e4", "comment": "Malware payload (AgentTesla)", "value": "0e07fee26b2ab2f3cf908bc6bdb11661", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698745128, "uuid": "0dd97c06-3e11-4f38-95ec-9755d29bdcd4", "comment": "Malware payload (AgentTesla)", "value": "8e8d036b62e2c0dca98dd60db67f3d22f019a52fea426ef03fb3d94a3e335890", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698745128, "uuid": "3edeb439-62e9-4b9b-91e3-d1cf213bbfd3", "comment": "Malware payload (AgentTesla)", "value": "d5fbbc286bb91356206d48d69cd0ec22af70650a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698745128, "uuid": "98420999-d65e-440b-8277-945eaa7907de", "comment": "Malware payload (AgentTesla)", "value": "4307791a64272cfed0d42561ff23bcc84c59df3530ae02da9b52aec323a4d31855757a78ece3864f78346d04dc9c672d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698745128, "uuid": "71af60cf-227c-4986-8886-fab7e8fc018a", "value": "T15DD4235633D84743E3FD13F624752260B372E1576952EA5C4EEE3AC63932B824AB071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698745128, "uuid": "5b15f0cd-9654-4fc1-8bb2-5ea885b8e99d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698745128, "uuid": "6688e6f3-7f64-4eba-b81a-199215fa2327", "value": "12288:p6+5oa6VzAtoxMrUmIK1kplLRD/uaivsL25aOXbAqAxLqZW:ppqVsyxM/nwNHiyjO8qY+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698745128, "uuid": "dd11a534-92cb-4b8a-9aa0-0fbae4e73d89", "value": 603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698745128, "uuid": "4ed22034-f50c-4d16-8d37-e380d4f9ce13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698745128, "uuid": "07af147c-6962-45bd-a628-2eb0926dafa7", "value": "SecuriteInfo.com.Trojan.PackedNET.2504.29822.6974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488f1f6b-77f9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698762304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698762304, "uuid": "dad69d61-5312-48b2-ab5f-4246c39f3bd4", "comment": "Malware payload", "value": "8195a83f9dd8278423063c465b8dd465", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698762304, "uuid": "3d55d2f9-219a-431b-a3db-51e9af5213e1", "comment": "Malware payload", "value": "90b682a3adbc871fb82a5d29bf6e80c2091908e6d1bcd8976382c9925d9c4ee9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698762304, "uuid": "6d3ad839-699c-430b-8f55-76c2e51dfe55", "comment": "Malware payload", "value": "98118918124580379cef84f73229ab6fd985d2b5", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698762304, "uuid": "65582dc0-d884-424a-b121-3ef8254aced1", "comment": "Malware payload", "value": "53f0d0bb7e9ad4c7ad3b91e085838b579fd1a2c50c47e58c4e3f8308d952ea2e75f9c4476a815839658e5e7b824abbcd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698762304, "uuid": "0b89d28f-f2c6-451b-bc47-5abbe8da03ce", "value": "T1EA24346CD30F02A98F62637A9B270E4581BCB66EF34442B2346C533533EAD3D652667D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698762304, "uuid": "d37e8d0c-83cd-46a6-bfb9-df5ba3ab6e0d", "value": "768:9wAbZSibMX9gRWjzguc6fHZIqlsZw4QyP98hdtEHi3UnUe24+0wbPl:9wAlR+gujfHZJR4QyP98SyUnm4vKPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698762304, "uuid": "7e4090f2-93ab-4a24-9c0f-a4b32bfc2ebe", "value": 227083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698762304, "uuid": "5965fd0a-e6df-43a7-8692-b2b64207924e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698762304, "uuid": "0b323d3a-a4a8-4893-86df-5d2eddd72c39", "value": "TT Copy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bdc0ea-77d9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698748768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748768, "uuid": "2033f097-0e0b-478b-8838-7568d619a345", "comment": "Malware payload", "value": "1d11a0afd917b90e7c96bd306a6f8244", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748768, "uuid": "61dbce11-6a61-4748-8c8f-7960430c7727", "comment": "Malware payload", "value": "90d58c6089fab3af52343960c33110e0b812b9199e31f260fb769e2c2d5d2769", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748768, "uuid": "61fd2637-ed6c-4f15-8d3d-66a809ad8e3e", "comment": "Malware payload", "value": "492e7212e9df24f75c87dc9d9d4d25fd4fcd9adc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748768, "uuid": "52303b78-0925-4225-ae4f-7fd4f71b4c9e", "comment": "Malware payload", "value": "73eefda209187facb3635404e45fa1ccb2d9d87913ed6852b138460587e28cf221563902479194235b8657cdcec2b40d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748768, "uuid": "1ccef4bb-e448-4e92-8daf-8a756424d7cb", "value": "T157052204E11C596BC86449BA846B25207367FEF97270F785888DB2B67BF37C24423A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748768, "uuid": "598fdb00-7546-44f9-a410-b930507879ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748768, "uuid": "f2c20f98-d8fb-4c1a-a172-ebc0cc5092ec", "value": "24576:S4lXef+ifPfqoIWroAQVfndzppGAfCBYIgU/RYWx1uHU:S4lOZnqoIWrKfdV6SIgU/yCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698748768, "uuid": "474f68d2-ed4e-4289-be1e-6df98f47948b", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698748768, "uuid": "48edf636-2c9c-412b-b196-4675b3e3a6de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748768, "uuid": "fc03cc34-861c-421c-b628-ae8e22f446f2", "value": "SecuriteInfo.com.Trojan.PackedNET.2270.23697.26758", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a43769-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698735108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735108, "uuid": "f31d8a06-0abf-481b-bfec-16867a03d5c5", "comment": "Malware payload", "value": "13686d653785bb505bc5e9a43e283a24", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735108, "uuid": "d2bc1161-b67a-44ff-a4a3-a476b4df4aea", "comment": "Malware payload", "value": "911931f8a041556bd94acf546b2e462f9e9a3a77a4f537f5b117c3ae6a5f34b7", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735108, "uuid": "f35035d5-6cd0-4fce-81ce-793f32a589cc", "comment": "Malware payload", "value": "169691e050d23dcb9a8ad7989e4b301e20833905", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735108, "uuid": "a487ffe0-94a1-4c32-8201-6d4c1fd6fc3a", "comment": "Malware payload", "value": "41ee5ce01430a8c8d68e4fd828843998b929c8e86918fd1bdf7465ec2b1fd2de57445aafbe645d7727bfdbdb3c7a6319", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735108, "uuid": "796de035-c3b1-4a55-8de7-acdcca4f4470", "value": "T176B3E12EB255DC49D153997ECCC9C1DB63097C92AF50E60F35847B0E0A3E983839F69A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735108, "uuid": "9532e48f-7ecd-4ff8-8b04-158103af28a6", "value": "1536:vpQDeeL896pQDAy9OKt9+CdBVnZwOUm3uEiGTP2fV6y1YLUqLxXs9d8XU:yrOGKt0EdCO2XGTP2d6WYgsx87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735108, "uuid": "bde2c5e3-05f3-40fc-aa5d-adf73bfbbc7d", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735108, "uuid": "a6230823-aa2d-480a-8ce4-589a164f6088", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735108, "uuid": "66aee15a-52bd-4a25-b1d9-ce9e95116715", "value": "awb_dhl_shipping_documents_bl_invoice_0000000000000000000000.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a780ea4-782d-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698784695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698784695, "uuid": "5d47d303-cfe5-48d6-adb8-3610366ed316", "comment": "Malware payload (Mirai)", "value": "596c27b7bf354c2f31fef2e172740214", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698784695, "uuid": "4438d718-f583-4324-9270-facd625db43d", "comment": "Malware payload (Mirai)", "value": "914b1fd396717b02ad84afc8e3e9753a60d158f2961c7eefaa2a3954b51c77c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698784695, "uuid": "741b474c-7763-4942-bbc6-a3248b0aa619", "comment": "Malware payload (Mirai)", "value": "ab6dfdc25fb27bcf7bba24d1fd003cfbdd4362cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698784695, "uuid": "4d79be6b-5910-4943-8eb2-a6d542a98b7b", "comment": "Malware payload (Mirai)", "value": "9effe3e41fc5e9e1cc04d467fbd83ae4abe3308f4cf439987049db13f67aa75ac386172a4ab0c1e963ed081cf8371c58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698784695, "uuid": "5a2d50e9-94e1-4510-8dca-90e0e1f0f6a0", "value": "T186237EC9E583E9F9ED4B09751473A7328773E47A1069C647D3E8C831E8D2A11A71B38D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698784695, "uuid": "896adc1c-b1d6-40fc-b1cb-190b58dfe6a0", "value": "768:vUOu9AiCB+BgNSjcTOsRG/zgEGxCIHKZC4mn118CyzSmrIIV:8Ou9AiCB+cksRE23HKMTn156Sm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698784695, "uuid": "de0b573b-3a3d-4011-9adb-bd3e50d58cb2", "value": 47084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698784695, "uuid": "6851e7bb-9114-4cd6-878d-023b8623fed0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698784695, "uuid": "02bf3b8b-1d4d-4563-88a5-9ac9f9f1b632", "value": "596c27b7bf354c2f31fef2e172740214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8bd113f-77db-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698749714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749714, "uuid": "10a5937d-d8d4-4041-a0d0-af19b24fcfbb", "comment": "Malware payload", "value": "012c4ae4763d43173a489103d44e4133", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749714, "uuid": "c9d8ff0d-1455-4bc9-ab38-c136e0807fa1", "comment": "Malware payload", "value": "9171f5713f2e4653d1da40e8b8d3946208baf056a601106cfb054e71a0f21f3a", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749714, "uuid": "5876cfb1-05df-4ce7-82d0-7d6d0ef81cc4", "comment": "Malware payload", "value": "ce8674d98d95ea6b9557f034895c71fe99030db2", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749714, "uuid": "688c1bcf-473b-41d0-b469-ca55a5ec7c62", "comment": "Malware payload", "value": "d30e3ab2b0d6e3ad844c722a6095ebff79c650abdff4c62234b3578d27953df20ac984a7670707da9f84dbaea2958fd7", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749714, "uuid": "0cbbe46e-e718-4231-81ca-9acb7b950781", "value": "T12B54230326D8FBAEB8BBF35414A5990468397A2B70B2C637DCEB53A375DEA8C4175005", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749714, "uuid": "7a834979-7dc5-418e-b008-9a1d5665724a", "value": "6144:KTde146Y9u5jIV7iVcFyQTXZvkdtnUztSAe2XOIJN/vKUanWEsvZU0:+A14HveVonLedUtUe3hH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698749714, "uuid": "41ce3c8d-7670-4940-b0a8-1b18f8bd9e6b", "value": 286555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698749714, "uuid": "49ed587d-f9e5-4b69-9ded-ab5a5082142f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749714, "uuid": "b567fc01-639e-4ab4-93d2-a879d41f1698", "value": "nCIMB-Transfer_Advice-202310301849809.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169af2eb-7792-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698717982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698717982, "uuid": "3d8b51dc-fdc1-4af2-8f55-850214fa3b3e", "comment": "Malware payload (AgentTesla)", "value": "95ef971ad0bbdace8a049b8b59ddd0e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698717982, "uuid": "99889064-1786-4b11-9cf3-d3d180f01fd4", "comment": "Malware payload (AgentTesla)", "value": "917f30ee59de50efe5fc8d75c7efd730a79adc56587b4be1b40e5e77628a4c25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698717982, "uuid": "a9b4c884-f22e-4f20-b492-67ad6ad2e8fc", "comment": "Malware payload (AgentTesla)", "value": "f301c9fcb28c592d95708c939b796727ba191135", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698717982, "uuid": "4c6d3f64-845f-4fa2-b810-c1ad7610bfbd", "comment": "Malware payload (AgentTesla)", "value": "ca4d09b63704076f2abee623930504531439572af691934fd28176b3b5cefb5abf94fc87e0ae5602203ae7cf4e611384", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698717982, "uuid": "b6a3066d-0e90-42e4-9209-0e51ae5074a4", "value": "T15AD39C526BEA2108B1F7BA88593A11344F2B7DD66D7DD54E05CC2A4D0BF3EC4C860BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698717982, "uuid": "59ef5607-1f1e-4171-87d0-c70a60ad6e6c", "value": "1536:F+PEWEse4Mi3mI2hb7KZ18C2NGkikGkFjGkikGkKEt0eEKU+kCKGWGPrbrbTDDpZ:qEWEseBQFJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698717982, "uuid": "9554a4ae-a134-4fa1-9515-ceef617b31fc", "value": 140582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698717982, "uuid": "c1cbca0a-1761-47f2-941e-51ee6eff4b65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698717982, "uuid": "dd70b92e-14de-4f9f-af3a-d331988ac94c", "value": "MSS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ffe0a3-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735488, "uuid": "c998541a-7a0f-473f-a7de-a24c4f644321", "comment": "Malware payload (AgentTesla)", "value": "823a024a35863be3ce633af52378339c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735488, "uuid": "1b638954-6be5-4ff5-963c-a2d7cedfaa5b", "comment": "Malware payload (AgentTesla)", "value": "930628856bda7b54dd4f3a317ef80c4211bca5937eb5445ed656d037d9995159", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735488, "uuid": "5ddc36c9-7e04-4309-b907-101587dbc282", "comment": "Malware payload (AgentTesla)", "value": "ba3e7397b05bd0f93af4c44d4ce390e4dd33cd2e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735488, "uuid": "bdafa1b1-c39c-467e-9ffb-5a90f2a3a631", "comment": "Malware payload (AgentTesla)", "value": "56a92dc938a3a4ad1eff7d3d814901b3bbee006ff684ae9584939738b0672e06a2eb6f9e7687ccbee829ffb7861235bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735488, "uuid": "4b971cdb-2493-4b08-b31f-e201e68bda3c", "value": "T17115016221985E9AFC2D137364770EEE07326D3ACAB1B81D18AEF1369733357211691F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735488, "uuid": "21c0eed1-d8ee-4894-99bc-39f407fa0d22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735488, "uuid": "2cd087f9-5b6b-43b9-aa34-c87b578765a2", "value": "24576:CD2KgYO1Y+vsEqx84b4GAn4uqKAhZaISOHA3H:UDgDkx9RuqK+xg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735488, "uuid": "c7a5ece5-0c00-4488-8667-bfa9f742adfd", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735488, "uuid": "a178d207-3c14-41bc-aaa4-48ea8b50d4f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735488, "uuid": "ef9ae0db-a42c-4d43-b367-20c4b5e0ce3e", "value": "OR\u0130J\u0130NAL FATURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b49875d-77cf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698744243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744243, "uuid": "479352fc-5bc6-4d7a-a030-e44a08db02a0", "comment": "Malware payload", "value": "b2a7a96f201d5e53f0f2644360da5489", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744243, "uuid": "4ea21fbe-e5ab-4649-aaeb-3e70e6f1d0dc", "comment": "Malware payload", "value": "93907bf6f7e6eb636875cdc82225b3ca0c6abc09ece7d28009c59455c67a4208", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744243, "uuid": "6a33efb7-d8e9-4494-8929-9451570b775a", "comment": "Malware payload", "value": "bee6e6312a653502f44d1c24f0ef02b7bc7d1117", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744243, "uuid": "93d3eb40-bd74-4ae8-9ab4-a40434ea0a0e", "comment": "Malware payload", "value": "2b9c1faf8483fd14f22e7aaa39d5733969ce56a6d39852878b31ad1551af9d906219f330354fb2085c5f7225fd81ed4c", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744243, "uuid": "8af7bed2-1ecd-437c-b2a4-a0aa9ed285c6", "value": "T1DF330275D116E015D758CCB4E2B0BA3B85538A86F33DDE5102A3EF911852DBDCCFA864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744243, "uuid": "e496ddb1-2411-4c57-8be6-ab2445191722", "value": "768:oAZWoxV53DgO9EeA+/pwhROzxyUxoU6ClurfPIiUr+ShfzzK4NAki9ceKYZ4p3tW:7DBDgO9FG0xonfPk+S9K4li9rKzp3tW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698744243, "uuid": "58d4c34e-d798-48f2-b4da-8865c34756c5", "value": 54861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698744243, "uuid": "66cae301-21cb-40e6-80d4-dac2e75a6eeb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744243, "uuid": "b70d4089-eaa8-4f9b-a9f8-5d5f56e02524", "value": "Accusamusb.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1956c622-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698735166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735166, "uuid": "e1b54229-7bcd-4d62-a3db-19901156742c", "comment": "Malware payload (Formbook)", "value": "3f7c59a688a73d9704c15205f34e1bac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735166, "uuid": "6249a373-364d-4231-9aeb-5fc0a936a5df", "comment": "Malware payload (Formbook)", "value": "93bc82b99ec0339576f7f93e026ee2dc33b8bdddd99b2addca44e5cbde6b59f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735166, "uuid": "2b59bbc3-6393-4b39-9f04-43795bd4d14d", "comment": "Malware payload (Formbook)", "value": "9e3979419c30f94fb592eae817aa7e2efa2a0600", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735166, "uuid": "3aece7a9-1874-472f-b3fa-37d8acb6e43c", "comment": "Malware payload (Formbook)", "value": "a5197350ecd71b4b623685a18d0d2d9daa8df1a70faf946aeb7b10403d3c39d90304d44d5f3f028d37ad55a06d3f767a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735166, "uuid": "b2b5a23a-3710-4793-82fb-08672d0cc494", "value": "T16FC4235867BD87B1E5A417BA04B45860AB75A2993385FF8C8E92F4C73C327D18F349A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735166, "uuid": "2e21bd36-e510-451e-8322-e00aff1136b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735166, "uuid": "5fad2415-0a4b-468d-9225-15832a7a64f4", "value": "12288:hUR6loapZDYjR5YLhcRQwI5kMyIWXJ8qeGp4ubvZ53GXp96P:hUR61ZDwR5QhcRIHy758qeNgz3GXp9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735166, "uuid": "daf5cb84-b4a9-49b6-8d80-bdcb82bad9ff", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735166, "uuid": "44270b81-f865-4442-a72c-9fc02a1aaa10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735166, "uuid": "591e1b43-1875-454b-8ade-bfe0e5ec557e", "value": "order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8383da0-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735540, "uuid": "27a2cbe8-5032-47fc-a819-8a1899052af0", "comment": "Malware payload (AgentTesla)", "value": "87728aa9f6d161675351dd438f333a6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735540, "uuid": "bc137821-56a4-425f-aebd-f1f1f0927675", "comment": "Malware payload (AgentTesla)", "value": "93ccb93c0d4d00bee268e1e2f39b96ef4b768db84926b5feed1393769eeed364", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735540, "uuid": "9e083c10-397f-4288-9c0f-b422e6561f57", "comment": "Malware payload (AgentTesla)", "value": "02ba1b6c4ada9b70df6a9d48151f2d403c93a331", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735540, "uuid": "ce6bc3f1-606f-46cd-aaea-f8ff0bf1b2d7", "comment": "Malware payload (AgentTesla)", "value": "0a8469c731ea2ac00f48679043ed5ec3415defbca4fb88706d7be6c1adb37230c824175c87805e760bebbdcffd72abe3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735540, "uuid": "15bc165c-68d7-4d1b-a901-ef634f79a073", "value": "T1B115F1A271A84A96F82D1372543A48DD0B322D3FD170D95D78AEF57A47B23432613E3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735540, "uuid": "a819f0ba-1bd0-41c4-9708-4ca3568c5abb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735540, "uuid": "6e15b486-7a2e-485a-a5f1-433a28f1b880", "value": "12288:jP0WWObW5YS65XUvxj/rVVo+HyzuCTVjn2sMTvVRVpY4ASpDCkpzyJZMhkOl:jc4YMCBVwCCxn2HTd7LAeDLpbCOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735540, "uuid": "c6f64ace-986a-4a86-b98a-b9744a27b52a", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735540, "uuid": "95015d3a-2684-49ee-884e-f573f7fd9844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735540, "uuid": "ccdcc3eb-a99c-4365-b730-0a4cabae636e", "value": "Butiran pembayaran.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f090dc-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735028, "uuid": "5e698d7b-14eb-4e49-a306-c247356e04bf", "comment": "Malware payload (AgentTesla)", "value": "15718d2036b08f48bd5ecd1b6e794ded", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735028, "uuid": "d205fb75-c734-4774-9eca-62d310fcd66f", "comment": "Malware payload (AgentTesla)", "value": "945bdf4b4ac938292ee9ff46c4e4eac0968474a7f271fb95db622a92f157c600", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735028, "uuid": "cbcf8c0e-b5cc-447a-aaac-ebc62f8cadf6", "comment": "Malware payload (AgentTesla)", "value": "640d49b3d0031f9dea13bb663987a74aa4cbc00c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735028, "uuid": "47297dff-8f7e-421c-bbf6-4cb2ac09ca9e", "comment": "Malware payload (AgentTesla)", "value": "a61703559a1c563440ee3ec1045a7590d4fd175feced4417773bf874c294b8146aa5f94c841c728b66bfa06874679e92", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735028, "uuid": "9c549ad4-c549-4061-a5aa-7693ae9798a6", "value": "T1C5336CA1EE951A1F4D4B27CDEC87494181FC805909366165FEED038EA20B9BCD37EB1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735028, "uuid": "a447c8f6-1047-44f6-a83f-712dd55fde29", "value": "768:YVFvVWgTiysED1FPWD1GppLBai+UDVb0j40P9hn3X3z8DXEw9tCC3t6AiFj0:arcXE3PI1GppLBaIytF5HIDXj9tCBFj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735028, "uuid": "7b6e05f9-3d0b-4f37-8835-a0269205d43e", "value": 53039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735028, "uuid": "860765d6-f1ca-4828-aa49-52c2a453250e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735028, "uuid": "27555f44-61b2-4186-9bb8-b8ce902125be", "value": "RFQ20231031_Commercial list.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e63a950-77d1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698745134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698745134, "uuid": "49a954c1-5ee0-47aa-90dc-8a524a96d571", "comment": "Malware payload (AgentTesla)", "value": "446dbeddb22e177aebf5bd96ce97bab4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698745134, "uuid": "b904ff11-68c6-48d3-8cdf-95a43091e6f1", "comment": "Malware payload (AgentTesla)", "value": "94618324cca3d7ec27d313d07ace47ecff68327fc88ae4e0db363e0bedf5ab37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698745134, "uuid": "fec2ebe1-005d-4f33-b8ae-b4f2862d395d", "comment": "Malware payload (AgentTesla)", "value": "5c7462f1d4765952a3688f8f11d015320ef19e77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698745134, "uuid": "af2ff748-c144-49d2-8a9b-ce580345c0f2", "comment": "Malware payload (AgentTesla)", "value": "a881a029bd100642200a10d85833f25adb0bd13add09ee322e38eea3c5012a1b479c37d0a9f3d9e9a4b3a82a3069da7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698745134, "uuid": "37aad8c1-73f8-4805-afb1-943dc74ae8d4", "value": "T1B6C4235E50CAB2ACE4ED990082930B27B306D1B9A497950EAB18D33BC15F05EFFD6C5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698745134, "uuid": "e4bf371a-4d04-4188-acb6-51fd8e4eee4c", "value": "12288:1h879MXLhCdYSbkW/7Qv5EVmiGYw9V530GHBW5rtn5s9tAyQiAIpf:1S79M7sdYSZpVmiGP9VN6rtWtAfiAI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698745134, "uuid": "c742bf32-c14a-49e8-90ac-55ca28144729", "value": 564164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698745134, "uuid": "9b21e7c9-91b8-4f32-8f4e-c6bf5439d7ed", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698745134, "uuid": "c98d8437-3a90-45ac-b93e-9a3a996de715", "value": "TT PAYMENT COPY - 10.31.2023.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19aad331-77eb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698756212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756212, "uuid": "23f1f71b-ecd0-4f2f-9fbf-05d51bbd5135", "comment": "Malware payload", "value": "b2e6aa6cacb0147941378b0796d863a7", "object_relation": "md5", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "ponteiro", "colour": "#D6B254", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756212, "uuid": "4a495d2b-1715-4366-b9b9-3853c52433bd", "comment": "Malware payload", "value": "960cca582fb015e413a8a78de706dc08ad20682c3438c603f81d39d07d48b1ee", "object_relation": "sha256", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "ponteiro", "colour": "#D6B254", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756212, "uuid": "8875c2d6-9a16-410e-9a83-98fcaab76e0d", "comment": "Malware payload", "value": "c8d9a333f18e1089665c2c2c845188ef3805eb49", "object_relation": "sha1", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "ponteiro", "colour": "#D6B254", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756212, "uuid": "c891acf6-9560-4e05-86a7-cb7464d4bbdf", "comment": "Malware payload", "value": "3d6568c17d78006dd7f8e6f4ab5afd099b54aa5c8bc911a7034cf349b349dea332369def438bcac0550cf849a6e3e831", "object_relation": "sha3-384", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "ponteiro", "colour": "#D6B254", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756212, "uuid": "ffe8b2a2-7f4a-4667-8e66-ecdbc94bee79", "value": "T13CB633B705407EC3E27693BB7C3288458811A9739B062635F0AF2AE5818256DCFF9F65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756212, "uuid": "f703dc30-63f9-4ee4-ab50-7955f8635523", "value": "476b15968756d899aa88d020bdd81681", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756212, "uuid": "83064d1c-27c3-4bac-9695-c5713fc2a25a", "value": "196608:16bGcz3J9gM2gjJusWvw+On/NWsVWCcJbWk+Ah2GYwXvTy0P0Q9X0RhS:4yczDb9usWvw+4NgbVh2GR20spn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756212, "uuid": "f84b08f5-d8b0-45dd-b3d0-a972df9223b0", "value": 10467840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756212, "uuid": "e622ef27-0d61-430d-847f-9da8afe0232b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756212, "uuid": "0a160733-149a-4df9-b9bd-1f682cec28af", "value": "__semqhn7_Q2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f6c93b-7827-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698782298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698782298, "uuid": "dc1033d9-7f30-4f93-b725-1efa17a0d8f5", "comment": "Malware payload", "value": "a2e2da4033a7080a9b5d3fa24d150a8e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698782298, "uuid": "de44ad18-ec0e-4d83-b583-aa3051eed05c", "comment": "Malware payload", "value": "968593a6e89a4498ec0a56643dde91dc2412a9e2344c0b97a79af38b1ef26727", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698782298, "uuid": "134cf309-7c22-4eac-a078-57db955bac5b", "comment": "Malware payload", "value": "285433bc8135b46f468fb6d0c374c482b164e938", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698782298, "uuid": "acc93b63-6b59-4e0b-a5b9-18fec2aeb39d", "comment": "Malware payload", "value": "1584f67683c5e138c737b8e64833b06c2f5f03701790559a7509f90c4cf91658ea72cd189b91857da70a7851771b7ea9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698782298, "uuid": "4c58afb3-be3d-47fe-a701-c505f86500a4", "value": "T1BF444211A3FD5608F6F73F846DB552680E36BCA6ADB9D2AD1260105E4AB2F40DD70B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698782298, "uuid": "e2b614ac-45e4-4d52-b4a3-c161b3528b4e", "value": "1536:JNiN4YlrlHqsDNgJqQAXq8+8EYYZPPnvqgu0V2OkHKFl8OBlaGLsAX5dYiTlSQpP:uNbqsCQ9B5qqF7Wl8xap7Htn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698782298, "uuid": "2a17e0de-6313-486c-8062-a5e8c23aa236", "value": 276628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698782298, "uuid": "6d73aa44-85b8-46ff-a6e2-85f3700fe801", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698782298, "uuid": "22a59728-047d-4e18-8619-f0a4453c09b0", "value": "NQRX0468_5871143.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d56f53b8-77ea-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698756098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756098, "uuid": "aa781ae6-2d77-441e-9f69-400037539b4d", "comment": "Malware payload (AgentTesla)", "value": "afa104ed35b42a2c1e2bd39c5598f682", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756098, "uuid": "60fb2345-53e1-430e-8ccf-a6b3dbdbbba6", "comment": "Malware payload (AgentTesla)", "value": "9805cd71abcb329f3de9145eb2be4b2f08a5b90ef450f3cad5bf9a31c2fa6668", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756098, "uuid": "afed0f20-5ca4-47a6-9582-5e4735426cf8", "comment": "Malware payload (AgentTesla)", "value": "908444bde33be786e0baca01176892d51b5ad323", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756098, "uuid": "4995d76f-fe95-4266-b6c4-ff0d19a4bf84", "comment": "Malware payload (AgentTesla)", "value": "cccba953b66c42a84daaed078ac37bef7e2e69edb866009a14e67fbd3561709fbe54299c0e2d9da0f86fb3f756903e7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756098, "uuid": "d008298a-4beb-4163-97a8-af14a2887070", "value": "T12D340E037E48EB15E5A83E3782EF6C2413B2B4C71633C60B6F49AF6624516425D7EB2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756098, "uuid": "88aeafe4-9d36-416b-b56d-2b9839cca2d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756098, "uuid": "edb592b9-c590-4b5a-a11e-68973a7c52ea", "value": "3072:ve0WjLLTjgup+NDyzeiYojNfozlpY5BCUiCDK:ve0WjLLTjgup+NIeiYojNAf1Uiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756098, "uuid": "a8796c34-0058-420a-80fa-758d6930ec33", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756098, "uuid": "2e342c6c-6d68-4d0e-a618-17bfdbf03a25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756098, "uuid": "65b9f361-9557-4827-8fda-553825684dc3", "value": "9805cd71abcb329f3de9145eb2be4b2f08a5b90ef450f3cad5bf9a31c2fa6668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939267e4-782a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698783475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783475, "uuid": "d2a1ce9c-10b6-4ce7-93a2-d7a02b7c76bb", "comment": "Malware payload", "value": "7204b8382c72222a5e51d32411458fa2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783475, "uuid": "d9340815-307c-4e45-9349-9ea0fc44ca8d", "comment": "Malware payload", "value": "990277d35031d6c90e4a367d6eb32b34cbfd135336c7f7267b23e613da25a39e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783475, "uuid": "13728f09-582b-4a5e-a69e-6e51aee8306c", "comment": "Malware payload", "value": "7a1ff0430bff4d3f646069d08b730e54d8dcca26", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783475, "uuid": "1d24af0e-17d5-49ec-82cb-c7694749e479", "comment": "Malware payload", "value": "452a1d782a10a8a425ae43216f9afd07256fe940b4ffa6ae44dc80d25ae3b11e457878b78943438164679949b451b180", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783475, "uuid": "7c6f47e5-8fe6-479f-9410-00f04ffb48b0", "value": "T18E73A71E7E258FEDF799823447B78E216A5823C637E1D2C5D29CD6012E6024E241FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783475, "uuid": "952dd6bc-723c-4b0d-9c48-776888faac5e", "value": "1536:qztcPRFA6olzssw4BOIVX9lDU8uDO++MbobAzwbFa10H:qC8nw4BOI9mDO++8zU8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698783475, "uuid": "0e541db7-37c1-4c22-94bf-c7bf627321bf", "value": 73596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698783475, "uuid": "effb70ca-7f2c-4b6a-b50a-338de599bcb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783475, "uuid": "95c50847-eb1d-408d-8eac-7a25c279ae7a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0987d6ab-77bf-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1698737287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737287, "uuid": "f1ac8724-e1b8-467a-808c-571e21ddddff", "comment": "Malware payload (MysticStealer)", "value": "82af68b7d8a6c38d4af745fadce70c91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737287, "uuid": "0724b2ae-ad4d-4189-803b-3583c5c6a234", "comment": "Malware payload (MysticStealer)", "value": "9908ac2e698eb862feb4e5e8c39b543827b7cbbe46671eb96a09646bde912776", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737287, "uuid": "33e9fcd7-bd36-49e9-9db5-0e92e71e5617", "comment": "Malware payload (MysticStealer)", "value": "68228cd21df03c39fa2be95efa46de5d588857c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737287, "uuid": "14c7c700-813e-439b-9736-1e0db7cd9189", "comment": "Malware payload (MysticStealer)", "value": "ad4bacb3f75dfd872a54ff6a83ad2ad5ff172d7f221fa22ff6b16d62db84914896e737ca07f48bbd829d42af8ffced60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737287, "uuid": "1d7328e9-6c95-446f-a81b-303a885b1724", "value": "T1EF35AE2279C080B5DDE221F643EDB63A426EE5B4071A46DF06D8DBEED7502C12F33696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737287, "uuid": "0f693bf4-f48c-4efe-ad29-6e302fcb4dc3", "value": "b6874b762c445425cfcea5128380cca5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737287, "uuid": "2aa929da-e934-48cc-96e7-18e5d6190a5f", "value": "12288:RY680KNJKYmtww5o7a0dY71Wa+8/SSE2IZHMPfrWqgVu+CHlNgoeHI+xGW81FQ/Q:Rexmtww5o7a0dmT5/SzZgqo3eHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737287, "uuid": "82a31534-1be7-461e-805a-794aca2932bd", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737287, "uuid": "8974558f-28bf-4dd2-af05-b4d8bf2175a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737287, "uuid": "93abcd84-3a18-4f66-9443-2ba759bbd6e4", "value": "82af68b7d8a6c38d4af745fadce70c91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae760485-77ec-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698756891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756891, "uuid": "572fe8bb-a3aa-47dd-9e34-4aed3a8816df", "comment": "Malware payload", "value": "09bd26a99940619b261eb7dc030e2861", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756891, "uuid": "f4870592-766c-40b7-a4e0-f69b38f185f0", "comment": "Malware payload", "value": "99fe3099044a3933d4018dee43aefbc5ae8f5b720a34e0562453f95fa70732ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756891, "uuid": "ab71c96d-0d40-47a7-9f66-17eef542e010", "comment": "Malware payload", "value": "dc52919e7220a9e10d90e4eff86f92b6b8997006", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756891, "uuid": "4d660e85-7ab5-4226-8d9a-ae77c28aa2b6", "comment": "Malware payload", "value": "a4d665e152aaca074690ebc75dd1190a9b3b06b6a1aae7904793b4f2d8c71027b8073be75222f1b9525514db2abcc537", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756891, "uuid": "a2cd57e8-34f8-4dc2-91b0-d5b81a903547", "value": "T14BD423803ADC8789E5B847F425E8966097346207E436FB8DCDE6B4D02A73B125EF2D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756891, "uuid": "b1b3663a-3144-421a-acad-20c50c978f0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756891, "uuid": "ffdc4d43-cfc8-4e8d-b78a-ab01d6fca5d8", "value": "12288:gFZpoaQPpr4GnZmPSN8zvbf8eYDsDieQrKs5wChctSjR1:g/QF4GnZmPVQeYsWjrZp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756891, "uuid": "26c8b227-3416-4012-bc0f-deb2f586753b", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756891, "uuid": "73732363-bf59-4643-925d-ac5fab42a1a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756891, "uuid": "0ba3e27b-4aba-4466-9e7e-b3fc1342b85d", "value": "SecuriteInfo.com.Trojan.PackedNET.2504.9862.28760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52ea50d-77be-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698737173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737173, "uuid": "d46ff6f9-696a-4cd1-9e74-2b5e7c2372b7", "comment": "Malware payload (RedLineStealer)", "value": "563018f931d4cb02add9f7013a7a4a4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737173, "uuid": "7bb69b5c-fb21-41dd-be4c-05ce717aafe7", "comment": "Malware payload (RedLineStealer)", "value": "9a2c37acab79076d98161a87c94c3c0ff08ab04313692591bf49cab9490d316f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737173, "uuid": "da8ad843-ac00-4d2c-ad73-415d847e89b2", "comment": "Malware payload (RedLineStealer)", "value": "7b283cb74791aae908a1586e9480b68cc780f6a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737173, "uuid": "8116e1da-c8e3-42b9-bba1-9346a6b80cac", "comment": "Malware payload (RedLineStealer)", "value": "b643ae7a75966bbe099f69ca0e85a2eb9d4f0c2ea19a69b67be834eedc3dd68e7728bc58971f295dcfeb4686257e192f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737173, "uuid": "acf5db38-678e-4673-9dee-33c7a0f36f69", "value": "T10665230365E440B3E9A8173055FF02D307317DA49A7195EB2B6A994F5C722A8BB307FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737173, "uuid": "acc0bcbe-b096-45c6-99a3-98797c702ad3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737173, "uuid": "748498fb-60a7-4087-bae4-49feafcb246a", "value": "24576:CyuJPPdZwk5EUGarK8XlvueLrkKpFtaAVXDd1oMstYbt2W2EeMk2cbjS:pSUkiYK8XlvueMMFsA1Dd1nt2Qeqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737173, "uuid": "d01293ab-090a-49af-ac7d-6b8db923bfe7", "value": 1532416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737173, "uuid": "6a1646b3-1ec1-4d4b-8aae-1a5fe48648f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737173, "uuid": "0d32bd7a-cd36-4024-a5d7-9e0e3f25a112", "value": "563018f931d4cb02add9f7013a7a4a4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829dc860-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735343, "uuid": "6e7260b8-db71-4fe5-b782-5bdfd150e8fb", "comment": "Malware payload (AgentTesla)", "value": "0559a1c04aa7e219d2d0aa1655546716", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735343, "uuid": "1177e7d6-f01b-4a64-a941-dcbacaf8a460", "comment": "Malware payload (AgentTesla)", "value": "9b871256215e2a8004870f93bbc5b017558df414023e01234db08498a9693929", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735343, "uuid": "7c7303a0-f6de-4942-ae77-61d8ad820553", "comment": "Malware payload (AgentTesla)", "value": "ef17c2aa3c1eb79d7e3efe14a17ee2cf4b3efa3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735343, "uuid": "5cdf767a-d21b-4d9d-85cb-36a27aeba356", "comment": "Malware payload (AgentTesla)", "value": "9c545bbb12f84a04b3443846cfa1fdff9d39372bfb24bd2837196070f0372deac5f382fb928e037a72797de1ae3e5d7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735343, "uuid": "a456f635-864a-4014-9e42-0c8f9aaa29f2", "value": "T11F740D1A76785132ED04CB3459F79E11C2D7EE9C6BE1961A24C8B66D1B322FE8F035C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735343, "uuid": "49fad893-1c37-431c-8ff0-4ac1e4ebf187", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735343, "uuid": "666badff-50ad-477c-b6b9-f1cbe78886e3", "value": "768:QMPrNPj4smDU4VeY1W5qD2HQg2ZzEjss2VSg1I1cn0sspAgpq8hLyg1uMN0+dzsw:HrNGI4VeZJQ7qPpqOLy0uyL+fQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735343, "uuid": "cf8ec3fa-835c-4216-8b62-3cb953f8e35d", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735343, "uuid": "94631b61-a18a-4c67-b1ae-8c548ccffbe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735343, "uuid": "68e5f533-05d1-4187-9ec4-f6e5efc6f789", "value": "Scanned Draft Payment Copy\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a1c95f-77bc-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698736200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736200, "uuid": "7f7030f9-8b45-4cf6-9f6f-c23b1d59fce5", "comment": "Malware payload (Amadey)", "value": "b6d627dcf04d04889b1f01a14ec12405", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736200, "uuid": "99318e03-4b70-4191-827c-41ff39f82fe9", "comment": "Malware payload (Amadey)", "value": "9da10d7b75c589f06f1758ed8e3c0335b9a738d0ad1317c48e380bca768bdddf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736200, "uuid": "5cb12e00-f666-48fa-bb62-1558ee32a07a", "comment": "Malware payload (Amadey)", "value": "f7292c3d6f2003947cc5455b41df5f8fbd14df14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736200, "uuid": "415651e3-1854-4f63-9552-781b84793de6", "comment": "Malware payload (Amadey)", "value": "20d7961d3804a0e5d28e2159b9d50666af98fbd7f576b543b51f87552031105fcad063fc13f6b1aba325cf375ab21d36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736200, "uuid": "ead0a2df-f796-404a-ba97-9b8057c6fcbc", "value": "T1EF642A517912C032D56061B21AB5BFF2C59D6C199BB04AEF6BC00E76DA212E3BD70F39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736200, "uuid": "5a290cdf-ee9c-4648-89f1-cdf4fd066ec6", "value": "f722e751a647e22fa4d7e966bdaa4f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736200, "uuid": "19f7af2e-f4bb-4213-94fb-fe9901960c39", "value": "6144:G77rhGafhHSBwHRqGJbdbZI44SGe4s8Lu67rvAOveiZavLb:G7rRSSHRnJfIrscu67TZhavL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698736200, "uuid": "31a9242d-9343-46c7-a2ec-e2cd98d40fcb", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698736200, "uuid": "8ba40593-b8bf-43fd-b5f6-6ae479c180d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736200, "uuid": "c8d1186e-1da9-4264-97b2-e8fefff8e2d5", "value": "b6d627dcf04d04889b1f01a14ec12405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e158fdca-780a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698769862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769862, "uuid": "5fa3a9d1-15ce-484f-8cf4-d1ff2428338f", "comment": "Malware payload", "value": "4f2510a2da82bfda58dcd40beef0b2eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769862, "uuid": "1837dc11-0d7d-42dd-89e0-fc3d55288816", "comment": "Malware payload", "value": "9e16c1446bb651d105fc3291e3cd797088d5b09440cb7e5000797de2e30a10ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769862, "uuid": "2f26edbb-de9a-430a-9ea3-9f29b6a2144e", "comment": "Malware payload", "value": "84364dafd10296d0c583cb16b175709af10c346e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769862, "uuid": "ffbf3042-a79b-4a10-8e27-665f69ad5b6e", "comment": "Malware payload", "value": "183c7dfc6d426c0bba5dad12ced748877c4b1fb56947bb839f3c79b84afa0cf8733cbba11ecfabd088d875e15fbfa4e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769862, "uuid": "cb09c906-c374-4458-be70-bf0ac2d768b2", "value": "T1D1551220F3F12609E0E666B24E74A7D01B7234167A22E35BDC84E155387CBE78DD4B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769862, "uuid": "66132b27-ad4d-42ab-8b44-5d92cf4b42d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769862, "uuid": "2f2ddf97-3a34-4b78-88c4-c5b8b8d885d4", "value": "24576:lgPMxjCfZv7Bq26G7xGAtEva4F0fcIUDPHn+TYi69bIz80/7b2jA8vT:rxeZv745G7Ahao0ffUDHWYJ5u/2jA8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698769862, "uuid": "a715aa39-54b4-4adb-8cb7-14147db8daae", "value": 1392016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698769862, "uuid": "9be3a674-e096-4008-aab7-59d236b7faa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769862, "uuid": "a542840a-bcda-4219-a61d-6a08774d1b0f", "value": "SecuriteInfo.com.Win32.PWSX-gen.20464.10847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a9af69-77cd-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1698743421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698743421, "uuid": "db2e83fd-564d-4ee1-a16e-1cc0f7aaa705", "comment": "Malware payload (DCRat)", "value": "10000a1461d64eea6e78ced2f4207929", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698743421, "uuid": "8f8e2a3c-a336-4444-9e3a-567259f4471e", "comment": "Malware payload (DCRat)", "value": "9f347c914c997f24d2a7418724e18599ec7c3b830f354d4fd5f78cfaec376fdf", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698743421, "uuid": "8ce4a7c4-9b1c-449c-9fa2-1f781253bd03", "comment": "Malware payload (DCRat)", "value": "0da597596cbd75dcdb66580ce886716bae231be9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698743421, "uuid": "154710e9-4dda-4e22-87a9-42b3d78b828d", "comment": "Malware payload (DCRat)", "value": "5c7a3b4d5979d1885b83053c3994877359e22b183cb400abff94ba652931434def5d503db0198de90f4a5f1921d530aa", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698743421, "uuid": "0a59833e-83a6-4f22-9f93-2e1ad7c59293", "value": "T1FB759D01BE44CE41F0191633C3EFA54987B0995166E6E32B7DBA37AE55123AB3C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698743421, "uuid": "3f330e89-f5f2-4b59-becd-8b6517e568ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698743421, "uuid": "7feb22b3-78c6-49e5-8487-cd144be1f782", "value": "49152:/fB964hl6mu9Ah3dFbHoLWFpOAN6SmiPS:nBY4homndFTBpvN6SJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698743421, "uuid": "e8015b0f-7d00-44b0-bd58-c0e9c694818c", "value": 1640448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698743421, "uuid": "8dcb288c-3a2b-4236-ad4d-6d7d079f84f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698743421, "uuid": "b8f9f75d-7c30-4166-a0bd-6257550382b8", "value": "10000a1461d64eea6e78ced2f4207929.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f905bc63-77be-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698737260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737260, "uuid": "f8baad6a-742b-404e-af32-e169823b6f0e", "comment": "Malware payload (Smoke Loader)", "value": "e524d6f64b9f0991a71f0d6d16d6d3aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737260, "uuid": "37219b42-5645-44f2-b75f-c98bf2bce4a9", "comment": "Malware payload (Smoke Loader)", "value": "a0fb82956fd995bbf4eb8191a05fc2b297d86b7861498e8087db14031be28902", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737260, "uuid": "9b4935df-e5aa-4813-92ec-7ef9fbdf378d", "comment": "Malware payload (Smoke Loader)", "value": "3c8e7e9cacf42d3bcf4dc28f487c38a178d6e200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737260, "uuid": "94ade56e-70c2-479c-86b1-168c1276cade", "comment": "Malware payload (Smoke Loader)", "value": "1ac854b1fba1950922efd87f197baa817716cc8cabb829f64145de6fd07d2b1a2ad93d2fafcdfe3b6fc1bfe4a9580cd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737260, "uuid": "8530accb-a331-45d8-8310-5b3bde7dd891", "value": "T17F158D2178C09576EDE220B783ECBA3643ADE4B407154ADF06D85BEED7606C13B37686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737260, "uuid": "e99b077e-53cc-44bc-83d5-9004b8be9b2e", "value": "b6874b762c445425cfcea5128380cca5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737260, "uuid": "d2aad30c-4300-4b19-b64b-e306117e1887", "value": "12288:KxzSmtwUJo7a0d0Fry0+8/GSEYIZHcJfxWqg1u+CH1/A:Kx2mtwUJo7a0dAP5/GxZ8q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737260, "uuid": "9d5adce7-be76-4eef-a6fa-d5a59734518d", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737260, "uuid": "10a2fc16-a52c-4039-8167-0e070b391317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737260, "uuid": "90048c66-97b6-4a0c-9581-2ee905ebf488", "value": "e524d6f64b9f0991a71f0d6d16d6d3aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af934f89-77ec-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698756893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756893, "uuid": "6259cf71-1c88-49b8-8a8d-df03cd89b368", "comment": "Malware payload (Stealc)", "value": "da7445c8881a286bbb427fa5854f8e79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756893, "uuid": "7bcf87c5-e50d-4c52-a533-373eb73e27b5", "comment": "Malware payload (Stealc)", "value": "a217dee30587e692a690bb7dbb8a43c77deb9dcff2522930c0b0f40d76f168b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756893, "uuid": "43b082fd-afe7-4a9c-a60d-288787f827c3", "comment": "Malware payload (Stealc)", "value": "bbe113b28ce76adbed21fb018848aba8a574fbca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756893, "uuid": "34807af6-788c-48ac-97f0-8bc28b5e0db4", "comment": "Malware payload (Stealc)", "value": "e11b2ae30e8648d69d6a3b664da8472059bffc06a5ad37720b6f8860dac6cae3d27f4c7e6471fe2230e4eabc0263f8a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756893, "uuid": "e2809742-2bdf-4aed-accc-ed92b664a40a", "value": "T10F24291393A13C94F9268B329F2FDBE8364EF5E38E597B6812599B1F04B10B2D163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756893, "uuid": "8f050cae-a522-4a3d-b8e9-b8e42fd2d2a2", "value": "e0361317ba2ada8e7d47765f45f5ca50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756893, "uuid": "b98805a3-4b7c-4ec7-b2e9-0f98db1f9389", "value": "3072:pGT2UBSmePZRsM6QyGFbGf2WXWgAiBONUc:q2UBSdPZRsvG2X8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756893, "uuid": "ad0d9fc8-8df9-42c9-8cd8-c6689d261067", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756893, "uuid": "54e1d431-732f-4be0-af3d-bfe60c1c58bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756893, "uuid": "f9842d38-9492-4584-b0ff-a29edec251ec", "value": "SecuriteInfo.com.Win32.PWSX-gen.31328.3622", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b5fe7a-77d0-11ee-8907-42010a9c0042", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1698744955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744955, "uuid": "b647efe7-53f3-4428-a351-86f5ef028b2b", "comment": "Malware payload (ArkeiStealer)", "value": "908ffa6f05e09995c1d3d51b08ccaa89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744955, "uuid": "122a2afc-87eb-4501-9ce1-8d87b7ac2fcf", "comment": "Malware payload (ArkeiStealer)", "value": "a59c57c65a4949bf1c9fd39f269cbdcfe500ea6842133dab9a2a4a979a7733d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744955, "uuid": "5b744aab-6e82-43e9-8ad3-5aba100b70b1", "comment": "Malware payload (ArkeiStealer)", "value": "2af025ccad729840e4c3fc7a3fb74d8ded669524", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744955, "uuid": "29a64790-6a76-4c34-b2dd-24024860f59c", "comment": "Malware payload (ArkeiStealer)", "value": "b88356ec60ecf799db0bfa0e7b0efb3480729a64533e7bab651e0248125158bfc57b73fdfd70c78d6adfb5fa09f32627", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744955, "uuid": "f81971e8-bd88-4598-9e23-171db4378b93", "value": "T127648D5383A13D95F9328B729F2EDBE8368EF5D38E59376912589A2F04B10B2C173711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744955, "uuid": "2b2d4a11-480d-4808-91b6-ae6ffbe857aa", "value": "9def1d395ceead157211a16b89467252", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744955, "uuid": "ccdc8249-247a-4681-816f-a5295752296e", "value": "6144:hsOuK0FCTrDVeM90fgwMisk6o0gUU8SqEic0W:hSDCnDrX9kL58vw0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698744955, "uuid": "8aa2530c-0f56-4362-84f5-676f6229675a", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698744955, "uuid": "668c4c7c-62a4-4357-b4c7-c556b0de8183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744955, "uuid": "08a35313-0445-46de-b75a-cb4b6bf46956", "value": "908ffa6f05e09995c1d3d51b08ccaa89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786a03d8-77b6-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkCloud)", "timestamp": 1698733608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698733608, "uuid": "88fcf7ee-ccfe-4bc4-bfeb-42cfcb676ddc", "comment": "Malware payload (DarkCloud)", "value": "f856ee7a50d2adf9a3ad99f6ffc53ce8", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698733608, "uuid": "da162b4b-c460-4768-bedb-aaee30451e60", "comment": "Malware payload (DarkCloud)", "value": "a64aeadba6cf7ac29c6688d904cd6a9bd5d37285b44f8de3b5980d2a18aad42b", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698733608, "uuid": "b491a7ad-2db4-4112-91df-684b6f40dd66", "comment": "Malware payload (DarkCloud)", "value": "9d689115405aa966109e8d8ad02e412e3da2180e", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698733608, "uuid": "d15dc771-5ed9-47b0-b040-18909c04ce4d", "comment": "Malware payload (DarkCloud)", "value": "e92af74450f2d971f4c3a87f9e0fc227211e918e369f30996e8e3085303c584b80c70d6f48025026e68541c936a0cf2e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698733608, "uuid": "8454fe8b-6015-4788-a7a6-52bf5b1d93c7", "value": "T1F32533F030DD46B5E186A1D257FCC9D42BD5C391113281EEEEAA0A11FB0DEA8BD584F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698733608, "uuid": "dd999980-24ea-4aa2-bc1b-911a0a8b895c", "value": "24576:yCT94698aZj0OScvUf9MTfGT/3dU9cazdnmV/F8:h9BSa1a5TGBdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698733608, "uuid": "f7d2538e-1247-42c0-80ac-a809463498aa", "value": 962451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698733608, "uuid": "d3690dee-7667-4dc2-9967-ac19c4a36618", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698733608, "uuid": "7b85d65f-625e-4c5b-867c-68c5c270061d", "value": "shipping document.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f7a27e-782a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698783472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783472, "uuid": "5cdf5926-2903-4bc2-85b9-b6a3504011ee", "comment": "Malware payload", "value": "3d236399931ff9a02630e3f5d2d86d93", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783472, "uuid": "7209ca4d-d133-4a13-8947-149f48959dbb", "comment": "Malware payload", "value": "a674ffedecc09d938f6788e8eba36c85d6ebfaa5ab134682ced4ffa8c037935b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783472, "uuid": "e8eb6175-b01c-4fe3-bac4-ae14dc3037a6", "comment": "Malware payload", "value": "70ab993a481d62b15b8a9c0cd94f38137a287cfa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783472, "uuid": "1306b736-cedb-4b7c-9b74-017dd87d07d3", "comment": "Malware payload", "value": "0b56c2eebda9839d9bdd2fe437ff45bc84beca5a3659ef2db5ebf02f630647f70b9be01cb676ac6bf6871cadd253ad0e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783472, "uuid": "6cef46e1-4091-4545-a7bb-d581b0b55ea8", "value": "T103433A85B8829A22C5D112BBFA6E458C372927E8E3DF32079D212F6177C681F0D77E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783472, "uuid": "e18dbac9-2985-4020-9d2e-822d90e87fe2", "value": "768:4A8wNc2CYaS9JuQIKHQ/P/32ptuTgpYP3LDTIOspAQ9JG8b7aPYz4ji448H2lDZc:UwIYaeJuQvy/mggpwGzSvH3wa10v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698783472, "uuid": "3a91ae4b-324e-431f-af90-266a4e3c3cac", "value": 56796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698783472, "uuid": "ae2f9884-9d78-4479-bf98-fee2e136fc93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783472, "uuid": "fd867e7e-9dff-4af7-9f36-8e99a7820c64", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebaeb9ce-77f3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698760000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760000, "uuid": "79b458e3-8850-4765-94d8-0b0cc6c2e337", "comment": "Malware payload", "value": "f9dd3b38f480ee16e6c53a9e341ab8d0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760000, "uuid": "571b30fc-750f-4754-a6d6-48ae2aac54e3", "comment": "Malware payload", "value": "a68251fcf8ec1df85858e470c782a49128493bd0ca2728dc048d061946d077bc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760000, "uuid": "e53d313c-43b6-441b-97f0-d64a5a5718eb", "comment": "Malware payload", "value": "1507cf0553210ef5918b2067e6b523664eceb013", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760000, "uuid": "86413eae-9161-42c9-b8b6-7f7b46d80db0", "comment": "Malware payload", "value": "872dbb3854a6ead603464bd459adbe57c11fc1e51680aa09e50da5dede6ecdfd17f9a6ab62db96a9dedd2330bcf6807c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760000, "uuid": "663e49eb-afc3-4add-9d85-c02985bdf4d5", "value": "T1FDE53335B124396C35AB2B282ADFE52BE78FC452B87EDD77285010CCB06A7397255CC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760000, "uuid": "cb3d0ff4-138b-446f-a7e5-a8dd5a47bc71", "value": "49152:48wSijQi6AGO9jT3awzsNWIcPA0x78/CMHOOY+UbJfM9mUyRfvL8pPv+M+x:48wSi2OdrawzsYIcPA2o6MG+UqAfveQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698760000, "uuid": "ef2e4bd8-8785-4d75-8886-7b20128eff15", "value": 3071212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698760000, "uuid": "bf19f426-5802-4fcb-93cd-b5e665500e81", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760000, "uuid": "ab16b1d8-484f-4db5-b4aa-92d41e495aca", "value": "NATURGY-FACTUR-A4-TLLTK_ES30102023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a37719-7789-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698714170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698714170, "uuid": "508eca1f-bb76-4715-908c-4010757108d8", "comment": "Malware payload (AgentTesla)", "value": "7e83a988cc539272660a95c85aa13c18", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698714170, "uuid": "d5be0eb6-84d1-4ca0-a083-75b1d8a9a358", "comment": "Malware payload (AgentTesla)", "value": "a68fd4d0e8032ad28e14cdad06feb36b0d6acd3df31db249770ce1c5a72f1704", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698714170, "uuid": "9e52c0c6-3813-4b7b-a98d-de3ba271917e", "comment": "Malware payload (AgentTesla)", "value": "7fd244738ee06b8f08dbeba98aef7676bf18f634", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698714170, "uuid": "bb6dab3a-c9dc-41e1-8bd3-b3d186e6d140", "comment": "Malware payload (AgentTesla)", "value": "9609f6d64b646c2d3b500cfc764061f4082f86036b43a91547d7b5362972ec7c942ad6b517578558a3a57c2da1097b84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698714170, "uuid": "c1dca821-5f46-4f2a-a746-f3480a191d97", "value": "T1FE741345BBE40247E63BA9704D3783E072B2F6251936F6178DA9E04CB8764B5D7C2AF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698714170, "uuid": "a5973470-4f3c-460f-bf7d-bd46a8e6a165", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698714170, "uuid": "6cb3ec97-5142-414b-83ff-e51510cb41b3", "value": "6144:XY7JxlvMKb2EB5GRyTq1e6oxbMlw/g9lxvy33sFpmHNoK9K5gpqCIqT81:XYdvMmB5GQTqwbMl8g9lxa0pu9KVCIiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698714170, "uuid": "7cf12125-e730-4b0b-aa3d-43b738b61dc8", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698714170, "uuid": "fe653e9a-5635-4d3d-8c13-cfa04b4ef019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698714170, "uuid": "11913159-73a2-469e-a71c-cdbecfa86dfe", "value": "SecuriteInfo.com.Win32.PWSX-gen.14475.22136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f314f15-77cf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698744330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744330, "uuid": "1e0c17f5-e9e2-42e5-899f-b981e7b2259b", "comment": "Malware payload", "value": "df6b07da720aa2f74a0e9c3d78dce288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744330, "uuid": "1980d006-d871-4c5b-afcf-d012d407f459", "comment": "Malware payload", "value": "a80eb6783410fe462b0a5d41dc5d2066782898608a64ffbac36b8954252871cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744330, "uuid": "917b48c1-8d2b-4382-819d-9c05b166c1d4", "comment": "Malware payload", "value": "97b5d94db5ff1a974b87736d3c5228d7a862c62a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744330, "uuid": "71d58a14-b59f-4eff-94ae-1f1f42721a55", "comment": "Malware payload", "value": "9ca202598a44776d6fe082e6cacd5232a69fb13faf58c86c95a37f1351c1ec7e2df0275f3e758caf055699c874383373", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744330, "uuid": "4c546280-ee21-4765-b3d0-5bbb8bb60a54", "value": "T1D1338FD7991540A2CCA7827A49632F6A77B4F37803707FF719B618AD0EE23E41DA8345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744330, "uuid": "e9069db3-13cf-4c66-8a28-2f0792f41fb4", "value": "285a182ea92ff1dd6ec059012bcc5297", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744330, "uuid": "f2fbce9d-e46f-454b-bdea-7d7e055a0f98", "value": "768:uoA8M2J9op5DOeUc/bYHtJNdegKdk+r2Or3hRb:uj8M2J9oTOeUc/bYPNiDXr3hRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698744330, "uuid": "992fbbf1-1d8a-4e28-a412-34b9f8de476e", "value": 54184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698744330, "uuid": "e21dfd89-b8be-44a8-9df1-9875c4b77113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744330, "uuid": "76f509dd-1376-4a91-9682-077f73da221a", "value": "a80eb6783410fe462b0a5d41dc5d2066782898608a64ffbac36b8954252871cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420e85e9-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698735235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735235, "uuid": "9cc3e67a-6109-4e56-a685-b772dc60c332", "comment": "Malware payload (SnakeKeylogger)", "value": "df9d5f4dd7b35e1288a6a0e07a98062f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735235, "uuid": "48981fce-55fd-4f3f-8e17-85524da4fe53", "comment": "Malware payload (SnakeKeylogger)", "value": "a84acc5fbe08df8a0f7439ee0b595b43c7ddaaac6c4b9927932807fb69294b14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735235, "uuid": "3c31235a-416e-4b66-ad07-1b2fef7443fd", "comment": "Malware payload (SnakeKeylogger)", "value": "5b020e8de129627a692a4ef05037a5f9ce5b325f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735235, "uuid": "bb4d53ea-a097-4591-b713-21da0f4827fb", "comment": "Malware payload (SnakeKeylogger)", "value": "6d66f7a476101f1af3d936eb31d02969fee0c55f2700b2e507f88f114103adfb1ef4d41e6648236422a89d09566a97ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735235, "uuid": "3770ceff-f038-4c41-b9d2-ca23cfacbfaf", "value": "T108B41200FA950F03E858C6BAB9B202707376901E72B6DB9CB8C561CBC7D3B658761B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735235, "uuid": "29c6f21b-563e-40a3-ab8e-b92a2d867c9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735235, "uuid": "5ffa3bfa-9a9a-48d4-a2af-6273b602f52a", "value": "12288:w8K69yqL+/jcidCDkudyLR5Cbm16RR6iXNVxhPlEAZfnWab:A6Xi/vUQudE3CCkwiXhLHZ/bb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735235, "uuid": "e56cd5af-3797-452f-8281-965a59bd780d", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735235, "uuid": "95ae2877-e6d8-4d47-982a-e76259355087", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735235, "uuid": "276a169f-a151-40b9-accd-8867bd2eb576", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d594449f-783a-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698790458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698790458, "uuid": "e705dad1-3bd7-4f51-9020-011f45d3b143", "comment": "Malware payload (Stealc)", "value": "962bd34194db7bd93d52f6dadf591826", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698790458, "uuid": "37646717-3e3d-45db-a42b-729f463eab28", "comment": "Malware payload (Stealc)", "value": "a964494510ab39940fe01c9a1f6c5277033afe32949af8fcc49a20686bd1051e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698790458, "uuid": "dae2d085-90b7-4e65-8d45-fb2d4769a876", "comment": "Malware payload (Stealc)", "value": "e39521887013d72f4944f668af576d039a34f483", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698790458, "uuid": "3f495a25-29e5-426e-b64a-9f4980ed2d50", "comment": "Malware payload (Stealc)", "value": "ce41c5735ee07fcfc28b4c36133e5fbd8011a8bc85939095f90a28e8a36462749a2d5d1907f5d6e0056abe45c5d56f6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698790458, "uuid": "75169a4c-e9ad-4d75-b5a8-dc2dd9458dab", "value": "T126045C03A3E13D55F9264B329F2ED1E8761EF551CEEA77EA32189A2F04B00B2D163751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698790458, "uuid": "efbda805-6bdd-4fe0-8e64-43bc5f8919b0", "value": "da9f25ea3031e9a563d04b4d7ccee4d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698790458, "uuid": "853462fd-83df-496c-8635-e1f6931e9c32", "value": "3072:Tz4+NndYZt4nTWazc16ooZqMJ0XwKF6596I:n4ondYETU6/0AD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698790458, "uuid": "0dd3c5af-399d-498a-afac-4daeaf4af8b4", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698790458, "uuid": "6a3c6183-e50a-461a-99a8-b63c85a329c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698790458, "uuid": "dbbd1c89-236c-4148-a0fd-c3a08aae63ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4246dadd-77cf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698744254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744254, "uuid": "da611d64-a986-4dd6-aaf8-09f965f157d7", "comment": "Malware payload", "value": "ab24d779475992266e657c048294944f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744254, "uuid": "9b1c4498-2241-4d00-b936-3604aef04ca1", "comment": "Malware payload", "value": "a9c49ae83be5c3148dc8532b72cbabe232ff1efe3514f5b674510de2a0537282", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744254, "uuid": "39f0e589-b0c3-4c62-bc4b-adeb79829224", "comment": "Malware payload", "value": "42816a86c1876cf438d41ec0c028c0706edc581b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698744254, "uuid": "d371e547-567c-44d9-a0a5-f3ec7a5d6cec", "comment": "Malware payload", "value": "6ecdd81bd0c0aa4b986fb51ffb6649a88c62c93cb6cb89f1e8ee2a9d50e33307fee3ae9623aeddd8f4bb52d351bd9247", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744254, "uuid": "dbba8e01-fb82-4269-81c1-4a618d80e561", "value": "T1AC25E07238C9C63ED317A372481DB29D62FDA2904E720A1776EC076E5F785C3A7109A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744254, "uuid": "f10b6bc6-7e37-40fe-9e7c-44305e17dd03", "value": "94bcc5b724063dcec05deb3baa7201e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744254, "uuid": "250f2877-476f-4e4c-a2e5-00292f1fcfdd", "value": "24576:YTDiWW14O1Pt6H3v3x106r7bbNmyfQ4cTk15Wt:BWW1VPt6H/3b06bF715", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698744254, "uuid": "5fa9778f-dee6-41c0-9de3-f0f54779517b", "value": 1037462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698744254, "uuid": "d61a248d-58f2-4a86-acba-1258c25d18f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698744254, "uuid": "126e7ccc-6dfa-492d-b898-1db6ab01683f", "value": "LC.sct", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60592066-781f-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1698778665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698778665, "uuid": "1478047a-3f67-460c-b721-d33c153b1f0b", "comment": "Malware payload (Adware.Neoreklami)", "value": "f621e8f38dff3d36f286a3cda7096e52", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698778665, "uuid": "b26adc00-77a2-459f-9a0e-f4f36daa1f8d", "comment": "Malware payload (Adware.Neoreklami)", "value": "ac015ea80a2d51922711029ac5f52a40af4163f548734754fe2cf399581decac", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698778665, "uuid": "b3ee9181-a47b-4b6b-aab5-c1c35d925d21", "comment": "Malware payload (Adware.Neoreklami)", "value": "08c695ebf684cfa0388852fa6017443952a41b24", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698778665, "uuid": "6f2acb74-658c-4ff5-9229-e65f34c0cd8a", "comment": "Malware payload (Adware.Neoreklami)", "value": "ab85238e551c1d48999359611c3fe35330a590a6b643769f13bcc2a5074e5a273498a4a0253ed5eb70dbfef513d631c8", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698778665, "uuid": "c1815ff5-a944-4281-be8b-a9fa692baf09", "value": "T18076331635F7D03CC1A7B13A9E956E0129B5DFE45F21082733954B189EFA3E1B22327A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698778665, "uuid": "addded9e-15aa-4f8c-920c-1bcce5a4ba20", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698778665, "uuid": "24203024-6d0e-4424-8dbd-30fcf1d81db1", "value": "196608:91OyqPSSBSG+2UjbsVzWIwONGVulZNqQiQn0miMsr+bI6:3OcSs92zFwr4lZNvLFI+c6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698778665, "uuid": "333d2f84-c4dd-4dab-b2b4-7139b21f2daf", "value": 7486514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698778665, "uuid": "91ab8aa4-f30d-4120-9f45-55be39d89370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698778665, "uuid": "e0dea418-6b8d-4af3-ae52-9264e22cd711", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9cd0b7e-77bd-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698736724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736724, "uuid": "782e2df6-7f36-47de-935b-80e952c8f484", "comment": "Malware payload (AgentTesla)", "value": "62b7dd1cb39af2e49e22ff4ecda14d11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ORDER LIST_OCTQTRFA00541", "colour": "#6529A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736724, "uuid": "016040aa-794c-406a-b29c-500449a6f0e9", "comment": "Malware payload (AgentTesla)", "value": "acbce39ea0f0ca874ad07ab64e37e29cde34ee5c9e875e29c278812a327229c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ORDER LIST_OCTQTRFA00541", "colour": "#6529A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736724, "uuid": "8f43d7d1-992a-4eb6-92ce-d22f5ac79ccc", "comment": "Malware payload (AgentTesla)", "value": "8c252523692a9e9a80d99e9f1c4778d83e05dfb5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ORDER LIST_OCTQTRFA00541", "colour": "#6529A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736724, "uuid": "cba7a900-0915-4b3f-a337-444b1eab7402", "comment": "Malware payload (AgentTesla)", "value": "2b04f6720bbc146d4837e48c6a43954edc7a3dfcd553de0598864b05be7622923b132d11b420ecaa39c04ce5e77e801b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ORDER LIST_OCTQTRFA00541", "colour": "#6529A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736724, "uuid": "a8c96de5-830c-422a-a4d5-1028f5eb6648", "value": "T19795941376AE85A2C3497733C5E7050407A3EF696363D60A2D8B3319397B7BA6B45323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736724, "uuid": "2a2cc6d1-1138-46d1-9e5f-a78d4d7a9635", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736724, "uuid": "3347ce83-0df2-4aee-aef5-8a08b9541fce", "value": "12288:1Fvtu3bwY45/17/X0cI8NlYjGGPmlWAMGERordGqqKhi9/pwhVNQrWWGfj1K/pek:kbV4jAf8AaGPsdM/pw8WWuQpbwhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698736724, "uuid": "8e3957b6-b1f5-47b3-bd68-d7f68ecf63d8", "value": 1984512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698736724, "uuid": "01eda87c-3b2f-4bd3-bff7-96dae657238e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736724, "uuid": "2d2a9df4-c4ca-40de-8f50-8ec20aa3939b", "value": "ORDER LIST_OCTQTRFA00541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35eafd59-7823-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698780311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780311, "uuid": "8d6e3180-c72b-4543-8af0-0e2db111e2c9", "comment": "Malware payload", "value": "bcbcc797dfb4a60a963eca6c5c0857e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780311, "uuid": "df2040ae-48f0-412a-99a5-9fca74957dca", "comment": "Malware payload", "value": "ae896b0c135765a64919beb413500428c8cb6de3be56c19b15a707f15b094626", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780311, "uuid": "c275709e-360c-4e4c-a475-d46b7816ae34", "comment": "Malware payload", "value": "8eaa723f7bcfc8ada2f98d55f61c105bead08502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780311, "uuid": "7e2e0308-1445-492d-81a5-8d1aca037d05", "comment": "Malware payload", "value": "d9519ad86fa42a9a87b95e8086b0365aaa5dcb12f2cb34035ab01337c969f147c8bd2ad33f030cb66eb4b84cccc9af8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780311, "uuid": "f7fcc5ae-e1bd-4f5e-a8f7-4b6281ce1a88", "value": "T1A915073D58B8223FC3F4FE518A5A5A16F1C0637B32996C38B6B32565431250EF9C693E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780311, "uuid": "23ac1309-b301-4a6a-9633-3e189e455ddd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780311, "uuid": "520972b0-0f1b-4989-addf-fb48746e6acc", "value": "12288:VWAtf9FyGuQyb0HWjoRlks+KS1AiSSxpc/auSnoXdYAW4GE9nsbgIdX2i:/tf93qYHBgKtauSSddGE9ns1dX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698780311, "uuid": "6b002fda-08bc-429a-a4a0-e1abffe0deed", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698780311, "uuid": "b1c31d3e-9e4e-40f3-b1b0-e4b62e14bdd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780311, "uuid": "46461432-a6c7-4c2e-ad0e-fab90ee84a5b", "value": "SecuriteInfo.com.Trojan.PackedNET.389.8162.2877", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36223b2-782a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698783636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783636, "uuid": "57a93c33-a3dc-4299-b35e-29b8a4833669", "comment": "Malware payload", "value": "3a37312509712d4e12d27240137ff377", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783636, "uuid": "53cbe6b6-b965-47ac-b377-9cdc95e760a6", "comment": "Malware payload", "value": "b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783636, "uuid": "a94405e8-0db3-488f-9dcc-75d8d5bcfcb2", "comment": "Malware payload", "value": "30ced927e23b584725cf16351394175a6d2a9577", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783636, "uuid": "d0e6789d-e57a-4f24-84a7-b42bc0a0745f", "comment": "Malware payload", "value": "2c537c153cada4aa313cb0c4e19a812804c0aee8ea6bf6e4900ac54bb0fee45e2435b8fd7277a9a528ed7957220c59d0", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783636, "uuid": "a88b26a6-162c-4fd6-bd7a-a81597ffe5ea", "value": "T1AFD0121496E8221052714E26BD789005DBB1B8212C1BCA9E5680918B18E6A45E636B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783636, "uuid": "3d98e8c0-c376-4d1f-b3d4-4c115932d899", "value": "6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlt4DAlLwkAl2FlRaQmZWGokJISlVl9:QZsiL5wmHOlDmo0qmt4clLwr2FlDmo0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698783636, "uuid": "9f65c528-750d-4a60-8227-1966709c5722", "value": 282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698783636, "uuid": "810d8a44-f4b4-4afb-9d21-e965204223c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783636, "uuid": "c7e54448-4e5d-455a-adf6-f59c62b779bf", "value": "desktop.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fbd210-77e6-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698754089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754089, "uuid": "1dd6c59c-c1c1-4743-a3f4-37b54032a5e5", "comment": "Malware payload (Formbook)", "value": "0074fb71f5ebdbc29a96c9b2d2ef6fa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754089, "uuid": "164829e6-0bd0-4e2c-899b-a7b1f66db419", "comment": "Malware payload (Formbook)", "value": "b06fa82f10d2120f00f919b03f578f97a3daa9f670a2bbd01749e3b573fb0315", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754089, "uuid": "b0381967-eb0d-4d4f-8774-feb0c0ce80dc", "comment": "Malware payload (Formbook)", "value": "4f33f3b3c5891b2342fa8f83f881289c46044802", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754089, "uuid": "9504895c-0512-462f-8469-ca3b5afd691a", "comment": "Malware payload (Formbook)", "value": "db23ce63a3400d370ea4f5957d67764c915910ebe207f9bd03aeacbb3dcc895a1ad59c4789a40548e93df8ff495ccd41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698754089, "uuid": "5e364a84-bb42-4b6a-892e-8719e2fbf5ab", "value": "T162E412D0988CDFD2C5BE1A3B0BA9E835966CDDB0D414FF5C6AB177C4DA76782E11080A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698754089, "uuid": "ec948b0b-8316-493a-9a9a-f575645aca43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698754089, "uuid": "578d6552-0851-4795-9a0e-b823d24b6916", "value": "12288:tUR6dhdoaQjwbUNG8raMGDdzPISYBlQCHspTRjq0j3xmZSSuXtXRfa9OB1Y:tUR6eW8Gv9P11q0TxmZSttXTfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698754089, "uuid": "34c7c6ce-ef6a-4338-8b37-93973497a1a5", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698754089, "uuid": "9d34ab01-9446-48fe-a431-141a40cfa783", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698754089, "uuid": "1537e9e8-82c9-4946-9c43-104604393149", "value": "876-1057.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1efed50-77b8-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698734590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734590, "uuid": "0a90a259-541f-4112-89bd-015f623f87e9", "comment": "Malware payload (RemcosRAT)", "value": "d2935dc7dd09462f382d4b4afbcf9687", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734590, "uuid": "3f74cb92-3e9e-4f20-b734-dde385149953", "comment": "Malware payload (RemcosRAT)", "value": "b0c62f506cc0f19ff1349e8b32d18f6a4ad2d2d09738e0292c6ddfd84761a177", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734590, "uuid": "86d947b8-7aec-4ecd-b5b6-7fae94a6add4", "comment": "Malware payload (RemcosRAT)", "value": "77cba131c6759587485285752b4cd094f7641270", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734590, "uuid": "967691cf-cf04-4ca6-886f-66084a0a0789", "comment": "Malware payload (RemcosRAT)", "value": "4e934e21b7994cf8cf77323c79fa8d2e701501ae3360d82ce87f3de7a573adf2ac405912506bdd95d1fa55120eea3b91", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734590, "uuid": "a72f614a-ef0c-4c87-948c-caec700649e3", "value": "T11305233B8D70DD7673BF02AF48D9C9F27B70484CF493AA3BB8A8553A45B7294611B205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734590, "uuid": "2f127f96-3edd-4e71-8557-4d18f8897f3c", "value": "12288:GbiIuy6RPU+5DnVx0huYaNSJKrm8e5mRPU+5DnVx0huYaNSJKrm8e5b:jrRc+Z0hu+Ki8amRc+Z0hu+Ki8ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698734590, "uuid": "76024d7e-aa1a-4b80-aa31-1d85af40cf4b", "value": 871030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698734590, "uuid": "aaf3515e-4a2a-40b7-9b11-9001a1ac2d6d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734590, "uuid": "a47bb61d-0ec5-48df-9253-bfeca30f6b2f", "value": "INVOICE098789\u00b0098980.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4170b97-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735533, "uuid": "02ef9210-e98c-49fa-a9e4-6559ca9a7bab", "comment": "Malware payload (AgentTesla)", "value": "caefc02291ecdf54b2b9373830acf417", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735533, "uuid": "351d8282-2e51-47a7-9d5a-acffbe8110f2", "comment": "Malware payload (AgentTesla)", "value": "b1238fb6ea47e24b96a2582464a2fc3a9de6a3a781c35faac7fd98e974c78e1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735533, "uuid": "686f3c07-7c3f-450f-9fa2-c6e608deeb95", "comment": "Malware payload (AgentTesla)", "value": "acf31897c3bfbcdfc85ab4179b81c0f3f7b23cb0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735533, "uuid": "5b780404-e97e-49bf-8d9f-6070da29327f", "comment": "Malware payload (AgentTesla)", "value": "5a5a92c0b3bfffd9367f47c22e15edb7233c9e4bd9420f007318e64f240f5d7a1a7df85e399e7e30733a54dce2fe5c91", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735533, "uuid": "fce081a9-e2d4-4a8f-b049-45399168ff67", "value": "T12B15DF9262589F9AE83D13F26436089C07725D2E96B1E91D1CDFF0E717723932612E2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735533, "uuid": "f79dc799-1328-4e1a-af34-2652c698892a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735533, "uuid": "141c2f99-2b23-446d-bea3-ed68485b872a", "value": "12288:NHmykDwMD842Oe381HmnOFUzocw2HOzetamMQSLjc+zunD3V5NwCPUmsrC:RkDV8ees1HWOIw2rtPszzqDUms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735533, "uuid": "81176e81-d96e-4db0-8aca-9959be2fa819", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735533, "uuid": "6990cebf-2bd6-47f8-8dbe-48f5c474f1bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735533, "uuid": "fa9f43ab-ad54-4200-b792-be457345fb0e", "value": "New Address.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d883c542-77d9-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698748801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748801, "uuid": "efcc5fa1-3f32-46d4-ad91-163daa6aa8a9", "comment": "Malware payload (Formbook)", "value": "c4c0cc517301f92d8444724c2c46f6a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748801, "uuid": "9f7a9b7b-e937-430b-8c2c-6ff097d5bec4", "comment": "Malware payload (Formbook)", "value": "b25ef1900e652bb134050946db0e2b68db9eb5afe55e93db3fddca8897498048", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748801, "uuid": "6898210e-e846-4f6e-ba0b-85af8464dd65", "comment": "Malware payload (Formbook)", "value": "75251f87dc2896a57cfa3f93280c99b601a5b38e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748801, "uuid": "f8068951-f8ea-49d1-ba41-3642ec53cb5d", "comment": "Malware payload (Formbook)", "value": "b23455f701060e336ae8ca0d879099ed9614d3b12cd3cca77dac3fd3e08f76f6fce648d609b9cd19837cc6611da914ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748801, "uuid": "6bc3e8cb-bccf-4358-abbe-2c7ad3747663", "value": "T16BC4228573FD6F02D26E9BF05AF7512073B5462767A1E72E2DCD63DA09A7F081A41203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748801, "uuid": "04ba8546-5642-4985-8429-9f6155bcbd63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748801, "uuid": "facfb4c8-d0a3-49ad-a6d1-d57c627b38a7", "value": "12288:o8e69yqLgPZNXHkKekwasvohc0JeWSvHGs+DmioN8:o6XU7jEfv6AWSvHGBIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698748801, "uuid": "4fa1d18d-94bd-4fe8-837e-106b7d71cad4", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698748801, "uuid": "adb66237-6ad5-433c-81a9-99294705b9dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748801, "uuid": "820bc05c-2051-4d38-9dc0-1587d5ddeb26", "value": "z46OrdemdeComprapdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399855fb-7823-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698780318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780318, "uuid": "cc4505ca-ba1a-49c8-a087-25ef46c27e62", "comment": "Malware payload", "value": "8f05bd336bf704e6534d5ee4636f5ca0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780318, "uuid": "6a0c92a4-5238-4763-85bb-0f8663797ddf", "comment": "Malware payload", "value": "b2807e6f7103919bf858571303edb40004ad847bc99441c026927ca7a3518546", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780318, "uuid": "f2d6c687-e5d0-4902-b915-39139f3c3a88", "comment": "Malware payload", "value": "62398af898b512874e6fd51d99a6799ed9b95786", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780318, "uuid": "4b906c6e-ad03-4022-916d-a4ead53d6cb3", "comment": "Malware payload", "value": "8fa66f9f1908c02a21de2515cec035a3d15d4b4fb99aeeebef8fe595008d530512b5ee37d2d88e268423526e6df96d81", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780318, "uuid": "4dbc1d9d-4591-4c43-9828-6834088685be", "value": "T17535AEFC75047DE6666F476BDA96ACDD03A626239ACBA4CC80A477C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780318, "uuid": "cf7f1dea-f599-4c1d-ba10-6de6cf0bf8b1", "value": "24576:kCtI/bN+EjFQwU7Y3OfY608qsbgEGIKbHOEiLGbI2VAHJtzbgsTpSRt/:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698780318, "uuid": "70c616bd-8eca-4ebb-9bd8-36ec58048bc9", "value": 1152418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698780318, "uuid": "43da43f0-30e3-419f-9cf8-cc3171b2e86d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780318, "uuid": "141b6c19-f7f9-4d12-a927-871e2829ab34", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.27294.9574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919057b1-783b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698790773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698790773, "uuid": "74764beb-82a6-4519-977e-ed702b5c3fce", "comment": "Malware payload", "value": "4bbe6891bc541d5ba35c4a89f26381b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698790773, "uuid": "0b35807e-f233-4762-8dbc-e9269478344a", "comment": "Malware payload", "value": "b3f91f2b64c8765fa718ef6cb933373e9e11f5b69d1423bc11c22344d410df38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698790773, "uuid": "ea0dd54a-938d-4e7d-9756-c8fefb8d22a7", "comment": "Malware payload", "value": "35e39ca771698941d9f7c6d06287f90e6a0880f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698790773, "uuid": "71e3fab3-019b-4282-a487-c8616de00069", "comment": "Malware payload", "value": "5e193f5ad93fe929b216d643b8a4e6d1219524ad30720bab66444b9914febdfafb4463a8110af858f45a1ac06b1eafe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698790773, "uuid": "f611ee30-0a4b-47e3-87f1-957e70ff4a1e", "value": "T116752319D7E8B0B6E836177019FA86834A347CB29978D26F77655E0E1CB16C0B83079F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698790773, "uuid": "93e2396e-a1bd-44ec-99f3-5e44177e850b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698790773, "uuid": "43441e5c-9797-4a97-9dd8-72b6fb85c218", "value": "24576:XyZg0dMwdH1ye1653Aio8Y1iJ+nFyysnOT9d47PhWpjvTIHRWWS97LtKfd/G8:iZgwMu1GQiotoaoqdCPhYKRWF97pSd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698790773, "uuid": "b44706b4-fc2b-4010-bd87-18c071f0da66", "value": 1620480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698790773, "uuid": "72fbfe19-b18f-434d-90a5-59e266a1ba1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698790773, "uuid": "2e8771f3-e1c7-4005-8e98-3456ab8d2e29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d133ae98-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1698735045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735045, "uuid": "6557c43d-569b-4464-ad68-893623ad5e0f", "comment": "Malware payload (Loki)", "value": "1969302622363d20558ab5d67d77dfb7", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735045, "uuid": "4b894949-2656-48e0-b700-1c0bad314e81", "comment": "Malware payload (Loki)", "value": "b4800773e3eee6e8a976552273774861c9e1d347e8d5ae500fc8b6c10bc73215", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735045, "uuid": "cd054f15-bc51-4012-9904-70d39bd5c72c", "comment": "Malware payload (Loki)", "value": "e31a144a38a91138419a616be17831d33982384b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735045, "uuid": "58431c48-3e8f-45fe-9986-4da64d7710bf", "comment": "Malware payload (Loki)", "value": "922f28c2439a4c22e2874d7761ec7fa90381d9125468e6c34e4f4e39ccb8752e00b041b8980644d9f0314bd3420ca341", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735045, "uuid": "da7fa4d5-cf66-4f5b-a61b-bfe33f060827", "value": "T1DC936DE2DB94161D4D4727AEDC424972CD78812E3623063AFFED478DA20B54C93BEB49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735045, "uuid": "3e6317fc-49a4-44a6-b319-4c16f7af2622", "value": "1536:XtWViKDGxR1cPljwgT/Nb7ZocId+SWuwpQUgMMX1jJ1yOiwrOFeBhjpy4:dO/Gx3c9jwgT97ed+bzuUgMoJJRiwrsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735045, "uuid": "d9565d41-5eca-425b-9ed7-9f27c1ddb397", "value": 90917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735045, "uuid": "e8a689bc-a5f5-4cb1-9029-08169db66d70", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735045, "uuid": "c3d7828f-f983-49a9-bbb9-8c342e82e0c2", "value": "Request for Quote (COCA COLA) 7788MX\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e06f7a-7810-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698772309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698772309, "uuid": "441534e5-bc05-4175-a57b-a7e3a7673c93", "comment": "Malware payload (RedLineStealer)", "value": "890f256f566dd38ac16fa2d7c8afb46c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698772309, "uuid": "07338be7-f02a-4887-8917-794174b0ba2a", "comment": "Malware payload (RedLineStealer)", "value": "b63c396d6a14d96ec8c4547919f763746aea0f05d119cb4c63b50735a6fa287b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698772309, "uuid": "0d44860a-b822-4901-957d-a062f6fbc043", "comment": "Malware payload (RedLineStealer)", "value": "f92624410df2ce932a763eea19d79fbc47a075cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698772309, "uuid": "92188267-f4ce-4553-9527-e6862b14bb2a", "comment": "Malware payload (RedLineStealer)", "value": "787da3dd23f355e98828032a2380be2956b3ebc4a9fd3473d997ff3d35eac72c43bd4b5c34b6e944965fb33eed7243bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698772309, "uuid": "abb172ef-ae91-403e-97f2-337119eaf670", "value": "T10824E776F304955CE87E533DB01C38B09E707C62E16ED32E45E67AED683BB498A244D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698772309, "uuid": "f24cad10-8d74-4cf3-baed-7d8e00f8abd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698772309, "uuid": "489122d3-1b5a-461c-b435-8d079686d567", "value": "6144:EmSQQNgcPf2iHv0+9JR/xadbzBNFygk5:DHQNgcPf1JROBNFygk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698772309, "uuid": "c2ad6d45-4eee-4a2e-baac-5f3170496307", "value": 227796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698772309, "uuid": "12d2b77b-aaaa-4330-b9c1-0b0ba4fa344c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698772309, "uuid": "04ae3c1e-b78f-4ff5-a0dc-9e3980009055", "value": "Mobocrat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e32c072-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1698735228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735228, "uuid": "14c0750d-0fbd-4ebd-b7c9-3c6b632f6e04", "comment": "Malware payload (Loki)", "value": "64c127bea281ea72353453d04aaeba26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735228, "uuid": "271aa9e5-29cc-45b7-b798-2adf43872654", "comment": "Malware payload (Loki)", "value": "b7132a46974ab6e499b4cb00c76eff0e299a24d720cfdfdedba2e4ff62b9abe9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735228, "uuid": "0d9f690b-8eed-4494-b32c-76bec0d94feb", "comment": "Malware payload (Loki)", "value": "ff9c344c8905f767482082fc11aa5288882f6015", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735228, "uuid": "7569748c-9b23-491a-8d51-2500337f3ea8", "comment": "Malware payload (Loki)", "value": "f4ae6bea9aa1489827335621ed8107c82c0258f0c5231b6b2fd4d9f692e571e0bd304cc81975a96e737d5b0f49283263", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735228, "uuid": "6fa61a16-e99f-4669-b96b-02991ee8cc6e", "value": "T174A423E805958370C5B857FEAC7410689371D062A983EBAD4EE194D63F75F836F20AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735228, "uuid": "c2f7ce2b-52da-4da1-91df-b42ff3ba826e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735228, "uuid": "79b6974d-e522-48c9-9110-2bd94f45edef", "value": "12288:aUR6HoaTbU3c1g5wTGrY9qseCMEVipTxwC6o7hgn:aUR6Ss1gmTQvCr0wkgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735228, "uuid": "7f8dfacb-c950-4ff1-9657-e33ddfbca6b9", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735228, "uuid": "42412b2b-094a-456c-aabe-54bad97b5cf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735228, "uuid": "a778cbee-b9ea-441b-acdf-a9922585e2a4", "value": "PO # 450013816 for P10\u20192023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37df84c-7827-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698782294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698782294, "uuid": "03caaa26-7fe9-41f6-9afc-cc1ddc034578", "comment": "Malware payload", "value": "7a6f86f91223eb252518b132de4122ed", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698782294, "uuid": "4d21bf0e-94b5-4ec3-8a47-b4c639911ecd", "comment": "Malware payload", "value": "b738382189c0fc5dc1afe9b9931b2d36ad3e325bf1b23bed9cef066bbaaec072", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698782294, "uuid": "d83af500-d91a-4e14-9d57-c67801f944a5", "comment": "Malware payload", "value": "2109454ec6716883e3f2b4b6b0be6e9c4d5d1a3e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698782294, "uuid": "7cb16aed-4850-4280-84d1-ab1db9bee20b", "comment": "Malware payload", "value": "dbc10769994072555bdac0dcd7827c36017d383e4e37be5060dd0ea10816122facc960c8c5bb427cb599bf40d2edb08f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698782294, "uuid": "b4f39f2c-9c12-4583-b0e5-6b37c070053a", "value": "T14A643111A3FD5108FAF73F846DB592684E26BCA6ED79D2AD1260105E8AB2F40DD70733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698782294, "uuid": "4ebb274b-8d50-4326-a8e4-76afbea90030", "value": "1536:3myOc7PUpGgJqQAXqVYFxHbrmMuB/82W87irR5Y+I6azrw33nTxoxAr85JYDhu8L:pUQ9wor/u9TU/jxoxcq8qfFY5MQwI6KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698782294, "uuid": "cd6a1064-2da5-456e-8888-3041657a11ac", "value": 327152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698782294, "uuid": "ab7594cf-d243-43f8-b9e4-dfb57295a813", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698782294, "uuid": "7fae0e87-b27a-430f-9e89-8f1acc194daf", "value": "ABJW0158_4895991.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84203e5-77be-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698737231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737231, "uuid": "087984d7-17de-43b4-a47e-bc1fb68f5ea1", "comment": "Malware payload (Smoke Loader)", "value": "dbb35fdcf0ca3cdb0702c804c83d0233", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737231, "uuid": "5f38d8c1-03e0-498b-8dca-62c2ccee89e1", "comment": "Malware payload (Smoke Loader)", "value": "b8b02e3cc47b6d0dde81b14b1a5469f65ec3efa32d8347e8e90a15097a21d0cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737231, "uuid": "5457cfaa-a130-4056-ac6f-6d50be0fa2ec", "comment": "Malware payload (Smoke Loader)", "value": "1407f9f4696386b6f3c476ce33cbbb1da6d5a127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737231, "uuid": "8bbb3af6-10bf-401f-a098-3816524a2477", "comment": "Malware payload (Smoke Loader)", "value": "499b67ddc831f2584d877cf6da855485fabd05460ae3d9a012ca8756cf71787d14d97029a706e3437cfbefc8d7909c7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737231, "uuid": "dde2ef52-a899-48be-8093-c7e10708b817", "value": "T137159D2178C09176EEE220B783ECBA3643ADE4B4071546DF06D85BEFD7606D13B36686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737231, "uuid": "5c5c55ce-00df-4f12-b8f5-b5bcd819fa3d", "value": "b6874b762c445425cfcea5128380cca5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737231, "uuid": "fa9ddfa9-3e9c-4a64-b693-e75fcf4830f0", "value": "12288:saaSmtwUJo7a0d0Fry0+8/GSEYIZHcJfxWqg1u+CHp+j:saBmtwUJo7a0dAP5/GxZ8qg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737231, "uuid": "71e0db92-7ea4-4384-b807-7548d6efb029", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737231, "uuid": "44448aae-a700-4acd-a13e-0b6695cc7437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737231, "uuid": "efcb5c4f-f3be-40a2-8db1-51b128dab1d1", "value": "dbb35fdcf0ca3cdb0702c804c83d0233.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7971e9-77ef-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698758287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698758287, "uuid": "135214ef-59b8-4d8f-9de6-e19588e97784", "comment": "Malware payload", "value": "8e9321ddd6b9abf9b92e0d2ec6db1918", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698758287, "uuid": "f9092b5d-1e84-41d8-bdfc-178dd65eb244", "comment": "Malware payload", "value": "bb9892ff838c2e6a7a2740122a6518b9d60da413638e7e102fa9729d1d9df7cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698758287, "uuid": "3a56d807-cb27-4a06-8e60-148c037ea4e5", "comment": "Malware payload", "value": "d9b91b1fc0d078364feb17470ebf5975e64a3a73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698758287, "uuid": "f19ffef9-687f-47ee-856d-9947b8710b76", "comment": "Malware payload", "value": "c1a09328242518ccdb40a9a60163f785eca77e2dfa1ab497643ebbd510d0c3c326c947cc385ce79fcba15fc45a01443d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698758287, "uuid": "1af46325-96a9-4215-8001-a49a6264b65c", "value": "T1CDD42284B6AC4327D87C53F6199479B4033E855698A0DADA8EA3F7C2363B7C04DB1B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698758287, "uuid": "00b86dc5-c766-4834-b0e4-c0a6651a69bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698758287, "uuid": "2ebd9250-bf8d-4b3f-9614-0987660de072", "value": "12288:qqloa0ObBSFIftXqx47gdxsEKwBMXglabLJXElMZk9LcMzS7LpKG1RJ7V:qqrbBSF4Q47gdIAMwlabLJXe6k9rzSPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698758287, "uuid": "28fea2d0-baf6-4b14-9311-6b7e20e39072", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698758287, "uuid": "81723296-56df-4ad7-9db1-e3d6aeda4a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698758287, "uuid": "df9c53ae-2070-40b8-96d4-16d97f323b59", "value": "Request for Product Lists,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a280e39e-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698734967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734967, "uuid": "8151f1ec-23e8-4471-b147-f885e58c18ed", "comment": "Malware payload (AgentTesla)", "value": "29ce1f7be448a7f91e0896028ad586db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734967, "uuid": "268cd973-4343-41f6-9f99-a05f2518d617", "comment": "Malware payload (AgentTesla)", "value": "bc50de48bed10e7a4938ae6a2a51f2c2b759084f8b86bf41aa63a2f8256938f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734967, "uuid": "0b9f7a50-4771-4fcb-811f-43774957d0d0", "comment": "Malware payload (AgentTesla)", "value": "5da67711443e7c1823b01a92e12eb90719e9970d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734967, "uuid": "8c0e6971-ba27-4ce8-a281-7d071685c786", "comment": "Malware payload (AgentTesla)", "value": "e0c3bce8a2c090987e7cdfee52f894bbdc091412af01c470be34e609c3257d64d65d0bc77f33732199edb3ed2dd0181c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734967, "uuid": "8b7a3844-186d-4a9c-9140-b981ff1d973e", "value": "T1D3F423443184A38E727942787B808F9973159ED88B4F76D0E989DBD2608D3F83E6D58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734967, "uuid": "a928bacd-e605-4b0f-aeab-7d2694eab534", "value": "12288:y++AClYS1jZ3XPv/T+M44g53WlexgW9dbJTSeWA2ZJiGmG9vmYy7Pc11xq0lc:059193XL74n53Wm9dbJfWA4FpFCPc1Nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698734967, "uuid": "6fd22906-8301-40e0-ad29-cd8c4509bd53", "value": 737263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698734967, "uuid": "0e7d07bf-61df-4dfe-9e97-615e478a3100", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734967, "uuid": "12116ded-16a9-4d61-80fe-5419a9b53a0b", "value": "DHL9874566855687.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb94cc4f-782a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698783623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783623, "uuid": "26046e33-704a-4589-a02d-be91dc8e79ff", "comment": "Malware payload", "value": "f832747cfa3316c3345fada27593d95b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783623, "uuid": "f41b9fd0-e32f-4193-b7a2-488bc0a92af6", "comment": "Malware payload", "value": "bd3166481098543ed3bba7bf0504f5799784ea37b3cd79ce1b4dbf2a44aef1d1", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783623, "uuid": "8f3d6c3a-7d85-4f3e-a0e1-3a43b13f4e21", "comment": "Malware payload", "value": "9d89898b9bd9c7cee0211f19a76479fd15643e2c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698783623, "uuid": "68e89ec8-05c1-4172-968b-ac60d626cbd1", "comment": "Malware payload", "value": "56eb2dcc88e9f23d34b9f2062d3de49b7ca1380fa56e39932cad199b3f412efdad36a72603301570e16b85d8dc9cccf0", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ruzxs", "colour": "#86702C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783623, "uuid": "c5ba2223-4b05-4a67-a5eb-92173dc10d9f", "value": "T19141CA6138FEDFDC9D16B1F87C83B1C4BA2C4B062084018615B6E84DB6B627545E27F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783623, "uuid": "b9705f65-9d56-467f-967d-9c32f2041f20", "value": "24:PDdSxCKYfykGYsAwwHR5kYWbqtfkUVLdkFvZCXeqOmn27VEfg/CJSepKc87kyKAv:PVFU7bqjXX6kCvK8oJAwMMxZwunjhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698783623, "uuid": "b002e98d-d031-4dd8-8505-f443d1fb58bc", "value": 1960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698783623, "uuid": "0f4ce356-b479-44b2-8c67-03a7b4180fb3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698783623, "uuid": "9a39dd2f-a08e-4855-a19f-de8c1afd69c4", "value": "sduyvzep-top.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a2d0f7-77b8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698734670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734670, "uuid": "32599fae-8813-46ee-ad62-82196ac8a043", "comment": "Malware payload", "value": "37aed510dead597dfbe45c52eeb45334", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734670, "uuid": "3a17416d-870d-461b-afae-bfa5d4db64d6", "comment": "Malware payload", "value": "bef5dc6ba7f00799abe1a51ed889f1e4308b0df5ec8e6c08a3c2f0536d00975b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734670, "uuid": "0e44f745-7a50-4531-afbd-f1fafb6c0e42", "comment": "Malware payload", "value": "0540c8594c8ef7ee9afac63e529c2fe899263a27", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734670, "uuid": "fd361e38-57ef-41ac-827c-80b117d0f595", "comment": "Malware payload", "value": "84684def49887e7ac967603e4ba9875435736f597317f9736fcc9594fc49571e9f42e1c9fabef89ab54ce1a4e6dd4b2d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734670, "uuid": "9ded87b5-86e4-4350-b491-0499e1f35ff2", "value": "T1A004446EC34B41A98F125376A72B1E4502BCB63EF34452B5346C933533EAC3D916A2BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734670, "uuid": "eb4eaec4-13c6-42a5-b843-5372a60f7bce", "value": "768:WwAbZSibMX9gRWjZRcQxG3hifaUCiYNxuJ+AkPPVf7OWD1W:WwAlRucy6IfrYIkPtfiWD1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698734670, "uuid": "64b1fdef-995e-4a69-aa6f-309708e7baa1", "value": 189069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698734670, "uuid": "7d968c51-768d-4e3f-8957-f0b3a29cf91d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734670, "uuid": "74ff5621-10c2-49a5-afcc-82e3a2d36167", "value": "Payment Advise.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcef727-7796-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1698719709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698719709, "uuid": "ba1d488c-97f9-47f6-9001-161a9981ce60", "comment": "Malware payload (Loki)", "value": "372c0ba3b4b2a68b6c3f41a9a0facafd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698719709, "uuid": "b28857a3-92cf-46d4-ad4b-9d7ea4f93b60", "comment": "Malware payload (Loki)", "value": "bf0021cff2f4f3ac204eca9821369176f8d16480510d53465ba2d239524ec7b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698719709, "uuid": "e1469a2e-ffd9-4c30-b841-1572721b8bd2", "comment": "Malware payload (Loki)", "value": "fd6d525db39c9719a746882273cdef014aa8ee62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698719709, "uuid": "d69b7e4f-76ec-451e-91e7-6320b47e09f9", "comment": "Malware payload (Loki)", "value": "b65ac75a674ce42e347dab4951ba91702de29668bd60446a573696454d9620444690941166606d601b271cdbdf6cdc8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698719709, "uuid": "798a9e56-dbc5-4817-b761-54d7dff79304", "value": "T1E8A42214135CE730D6B6877B52B810629FB0A1053150FFFD4EE0F8946EB6B82DB2A792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698719709, "uuid": "c089392b-940c-48e0-b0f6-b2785a32595d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698719709, "uuid": "7e8c4a17-12e7-47a1-9936-48274066d8fa", "value": "12288:bUR6ZIoaEqV72w2MjG072OKrX0WV6sRxAAeprvsowuSjVo0W:bUR6PS3JNQwWrDeFvsTV1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698719709, "uuid": "6b2ec731-3fa7-4ff6-a474-ae3a7d06fdac", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698719709, "uuid": "56e363e6-ccd6-4ba0-8318-4b06c6ba71a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698719709, "uuid": "4b895edb-957b-4301-80a2-121eb6977cf8", "value": "DHL ReceiptAWB#20908289822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8434d1-7820-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1698779120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698779120, "uuid": "e609613f-343d-47df-81dc-7bfd97910266", "comment": "Malware payload (LummaStealer)", "value": "b3ec6ed0a04dd6830d96fa722529d278", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698779120, "uuid": "925f0248-654d-42fc-b0ae-0d026d55e6f4", "comment": "Malware payload (LummaStealer)", "value": "bf738eeee983c909af9211968826b57eefdf3d1050de9a5c0b09e5cfba511314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698779120, "uuid": "4fa1da5a-76ee-4a4c-9e16-5a78ebd0143b", "comment": "Malware payload (LummaStealer)", "value": "dee57937b2ee81d1738fe3e4218f0ac55564ab81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698779120, "uuid": "b049eb24-4c08-4dbb-b105-74d7c6a17407", "comment": "Malware payload (LummaStealer)", "value": "d4f10596299b872d2c0a877554410178f3e5d011b69dcce1f535d51bb6611b44340e98708bd85432c8269f2b7e20c38f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698779120, "uuid": "6f4d8eeb-4e4d-4a2f-88b1-956a8886664c", "value": "T178B75AC7F89051E4C1AED33186668262BA707C895B3027D72B50FFB82E36BD46E75358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698779120, "uuid": "8464368e-5d05-4efd-b45a-15a4f24c12ea", "value": "85cddd6092e65c1a58dd1e6e9ab9fc63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698779120, "uuid": "149ec5a4-e84a-4bae-b41c-5d176ef1b243", "value": "98304:0agXQ4zatWFPtfqBuNRX0EcuUDeJ8Jb0kD:R7SSQqYNRXNGDe6JB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698779120, "uuid": "19ce2b24-fa5c-4cc9-ae54-da0b2563e2ca", "value": 51391680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698779120, "uuid": "b8f44a42-4727-4bb6-9573-682a166265ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698779120, "uuid": "08916435-a462-49c3-8311-1b8e5cc63910", "value": "b3ec6ed0a04dd6830d96fa722529d278.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4d79f2-77ea-11ee-8907-42010a9c0042", "comment": "Malware payload (Mydoom)", "timestamp": 1698756113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756113, "uuid": "c1acd976-54a1-4cc6-be57-ed4d78d3ebb4", "comment": "Malware payload (Mydoom)", "value": "0828b02c5c8c75d6804613f8abbc0558", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756113, "uuid": "12bd858d-ca3d-4b7e-a14d-8bf1f1123a5b", "comment": "Malware payload (Mydoom)", "value": "c0b6c2fd24904744424ef20502d0649dafb6211ea4885dfd217e59efdb39a758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756113, "uuid": "8d4549fb-eb65-41f3-b0e8-c3eeff9403f1", "comment": "Malware payload (Mydoom)", "value": "9e71939f307d38bd54ff77b89161bd8637080a3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756113, "uuid": "aa133e3e-4288-4a8c-9717-7f75dbeb7a2c", "comment": "Malware payload (Mydoom)", "value": "2b5863c041fb821a4bc0eedf4c5bbf4f1bcbe85abaae97d0d7918b419276ad0fcbe1bb9a2cd0e659442f847ca99f0461", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756113, "uuid": "ab011579-79f1-4b84-9592-925a33b27fd7", "value": "T1D4F2032BE361A5D1F343D43C2C4A766466DCFFF0C5CD492630582B6AE5ACC89AB447E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756113, "uuid": "24041171-f840-4964-899a-9760e7163b23", "value": "5d02f6de12eb07fb22fe87e05e50d6a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756113, "uuid": "32720678-9056-4af3-bba2-60fdeea57be9", "value": "768:pwy7luXqnKZ3URe/cqhVnjBsuC1bfeFb1RbfrFFu:aypnKZ3Ulchtsl1bfw/frFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756113, "uuid": "1faf208e-d5c3-4cef-bd68-69e4d1b0098d", "value": 35356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756113, "uuid": "4388721e-2895-4505-abca-060b9e6aabe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756113, "uuid": "aee5ae98-5f95-41b9-b278-c4d4c8ea7880", "value": "Transcript.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a9ea2d-77ed-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698757246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698757246, "uuid": "e6278fc7-2efb-4e68-81e3-d051c32f81df", "comment": "Malware payload (Formbook)", "value": "950d7ba3511783a6a30c8ce19dc6a91e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698757246, "uuid": "6867410d-8c96-4ba1-9bc0-c06097cb651b", "comment": "Malware payload (Formbook)", "value": "c0b6c699072069ff553e7a17c9c43961ba97d3a73c0dda64ea297d1ef9d0c75f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698757246, "uuid": "46f84bfa-292b-4f27-b6f3-0c11f5ca8389", "comment": "Malware payload (Formbook)", "value": "bfec964456838da3b37a6981072cbdf450554168", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698757246, "uuid": "b38baebc-97b1-4c11-965c-26ea88c98b0c", "comment": "Malware payload (Formbook)", "value": "37863df7dd2dc6a03941241bfbf7d20eb9a7cb99faac732853754d444d8d4ab702b81e33483803533386d3101faef175", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698757246, "uuid": "2fa9c875-2a8e-4275-ad83-f2e55fb0620b", "value": "T131B423E013598BF10AF226D602ADDCB87B15369D73EA7D849047A1D7D8DC0FA89789F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698757246, "uuid": "54610e46-4101-4444-9e06-1056241692bf", "value": "12288:i5bWqMlRVYHhT5QdLwIvmM4K8HJAoe0F4wUR3gH+BANfZ/HJe:xq4RVshT5QLp4dpAoeXj3gH+yRfJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698757246, "uuid": "6bfdd001-8d99-48de-895c-872141c7af17", "value": 539027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698757246, "uuid": "9ba708ae-802c-434c-b254-fdba63fc0965", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698757246, "uuid": "ed46e2fe-0686-4df2-88dd-483226b8d328", "value": "RFQ 3728422023 pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3eadf0-77f6-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698761260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761260, "uuid": "f731a6fb-c516-4c37-8f98-732ede202266", "comment": "Malware payload (AgentTesla)", "value": "fe7a1b19cee84c4dc4eeed17ce8f8b42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761260, "uuid": "484566f5-b236-4797-8fcc-6230edbdcffd", "comment": "Malware payload (AgentTesla)", "value": "c107d4cc003e96086be97b02304631459e7b4ef3038fd6716ab583efe60dc964", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761260, "uuid": "811d520b-526c-4431-ab60-78259398d72e", "comment": "Malware payload (AgentTesla)", "value": "ee26e0edd557ababb5788464fa7816e27879d233", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761260, "uuid": "2d2d726b-ab05-4866-b0a1-272103e74e5e", "comment": "Malware payload (AgentTesla)", "value": "48a72c02a935e08ba7f8d4fa488c199598d67e6f3fe590425d05201b276c41bd849c55d8f0c8c36c6e46a15877924faf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698761260, "uuid": "0a95f363-351f-475e-922c-839084cc1b16", "value": "T17DD4230A776857B6D1F843F484769A8413F1618316D1E3EA4DD768C33726BE40EC2EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698761260, "uuid": "a39d1f3a-5f36-4f20-9556-e6d01a3361ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698761260, "uuid": "3b53483e-39b5-4fa8-90d0-99316c5cfa7e", "value": "12288:dLpuoaapAT54FLoNWf6hRBO6a0ZnioEb/yPMYXX8C/ypYtLiFdhQ8vVuBy:xpP2sLU46hLXEoPMQXyKi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698761260, "uuid": "056aa90a-9864-4631-a3e6-19a0b422a761", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698761260, "uuid": "2541891f-4150-4d8e-86c9-1f31959d7310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698761260, "uuid": "c80ee1c3-c5de-426a-a007-fefb3682cf5f", "value": "FATTIMM2110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba096145-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698735006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735006, "uuid": "0f729670-131a-4263-8a6c-a409572e2a24", "comment": "Malware payload", "value": "667c6f46f4d1b7507689086bccc03029", "object_relation": "md5", "Tag": [ { "name": "pptm", "colour": "#D899A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735006, "uuid": "b14c11df-ab38-407c-9948-df7164d96643", "comment": "Malware payload", "value": "c17dd1bbce902d04fa8f4b45e0c965d16a8b2f203d2f5d720027eac255ccaf6f", "object_relation": "sha256", "Tag": [ { "name": "pptm", "colour": "#D899A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735006, "uuid": "09b7ee3f-606b-4d8d-8f08-48833feb1430", "comment": "Malware payload", "value": "087466c0cd0ca7b888a1452b92163f17441de12f", "object_relation": "sha1", "Tag": [ { "name": "pptm", "colour": "#D899A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735006, "uuid": "43a0e58a-bc5d-47dc-a81c-c91e77a29003", "comment": "Malware payload", "value": "7c9450e32586aea87aecc4b25b8a5fd5254805930fe99cae343249e7885601bc647fba220aaed3eeef47cf9f827afda5", "object_relation": "sha3-384", "Tag": [ { "name": "pptm", "colour": "#D899A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735006, "uuid": "71bb02c2-198b-485f-9cd6-b34e9881973b", "value": "T165D4235F79004953E0E61C3EB12AC4EA6B754945B002BD9AE49228FB27FC6D37C4D39E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735006, "uuid": "02ecf462-25a2-4c08-ab2b-705910b64923", "value": "12288:DvJBMHPtxYLaR7uUhdttdVUUqDdqoQ1jZIBK704PN1o2RPGwgQc2:zJ0i855iU7Z+P4PN1d9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735006, "uuid": "a5696090-7e91-42e6-ab80-c8f49e29cc3e", "value": 638730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735006, "uuid": "68c376f7-8cbd-429a-abfc-049ed70ac437", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735006, "uuid": "3e9c9a3d-3181-4da6-b41e-bc59ef629265", "value": "CHINA PAIS ASIATICOS.pptm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a92af6-77e7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698754761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754761, "uuid": "ceb64fb6-5757-4f3b-8634-c7e5781d1341", "comment": "Malware payload", "value": "5d791cc1b2dda8ae7bf8d29373af8965", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754761, "uuid": "bc448896-a4e2-4438-ad5c-25db16f33fb1", "comment": "Malware payload", "value": "c36bf03106d84b6e72e6e48f6173864b1e4bb934ea5ef83dc78b78c113f8cc11", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754761, "uuid": "2d225078-7990-441c-9c78-d5bbfd9e214b", "comment": "Malware payload", "value": "aae69b2a59f84000d51509ef79b4607c1af111bb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698754761, "uuid": "2747df24-8649-44e4-b61f-9cdbc5ab5970", "comment": "Malware payload", "value": "ef8993af2108108cb390820aa39b611dd5b63888993b60d15a657c463a4b92fe72ebe52333fe7e56572526b619caa7b3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698754761, "uuid": "bb99033b-13f5-4d6e-a0c6-937999abaf8f", "value": "T1BAF202AD1AE3804106D2A5A7F6BE5B50F604CB95EEDB812B105D4F8F11AA33BF54F138", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698754761, "uuid": "4b4b562e-49e3-4b65-ac37-b89a10b78677", "value": "768:Liteti0Zv7RDGCh4WgRKgeHNq4mo262/ZW/eunbzomAL9XRq:Liteti0ZzRDGCh4WiKgeHxmoD2/E/euL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698754761, "uuid": "f5459260-eb55-4a71-9387-9c0d9e5920ee", "value": 36180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698754761, "uuid": "819b4932-2a3b-4e61-bbad-7eaa1e4ef25e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698754761, "uuid": "457c4562-46f3-451b-9721-f45b8acc020f", "value": "Kernel.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bfbb7e-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (XWorm)", "timestamp": 1698735162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735162, "uuid": "eeff0529-fe69-40f9-a7bc-4827643a9515", "comment": "Malware payload (XWorm)", "value": "036c0cd48a482a5747a07e965ac6c6f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735162, "uuid": "8f680258-3868-4482-8676-ba7c65ba7101", "comment": "Malware payload (XWorm)", "value": "c39365657b596c0e0d5599d177ec383659d23d24d1e529fcf2eeef2c8f82e5f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735162, "uuid": "a76648d4-eafd-47a0-8cb4-bce5754f4eda", "comment": "Malware payload (XWorm)", "value": "d7017e07983727cf7401f403671e69b55b8b9da4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735162, "uuid": "c29e1c08-53ff-4639-a43b-ff16813b33d8", "comment": "Malware payload (XWorm)", "value": "7cc22a2855cc90d82689a4656eb1fd28b780cbe4e08e70efe3ffd31aff81091982bc6cdd5661bd39c81f0ca86523c979", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735162, "uuid": "42ad0ad9-619e-415d-b73d-1460202a8c77", "value": "T199942240168887BAFAD843BF907826600BF9D158B980EF9D4EC874C57D7E7835F29636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735162, "uuid": "aabf333b-eadc-4257-bba7-9f18d5ef86cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735162, "uuid": "a5574e78-ff49-45ae-8a5f-79a19255e4eb", "value": "12288:VUR66OoaKUk62w97VQ+TY11/d13H+YAcms:VUR6OG2cpTY11/d13eA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735162, "uuid": "c7afbcee-78aa-427f-af12-55de04b35c43", "value": 445440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735162, "uuid": "a5242884-a7ed-4881-b96b-213bafb695c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735162, "uuid": "0f060d51-e635-4348-a00d-14824cf7b666", "value": "WDMFT505_BL_JPTYO01_EMOTO_1017_000103_008DA21581-MAIL.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a106129-77a3-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1698725423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725423, "uuid": "13bdc22f-5f6b-447b-b6fc-a846fc289e37", "comment": "Malware payload (Loki)", "value": "ebcbc1c808b1c636471cd7f89d06230f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725423, "uuid": "f5a8ad80-9ac8-4e2e-a2c8-58510d375480", "comment": "Malware payload (Loki)", "value": "c48ecc22b1d6a955c8e6346661d51b528cc5233909e0f3a6665353f63fea6343", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725423, "uuid": "92e25a6a-8dab-442e-a911-5e23d2129394", "comment": "Malware payload (Loki)", "value": "53ac6c0d8a18558657653dac303c7432fedf9153", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698725423, "uuid": "8741df65-4ed2-4741-b405-e7fd7f75c769", "comment": "Malware payload (Loki)", "value": "45a2cc41d531157dcd49bfda3ba84f5570fef822a0f33527386dce1c0b5ad50c07c61ea0cef9490743e355641be42372", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725423, "uuid": "4bf09cf2-c790-42f5-ab41-9a540efc5cd2", "value": "T1C0B4DF9C3650B1DFC85BCD72DA681C20E620B07B530BE657A41722ADEA4E6DBCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725423, "uuid": "1b391b11-143a-4730-971f-9815b72ec20e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725423, "uuid": "dce512fb-833b-4e9a-8280-4d88175f2bf3", "value": "12288:gvpMU8oadbLu3ZEZ/F6hB9t8uQjdUgcXjWBThWIJi4hx:I2CKZtoB92cTXqBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698725423, "uuid": "97553746-882b-4737-adb0-cb42e6c07148", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698725423, "uuid": "ea55f559-e4b1-40c1-90c4-92d15cadeb2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698725423, "uuid": "3ff394a5-4416-453d-9003-082cf2a494c6", "value": "JNE DOKUMEN PENGIRIMANhtml.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdea63a6-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735040, "uuid": "0d95cef7-acfb-4675-b644-f308e55c2111", "comment": "Malware payload (AgentTesla)", "value": "f9aa2e0247bb948af362b85e52e3f717", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735040, "uuid": "5dd97412-51df-40c3-b6d0-65c95b843378", "comment": "Malware payload (AgentTesla)", "value": "c5f9efbff6857f8616e2623ccc463d207ace2f141043468e9e1d523fcf9aa494", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735040, "uuid": "aed56b9e-5ea8-4802-a0e7-a55f5842be45", "comment": "Malware payload (AgentTesla)", "value": "3a5c76361cde78574a827adae30b288f641c8f78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735040, "uuid": "ede15f3f-8418-48f2-9ce4-e9773a5795ff", "comment": "Malware payload (AgentTesla)", "value": "b75f3080d63cd925105d07a739471328ed76b99f5af9ffe2c3041889fa78d920d85cd84880819c14464efb2d9b512a78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735040, "uuid": "33405c5a-94b1-4cb9-854f-cec3e5c9b98a", "value": "T1ACD39C526BEA2108B1F7BA88593A11344F2B7CD66D7DD54E05CC2A4D0BF3EC4C860BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735040, "uuid": "12a02135-cb52-4b88-9854-02783ce7d122", "value": "1536:F+ke4Mi3mI2hb7KZ18C2NGkikGkFjGkikGkKEt0eEKU+kCKGWGPrbrbTDDpOAWGv:3eBQFJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735040, "uuid": "b166f865-11bc-4ba8-bcc7-0877ccb29056", "value": 139730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735040, "uuid": "da6b74fd-13e8-411a-9c1d-e83b2b6b5fcb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735040, "uuid": "562e9439-2de9-45ec-82c3-16e3bc850f21", "value": "PurchaseOrder.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331bc1fb-7811-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1698772576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698772576, "uuid": "6b4ae0cb-9da9-413b-9b40-50dd0d6cba0e", "comment": "Malware payload (LummaStealer)", "value": "d165d4e09ea0624e62fd5bd90fe68c96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698772576, "uuid": "8193a2b9-8e85-48cb-8f57-b5b88284a0dc", "comment": "Malware payload (LummaStealer)", "value": "c6befd3879040aeca88afd9b461177c9a3fc830f2020f2878696ddca0cea994e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698772576, "uuid": "f8e3ea34-0fb9-4c27-abd5-9a8d85e46be7", "comment": "Malware payload (LummaStealer)", "value": "9a95939bdfface20125f497c54eda3f3d421e790", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698772576, "uuid": "b5c6b37b-d57a-4bef-bc19-fb74c939ff41", "comment": "Malware payload (LummaStealer)", "value": "50b064706a4350117e99f0047c6d7b7781e4bc7be1343f5bbcc8ddcab37ff05c1adbc7eb68d2e3a95c620a0d70180ee7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698772576, "uuid": "040f96bf-9404-4c49-9e38-b1957301ade5", "value": "T1A8268E02BA51DB2BD11D5536D2D5AC1973F2E841A113E72F67D422292C833EE8EB74CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698772576, "uuid": "016c038a-5747-41d0-96fb-98de79c17313", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698772576, "uuid": "a11f9cb0-62e8-4a39-8434-6ce2e1d96a25", "value": "98304:LhX2dkgF2fKzz5du5XdYQokRicv/f6qzT0rh:LhX2dZF275XdZYcvHvvch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698772576, "uuid": "e6ad41f2-b117-4dab-a273-d291010207ed", "value": 4674752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698772576, "uuid": "843b9f08-5a8b-4925-8c14-91a398017ffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698772576, "uuid": "80a5902b-7d74-406f-a4a6-5e5da57fa38c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38d0624-7811-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698772818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698772818, "uuid": "b63dc7a7-57f4-4a2a-8420-1b5040347652", "comment": "Malware payload", "value": "246287d32b60e2b7bb61049101ea6679", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698772818, "uuid": "5e29edc5-1dd7-47a2-b3ca-62f14e47f7bb", "comment": "Malware payload", "value": "c6ecdbe4c6170d3ec9b20e20717ba27169b9e409c9b49690f0e09986651c744f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698772818, "uuid": "28639c3c-0172-4fc2-9776-3ef96ecd42f5", "comment": "Malware payload", "value": "eead6aa05c2162297bd659552a2b36c9d4049c9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698772818, "uuid": "cd377dff-3bb9-40c7-8837-cde0fd80eaf3", "comment": "Malware payload", "value": "dede0c7f1242ff1237e06117e4f491af343822c104429e9f37435575d4920884ee816eb741d8155b0f4815c01968fe98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698772818, "uuid": "e2ef81b2-6450-4c0a-928f-6350b67006da", "value": "T1E7C50262F390153BE17716389C0F8359AC39BE502A34A98B2FE52D0C5F797C27D29297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698772818, "uuid": "c5d62af0-f454-4d3b-92b0-d30faec90d22", "value": "86017bc19d1fbf8fe17849ce343a3f2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698772818, "uuid": "e42247f7-86ca-4211-8f23-d124b89656b8", "value": "49152:cfvsoieEhVbQVSOlX0ZjyqZrV/O3mdrqADkXfOc0:ccowVbQcOlBVWdrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698772818, "uuid": "1a9a1f2b-f67d-4709-871b-12f8b72ec1bf", "value": 2713088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698772818, "uuid": "583cb664-9880-4f1d-b8af-f60a6ffff63a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698772818, "uuid": "93c7a9b5-dfc3-47ac-a6d7-cb99ac018bc9", "value": "6469919403.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb292184-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735518, "uuid": "1c505cc2-d7e7-4f69-acb1-101f2265a8f9", "comment": "Malware payload (AgentTesla)", "value": "d114792f688e4dce77132d6936793a4d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735518, "uuid": "f038af41-471d-47b1-a37a-90b7b2060f83", "comment": "Malware payload (AgentTesla)", "value": "c8ffc83919d2045260e70301c44ef7d5090149661d4e4f9a7a67d55aef984c68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735518, "uuid": "7b70ba58-0f63-41ce-a990-e86b0575ed18", "comment": "Malware payload (AgentTesla)", "value": "4aecf7991ab28d104dded940543f3335621ee157", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735518, "uuid": "b6cd9cf9-da3c-4df4-bcd0-28a8a5dd54c8", "comment": "Malware payload (AgentTesla)", "value": "239451d967bdb5141fbdf5cbadaaad88adc186c50056c2c566e60ad10b0173b4375403c2e543fc9618917fc045973aea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735518, "uuid": "8ca29d60-306b-4d8e-92c5-3ebb1e1a9609", "value": "T13DF4F16651448ACEFC2D23B264324EED47329E3EC7B5B91E299DF0364773217220696F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735518, "uuid": "84c421ee-6521-4d04-a98f-0fd622875980", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735518, "uuid": "7515a2a5-af5c-41ee-846e-3dfaa98ef6bc", "value": "12288:OPRF2iNO1z+KM14QZvQUwvEI+e30aUT7N1g+dPu8+eyoywk/2+1:OZF1ZLIUwvye303NjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735518, "uuid": "c0ce40d9-9959-4b99-83a1-cb4905c8bba2", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735518, "uuid": "5eb6abc2-70f7-4533-be2f-bc2699f3e0fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735518, "uuid": "311f8346-fad5-4b61-bbca-15d3278927f6", "value": "PO-040112030627.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80702f3c-77d6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698747365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698747365, "uuid": "a893324e-2694-483d-a35e-1d9d9e4dfcbe", "comment": "Malware payload", "value": "7d3d5e26cc91fea1694104bf1e310069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698747365, "uuid": "f51447be-5708-4cec-bd3a-e99a8206465d", "comment": "Malware payload", "value": "c908409d7384377c46b1c576f8e44032f1ffb8faad3ff61bbcf4496d1a6f0b54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698747365, "uuid": "67282cbb-f4d7-48b6-bb36-fee10e5b1a26", "comment": "Malware payload", "value": "ed46a72858fb631514f9ab1a8b97c52e6bd7189a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698747365, "uuid": "0f140f7b-204f-4095-a25d-2a859ce97b61", "comment": "Malware payload", "value": "b6425d359073c4f83e368de58f68d50d3d26a21b55ceb34a1a2f39ae6dc5c8ba233f4d88418795e053d6c76315e20a25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698747365, "uuid": "93f9ae30-90a0-48a8-b27a-33512b40336b", "value": "T187A4BF61F3F5AA4EE5DA8675CE20A2D0627324276703D35BCC44E5E9382CBD78EC05A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698747365, "uuid": "7cc4033d-77b7-4126-ae69-213224bca1c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698747365, "uuid": "9cfed3dc-0e0b-4276-b2a6-6d60c5eff024", "value": "12288:Jy+qzuu9m2l2zNDoAO4nzat/l+UoB6ZuJomvCkSwzE7TZ4c:Jy+HucRuYzaB7dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698747365, "uuid": "7d447f3b-7f34-4b96-8698-d82aef50215e", "value": 455680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698747365, "uuid": "1a11c995-0bbe-457b-b8f4-d863fd3e4e8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698747365, "uuid": "f6206bf7-f4d5-425b-8bc9-20abe1f63376", "value": "PO #GM88997774566096764664665.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25d16c3-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698735530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735530, "uuid": "bfec6857-35dd-4115-8e42-79f37210ac5a", "comment": "Malware payload", "value": "ae28b312c230ea3ff133b38112c4ae69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735530, "uuid": "bcfc8b39-8437-4f56-9c69-29a94bf92c19", "comment": "Malware payload", "value": "cdc434fbaf1145d8466253e998cc37a5d8d8fe9f52839115ab69641a22d801ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735530, "uuid": "1ee4927c-52d6-4f84-80a0-fc210f46ca19", "comment": "Malware payload", "value": "4e645140da0bf90b5c51dcd67f0e47ff6ac63ed5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735530, "uuid": "b2098643-5a1e-47be-b03c-ba4dbc00cd7b", "comment": "Malware payload", "value": "67b8e91edb7eb5fdfbb9948feeec951bb73f6e44926eed13a61b17f945a8a43ef11798289d3878b9488cc78a55a5ff8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735530, "uuid": "cbd62e07-7cbb-48af-9b44-8cd810d58bf9", "value": "T14CF4F1A265584ADFFD2A237264770DEE0A625E2DD6B07C1D14AFF02683772473216C2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735530, "uuid": "4c900c28-511b-4196-8996-fc17ca774823", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735530, "uuid": "943af545-dd32-4529-907d-3ffb00049906", "value": "12288:DfxWokc+Hgbd2baJXSMCqu+8oDcJOH+bakjnvPJjjm1/Vc:zxjkcrSou8IWc3xW1/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735530, "uuid": "8d04e10e-6cb4-4872-90fb-d1254bb8a7ee", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735530, "uuid": "bfaa47b5-6ba9-426a-891a-c575298d8bda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735530, "uuid": "f732643e-7802-427c-8313-8a53b9b6a9fd", "value": "PO-00112023062700.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1bcbec-77cd-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698743598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698743598, "uuid": "697f9cf4-63b8-44a3-975d-0353dd87989e", "comment": "Malware payload (Smoke Loader)", "value": "c73dbded9804060e3f4c117aa6dc6b27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698743598, "uuid": "31222280-2d84-4b3d-b77b-43ad81895b7a", "comment": "Malware payload (Smoke Loader)", "value": "ce015e5940a83246f5f69f4548281a05783e4a664be65b93422bab2d1ed9dc41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698743598, "uuid": "efb16325-6824-485d-939d-84cdac08c1f9", "comment": "Malware payload (Smoke Loader)", "value": "bc9d7ac38c536930f2a7d7ad4ee9172f7044d9cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698743598, "uuid": "61310a22-af30-4e64-be57-868548432d08", "comment": "Malware payload (Smoke Loader)", "value": "564417c8e3035ff94b1f23de8600d8d52016edfea0e0f68ab6eba79bd5953617c544ec928ed8580962e7837db31b3008", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698743598, "uuid": "4e9fa05d-2428-4709-8545-60a8729fb07a", "value": "T1AD24191393A13D84F936CB729F2EDBE8365EF5E38E593B6912589A1F04B00B2C563711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698743598, "uuid": "146bf220-2154-4d82-b134-2fcbfdf80e18", "value": "e0361317ba2ada8e7d47765f45f5ca50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698743598, "uuid": "a70b97a1-6897-454e-90bb-b235f7dd534b", "value": "3072:GAT+iBuseTNxKefkAifeZn7Qw9YhPPyMVzUTTBZJBNbc:r+iBu/TNxKwz7Sw9YhyMVzUTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698743598, "uuid": "611db212-8088-49f6-a843-7c007323feff", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698743598, "uuid": "e05fb0ae-bdee-4df1-b9b8-618dd4c59075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698743598, "uuid": "46254255-9cc6-40c2-ab5a-f1a56407b59f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e2b4fe-77ea-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698755771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755771, "uuid": "b7cff826-4bcc-4786-b09c-d0487b15b4f7", "comment": "Malware payload (Stealc)", "value": "b1f17d1d0c3ab5ded049a7b75d09d556", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755771, "uuid": "7449cc5b-b213-455b-b192-599eecdb122c", "comment": "Malware payload (Stealc)", "value": "ce7d4e42214fb2d3fd16554aabcf1b2e7e96908575ef20cd56f154918c950b5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755771, "uuid": "7d035c58-07cc-494a-b15f-3c2b2306b58f", "comment": "Malware payload (Stealc)", "value": "9bb2bb81d34585442f35e9f50dd9898b187b7cac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698755771, "uuid": "43f226b5-e3d6-4fd6-a829-eacecd4fe776", "comment": "Malware payload (Stealc)", "value": "9c95a48be8d456fc1ee0e09dbce6e943ab04c21bb65937a4551fb23bd2b039b16f96829a0e5a3a1f090f4536ec6df8d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755771, "uuid": "21a2f37f-dabd-41a4-be6d-8fb9e5bb2ab5", "value": "T194243B5393E13D94F9228B329F1FDBE8369EF5E38E597B6512489A1F04B00B2C5A3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755771, "uuid": "a39088f0-42c0-4641-a2bd-0e5fed64182b", "value": "f90e29ae4efabbc6b498b140aa3b7a65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755771, "uuid": "9416e612-14c4-4903-9584-c6d2e572137a", "value": "3072:6UTVodMdiVXed+rhapMndKCqQ3zrru8n3SJNUc:XVodM8VXede8pMnMCqwPuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698755771, "uuid": "4e9a91c9-7f71-438a-9489-60b7e2d401ae", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698755771, "uuid": "298d64cb-49b3-4e7e-8c60-a8ac651aedbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698755771, "uuid": "73f38195-7fdf-4d4c-8c42-bdbc3cad661f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f447c939-77db-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698749707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749707, "uuid": "b057a730-504f-4827-a2d3-9fa0ca93dc30", "comment": "Malware payload", "value": "8f3ae38f8a75b818d933f8e33e6ba9dd", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749707, "uuid": "5084a754-d4d1-40cd-bf02-a7fa43d2ef5b", "comment": "Malware payload", "value": "cec729354fd44d8952c6c582242ecbaf2e21b27c392272f05c10e928e9a6b97f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749707, "uuid": "eea0de81-71fa-4b15-997b-e982a5d75e75", "comment": "Malware payload", "value": "707101c1443ed52e52254bfff1bd8c570f7586df", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749707, "uuid": "4c888627-bf16-4141-87b8-c1654d0dfd17", "comment": "Malware payload", "value": "b3b62f398c4f888366ac789b857b4d7bcb7a287b17c494a9d87871bac6c5c504421bcd9a20e00fd87c0ca54b01ff6128", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749707, "uuid": "66c9fa28-d08e-42fd-988d-cfe4ae816dc9", "value": "T10524346DD34B02A98F525336AB1B5E4542BCBA3EF38522B1346C833533EDC3951292BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749707, "uuid": "64c3f5ef-2988-45de-9b0a-d356b04bee3f", "value": "768:5wAbZSibMX9gRWjq1EpH6VNLcJ5T06t7gwVFX:5wAlR7ipH6PcJ5g6tDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698749707, "uuid": "1ccdd9cf-1046-49fb-9a6b-b4735a706f0e", "value": 209906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698749707, "uuid": "c31769d9-4ef2-41c1-b7c0-d0ded50c07b6", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749707, "uuid": "9f65bf19-b20f-4e2b-bdbf-a6b99791998f", "value": "REF-10113128.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b37267c-77c0-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698737854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737854, "uuid": "908cc157-2d7f-4c12-9b36-9a50826a6b5a", "comment": "Malware payload (Amadey)", "value": "ccb42719cd1c338063218a0ce9d31227", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737854, "uuid": "a577571d-cde0-4981-86be-5d099851dec2", "comment": "Malware payload (Amadey)", "value": "d06094368166a83ecc3802c2ff155d2ae25c1d7b840331fb2c52ded1d6ffdd62", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737854, "uuid": "54c9e8bf-bd37-4a44-8bc2-6e5ca6ca4987", "comment": "Malware payload (Amadey)", "value": "3e39433a9099b9aff9924aea4527c6ecb0c57f11", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737854, "uuid": "2388dabc-1220-487c-bfd8-81bcc8288988", "comment": "Malware payload (Amadey)", "value": "8b803d7650398a6268c52a9ad5d736a5db95327ecc1c7a3bc7b81ee6746ce270caa0796623d16f113f6832721c31262f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737854, "uuid": "a453e858-f3ff-47b8-bc7d-6a9e45a9f1b8", "value": "T136752322F7D8D472E8A007740DFB16872B347D619D7882AB2392DD1B8CA10D9AD7477B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737854, "uuid": "17d46c80-928f-4fe0-9b3f-7fc9fdf97f34", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737854, "uuid": "94178885-e607-4c40-be8e-e68a63421521", "value": "24576:yytl81dZtjEmTjLtYI50rYPz4AZRX3OGn+m/hDk//p3N2CUfw3/:ZtlgdbEuZYIqrniOGHhDoR94w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737854, "uuid": "f51cdb3b-b9bd-40e2-878a-105ddaaf1e4d", "value": 1612800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737854, "uuid": "30c5ab18-076a-4b2e-b4b1-0eb3eff8adf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737854, "uuid": "906b7586-ef99-4947-8f79-eb5c0b70273d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e3a11d-77bf-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1698737274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737274, "uuid": "47775bd5-e338-4be2-adbf-0e7e2a31db66", "comment": "Malware payload (MysticStealer)", "value": "0057a88d88403138f362aae6b596a61b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737274, "uuid": "5da1b4a7-34c9-4886-8c3d-63b7a3dac93a", "comment": "Malware payload (MysticStealer)", "value": "d0d3c2f792952553b460dc4d3961ea0c48c880410171f4c9d69f33864d7178b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737274, "uuid": "9e73fd0a-c281-4aef-93eb-df01e80a2600", "comment": "Malware payload (MysticStealer)", "value": "2489e63be539af46fe470a8a81070e9d6fea123a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737274, "uuid": "86f9809b-8d6f-4d11-980d-7186b2970e27", "comment": "Malware payload (MysticStealer)", "value": "26f711406b3064470ea4888b3dbc8bd13a8822ca663ae7cc00309e90485dd0d21eb1173c7deb8afcf84764f9f7b547c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737274, "uuid": "7bf44fb0-01a8-4af8-96fa-ffc240307306", "value": "T17B358E20FCC49165EDE210BA43ACB62686ACE0F4071546DF15E85BFED7A06D13B326B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737274, "uuid": "c6ee4d5e-cb0d-4184-87e7-dc53f33b6b2f", "value": "b6874b762c445425cfcea5128380cca5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737274, "uuid": "9c337398-4c6f-4af1-baf9-a4910d924fa6", "value": "12288:ad68cKl/pYmtww5o7a0dY71eC+8/yqkOIZHEff7eKgru+CVcpBHL2f0ahqH:a7umtww5o7a0dGD5/yDZIijL2fZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737274, "uuid": "8a18e2ae-c623-48a5-94b8-1bd3003f34c2", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737274, "uuid": "1331f581-7abf-4a13-a504-f191f8c6a2eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737274, "uuid": "0578546b-2877-4b24-a13e-2ddcae320277", "value": "0057a88d88403138f362aae6b596a61b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11683bc8-780b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698769942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769942, "uuid": "ff7b628f-cfe8-4223-b2eb-560d70d621fb", "comment": "Malware payload", "value": "d92b14744c5f28a4413cb92d04fefd47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769942, "uuid": "f32d2b1c-2a47-459e-8aa5-b4c167dd83fc", "comment": "Malware payload", "value": "d0df76709b6ae3e3dc4cbf928091355e8cd18b67510d54fd9658314e88a30e2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769942, "uuid": "e7582533-5281-4da7-bbeb-7028ef5a9d41", "comment": "Malware payload", "value": "73df85cdeb92784ffad0580a7614757d977d8f4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769942, "uuid": "283e2045-7865-41d8-8a79-10451121148d", "comment": "Malware payload", "value": "e06ab56fcfd894295d05dc416827734fae2b0b4a39ed89162cd923d8f86f653783380cf1ebc553fb2fc37b30def5ce77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769942, "uuid": "e44fe171-0700-4976-9e8f-853057dd4073", "value": "T14E84D002B6D688B2E5731E350939A721A97C7A301F34CA2FB3D44D6CDA71581A635FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769942, "uuid": "4a497e0e-86b8-4550-b37a-45a5d14c02ad", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769942, "uuid": "35d42cdc-c007-4b57-a57a-7080acc2dfda", "value": "6144:2IIcrXQ4S33w614mazUBHfSdocWYD24f31nc3JGeA87LZa/FiWraaIxJ+Hcf:AcrNS33L10QdrX631nEGeH7Lg/FiWE4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698769942, "uuid": "ac525727-f0b4-4a37-82ba-cc2c276a3115", "value": 407182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698769942, "uuid": "59b0a50f-ae40-4eed-a1da-c37db52866da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769942, "uuid": "ab1befb9-7800-47f0-9756-73bf63d673be", "value": "rhzjdgfsd.sfx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecd2a88-7821-11ee-8907-42010a9c0042", "comment": "Malware payload (RecordBreaker)", "timestamp": 1698779655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698779655, "uuid": "cc9fc5bd-9259-4643-8f86-ec1da8f912b1", "comment": "Malware payload (RecordBreaker)", "value": "a138b72898e30ea18028693b9f1670b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698779655, "uuid": "91484f00-5917-4e0c-981a-adfd2248d55d", "comment": "Malware payload (RecordBreaker)", "value": "d10e1ac749cf2185f3c055253d44dbe8011ef7152c8fcc058b1552d86b9f77c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698779655, "uuid": "c18d6c3c-742b-429e-aa97-9b9ebf4d4cbb", "comment": "Malware payload (RecordBreaker)", "value": "1257564ece8a860946b79e1596b7512539031d94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698779655, "uuid": "831eb454-7fef-495a-918d-44f7c573b6e9", "comment": "Malware payload (RecordBreaker)", "value": "e8aba3e822a475bf517dd833c4bd91f1b1c2c1f89ad05c5460e299a6cefbeebbc50c8aea3786034897dc874c482cc8ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698779655, "uuid": "3f68354d-86de-4e24-89fb-4ffa3fb1e770", "value": "T180752323B7E48271E9F6BB3049FB03831A75FD9255FC650B3252E44258736419A3A36F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698779655, "uuid": "8ccf3aa5-24e5-46e6-9338-af68f1742c05", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698779655, "uuid": "6cdfe154-f08e-49ef-bb6d-c95cbb19a437", "value": "24576:IyOHYYPUyKXDTGEw+9BSHz5NZjFCbjBFEe0qNZ2sALHfBYvfplwGqypr2osk:Py2yGtAHRg3PEenNYsrfOCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698779655, "uuid": "55c6dcd1-6f44-4b4b-9d23-cb5ff53d29ca", "value": 1616896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698779655, "uuid": "a02c3619-8c54-4cdb-9f50-4a5c47bdb1a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698779655, "uuid": "552e3481-d8df-4cff-8a82-bf46378c45cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a018f83-77da-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698749126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749126, "uuid": "dd73cab0-46b6-460a-8572-709d81f6ae78", "comment": "Malware payload (GuLoader)", "value": "617ff260c3c17d90c394d42cc5e14959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749126, "uuid": "17b6ee36-1210-4cc2-9c42-2185ac99e5ab", "comment": "Malware payload (GuLoader)", "value": "d179cf3c09d0d15b89f250aa1b4a75d8bbca3c49d472fe57c56b1786c65af483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749126, "uuid": "5cfb45ca-fe32-4c70-b93a-374cbd0fcff5", "comment": "Malware payload (GuLoader)", "value": "a545bbd4d2a9c534e5f49c3b54aea4bfd12ae4d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749126, "uuid": "b376a2ca-338e-4600-b785-9fe0bce93351", "comment": "Malware payload (GuLoader)", "value": "01f8a0a844f6237854e10468433001a5c42249ce646b4d608e32948e05a83ab7b17de71e841c128b1cf61784bdbfe256", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749126, "uuid": "7db79473-d797-47c2-b6d5-a0e2f6ad606d", "value": "T16EF4E0216B19F913E2F213F4C467DF697B258E150E3BC67386A1AE2B78FC3911D18216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749126, "uuid": "0ba95280-12f4-405d-8554-7aae5e9f7528", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749126, "uuid": "ebf0d953-6e85-4ad5-ac99-9ffc4ed293a5", "value": "12288:uJWNBQfoDHA6HSt3N7dtSf27eUAjI9XLvlDwLEuSflue6VfFtqdXFH:uWD1kleljkbvFHfluNtqdXFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698749126, "uuid": "2afcdc68-b7a4-414a-8c4d-bc376299e9d2", "value": 736090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698749126, "uuid": "a9370015-4fd1-42f6-bfaa-c736fe09663f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749126, "uuid": "18f344f4-c8e1-40f0-a9f9-e93b674f3aed", "value": "z27Icycold_Orcamento-HPN-100001329016-1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d65d70-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698735528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735528, "uuid": "40101f84-9297-4ab9-b544-8bf5ff4f98fb", "comment": "Malware payload (AgentTesla)", "value": "41e40b0fbe362be8955d116b9e9cb3de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735528, "uuid": "629e0ca6-4122-4837-a3a0-11b242f4228a", "comment": "Malware payload (AgentTesla)", "value": "d1f51cbb32fea7f702c71d3c742839e5ff5cdbff34e2cacbc0e4cda58ae16722", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735528, "uuid": "e10ca40e-78fd-4e57-b140-26b3fd4dcf4c", "comment": "Malware payload (AgentTesla)", "value": "a936a297d5fbd3dc7194dfa16a0a3d5ee0c3d216", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735528, "uuid": "fd44e6f3-7b87-4c86-af34-82a7fea62a34", "comment": "Malware payload (AgentTesla)", "value": "c8bc6257ae61331b571e8ae91ab2d6e3351e8837f61ea0ffbd343e652648dfbba1904a53631d0674a475c183719f53fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735528, "uuid": "5071b6e2-3f1d-492b-80c1-3382222f9176", "value": "T1A0F4F15325594EDAFD6D53B2543B4EED17660E3ED6B02C2D24AEF472833324B321682E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735528, "uuid": "89d2cd20-1e2f-4a39-9a51-cbe0d2e91271", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735528, "uuid": "d5dcee4d-9b2d-4913-a4b6-ce77734707cf", "value": "12288:Ym1Di5wr+kQiFRzPbIFS4W+hCN4lIK5njfwJuP:YiDmE+MRzch7+iL2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735528, "uuid": "503ce1ef-d393-4100-ac9f-8508355e5b85", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735528, "uuid": "f5ac7dee-1276-4b7c-bc8f-6a009542faf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735528, "uuid": "9c1fbf2b-8f78-4bbb-8e1a-83695a8ce988", "value": "PO-0011202306.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b39211e-77fb-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698763087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698763087, "uuid": "86fc117c-234a-4811-ad42-fa2b415683fc", "comment": "Malware payload (Formbook)", "value": "2cd69c072759aad8316bd2355e38ab00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698763087, "uuid": "3e8107bd-06db-459d-9bc5-5c673d2724df", "comment": "Malware payload (Formbook)", "value": "d234e1948dad52b1baf3bbf4656842f9b21d63f63d8cc7d34abd50b9b8953401", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698763087, "uuid": "23bc2b9e-1758-4948-840b-a2324525e58f", "comment": "Malware payload (Formbook)", "value": "76e68306c1b3601ad8705899c5fd40e1bc6fc57b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698763087, "uuid": "2122e681-68f8-4db1-99e2-d9de45919877", "comment": "Malware payload (Formbook)", "value": "3145aba1cdfb2c5e4d56db501add9b61e2cf36596be4060ad246a84c41325bf0e4fcb034f7a535f8feccddbcd577546e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698763087, "uuid": "529d56dc-e030-44e6-bd55-ba453b6bbeb0", "value": "T159F412162798CB22CB2D9BBEA07500484BB14623E852F75DDDC9E1EC1C263D94D2F6E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698763087, "uuid": "6f774ccd-b443-4678-a3c8-12f157f62d40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698763087, "uuid": "2695eb65-216e-458e-9b41-f67bce2fae19", "value": "12288:j2FFpvaC1FheIV9RcEzZ+ajexpBDknLKvxpvuYukPpLnmK4:jOFph1LV9Rh9JSxzknLAu0rmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698763087, "uuid": "eb18059a-ec0d-4a89-890c-8db7c830bb40", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698763087, "uuid": "9a64ef4a-65f2-48df-9b0b-9e165c8a7bf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698763087, "uuid": "44bf2949-cd14-4c84-88fc-4aaa3297c96a", "value": "sbinzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9692076d-77bf-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698737524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737524, "uuid": "9551f36e-bd6a-4372-887f-0279a08525c2", "comment": "Malware payload (AgentTesla)", "value": "ada654794b72ff4d6c5bc4a2b980ba85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737524, "uuid": "87d9dff2-2e91-441e-a6a6-f46d78cd6668", "comment": "Malware payload (AgentTesla)", "value": "d2c753ecf3190e32e4a5ed873a796383a445c3d51012bcc5739bd42d99dfafc5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737524, "uuid": "6a289272-fc07-4b8e-b2a9-d2c492474828", "comment": "Malware payload (AgentTesla)", "value": "0abd6d77ee33987cb7a32770e5b6887a4a04deed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737524, "uuid": "a1a9eea4-e82f-4e84-8bdb-9b41d39549d7", "comment": "Malware payload (AgentTesla)", "value": "ac3e193cc644e33855c6b7c017f82a63e48708ad2c708993e2b2dc1b9cb0aeb1e5ded343a0f51a84bccbf217cc06284e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737524, "uuid": "67851c6a-c68a-4454-9034-4988a90d861c", "value": "T1F6B4DF64E6F1660DF5E24A7A9D70A6E4673238627A02D25ECC94E08D743DBC7CAC0673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737524, "uuid": "f34a837c-8f90-43e7-bb2e-528fcb7711f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737524, "uuid": "a496847b-86a3-4e32-9e59-1a092626e1e0", "value": "12288:nTW86fsTiubFoAlT6ZogjuQ7DYmXesyIXm9rXmKQVTNpVo:nTF6fWoAlm6gjdbexmpVxpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737524, "uuid": "673886e2-3dd1-4c5b-8cc3-7670cc4e508c", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737524, "uuid": "e659e7cc-354c-4bf7-8ba0-87f5c7678bb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737524, "uuid": "becbf407-1cf0-44ef-a6d6-6ebac9848e90", "value": "MT103originalCopy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc69c23-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698734962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734962, "uuid": "f297194c-7913-4782-9015-6a3cff4fa1e5", "comment": "Malware payload (AgentTesla)", "value": "d740a67c08ac249e982a644ab1f8609f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734962, "uuid": "2c7afa4e-9de7-48b2-a0dd-94e83c3b5dea", "comment": "Malware payload (AgentTesla)", "value": "d452cd60be5a85bf77b9866d3857b7cf8210baef2391b0250f6c745b0b794d3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734962, "uuid": "c9cd9c1d-b7f6-4bc8-9e29-f97e18b4d815", "comment": "Malware payload (AgentTesla)", "value": "a2c9567ffb677c8d721124292baef6e698d9c950", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734962, "uuid": "3b6e7f10-5bf1-4fa3-abd4-9636ddbda97f", "comment": "Malware payload (AgentTesla)", "value": "e0bbeea98d30afba696687827752821b3a04b446273db4d5403e29cff4d5dedd22e989388528eb0aca1717f21fa8272c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734962, "uuid": "84bf3588-3bb4-4e1a-915d-46890f8e0de5", "value": "T140E423EDCF5E81DAC955F2D3159D4DAD0A12BF8C0388472E212B4AEEA7460C5B4FD89C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734962, "uuid": "19efd44c-6aab-4a4d-922d-31123230ade7", "value": "12288:c6KJ+qUdjloaR0/im61aNCI9N+brSirAtmmtYQXyaVRi21:c6KAqUd5JR0/iV1a4UqKQmt5XyaVQ21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698734962, "uuid": "a40a9b7a-3a6f-4460-bf9b-71d5c39ba8cb", "value": 669290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698734962, "uuid": "159f0220-511f-4018-bac1-542f85bd11f8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734962, "uuid": "fcd0c318-4e95-476f-988a-df832d2cfed5", "value": "Orden No_AM64782.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deca04d1-77e1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698752248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698752248, "uuid": "f453b337-7ddd-43f8-97e8-99919e955cf4", "comment": "Malware payload", "value": "bb2296d5b0c26c86f3a7847923dc92c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698752248, "uuid": "c23b000b-c999-499a-b86e-06f7f6d58a71", "comment": "Malware payload", "value": "d48d8fc7d8f2ff5a0bf6245240979a82684a79ead531ef4ae46ebde9af0c5a6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698752248, "uuid": "afea278b-e99d-4855-97bf-efb62ca14a5d", "comment": "Malware payload", "value": "f9ec5dd16bb77042d9941e52da3c54b901022cd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698752248, "uuid": "adaed55b-37e1-4d5d-853c-e11ba26f4cb4", "comment": "Malware payload", "value": "4efc4fc65205d9b09a04fa62b87af4ab79b449a6872cf45abf748ba10d20e7e12e34e2bb720229eb56d1b7d158b40e96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698752248, "uuid": "a464a65c-04e9-4d51-aeea-6b2f52e18c3d", "value": "T1E9741224E5F6E705FBE14678EE29608127B248231D4FC5BEECC9C98A2D15660D4F133A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698752248, "uuid": "6efb4d8b-30d6-4cb8-aa00-eaef22a31803", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698752248, "uuid": "73144240-c7f9-4e5c-8b83-3a871025233b", "value": "6144:/2G94nD4GdLgxpel2HODUUkenw/4IVrJmemcvEM3mLTbPsYv6lLMgKvvKha9hZ5U:eU4n0GSxpeFoUO/4IVvvEME3sYv4MgKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698752248, "uuid": "f71dc0bd-5ff7-4a76-b26c-4b4ae96b8d7d", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698752248, "uuid": "58f4c679-7964-44d8-837a-bfc0a0ddac11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698752248, "uuid": "dafed706-6766-4faa-8c37-2afc9bcec0cc", "value": "PO-000001306.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f208fd0b-77f3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698760011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760011, "uuid": "af5bf9c8-9de4-4006-8aaa-adaef2488901", "comment": "Malware payload", "value": "c319cc8680b41d3323e9dbb605e4f305", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760011, "uuid": "cd6859d3-9982-4ea6-91c8-3fb9efcc6684", "comment": "Malware payload", "value": "d59ebb5cff15141dadb893eb091188826095a182dfec3b49d0ccace3674d196f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760011, "uuid": "dc3559f2-6aa6-4a31-adba-f2521af53e82", "comment": "Malware payload", "value": "2607826b690f4b83f10a55d205e40031f7091684", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760011, "uuid": "85e1158f-fa79-4631-bdf3-7f62d953d46f", "comment": "Malware payload", "value": "674cbc9dd171031df57487eada8fa3d3149d22235a46b8d5242e7c9c28aade59292465d7048daf10097b6d8aa8a15526", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760011, "uuid": "da490aec-fa66-4240-882f-d795e884170f", "value": "T19D1733E4D59A5FA41E0E7802FA6A33CD23D6B401B86CDD238DE771BA4153642E09CDDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760011, "uuid": "d238ee1c-f86a-4948-bcd5-b4f6cb1a9727", "value": "393216:0PWO2aMhl3U8VqFs2pOuL6E6JPFuIkPKEKO/3xDf8cirBDatwRvbJ4ss+gA:0POaU3yFnpreDiIkSahwhZiw1qra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698760011, "uuid": "1d5ffe1a-2623-43f3-a4df-b769630a4e31", "value": 20150930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698760011, "uuid": "7c78f4cc-c45e-40dd-80b4-dd22c6dd36d5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760011, "uuid": "22f584f4-b273-4dce-b51d-f05ac67da3a4", "value": "ec26.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed7f2a7-7786-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698713191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698713191, "uuid": "7924a609-9afe-48c3-a1fa-0f6f2987c3aa", "comment": "Malware payload (RedLineStealer)", "value": "8ad19e5342b8b6c1ca99bdda95fcd88b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698713191, "uuid": "7d94a222-4f4e-4834-8622-be7b160caa2b", "comment": "Malware payload (RedLineStealer)", "value": "d65edb8c4660f998ce9a8c7788f7953f4ee59612c8a40e9f590aa0397708f93e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698713191, "uuid": "494ea48b-21e1-4b0b-a4b0-d2d35f8eef06", "comment": "Malware payload (RedLineStealer)", "value": "b17966a989c0558e7c68e7c74e5ed16865cb4150", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698713191, "uuid": "aa8b96f4-1bf3-46da-a43b-f104749eb57d", "comment": "Malware payload (RedLineStealer)", "value": "40911d6aecf530464ab22153a19820b70edc87cc997f66abe148a7b5b097e9325814c1f455e58f3ba347c2e5a0c5b720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698713191, "uuid": "8a4477fe-142c-4255-af80-c62e01e58100", "value": "T102752362FFE64B62ED351B3161F583430E39FEB708A801EB2754812D1DF2A4589B175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698713191, "uuid": "63e3897b-9ace-4925-8f36-a8d7a3c52b94", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698713191, "uuid": "3e106f76-be7c-44fb-8a01-298f6ffaf3cf", "value": "24576:qy84DH31noQWhvGazh8DxAKRAPWcUdJbKEny/ZH0r8ZugML1hOBG6OQ/24mxTKN:x8eHln9xa18Dd3cUmEyhUKQJ8G6I3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698713191, "uuid": "3e0177b7-91a8-414f-9e62-bc55b1158a78", "value": 1616384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698713191, "uuid": "7662213e-38f8-4e85-9d6d-34bccb66c471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698713191, "uuid": "5eb3d8f1-babd-4f81-958c-2cfe5ad506d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf16da9-77f6-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698761234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761234, "uuid": "42952afc-c73f-4621-b25d-bb9b998f01db", "comment": "Malware payload (RedLineStealer)", "value": "a89ebe1dca1e0addb02a2fff08fcf729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761234, "uuid": "9c4ebc95-b102-4429-ad4c-72d2ba77da5a", "comment": "Malware payload (RedLineStealer)", "value": "d73566fd084c81068bf3c4a586974274cbb1d200a5ebd3e28fe1c01d78e5284d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761234, "uuid": "8230d75b-c54d-4a4a-8dbf-9f314d9c59f8", "comment": "Malware payload (RedLineStealer)", "value": "c45c1a839036311776a8ec5ad8300269d969dfe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698761234, "uuid": "0fa0d47a-fc30-417b-a9ad-60c3bb3f4f0e", "comment": "Malware payload (RedLineStealer)", "value": "330175ab4d2bf8717f3c118e019635b7a77eea0309e314c0e0b259520fba15c6e2766c37df45b1c098da5cb2f4a53d9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698761234, "uuid": "47912710-1a0f-48cf-811d-45494e396da4", "value": "T126B448A5918790B2CC901E7D7F8C2AE28EB22CB419E13EC71ECDF14439B7664736592D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698761234, "uuid": "f101b503-cabc-4e3e-b7e1-62523f86892d", "value": "f8095a27aa19f6cdda5d2d33cbb77f2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698761234, "uuid": "36bf1b39-25c9-4fd8-b9ea-4b9612507e47", "value": "12288:ep+syol8egndWH9FTwNVKnkcq491QjPPosQWsXXL:wlEasVKnp4PosQWsXXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698761234, "uuid": "cb790c69-8145-4b86-9fd1-159f591e636e", "value": 513016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698761234, "uuid": "ce59be89-318d-473b-b3e5-3b5baced3208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698761234, "uuid": "fc503394-1663-4042-b808-5ece8fb0adae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63e1db4-77ea-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698756099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756099, "uuid": "e0f08128-2e9c-4b54-aaeb-14ed574b5909", "comment": "Malware payload (AgentTesla)", "value": "4583d6596b18cc84d2186d4587283267", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756099, "uuid": "41293bd2-0ad0-43ca-9741-1a7f8c18e408", "comment": "Malware payload (AgentTesla)", "value": "d85fa886dd4a1d381f866093bd6f1b8d8feafa371aad11657a46ac675fa5629f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756099, "uuid": "f6e4bde3-ffe1-4f81-8e3b-a14f339c0b74", "comment": "Malware payload (AgentTesla)", "value": "9ce8ec14915b5e2bf8d671cfa9819a27eceace8a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756099, "uuid": "940b0989-e33b-4fab-b832-3b97efcd0b17", "comment": "Malware payload (AgentTesla)", "value": "78c9449f23cc36fdcc00850fb83c9246b7ed55ce10e04e6b0c0b52b6132d619effc9efbc25b6d545e2d56154ff31ee97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756099, "uuid": "b00249e3-69d6-4400-bd11-8f082b0835dd", "value": "T1923400037E88EB15E1A83E3782EF6C2413B2B4C71633D60B6F49AFA518516525C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756099, "uuid": "443e2d2e-fdfd-4fb8-84dc-98053a6768d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756099, "uuid": "b320e76c-c82d-471f-8ecb-52d20433db5d", "value": "3072:LKrColxVZl4LFcfQ+3hbdBaGoFa+hf75vTZ4jhg/5q5VkcWi:LKrFlxVZlQFcfp3hbd321vTZ6gMVVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756099, "uuid": "c6269ae2-f82e-4e83-8548-68b77f56e278", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756099, "uuid": "3a609ca4-709f-4f8f-91a0-40f3f8944969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756099, "uuid": "3c882cfa-c9bc-498a-b2f7-90276a07600d", "value": "d85fa886dd4a1d381f866093bd6f1b8d8feafa371aad11657a46ac675fa5629f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e3711f-778a-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698714764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698714764, "uuid": "67121e4d-952b-48f5-8f81-aa123b76c92a", "comment": "Malware payload (Smoke Loader)", "value": "6af2068e70fd5eb61fe4be4fafba04ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698714764, "uuid": "8eb10a5b-e017-4c6d-acea-378c05a6fe90", "comment": "Malware payload (Smoke Loader)", "value": "d86b530f1dcf5d9ac1b107aee3085d7dec763b4bcbeddabc0d64451d2eacc9e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698714764, "uuid": "7f7f2490-6527-478e-b1f9-21e35020812f", "comment": "Malware payload (Smoke Loader)", "value": "1164cf42ebb1c0dfe6efe634b1dffc08b9314a26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698714764, "uuid": "2a0b92ac-4582-409d-a826-97030dd6646b", "comment": "Malware payload (Smoke Loader)", "value": "a19e49002e1fa2ec59d7c5477ec48ac84c594f2057f2583757aeb180be89c7039dd0091ada760cd64e6091a8e3bd5dbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698714764, "uuid": "b1aeeec0-1e65-4ba5-801c-e41b1fa99ea1", "value": "T1F426333128E3F9E6DCB66BF219972C5445206A206A80E248F21F053665CF59FE7BF70D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698714764, "uuid": "5f70a3ba-b43e-4ba5-ad7f-07ab759543e2", "value": "8d2803775af2b344d65712330e01834f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698714764, "uuid": "8ecf8c3d-085e-411c-a447-2eb6f65c02ce", "value": "98304:Jrw64myMpBfPJfmzyMFYIgTqRD72PmAmXoOpASGsJr:pw5m9pJPJfmzxFYhToDqPQ9pG8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698714764, "uuid": "f21fbd78-af47-4f5f-b1d8-d27e53495c92", "value": 4748528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698714764, "uuid": "c582654d-1615-40d4-a6c8-989545376cd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698714764, "uuid": "6c97bc19-118e-46a8-8214-185873385818", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a43b5c80-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698734970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734970, "uuid": "4e45e9f4-1cdb-4f34-8649-a37e1c285421", "comment": "Malware payload (AgentTesla)", "value": "6d4fb29d6d54bfbcac2b3d9426d437db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734970, "uuid": "fa5c459e-a9d7-457a-91ad-93ba4d0d17c7", "comment": "Malware payload (AgentTesla)", "value": "d923c32033c70b3a903f84ce8b2e37c706344bc4cee562452bf228b3076a16bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734970, "uuid": "df42ddeb-1099-4cac-aa58-5ef37081b260", "comment": "Malware payload (AgentTesla)", "value": "dd550aa9709f105c9d78069121e1d9d4feba319d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734970, "uuid": "4c397ae3-a052-441a-a013-7a990e9febc2", "comment": "Malware payload (AgentTesla)", "value": "3a872c864d61aab651c1ace8c7c1388d3c765ab0db4e3e9ace0f8b505a032edbca6ead15655db4187583e0365e01ae73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734970, "uuid": "3791c47b-1746-4ade-941e-e6d92991fd85", "value": "T1EEE423B765FA505BCFA5763472123F011BDE6D366C4523E7DACBC49B0243C852EEA810", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734970, "uuid": "df5d7a5e-ea84-4edc-a56b-926b299d7ff7", "value": "12288:WtcBCPuQOrNdwHm/shCSTXiPejpKXKGPpKTFqAaGL:W/PtO5v/shCSWygKGBKTwAaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698734970, "uuid": "482c6d6c-adb5-4395-956a-0e7aa8f169d2", "value": 671525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698734970, "uuid": "5057d95f-7ac0-4f80-a85b-8f9b595d80ee", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734970, "uuid": "bb9101b0-233c-4504-86bd-0329c2404770", "value": "Revised enquiry for Urgent buy Denmark.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4256c9e-77be-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698737198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737198, "uuid": "dfa09648-1a84-44dd-bcf4-c4697ec09fd7", "comment": "Malware payload (AgentTesla)", "value": "9c790f3aa4af087605d3ca829e9e633f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737198, "uuid": "afafa399-e0cd-430b-8acb-176ca40dab6e", "comment": "Malware payload (AgentTesla)", "value": "dc5a6c0264dc1bd2b948b6bf82b6912e8d7a8e691f95a2dcac4f7f6f0a5abb1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737198, "uuid": "e133a84f-2e81-453b-9ba2-a35477a2c36e", "comment": "Malware payload (AgentTesla)", "value": "6cf5bba4716741239b0dd1ec49f09cf0a0e28f66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698737198, "uuid": "ec011c72-faca-41ca-94b7-9c31f3f116d4", "comment": "Malware payload (AgentTesla)", "value": "2e4011c756b56201edf86a922a82ddd309de1ece50b47b0af61e627af0064032518b84767c1d73d5d577b2b8da1429af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737198, "uuid": "67bb5a2f-8944-44cf-81da-47289cfe22c3", "value": "T1FD151201BAC184B1C4A61D324B76BB11A93D7E206FA58DCF73D4196EDE316D0DB327A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737198, "uuid": "f9a5e97d-8252-4864-8f64-f2ff47af5d8c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737198, "uuid": "c5d6d0f3-ab83-47ae-9c1c-3bf81ad5d3f7", "value": "24576:bTbBv5rUNt/HlTycDRyQJjUZfpaOKUSdQYvH:FBetvtZRyQJchKzPvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698737198, "uuid": "21940076-c9bf-4039-b482-7b41fa84f2e2", "value": 938678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698737198, "uuid": "18235ebe-4025-463a-bdfd-a54afdccf499", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698737198, "uuid": "1c799968-e5d6-4982-9c01-3210fd5180c1", "value": "9c790f3aa4af087605d3ca829e9e633f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd28cc57-7814-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698774096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698774096, "uuid": "af56d193-b137-4e84-aa40-386a689d9b4f", "comment": "Malware payload", "value": "a8d88cbc4823e634b52a304af8f9e404", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698774096, "uuid": "23d10939-04b0-4293-815e-36dba2a1f3ee", "comment": "Malware payload", "value": "dd7eadb2f710251b89b863fcf1c39f6cfd83e080105123197ad05999a39d75cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698774096, "uuid": "5b543235-3c29-4225-b2ea-972407254137", "comment": "Malware payload", "value": "eba1f47c6e74e4f5480aa65ed54ff7dc0e07eccf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698774096, "uuid": "a654fa4f-372e-44af-93d9-7fad32457fdd", "comment": "Malware payload", "value": "60d732c7a565e843d8e636afcfba316702c87c2f54af6e56100c5605f920714966a3cc70f7642b0756b844d655d0d83b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698774096, "uuid": "9489d50f-6063-4bb3-84e6-becad8bce195", "value": "T16845CE8B2912885AD4D4BF746CF565863A379CBA0014D283EDDFFE2CBEB134461C669C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698774096, "uuid": "c6f583ef-0a20-436a-8302-86044eb291f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698774096, "uuid": "1377f084-0cb4-4df1-8f62-d2475f6b7310", "value": "12288:uLNboa9XPXBC4ixSWe5oUekYOICNS2/zkloKnAn44y3J3XlAt8HbacNpW6a+rTmI:gNn03Sj5VTNSCYBH4yA2ecNY67Hj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698774096, "uuid": "2ffce6a3-e2a6-42db-98b5-1660f7033bcb", "value": 1182208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698774096, "uuid": "e7cdcce2-5ce5-4e16-8f46-50d3bda87901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698774096, "uuid": "cd7296f0-c0e8-4426-8f6b-8ca17da81d78", "value": "invoice and packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a60016-7844-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698794667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698794667, "uuid": "19fbd33d-0773-4bb7-bfaf-3b530ce05915", "comment": "Malware payload", "value": "92006c36f729aefcd9ec4cda1163f7df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698794667, "uuid": "85e84a7f-9c9d-482e-abf0-f26aa7a0bace", "comment": "Malware payload", "value": "de202d2f7ee8a12500e6de9d1c9023bfeafee79cfcc1eef197e2629790b655ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698794667, "uuid": "d2711a80-1ff8-4840-8203-178466f9c0f0", "comment": "Malware payload", "value": "2f11a44ffd307807bf42627a27f153466cf74d39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698794667, "uuid": "396ed44e-3892-43e0-a310-646e5658ff04", "comment": "Malware payload", "value": "12280e20dca6709734cc6b0d6a7271aa665bf200cdbda827a1ec36730e6b78f65f5c01c8f17185695b9dd36b20693d89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698794667, "uuid": "aec5b195-2250-4101-a566-51c1a47e1fa2", "value": "T14335E14131D5D8C9E4433AF258BFD16096786D9F40A0C60D2B86BB2A69E734374EF78E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698794667, "uuid": "a4b2aa55-68bf-4287-b7cf-2366c7813eab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698794667, "uuid": "80948b68-b8d6-45d3-b534-d05ebfc8aa56", "value": "12288:65CQ/kGgdPc55u4ue/xiWYgmGif5cxJKqE/+YV33RR0O7f03l5rQp0ZlaSiyyjK:ix55TmWYCie/VEBBRXJSad8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698794667, "uuid": "d2c76397-b557-4c72-bc91-3e44bd2b4f46", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698794667, "uuid": "35196461-b05d-45e5-931e-54c12f6882c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698794667, "uuid": "717a84ab-fb09-4c24-bd16-402cf6537de3", "value": "SecuriteInfo.com.Win32.MalwareX-gen.591.30569", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea11c853-77eb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698756562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756562, "uuid": "b80af97d-89b6-4431-aee0-4d87a35f113f", "comment": "Malware payload", "value": "d4a8463332d11c465c311485626a089e", "object_relation": "md5", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756562, "uuid": "83a182d3-65f6-49b4-9918-7fabda65bd3f", "comment": "Malware payload", "value": "dff3d7a15b8ff7fada4397088a658bc79d47c0d387ee9a3c710490d73983395a", "object_relation": "sha256", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756562, "uuid": "defca2b3-9554-4a75-8ad1-54cac88a6970", "comment": "Malware payload", "value": "ddc07ff6160187c0b48d9b1d34aa05af90483bd9", "object_relation": "sha1", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756562, "uuid": "de889a30-2005-48eb-b239-00e74bb3f6d4", "comment": "Malware payload", "value": "51f9592b1af056bf34578688f5b0c19975e4be399cef0046528b3c0b5b33278f861f377d0208b80f4d53b78b444f19d4", "object_relation": "sha3-384", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756562, "uuid": "0fbcfeaf-4312-44d7-b8d0-e296ce09e268", "value": "T1A8A25241AC00E642B34B3CB94592B62C696F850FC7644902F78DBBBE5B7CEB94097B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756562, "uuid": "8c53c4b2-faeb-4668-9ec0-11ab1b617a27", "value": "384:QcyvJh/drDCNrr2YyHEHaeizHlf2GkxUtJNFw5ARMthKqsvvvhUvhkvkNp8mpdFm:QcyvJh/drDCNrr2Yyk6eizFf2GkxUtJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756562, "uuid": "667c93c8-3d6c-41cb-b830-1d454b052fde", "value": 21964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756562, "uuid": "d620c872-c641-4426-a57e-fb94cb1c94c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756562, "uuid": "e13201a9-e94b-42e1-9187-9c7ccc0d5a72", "value": "settings.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b4fe4b-77ea-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698756103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756103, "uuid": "12a7bed6-5e87-481b-bb3b-af65b6c22a3f", "comment": "Malware payload", "value": "c29c1375b79b2a39a4092cb6946e3f28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756103, "uuid": "71f23938-36c6-4c6e-b121-39f3d1069e10", "comment": "Malware payload", "value": "e22a20c2e0547c6f4005ee9880587503abb4cb087588c7d44cc2fb90a5838ed8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756103, "uuid": "d167fe8c-e176-4564-8f20-f129e43481a0", "comment": "Malware payload", "value": "e99466df0037b2dab766e7b158608221b2d20d1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756103, "uuid": "c2e97895-c227-496d-ad65-98cdde757553", "comment": "Malware payload", "value": "bf63b9092d0735e74ba04e3a01dcd98bff19e77139c2f7c0fded19f4381e7c41be4603bb0ee8b26a8dea0f1ce49e35bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756103, "uuid": "a01e7048-51c5-48cb-a534-aec7cf0de0ef", "value": "T181E4F1407ABA6B15E6F8D3F94662650403BB652A31B9E3C44ECE11CE1BF3F804952F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756103, "uuid": "6ab3f377-12c3-43b2-81f6-3f5877f63a9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756103, "uuid": "a3376bd0-87e4-452c-90f2-e06635afeee1", "value": "12288:fXWv0zKz2UOplarRlrmV4rDw2m9Hvw0//PuqCDk:fk2XwSVuwFHvwS3kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756103, "uuid": "9d196681-d672-4fbe-871e-1041ab2266a1", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756103, "uuid": "a47f823e-d62e-4116-94ee-1f9f7e0d8ff7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756103, "uuid": "ee78da47-60c6-4fcb-9542-8c4e5541ef3a", "value": "Joint Fortune Shipping-October-INV13463.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699c59ec-7806-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698767943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698767943, "uuid": "7d450563-72d3-49f7-889f-03ee02882923", "comment": "Malware payload (Formbook)", "value": "791ce1434155065567a4acda67cc0740", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698767943, "uuid": "9de73123-bee9-4c6d-a1c0-4286eaadc9cb", "comment": "Malware payload (Formbook)", "value": "e22bd64f9bdc51260beb0a1ef3e1a2b45072a0a64522b8afe4d5ddb8eb8063ca", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698767943, "uuid": "5d62aacf-e9c6-4b04-8258-ef158ae48dde", "comment": "Malware payload (Formbook)", "value": "af7d03484baac95a52b682cec4f1365f740635b6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698767943, "uuid": "a12059b5-891a-4775-bd62-0f5a61812c92", "comment": "Malware payload (Formbook)", "value": "68c30758ec1b4fa63b010018fbb96b7cae877dbeaf51e66522cca624b1bf84d8e426b7feff1be51de0b1f3de56a4b734", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698767943, "uuid": "d37878cf-5345-4660-9929-a299b2a86dc2", "value": "T1FED423C426AB63D6AD9C2FB8C551910DD348BF6DC3242F75B7FA23908970BA63919313", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698767943, "uuid": "eaa892c5-84b6-4ca5-a198-3a4fe9545f05", "value": "12288:1vO1JLEwa9sItEH59zZdcTi6/womT80AAksRf0+zQ7:g1JU99t09zvcTDIo3WRf01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698767943, "uuid": "5277d631-2557-4c87-ac89-2928c247cd61", "value": 604937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698767943, "uuid": "904ef1cb-25c8-410f-8ba5-50feb713f2dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698767943, "uuid": "51266de0-24e4-4331-b583-637ec9edc557", "value": "SCW PAYMENT -OCTOBER 2023 SHIPMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b53a5c3-77f4-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698760188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760188, "uuid": "f1117b62-7e4e-492b-86dc-76952c61663e", "comment": "Malware payload (Smoke Loader)", "value": "1116bed364aa4f97554d7b7f5eafd1eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760188, "uuid": "20f7db36-0b22-4661-9ec1-c97ee29a63df", "comment": "Malware payload (Smoke Loader)", "value": "e2b5145997ea023b6a21e305f46d725c8686f152d5666bd452b8adcd5af92d82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760188, "uuid": "3a62f392-29ec-4391-b732-9ed3f664c5ad", "comment": "Malware payload (Smoke Loader)", "value": "6bc50e513afed6a1ffc1a2e15533accdf13da801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760188, "uuid": "ca528d03-9232-45cc-b4a0-af2957b527c7", "comment": "Malware payload (Smoke Loader)", "value": "4b4d7d897320baf1798e5c4a60db71ae3f3b8902ac3136db4f5aedf3abc44e484d7816e8ca7098378856df10039064aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760188, "uuid": "390748ac-c371-4920-b462-7f89a010ec95", "value": "T17C24291393A13C84F9268B33AF1EDBE8769EF5D38E59776912589E1F08B00B2C163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760188, "uuid": "bfd5ff94-2f1a-4bb0-820a-6ec1092e0790", "value": "f90e29ae4efabbc6b498b140aa3b7a65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760188, "uuid": "97b9f3e6-a0ed-4dab-94a6-07b5666069e9", "value": "3072:IGETm+ddoiVXkbc15JD1/Z6xq1qld60YnRVzfOVntPNUc:IPm+dd/VXkbyTZZUqUl8n/fO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698760188, "uuid": "fd1492b8-c5b2-4936-99f1-52e427968793", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698760188, "uuid": "44cbe947-c19b-49bb-b080-bfa703f59de2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760188, "uuid": "60fd4b96-b500-442c-aaa3-a9ae212e6ec0", "value": "SecuriteInfo.com.Win32.TrojanX-gen.19227.4693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02197bb7-77eb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698756173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756173, "uuid": "89a9be18-a1df-45f6-9aa8-b932d59c91f2", "comment": "Malware payload", "value": "3aebe9048bc905a6e9c7e8deda7157ff", "object_relation": "md5", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "ponteiro", "colour": "#D6B254", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756173, "uuid": "d4352ade-c082-4ae6-9ea3-ffaea54fb67b", "comment": "Malware payload", "value": "e345b19eff4b3881d8b608fd14278ee602f2f9b2cbde8b248492f80b3514b121", "object_relation": "sha256", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "ponteiro", "colour": "#D6B254", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756173, "uuid": "5f1acde5-3b75-43df-a1bc-1cf0c1ae98c5", "comment": "Malware payload", "value": "00038b6c158a14ec7e301ccff839888aa4096184", "object_relation": "sha1", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "ponteiro", "colour": "#D6B254", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756173, "uuid": "fcb88970-acb7-47a0-8596-5b418bd73e92", "comment": "Malware payload", "value": "9f15f78ddf736b5692f47fe4481d49a7c3d62ed997707e0261e7e472edbd4cf4544f1f851cd9e43fa476bbb06c44dcb3", "object_relation": "sha3-384", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "ponteiro", "colour": "#D6B254", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756173, "uuid": "4db0de16-ba76-4627-bc44-dba751c47685", "value": "T14C16127385807EC7E1B557BA7C2285088D29FD769F12123AF12F76A182B658CCFB0764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756173, "uuid": "1cfb99b4-2c5d-40b3-9d67-70f5df0d4969", "value": "58fc9a0a0ea32a098187db88ebb8c215", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756173, "uuid": "546af1c0-9d25-433d-bfb3-b890c5a3e004", "value": "49152:B4DW/LRMhSXfSKeTSDzk0BYDdcFtR2p2Vck96zP8XtPfSFzoxGo6MO+XmzRDfv4O:kWXv1eTSDfsdO2pY9oq8pooeCzlv4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756173, "uuid": "9681a5d7-33a4-4c01-bc54-ded654fb131e", "value": 4404224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756173, "uuid": "cc7bc32a-a2d1-421a-a873-eae7165c1adf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756173, "uuid": "6d91cb4d-d406-430f-8c99-2e3734fa90e3", "value": "__semqhn7_Q", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae692a84-77ca-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698742288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698742288, "uuid": "b6579f30-1486-49ad-95ff-96aaf87180e0", "comment": "Malware payload (Formbook)", "value": "40c6d46c7bf742d79a052527f120033a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698742288, "uuid": "c051fc48-27ab-4942-a47f-5bde1b8f4c3d", "comment": "Malware payload (Formbook)", "value": "e486c429d3307526c207b6372012999c9a9a84d8d90f72a9c185f1242d3bef7d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698742288, "uuid": "315e1fd1-09ce-4db4-b608-e22642974ca0", "comment": "Malware payload (Formbook)", "value": "83152a2f61b1dffc8e2ca76275936f0baf051fa5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698742288, "uuid": "d1ea5782-aa86-471f-b175-02d139b10a30", "comment": "Malware payload (Formbook)", "value": "6c16b5b84d2d350a7d05be2d6e4458d3f59bcd72e02da8dd1ada01c45b1c5c064481cd83e93d329c07af3154e4f60dc9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698742288, "uuid": "42366c97-21a0-41c8-853a-1cf5b90bc8f7", "value": "T13BD423C426AB63D6AD9C2FB8C551910DD348BF6DC3242F75B7FA23908970BA63919313", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698742288, "uuid": "dd6a4faa-f882-4916-834e-da440da38aa3", "value": "12288:xvO1JLEwa9sItEH59zZdcTi6/womT80AAksRf0+zQT:81JU99t09zvcTDIo3WRf0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698742288, "uuid": "c401dab8-0ffa-4428-b7b7-6c05139963ef", "value": 604931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698742288, "uuid": "85e7eca2-a3ac-40f3-ba8b-e357165a2293", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698742288, "uuid": "838836b8-d26a-4f63-ab71-a2912a106fb6", "value": "TT Application Copy for payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175a9503-77f5-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698760503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760503, "uuid": "7ffc692f-00c6-484a-94c6-e893c98b86e0", "comment": "Malware payload (MarsStealer)", "value": "75457ee78472b214f9532d2716d1a285", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760503, "uuid": "a3cb7c71-a984-49b2-94e6-7eae05b1d64f", "comment": "Malware payload (MarsStealer)", "value": "e4afe296a82993d386d4619f8a91152ac7da03a2dcf52c7eaee4397796d0f32d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760503, "uuid": "d2eafe69-4b74-4e80-9138-6f0236b97e61", "comment": "Malware payload (MarsStealer)", "value": "e05ef47ff870ea660a55f541ef4f0c86c2785c9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760503, "uuid": "1199a7f1-457b-4b38-828a-f4e46eeb51c2", "comment": "Malware payload (MarsStealer)", "value": "0acd0fb13618287517bcb74f18d05e005f3d66a6a967cceaf40ce9acd92e1a7189d3c5474a4918dafc33245876bca54e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760503, "uuid": "604afa6d-2c22-4c2a-bd52-d88f2d652328", "value": "T1DF24195393A13C80F5268B329F1FDBF8768EF5E38E597B6912589A2F04B01B2C563711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760503, "uuid": "a15d3628-65e8-4539-b502-9ec7ce7f55ed", "value": "0c9d3ff66162daea31cb3f02591d560a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760503, "uuid": "89270209-3f1d-47d0-8c4f-61f1a31fdc84", "value": "3072:XtA6+RCHjOiniKEy3oPI+x2IX50dZQ6FFnoJI9CJMNpNUc:dA6+QDfni+PyMQ6sJcCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698760503, "uuid": "c0ef06de-368a-4ebd-aa7a-815811cac96e", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698760503, "uuid": "a63defe9-70ec-4187-b94e-ccc44697ca17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760503, "uuid": "9e12604c-83f4-4a02-95f1-6af7fab7a92d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2739bc-77a7-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698727222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698727222, "uuid": "1e070d9d-7ee1-4b61-aa56-006a3f9e4c9e", "comment": "Malware payload (Formbook)", "value": "411b8eb23af4c2864c19e5539066d4b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698727222, "uuid": "a0f6a017-1c4c-46cf-8015-3eafe9751580", "comment": "Malware payload (Formbook)", "value": "e4b2f31e7c9fb2df6cf161898f23653c49d758f8f733e5910b99f3fd998569e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698727222, "uuid": "daca6eac-6a1d-4fdd-9bd0-56f0ea5b874a", "comment": "Malware payload (Formbook)", "value": "af343255ec80b898fdc67301ab1c07d59dd70fb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698727222, "uuid": "76ffe461-acb5-408d-9f7e-8c41e06a5aad", "comment": "Malware payload (Formbook)", "value": "316df98318ad8d9f6c0ed8c7c2de9ca898c846b8bed9a97322afe1dd280d1fbc1261396441572f0647fc1e059b64a727", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698727222, "uuid": "ed08ef60-116b-45ef-89cf-35172c1e1661", "value": "T1B0D423B87610D762D0A5237BE0740AE043E495BBBAE3DF6C5DC199C60D74B620339B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698727222, "uuid": "059d6770-afdb-4673-a477-305c451b5a7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698727222, "uuid": "479cdb26-9973-4926-a05d-a1092fb2f431", "value": "12288:BUR6dwoaRPImELgdr8/SkKqDR2MHOsgpshhRpyacHVuTwjIJ25yyCWN:BUR6+558/SFWQMHJguhm1ty4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698727222, "uuid": "5fb0af3c-5ba4-49ca-8471-b1184b58781a", "value": 623616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698727222, "uuid": "04b1dfc2-133d-46f2-89b2-ec814afe96f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698727222, "uuid": "d82581a6-0195-409a-9119-e35334a3d8fa", "value": "SecuriteInfo.com.Win32.PWSX-gen.18902.20315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4ac967-77ba-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698735522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735522, "uuid": "efbbc129-a4cc-4a9a-b900-61c2c3dc6425", "comment": "Malware payload", "value": "e4db8a7cf90502cdd5695b243d8a9d66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735522, "uuid": "0cba8aba-98ba-4c9c-ae4a-1c4ea4a0c1d0", "comment": "Malware payload", "value": "e83bd0e4c4aad652ca62b210f17e4a6f6319912c863c2798407c96bd05e9e8c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735522, "uuid": "626510d4-bb83-46b0-990a-591d89ba8bb5", "comment": "Malware payload", "value": "6d7bb07350f4b1c16a2073da11d307bdac188ab8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735522, "uuid": "f442ce1a-5fb3-416a-b17a-7202ee5d3cb2", "comment": "Malware payload", "value": "f3ed164347b33666ece48b40d1901a6ffa81ea48df2e53f2189b13f0debb2f6b8dcba30c23f8130696f8ca2677d224f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735522, "uuid": "3ea588fb-fa25-41d8-940b-f82b2f3f0d73", "value": "T15D15E1622744C98AE8191272D4324BFC06225E2DF570DC0FA8DDBD6EB7732D7321699B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735522, "uuid": "07de3433-3988-4ab5-84dc-36bb47d60e13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735522, "uuid": "72971c52-fec2-4ba0-8941-3da368dfc0fb", "value": "12288:3wLJRcFdsCylUvmDtfqmKKMIgalbjNDlIfL92/tOfgRf7V:3wLj5CQjDpLK3UjofLSRf7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735522, "uuid": "4cbdcd9f-9937-4ad1-8baf-3985963f7911", "value": 945664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735522, "uuid": "487d16c2-6ead-4460-9cc9-1aa9a5f9b6b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735522, "uuid": "0fe2de46-fad2-4da0-b7e6-0537cd3ad8ac", "value": "PO 2300001991.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7335a925-7789-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698714272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698714272, "uuid": "a644ead7-3655-4b33-92d2-4a6520975561", "comment": "Malware payload (RedLineStealer)", "value": "ec8bced62307629a7c665a590d6594b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698714272, "uuid": "d7b0c02e-6425-4a8b-909b-d2151971e78b", "comment": "Malware payload (RedLineStealer)", "value": "e8473fef65d17c9da9924866ac42f487e57da30e95381b56d3e75471d2ee62ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698714272, "uuid": "01d3d882-8b88-4223-bb3b-4f93c961ec55", "comment": "Malware payload (RedLineStealer)", "value": "d5584334d4241f8d6781b1ff10968b901584968d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698714272, "uuid": "9fc86b09-fed7-4cba-b737-a4601814ea6c", "comment": "Malware payload (RedLineStealer)", "value": "b06394fdc04317baade5fd55a491fd8fb40eb660c5ce0e3911142198a629dd9d13be97550f0c43bd8f1e98d844157be8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698714272, "uuid": "db03e859-6726-425a-9a77-ca5149533e7b", "value": "T13B752347FAF4A465EDB42F701CEB47C30B76BD699C28431B6391A5CD05322C4AEB136A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698714272, "uuid": "4a99f912-9a3e-4c3e-a17a-c8631d42edc9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698714272, "uuid": "d4274be6-6eb8-4caa-b67a-8826150e5f4f", "value": "49152:euRYv3EU8X+HcyeQnyYbj9iNtnY2HVHVX:nqMRX+8yeQDjMD7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698714272, "uuid": "a6433349-c2e3-4ef7-ac18-b839e103810c", "value": 1608192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698714272, "uuid": "aa0c2dce-ee7d-477f-b6e2-61fbda6a722c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698714272, "uuid": "9b1ce016-907a-4087-bbc0-c07870fd28ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b4f3ac-779a-11ee-8907-42010a9c0042", "comment": "Malware payload (Healer)", "timestamp": 1698721606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698721606, "uuid": "495b2ff1-a63f-4d12-a94f-a9c493b09785", "comment": "Malware payload (Healer)", "value": "4876370b4aa7cc5c03cbfc21da0d5c3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698721606, "uuid": "23d4d703-0e7b-4986-89ef-720a04b0c6e8", "comment": "Malware payload (Healer)", "value": "ea3081b6dd31197675f5d03c9853c2a8dd51868ac0bf7956cba0cfe1f7e8ae45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698721606, "uuid": "ab6cae78-8b06-40a2-b508-c94b6ed3b809", "comment": "Malware payload (Healer)", "value": "4cf8de2830dc960f37ba0dd0e8d50d6be0c90206", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698721606, "uuid": "a3c10f6b-f578-4258-b355-50b9c597fc1c", "comment": "Malware payload (Healer)", "value": "482392f4a878f90a4369ecda6faa15f0070a2a2fb297abdbfe11e7c064a8e619908485d3339edee2b079ca2eb43cefdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698721606, "uuid": "3b5ecf5b-bcdb-48b5-9d0f-df1d73a4481a", "value": "T101753343E7D48172ECA5ABB020FB07E70A7D7CE5AD70C72B120545992CA21AC7B6573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698721606, "uuid": "23bcda74-fb8c-4208-a50a-62c143c0aecc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698721606, "uuid": "2e25c479-c0da-4eb9-b61d-4c2c11aef3b6", "value": "24576:Myqv6Mq+w7oXYLxxccNUwCHCYqd+Rl0VxQW2Se7/+zCD13Y1:7qvPq+yJXUfjD0VD2SK/+zCD13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698721606, "uuid": "8751bdb3-f21d-4b1b-9672-9cf0e8e7ced3", "value": 1618432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698721606, "uuid": "7a2189a5-8321-4062-baaa-1285fcc0ab62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698721606, "uuid": "101789a2-4487-47de-b945-9d5c82175509", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c880a3f0-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698735031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735031, "uuid": "3d436a6f-f329-466e-bd31-41fa241abcb0", "comment": "Malware payload", "value": "f22a97184e274a9cd384a549415ea639", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735031, "uuid": "3fa1f536-3cce-478a-9330-9818bf1600d9", "comment": "Malware payload", "value": "eb1b6ffe3f488be5a4db032a49c8235e54afc59b318a11bf09b840902b062565", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735031, "uuid": "7b7ba81b-b9f1-4ef0-9062-251895f532ba", "comment": "Malware payload", "value": "af704f6c70e5e5ff260116d48736744d70e8b59b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698735031, "uuid": "ad147247-42b4-4882-8479-813ea0c6bef1", "comment": "Malware payload", "value": "64bfdc6738a3d5e9ddd0486b8ae5f8daa03b66236aabfc5b44c1b59b2c4c9d1c681f7dfab71e88b6ec658c40db812a01", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735031, "uuid": "950d8d02-c898-4dc2-b0a8-13357daee7b8", "value": "T19CE0C68E100FC408422D82F2000EBC88F6C1838D0A00F142EA9CC01C2E1C04CCBD3B9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735031, "uuid": "78098c53-5d54-4f70-8df1-3e20110a30fe", "value": "6:698t62Cap8wwc7EqhCGi27PWYNUq/rJLeGHF2z7OWRLCEKLpT6mW6J4fAJFJvF5l:65RcQG/Wp0rQGHF2zCMNQgCJ4fARvF5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698735031, "uuid": "138db4ee-588c-4e50-a74f-d9f0e35b5562", "value": 349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698735031, "uuid": "5ee7bb45-58b2-498e-850a-b5c5407f9061", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698735031, "uuid": "82a45a5d-a5ea-41a1-8dc8-6a6e59b7a11b", "value": "Document_OCT-Report-2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a34340-77d3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698746169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746169, "uuid": "004cf0ee-eb61-40c1-a09e-7b8ad60d7bcc", "comment": "Malware payload", "value": "4c9b0e70492b81fd0160351cca4bc819", "object_relation": "md5", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746169, "uuid": "358a356a-828b-4da2-893b-652672fb8da2", "comment": "Malware payload", "value": "eb2addefd7538cbd6c8eb42b70cafe82ff2a8210e885537cd94d410937681c61", "object_relation": "sha256", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746169, "uuid": "fafc206a-0792-49ac-8224-0e24407613e1", "comment": "Malware payload", "value": "b00fbecca04e3bd80b07e39958d62a981e216a04", "object_relation": "sha1", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746169, "uuid": "dcffe3d7-910b-4686-82df-80a115611b4e", "comment": "Malware payload", "value": "f40ecff8cdf4ed27f03b2fb9ec7b383951b56c09929c6aaed98ea90e6aed53af9d6587e024ece639229d4bb4f94639c2", "object_relation": "sha3-384", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698746169, "uuid": "f5f5755f-8f29-4359-b4db-6673251e7719", "value": "T11341861BD10F82B5EBC952C6F554AC0ED844D85E6601BC75B6FCD2C0AF160A1825B00F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698746169, "uuid": "20b3dab2-78e8-423f-92c8-4cad23cddd35", "value": "48:fwQTsDo+xEttYEjCY41Fc05GKWUEk7WYTlaVcmDt:fwQL+SiQCYmcMGKfEcRmPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698746169, "uuid": "9fcfd61b-a0a9-42da-b739-607e2368add5", "value": 1883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698746169, "uuid": "16f816bb-3bf2-4907-bcd4-616c2b390edf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698746169, "uuid": "732b3aa3-389c-4f8b-a53f-055a4e573ffd", "value": "new1109.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27f10f3-77f2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698759475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698759475, "uuid": "2abe00ea-eae2-4df6-8217-fc73bf0d4b0c", "comment": "Malware payload", "value": "2f93a7e61bd8eb8b595fd67c130edbc2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698759475, "uuid": "5701a1d1-ea4d-4cc9-9772-48f7342bfff0", "comment": "Malware payload", "value": "ec48d692547341789a9205f607983f9cd485435df4fefda1654a5eccbe12bfb0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698759475, "uuid": "39443988-e4e5-4218-afc3-9136d038baac", "comment": "Malware payload", "value": "61ff557dda346f2f91189c92456d946a41fb8f36", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698759475, "uuid": "4808b8da-fd5b-46b8-9231-c24986594f8f", "comment": "Malware payload", "value": "988163fe9bb5504e25fc42055bd4fd0bc7893cbee299d5b62fa2daf40893785a1817fa50adfb2f46ceb4563f56ff1edb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698759475, "uuid": "93716381-6e06-439e-a37d-fdd232b39e2c", "value": "T1D7743111A3FD5608FAF73F846DB592640E26BCA6ED79D2AD1260105E8AB2F40DD70733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698759475, "uuid": "c263a0b5-fca0-4ff0-95d3-e2d0a8507592", "value": "3072:YzyQ9OdYMPFJpcJcZknVewmBiUM1E2RfClUkhBEjyf/M:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698759475, "uuid": "54c97e3a-8344-4e49-b9b0-7116bc53ecdf", "value": 357856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698759475, "uuid": "8e8c45e4-e02f-465a-b199-23f828bda5ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698759475, "uuid": "d505d749-92b5-47d2-87aa-89f301951c8a", "value": "KNVX0789_9430262.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2859ed-7784-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698712272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698712272, "uuid": "11072b6a-63e9-4c3f-acd1-9caf2c2193fa", "comment": "Malware payload (MarsStealer)", "value": "f88100fe10c4aabc9daab98a1b1a5308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698712272, "uuid": "934aae45-b68a-4fd1-ba40-9ee962311f18", "comment": "Malware payload (MarsStealer)", "value": "ed094abd877a142de3367df9ee27ee86e9807dcd4756b02c68132ff0a0d6b168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698712272, "uuid": "1d341489-0c22-40b4-adc5-2f1a3817e4c4", "comment": "Malware payload (MarsStealer)", "value": "097689a350a2af5a19a18f924209df3a898bd154", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698712272, "uuid": "64957294-d805-4d73-a9e0-22c1b3dadfe2", "comment": "Malware payload (MarsStealer)", "value": "34b2690fd5de70ea9be7fb9ec7a787cef414231ae2056f7f104d7d037ebe8fcc02dfc594857632aa79e36093364c949a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698712272, "uuid": "bcc99803-026c-44b4-be4f-1fd012b555ce", "value": "T10A24292393A13D85F9368B329F1EDBF8368EF1D38E59376912589A1F04B00B6D1A3751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698712272, "uuid": "28d82944-2b58-41a7-add9-7d808c93d3c4", "value": "9def1d395ceead157211a16b89467252", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698712272, "uuid": "854ce0f2-21b5-4a25-b527-bf03d38f017a", "value": "3072:gZcppBKGeRJhNuCVAo4Zy2x9egic39xjKmH9vQIzeNMh:lppBK9RJhNB4ZyAegLf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698712272, "uuid": "66a2be4c-50b7-4dfa-889e-27287a863006", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698712272, "uuid": "68cc3ac3-c07f-4946-9cde-965fa589603e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698712272, "uuid": "c5df574a-f86a-4725-aa96-f781d9a87b64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef6b2c5-77ea-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698756087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756087, "uuid": "c7bfbb88-0acd-42ce-9cd0-804253df6539", "comment": "Malware payload", "value": "5b52bce0cb4a92cad69ca0a71aa3f23e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756087, "uuid": "d70edcc7-322c-4e24-896a-6ccb4796186f", "comment": "Malware payload", "value": "ed557334b0e85c886a31ce62976f593cb19c500e2cafa83dcc2a3b484ab86e18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756087, "uuid": "cbd2ff11-59d3-4ffe-964f-3bc3b43a85c6", "comment": "Malware payload", "value": "f5fee2fb303ed3995c2b3cd1646b2d1208b27e5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698756087, "uuid": "aef9fef2-2ea7-4256-9780-1235f53435f0", "comment": "Malware payload", "value": "2afe7e32135f1ebc4764812c804ed72656e480a2e1cbb42fd20d61e49359f453f93cc10bffa32b442d4de4d39d3b84a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756087, "uuid": "75e2be49-05b3-42cf-b2c7-2eab69286d96", "value": "T1B074173228738061EEFEC1347CD1B765462438BE9ED94FC7F59876EA3A632D1523019A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756087, "uuid": "013444e4-3b5d-437e-a0a8-57f3fed0abd6", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756087, "uuid": "d8abb7f8-748a-4c5b-b61b-65012b21d3c3", "value": "3072:qDKW1LgppLRHMY0TBfJvjcTp5XJpv8xyfOssWHRJFk48:qDKW1Lgbdl0TBBvjc/Jax2XX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698756087, "uuid": "19910eab-c86e-4776-9efb-2f5d93945b1c", "value": 344464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698756087, "uuid": "72b162e8-b328-4ee7-8bce-8ba9c11e19cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698756087, "uuid": "cc92571e-1a38-4f13-baa1-e17aeec68ff7", "value": "440531ME.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f276ba2e-77e2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698752710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698752710, "uuid": "9a234180-34c1-4038-aaa4-fa1eb0a537e8", "comment": "Malware payload", "value": "a69497f59574c97e4d5a6f621ab32d98", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698752710, "uuid": "294dd909-1e00-4344-96ed-79e3ef6a2131", "comment": "Malware payload", "value": "ed8841b63c1aadb5387eef2b4b22f9386e838324094da66d5141838757cd532d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698752710, "uuid": "5361a848-e71b-4930-88db-cd32545dbe37", "comment": "Malware payload", "value": "bc2b624b7060d35d7f4602b86073bf9e64f5b544", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698752710, "uuid": "f0e33c8d-cff2-48d3-b97a-250ceb0fd0d9", "comment": "Malware payload", "value": "3fd3e58a052ce834f9521b3043ac4b935ba1eeb3db2dea379ba06e125113a08c2c51fdc14440c363d9de103d977fcd23", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698752710, "uuid": "77d96f0a-5700-4ac0-bbe7-822d3512914f", "value": "T1EFB34ADCB643B4F508B730A6556F7146FA3249A2B40C8850D40AE9D03E3CF9A5577FEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698752710, "uuid": "868dbe3a-c432-41e1-a785-e3bdc975a566", "value": "1536:7oEtP7O8olzok2TO51Dk6/mIviY5UDDp1UsmNvb/40:8GO2SmIaYWDwNvb/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698752710, "uuid": "4ee81377-ac4b-46b0-a2c9-bb54edf62df7", "value": 114715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698752710, "uuid": "813c464b-dd57-4f15-8191-c36718fb4f56", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698752710, "uuid": "1bf62ae4-8a5a-4b51-916a-3d906eb26785", "value": "Impeditrt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6e844d-7791-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698717701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698717701, "uuid": "d72855ac-f831-4bf9-9be0-8a8436467d07", "comment": "Malware payload (AgentTesla)", "value": "dd68aaf78901710759406c19281e1d6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698717701, "uuid": "953f1527-80a2-49a7-9566-cc65d2545e5a", "comment": "Malware payload (AgentTesla)", "value": "ed894c41caf24ca689f2155ce7ce263ad06b4662830a25fb8ec25271ffb49184", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698717701, "uuid": "00410545-6cac-40fa-bad0-39bb0e1ab915", "comment": "Malware payload (AgentTesla)", "value": "e782a23a4bd72f473524b306297191d42025a9f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698717701, "uuid": "5d4c894a-50d5-4e58-a4a4-936565e71662", "comment": "Malware payload (AgentTesla)", "value": "56470ee59e513e3f31929f9d53b790fb0cc6248c29535267388c10e284037ea72a8dc55e9859903be8eb8a05fec42df3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698717701, "uuid": "d21c8ee2-efc9-4cb7-911c-fb3022bf0773", "value": "T11FD39A526BEA2108B1F7BA88593A11344F2B7DD66D7DD54E05CC2A4D0BF3EC4C860BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698717701, "uuid": "57ec83eb-a5a5-4a14-b201-577cbc551adb", "value": "1536:F+ye4Mi3mI2hb7KZ18C2NGkikGkFjGkikGkKEt0eEKU+kCKGWGPrbrbTDDpOAWGv:xeBQFJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698717701, "uuid": "c6d14e22-9f40-4311-b8bf-981631dceda7", "value": 140582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698717701, "uuid": "524de116-6814-4844-8135-fb3994549b7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698717701, "uuid": "ef4e8129-0d65-427e-bfe7-df9aff8ad309", "value": "HRE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89619c8e-780b-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1698770143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698770143, "uuid": "d694bcfe-4a4e-4af2-8704-e7a60e719076", "comment": "Malware payload (AsyncRAT)", "value": "03ab3f87f56307039bf70e83f1a6f26c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698770143, "uuid": "8be586b1-2391-443c-ae69-7d8849b59ed6", "comment": "Malware payload (AsyncRAT)", "value": "edb572c6290bea0a5025defb4ffe79ebd4af2e0448901cd64359f00e6a00bdaf", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698770143, "uuid": "8cf8e3a6-b218-472c-88e8-57784978204c", "comment": "Malware payload (AsyncRAT)", "value": "589d057c4c86b53980ed173dbf3042490e9ef919", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698770143, "uuid": "be9094e8-d31e-49a3-8ebf-a56722caaa48", "comment": "Malware payload (AsyncRAT)", "value": "a6f3b3298fe3c0c886f5d1bbfb44d89455b96bbac1cfa7ba4ea8e33f73eb6c6b4fee88f0748f48c526e07862d99c0330", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698770143, "uuid": "6a690a13-9fb0-43a3-8fa9-ea9491106457", "value": "T172C4F102FAD688B2D5721D355D3AB711A9BDB9201E34CB2FB3C44E6DCE315819634BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698770143, "uuid": "787a02e0-5ffe-49bf-902e-438b6e8384db", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698770143, "uuid": "fb65ffaa-a3fc-422a-a58b-156cfebe717b", "value": "12288:AcrNS33L10QdrX6tO1nnNPRM9oU4aWannrGE4jqvq:jNA3R5drXIO1nNPRAo0W+r14qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698770143, "uuid": "42491714-0502-433e-ba92-879dadf56c6d", "value": 550588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698770143, "uuid": "fa1edeca-1793-4242-8c7d-1e486daa44f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698770143, "uuid": "2590c939-2f97-49f9-9075-dd7dcc691fd6", "value": "z84Odeme_Belgesi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66763dd-781f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698778782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698778782, "uuid": "55a9905b-2e60-4c6a-acf2-783a67bbb156", "comment": "Malware payload", "value": "f99144850b207c5ced4a836ed8dae5dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698778782, "uuid": "28675d82-e980-4b00-9523-74d3b973b365", "comment": "Malware payload", "value": "ede13e3fd313af456755cd4c702476918cbe5ea76b9aa527081d9d585b448ff7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698778782, "uuid": "1231dc7c-278f-484c-8b82-8853e2f5b19f", "comment": "Malware payload", "value": "3991c67822f48abe205f656d1af3c615523a22df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698778782, "uuid": "ea881525-8711-4731-8f6c-fcc861bd58f1", "comment": "Malware payload", "value": "be8fe95b7fdcdbfe4b9aa1db04fdd9a15a01968146b4f0e0e58171a6e34f78e636ed8f8a2950cfa66524472a7fe50a40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698778782, "uuid": "3c88910b-41ee-49e6-b6df-b809a33256dd", "value": "T1DEB4D05973980CB5EC774279C977A545EA77BC110B70DA3F03A1232A8E3F750A92AB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698778782, "uuid": "ef859cb1-2e5c-47d4-9ff0-c731e51c67aa", "value": "e84df41b2f503185a5597a36231acc88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698778782, "uuid": "a2cf4736-d588-4f5e-950a-2bf6104e69cf", "value": "12288:cWzWEJzQvFoEcB9y3+KjCKo82/Ww5CGe90ra0x:FWE1QvFD+5KoL/Wwx2w5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698778782, "uuid": "7eb7e753-9ee0-4526-9c7a-b6a98777b81d", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698778782, "uuid": "6b27542f-f8a6-4c04-aa3f-3240eea02cfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698778782, "uuid": "14f1042f-8844-4c90-a95d-9b1dd0f6d349", "value": "Bqtloioqfk.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ad30d8-77c3-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698739269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698739269, "uuid": "ab3c47ae-14ed-44b5-aa30-ae0a38ffdaf6", "comment": "Malware payload (Formbook)", "value": "d1a01eb4380c0b5afecf2a8e2dc8902f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698739269, "uuid": "1d0de545-d659-42cd-83a0-3762d4bfc03c", "comment": "Malware payload (Formbook)", "value": "ee15b6d592e19dac7b1baedfd072befcf7351c2e65ca5b2fca9ed1fb61ba3e11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698739269, "uuid": "f28f77c6-793c-4a9a-b0a5-d4376129e488", "comment": "Malware payload (Formbook)", "value": "c92465db4c450bf685b62c814fbdb90f5d2d71e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698739269, "uuid": "a7bce789-5e5f-4332-9196-ffff5be8c973", "comment": "Malware payload (Formbook)", "value": "b7248a09b41123b911147a29241a77282700664de3b7d8c512fd9feb47a61e7b216af8c3cc2a2b4a789e7fc7642fc879", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698739269, "uuid": "b766bd7e-20e5-4d7a-b251-b23a97e81418", "value": "T144C4227439F88325E0DC23F83569A8D21371E20860A1F37DCC9677E6665A7128BF197B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698739269, "uuid": "3f194dfa-ec32-4392-b8b6-be98b0575ea7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698739269, "uuid": "784efd7e-e4b8-40e0-83f2-d8630ce27f93", "value": "12288:jKUoanQGgcZyHgfyNej6dhUKz2kDGBjbnp5gGlC:jKiPHWtDUq2kDGaGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698739269, "uuid": "896cc923-9331-4c20-8bba-9fa1626f2cd2", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698739269, "uuid": "eba0d02f-2433-49a6-8925-e56cdac86445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698739269, "uuid": "722b6769-a868-4a2a-80f6-2034f6e891df", "value": "d1a01eb4380c0b5afecf2a8e2dc8902f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4dfb860-77d3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698746218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746218, "uuid": "b41d74bd-13da-4e13-b095-98c7a6a74ac1", "comment": "Malware payload", "value": "2f5287832bd305decdb65f23bf160ee5", "object_relation": "md5", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746218, "uuid": "a255c5d3-92ee-4c48-9e92-7b4eaec1cd1b", "comment": "Malware payload", "value": "ee4c788dd4a173241b60d4830db128206dcfb68e79c68796627c6d6355c1d1b8", "object_relation": "sha256", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746218, "uuid": "2462b2fa-2d8d-462e-81d1-856914a5c784", "comment": "Malware payload", "value": "3b5c94bff4dcf49f69a1ee0e63566c83fe601e8a", "object_relation": "sha1", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698746218, "uuid": "8b3c0b2c-bac6-48bd-8307-22cffa09537a", "comment": "Malware payload", "value": "639b090cb86980c5221c82b563f84fb55f426baeea6c5d768f592173b6dced7922642d27fea62006d29f8b8208e6b86c", "object_relation": "sha3-384", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698746218, "uuid": "1a5100bc-074b-49b9-884f-72a24fd09968", "value": "T1B9B633C96043FCA6FC4E9C7395FB69C1D31C6032E19A9830E7C5B74169BAB9081279B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698746218, "uuid": "89926ff0-64f7-4976-8997-5c8ad9fe2608", "value": "196608:unwehYexaakjhhfx9u8hSGt+lokSTLW8f3HOlyDm+dshSS7Ss9AMCloAbZ6OR:EweLxaakjhhfx97MvS93Olyra7xN+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698746218, "uuid": "738e9b54-36bb-4c4c-b475-87bbe0f748bb", "value": 11356021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698746218, "uuid": "4196ea37-d708-44a5-ae64-f101ef4cdef8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698746218, "uuid": "fadce950-8e49-454d-8c15-764cfe21f912", "value": "Brave-x64.msix", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be834fa7-77bd-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698736732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736732, "uuid": "351bfbcc-fd75-4793-a23b-57072143fe1f", "comment": "Malware payload (AgentTesla)", "value": "1e6ed92864eeb52ac5723019928d8b2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736732, "uuid": "91cb263d-b880-4997-b78f-d9adf52b4be1", "comment": "Malware payload (AgentTesla)", "value": "eee2b0982e284cb4e0fe33b948b317e900bae6282d70434a1fbfff722de87732", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736732, "uuid": "c07054f6-ad92-4ffd-b0fd-565d962cc8a0", "comment": "Malware payload (AgentTesla)", "value": "7494eb8a809e7aa8850149d8f93dd7ea00294dfe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736732, "uuid": "30f83caa-6e0a-446a-acaf-fd4f241bdfe1", "comment": "Malware payload (AgentTesla)", "value": "72b9d86ab772648a9745b02a27b935dd62a0a6fa4400746b547eb79f4c6a07565a1a100ac576162cc7bded107931ba4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736732, "uuid": "81bfd817-3b88-4ba5-81a6-ec12c65c26bd", "value": "T1FA858203BA5689B2C5489733C6DB041443A7DFA17363D60A7D8B336A19733BB4B4A727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736732, "uuid": "f246f724-8b36-46b6-b26d-a25b127d5020", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736732, "uuid": "e3cbe64c-b0b6-4a26-8c6e-053762aa64a5", "value": "24576:lTK56k6xctsX1VT0AwQqh3qla2xcP/LqpQv8Yt:lO6KGvKTqpQv8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698736732, "uuid": "e00eb236-3e54-439c-be6d-6bff7bae7b13", "value": 1862656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698736732, "uuid": "d2790c89-538f-400e-8992-d2d7f03f4fbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736732, "uuid": "5827381c-1a50-4573-8df9-6d86924da059", "value": "ORDER LIST_OCTQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349b95fd-7820-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698779021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698779021, "uuid": "156909b5-efdc-4f5f-b8ea-0aac47ddf976", "comment": "Malware payload (RedLineStealer)", "value": "a9c2c30c01843cf4d44de1c9d0c91cf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698779021, "uuid": "cac31ee8-ed14-47d2-963b-cc3bc808e42b", "comment": "Malware payload (RedLineStealer)", "value": "ef44c3559653a642b52e8234befa41deeb0ef5797ffb161549f5057490ffa54a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698779021, "uuid": "9f13f192-0255-42c1-bfc1-f96dda970080", "comment": "Malware payload (RedLineStealer)", "value": "8b0bdad80d6559d2f610eb4fd1b86e9ab38b27d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698779021, "uuid": "708eadbd-86bb-46d5-8784-fe86cf512308", "comment": "Malware payload (RedLineStealer)", "value": "713d8c5d510b6ffb32364a323239e4a592b214979105258935285a925d3bdf8b472324550dcecc5dd71b340857bfc3ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698779021, "uuid": "4575e460-71b8-4b3a-8e2a-d26f2a99cc23", "value": "T1C7358C2039886076EDA63177839CB635D16CF0F8C7119BCB19E4D7EEB6741C26B32A46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698779021, "uuid": "a67e9da1-7a68-4482-b9c9-700f79703c73", "value": "8d909f6529b3d4f164fcba0bf968f2a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698779021, "uuid": "445c9939-cd85-4110-acbd-f9e55c847521", "value": "12288:qq5l817Tb1M7eWQGI4SzGSC1lY1bOE7ZK6WLv721u0yfyAMxJeLHDw1:9allM7eWQGI4SyfTcZK6WAJaH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698779021, "uuid": "b9f6993e-7c4d-4448-88bd-af214ab60646", "value": 1146368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698779021, "uuid": "00415c2d-2ce3-4a08-baf4-3f1a61bf2477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698779021, "uuid": "f6a70918-c7fe-4d9a-b3e1-6dee4f6db15c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c7f04d-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698734709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734709, "uuid": "9e453377-fff2-4322-abcf-fa291bdea0bb", "comment": "Malware payload (Formbook)", "value": "05ec4080717dcb5a40dc0b0312d1aeb6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734709, "uuid": "7aaea1c2-159f-4b15-8736-e6a19806cf0a", "comment": "Malware payload (Formbook)", "value": "ef4f426415068e5a502b564613d2fbd5d2a0fa3095c10354e718828171826b08", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734709, "uuid": "233b26d6-5aae-45af-b2cb-4a607d35340f", "comment": "Malware payload (Formbook)", "value": "6f0194e96600b148f0e5e54d8305c423a4737668", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734709, "uuid": "fcdd2992-0fc2-47e1-8678-320f7c8b05f5", "comment": "Malware payload (Formbook)", "value": "c3e6ff25dbc7da79260a9d703ad8608fdd7835d01b435c3ce05bb16ce5dd93fa283dc4a0a557f6fee5bfd1f673f6b964", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734709, "uuid": "1fd98ba3-3b3f-42c8-8943-3ff61bc49d21", "value": "T1C034346DD78B01A9CF624376A71B0E4402BCB62EF34552B6346C537533EAC3E91622BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734709, "uuid": "99e07357-d1c8-451e-972c-f666e0b814b8", "value": "768:WwAbZSibMX9gRWjPA+N+Ck5yNJFcGcEoGN:WwAlRu+Cn3oGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698734709, "uuid": "92f2e903-1e6d-438e-a0cc-167312fa4da1", "value": 235472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698734709, "uuid": "9e307f8c-daff-4eff-8b6a-9f63e53a1719", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734709, "uuid": "0627a28c-826b-4b2f-b7fc-bb6299af5f44", "value": "Bank Information.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4af3876-780a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698769867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769867, "uuid": "6afd67c0-a2be-4462-9881-f6d81a051c0f", "comment": "Malware payload", "value": "4b0a82dc47565ead19950288805f43e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769867, "uuid": "1fbd3922-2aae-4e9e-8225-5c1c35853af4", "comment": "Malware payload", "value": "f0f8649135af4815cf441bd553124b2f422d39667dcb7d0f476a9cc5a871767d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769867, "uuid": "6f574b1b-b110-4694-96a8-65298fccdc3c", "comment": "Malware payload", "value": "3f32f653f674d85cd024ec236383e19686f4e541", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698769867, "uuid": "3652947e-18b9-42cb-a182-0a703b4e758d", "comment": "Malware payload", "value": "8e33d4c95787653c48abd48417f079c544649914a02708a9fb580ef5c137fd41aa58bdf651027002f00219dd97a16d38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769867, "uuid": "7dd865db-11ed-44dd-a51d-f7a342ee674a", "value": "T138F35911B4D0C032E567153249F0CAB06A3DBD754FA69EDF67944F3E4F302C1AA36A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769867, "uuid": "f8ff08c7-1409-42fc-923c-bd1a24eeaa98", "value": "5a23357764f0c833dcd1a07cf87f8149", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769867, "uuid": "578dd03b-5549-4eee-8f1a-36b2d5d0fa25", "value": "3072:cysS3L3kfHEdvOtJuWDPQC2N0PCSJF91i0Rz0PaOfFPgL4rIONE90Wg:c1QF2hDPaKPTF/ntIa1pk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698769867, "uuid": "56351264-f2de-4ff5-a95f-7ab5bd46c4ee", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698769867, "uuid": "92e1093c-600b-4908-a8de-6116fbc599d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698769867, "uuid": "0250a179-f31a-4bf0-8912-0f5fa9266d34", "value": "SecuriteInfo.com.Win32.InjectorX-gen.30566.27452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d522f7c5-77f5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698760822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760822, "uuid": "fbdfb2de-ce74-48b1-bbfc-c0ab22541bd9", "comment": "Malware payload", "value": "a4883c76d9ea6c7786aa41a01b62f08a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760822, "uuid": "e0dc76cc-984f-4542-963f-9bf032f99df1", "comment": "Malware payload", "value": "f1e6304aefc8307071555b490d2d6ee8b7d244f092029d4f6641e13e10608dd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760822, "uuid": "e228ab12-2dd2-4d52-aec6-56863065c0d7", "comment": "Malware payload", "value": "c3dbeec1c769521808e1b1941bea4651772118dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698760822, "uuid": "6d1ca750-d067-4a6d-9825-085e3e2d4dd7", "comment": "Malware payload", "value": "3465f52a120f83a2c9a95c18a02f6fccfc52a79928e8d6b80ab389254e66237078323be4c47416ed1bb7094a0523460e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760822, "uuid": "0ae62689-7d5d-47eb-a724-337c014c8348", "value": "T136753344E3F8C136F8783774A9FE17831D2B7D13A8B8D30716AAD5659D625806832B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760822, "uuid": "8e3e2873-a79b-4fe1-b296-d9e84d8ba9f2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760822, "uuid": "104aa1de-750a-4487-a97e-915602d399e5", "value": "24576:ZydeALh7YahhcsWilooVLwxZiNtjgJ0Q5JnPctJHV3cx8JQn0i:MdLREEbLwxZiXgJr6JHVsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698760822, "uuid": "5c9502ba-c16f-4a4a-9235-612b03e91f2e", "value": 1619968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698760822, "uuid": "4e4f8fa5-9ede-454f-9eb0-019820337c5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698760822, "uuid": "bb9a2946-c763-40ca-8ccd-58fa067eadce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2e790d-7792-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698718208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698718208, "uuid": "37906bb8-2bc1-4d91-ac4e-abef4dc69da8", "comment": "Malware payload (AgentTesla)", "value": "16c6922f713e35f485266c858eeeb038", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698718208, "uuid": "5b6b5ebb-0d27-47eb-b833-a1d7605fbb5a", "comment": "Malware payload (AgentTesla)", "value": "f3f7dff00ae17fb0044043a1e7f792bf8047ffa80020bf4099bcbdeee2be3245", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698718208, "uuid": "e9b44c21-f35a-408e-ade1-6226e0810935", "comment": "Malware payload (AgentTesla)", "value": "d26bf02444500016f7d93e497683669669c762b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698718208, "uuid": "b0155bbe-f9c2-4481-9fd7-ae8764476959", "comment": "Malware payload (AgentTesla)", "value": "ee3b1d36ce9235fe0316424a261c188c145f88379633262f9de4527fac6f838b8df9d7ac98fac4ab05c4477532f4635b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698718208, "uuid": "0800b343-a16f-4b42-be17-c6a2c9a6cf13", "value": "T119D3AB526BEA2108B1F7BA88597A11344F2B7CD66D7DD54E05CC2A4D0BF3EC4C860BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698718208, "uuid": "5b44490e-94f2-4b5b-b0ec-1862f6db31f7", "value": "1536:F+WNSe4Mi3mI2hb7KZ18C2NGkikGkFjGkikGkKEt0eEKU+kCKGWGPrbrbTDDpOAH:lNSeBQFJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698718208, "uuid": "8e3cfa9e-ea72-41a9-805c-78b085d9b090", "value": 140590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698718208, "uuid": "2c92f290-dde5-4324-bcfb-c0572108c757", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698718208, "uuid": "b2c111cf-8748-4feb-8beb-bf1f4cf946ef", "value": "JDS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6edd7f-77bd-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698736730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736730, "uuid": "9f76bc5d-cc0c-4593-b800-842249b6c4b1", "comment": "Malware payload (AgentTesla)", "value": "544cd57baf802549a4453b5e077f9bd1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736730, "uuid": "1fee0c15-575b-4c5a-bef6-5a84d965af42", "comment": "Malware payload (AgentTesla)", "value": "f56e9fc3e849f746c918864bab7f6e03ad1721ab05dade87aed887ac8c2c6526", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736730, "uuid": "b39b0d82-34b4-4aa7-9893-9476ecc64cc3", "comment": "Malware payload (AgentTesla)", "value": "cef0991d8f2b8bbc8c1637753cd6c7d50ebe5a75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698736730, "uuid": "54234d72-bac2-411d-817c-1d6fc399fd4f", "comment": "Malware payload (AgentTesla)", "value": "c5afe31151e90cd6aa3d5a85ea1e3b680e6e1690c6d3d9b88689a3e9815de7e280c4f03a5b03c23a5f43455eccf3da82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736730, "uuid": "c879b2e1-27f3-4f37-ba2b-54adab85c720", "value": "T1AE858203BA5689B1C1489733C5DB0C0743A6DFA17363D61A358F336A15B33BA5B4AB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736730, "uuid": "aceaf47b-46d4-4bd8-a2bd-8ba074309c94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736730, "uuid": "eb207ab5-00ec-4702-ab5d-68acf0520cf9", "value": "24576:gm1Z66alq9tvnmWJFfQ7mbny/8S1DA9cyHeC02OQM0:bHJt/LhIC02OQM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698736730, "uuid": "2549eaee-a7c8-47cd-a6a6-7b492a20d16f", "value": 1859584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698736730, "uuid": "134fc530-e50f-4862-b6e4-ed395353d014", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698736730, "uuid": "ba10d9aa-14d4-43db-a53f-4e642c05371c", "value": "QUOTATION_OCTQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082b7dcc-77dc-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698749740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749740, "uuid": "4f8fcc39-5124-4d51-8dba-f733116a4b1a", "comment": "Malware payload (AgentTesla)", "value": "2513698cc8377e72e593189750ed7641", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749740, "uuid": "5085221c-a6d1-46a4-8f83-f0c6d8375ffd", "comment": "Malware payload (AgentTesla)", "value": "f58341abdb05ba4d6796449c4472460c298b1c88b93d7ff401583a695ad2dd35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749740, "uuid": "84e6c94e-8910-444d-a2be-1c74952bba56", "comment": "Malware payload (AgentTesla)", "value": "4105156933148c9e6f96202db7690ab7d3543e41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698749740, "uuid": "689c163c-6ac0-4caf-a788-b306695c892c", "comment": "Malware payload (AgentTesla)", "value": "af178f4d99c9faf35516f144537d870b9dc78698b7dae678642c0a48efacfaffe77e45940e66d53ebf25c4bf09e43726", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749740, "uuid": "3527e51f-3182-46a8-b153-3f0128ccab57", "value": "T119E40144B7A75B12E6F993FA8532525007BB266A307AD3854ECE21CE47B3F844952F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749740, "uuid": "3ce11604-e0c9-4589-9749-8edba5e8e022", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749740, "uuid": "8a153b2f-f424-4022-bfc2-6118467a91c5", "value": "12288:WXWCwkFljovIbYJJ/2X75orTfRJSJ/PDdP0lnun/l2vYj:WK7vIbYJO1MsJ/7dau/lyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698749740, "uuid": "e39e91c6-b19f-45b9-b4e9-870b421633ad", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698749740, "uuid": "908ceca3-7efa-4080-ba92-a685788c5cac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698749740, "uuid": "a44e62fc-2b5d-4c1f-9f9e-0de2be6f6779", "value": "z16order2354646337-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c0ff83-77b9-11ee-8907-42010a9c0042", "comment": "Malware payload (RevengeRAT)", "timestamp": 1698734999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734999, "uuid": "8edc1710-a706-4634-a23a-b33221984fc4", "comment": "Malware payload (RevengeRAT)", "value": "998540ce17639ce0111b5e5388f14efb", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734999, "uuid": "e01989d5-1235-4f51-8ad4-da63c379ddcd", "comment": "Malware payload (RevengeRAT)", "value": "f7fbf7aa0a25cb827bfb8f0cb82f038d27875345795f369adf043f0833e51e05", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734999, "uuid": "c6ae3c13-2b59-4721-b87e-25f866479364", "comment": "Malware payload (RevengeRAT)", "value": "2bb8da5eddb2ba0305eed91c12662b7c3d60b863", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698734999, "uuid": "62f40c3e-a17b-446b-9c53-c12ebcd2c4d9", "comment": "Malware payload (RevengeRAT)", "value": "52164ff36ef6974c0ba3e9b8f7c7bdb62d2a2456535b1ee6b885081e10c68553c33fc186315042333e7e290f5dff8892", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734999, "uuid": "a4135213-a62f-474f-886a-418642167f7b", "value": "T1EDF1AF5A5C021108FFB75E3E28FE2FBF3A1EAC195886D19F3440229C18634079B8579E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734999, "uuid": "9466ac9e-98d4-4633-82b5-53df70dd0af0", "value": "192:xrXP/4msvg0xBlMcoyMjeu+o5iDSGMyN588qIAVjPl:dXPKvgiBlMJje1keSGM45TAVj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698734999, "uuid": "d9ff2b80-2f0b-4a06-b256-930928634a35", "value": 7967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698734999, "uuid": "beb1e16a-ac57-4261-b538-c91ff40cdd46", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698734999, "uuid": "4fe003ce-9663-4ea9-89bf-ca569dae3b23", "value": "Detalhes Reserva.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c3168b-780f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698771902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771902, "uuid": "a7bffd24-6ff1-4384-9702-1c2f4a72ed02", "comment": "Malware payload", "value": "4f9fa61a76fd02b904f57d327fc80f71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771902, "uuid": "6186117d-e632-4fe8-8394-60838b354487", "comment": "Malware payload", "value": "f8036b4993d07ca0d117b299c9111370cfbb01c69da2ee831d8064c7f0da899e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771902, "uuid": "eb29e8ba-bdc2-4bd4-b752-e72b1e667633", "comment": "Malware payload", "value": "bd7d98a305d294e89505c5cbf5c692a0201c9f16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698771902, "uuid": "343069fb-01cb-4cc9-805f-855c14f5b096", "comment": "Malware payload", "value": "4304e5891e27beea2c11319b3fc6d6dad063fe0dddda9418a208cfbd00e8452a182b75c555dced434486815de0a02f08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771902, "uuid": "59c8c69f-bcf8-4239-b06b-11e3879b5728", "value": "T10DD4F11877984CB5EC728139CD63A946E7B3B8264661DE2F03A0579EDF2F3606437722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771902, "uuid": "84eb5092-ddf3-49db-bf55-bee39c6272da", "value": "b31ea98cca713b7e0ebd77013bfa9149", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771902, "uuid": "caf82636-630f-4384-b808-c35233201a82", "value": "12288:T/cYjwx7s0zXoBA5ozd6IDqk0MzkC4sEEqtQGfbjcED/l6ZCJj:oYMx7s07h5ozdDntzTPEEVGfbjRD/l64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698771902, "uuid": "ddf205ee-f244-4168-9abb-bf0352c6d3ee", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698771902, "uuid": "01909bd1-6230-4f59-81cb-23ffb4870f9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698771902, "uuid": "27629beb-4925-4333-917c-bf9a25f46713", "value": "4f9fa61a76fd02b904f57d327fc80f71.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66bda791-778c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698715539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698715539, "uuid": "21c856fe-e11b-42e4-a9ca-43784460a935", "comment": "Malware payload (RedLineStealer)", "value": "6455e498bb671cd8be68d2ee8fea209b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698715539, "uuid": "b97f22c8-fa7e-4f9d-b6b0-5c6f113fa670", "comment": "Malware payload (RedLineStealer)", "value": "f81b73c904d920683bf88a6d43bb7271c45ebbcb463f241f251afeb49e3f733a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698715539, "uuid": "c29a1be9-627c-4ed2-9ebe-f4348650d0af", "comment": "Malware payload (RedLineStealer)", "value": "17f4ffb715f31917558abf7cad100ae414dc876c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698715539, "uuid": "7ed7cd17-321a-4eb8-a3d2-7d11af143aa4", "comment": "Malware payload (RedLineStealer)", "value": "1c7a17bad4ae40449565e94c161f962797c028300c5d4564617be2d91446c38daecdbcfbc50fcfb8738ef410cd5a2a85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698715539, "uuid": "3d8b1fee-5fcb-4b53-85ee-785b64cc6463", "value": "T16F752313B3D14663E5BB077828FA42D31B32BE529E72035F264959087A73CD9B432B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698715539, "uuid": "2e7500ad-ff49-49e3-b8be-f4d8128ef96e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698715539, "uuid": "ced0ed55-a319-412d-bb0b-1c5897268a9f", "value": "24576:9y+z9PfwKnQPkgtbmu8PBoLGvoVvBKgHHNrbvpsGluuf1otPFbqmFM5dMLAoiBKH:Ye9PfjnQMgNqPFv84INrbaLl9qmFUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698715539, "uuid": "eaa21f00-a126-4ce6-b0b0-38d1bcd4975d", "value": 1613312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698715539, "uuid": "29e40219-c14e-4cd0-9ad5-63eeb0a3b305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698715539, "uuid": "e7fba562-d4a2-4347-9cfd-1292b266c75a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4141a3e-77d9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698748767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748767, "uuid": "c2857b5d-4c82-4492-8dac-fc1339147c3b", "comment": "Malware payload (AgentTesla)", "value": "704f2d26a5f453fe7f8840c2b59f13b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748767, "uuid": "237a7312-eab1-487e-8202-2d2530e5a7ba", "comment": "Malware payload (AgentTesla)", "value": "f9532e260b448c3d6a49526e4a009deaab294d90b012862be8cb4fa000427f03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748767, "uuid": "e471b171-6c29-4617-b3f1-1df8adcb3238", "comment": "Malware payload (AgentTesla)", "value": "5c27d16d5cd184394878b3b1e86df16a9d02b7e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698748767, "uuid": "c42364ab-1978-45d3-93ad-49852d7190e6", "comment": "Malware payload (AgentTesla)", "value": "92a06d4e0c6535de134b4280f705c095e0e317703783c1843dd6d83d9431b021f8583197cfa042a1d1e63de747b54aea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748767, "uuid": "8f37a949-db4f-41c9-80f3-30e9e8e0242f", "value": "T169D42381379CAB62D6BD07BE5E685C90977EB1632041C63ACDF391C56182FC487E1E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748767, "uuid": "8a0e461f-ed85-4ad8-8461-3cebea7c1c21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748767, "uuid": "4253c8bb-c01a-48e4-a8d0-88e3e538ae0b", "value": "12288:RYoaOE37VEfLNbswA5yP0JF1z8e0VTHKJLtTklePAEGyP2:RfE3Ba3CkuIHKnitEGyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698748767, "uuid": "2375ac95-f54a-4532-ab65-18b9eba9d86d", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698748767, "uuid": "ea1f6b79-1034-4561-aa7a-a935fae266c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698748767, "uuid": "183b524f-9a1b-4941-83b9-4256372eb886", "value": "SecuriteInfo.com.Trojan.PackedNET.2504.30193.29716", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38932de3-7823-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698780316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780316, "uuid": "4eb7e6d5-0b7d-48d9-9aaf-f55821756c32", "comment": "Malware payload (Formbook)", "value": "feb438764e46ae7e7ac29ed3db4193f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780316, "uuid": "8240d853-63a5-4086-990f-e2a632285a43", "comment": "Malware payload (Formbook)", "value": "fcdc9c84c2d743794b07d4cff425214fa4466f3698e88d36cd6956531303ab1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780316, "uuid": "fd499f20-7838-4e3e-b5aa-0e81e4450299", "comment": "Malware payload (Formbook)", "value": "6c2a1128f45a0c7f2b57ad2772a906084799cfba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698780316, "uuid": "34d4dc23-fa21-4d82-890c-1f75d56e2333", "comment": "Malware payload (Formbook)", "value": "96bb73470f85af0b2f80f93f408548e6a8d1427b04868acace40e4c6d3f6711965de825f9432964cb321171c5a143e5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780316, "uuid": "e04bd77b-b72c-415d-9551-12141987d172", "value": "T135D423407AFD1707C77DA7F949224100A3BA565E5676CB4D3CC862CE4DE3B280A62F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780316, "uuid": "0b61eb1d-3fa5-4aa4-bfd7-8ec1926a19d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780316, "uuid": "9d219451-e1e2-48d6-b07a-344441fd8ec0", "value": "12288:l8t69yqLdc+5836KMdirnDmA6mBfk93Uutx8+6vZ6t2fe7+JdS4K:A6X5cs83TME+BrpUuNPt+e7GdVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698780316, "uuid": "09648a1c-dee5-45e5-afbf-6c700d18b97b", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698780316, "uuid": "98930d0c-5a55-4ef6-bed2-bdd5e63d4bb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698780316, "uuid": "52e050d0-465a-44e3-a129-b15ca7daeadc", "value": "SecuriteInfo.com.Trojan.Inject4.59820.22477.20906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0149aea-7781-11ee-8907-42010a9c0042", "comment": "Malware payload (NetSupport)", "timestamp": 1698711018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698711018, "uuid": "90f655fc-1edb-4581-8285-e0a2f9a893f1", "comment": "Malware payload (NetSupport)", "value": "daf08776ac128bdba34cdc080bd260c8", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698711018, "uuid": "e4947fef-73b4-4fc9-b86d-13316cc6cbf3", "comment": "Malware payload (NetSupport)", "value": "ffbe0fba6a12d27198053974de52163c9a4ef59637901f5846f49d0559f49826", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698711018, "uuid": "eeea7f9d-ed03-4dc2-af18-7a330544d5f5", "comment": "Malware payload (NetSupport)", "value": "e52d7e169c5093769fbc9e4fe58c9e2538eb242e", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698711018, "uuid": "1c4fd508-8505-4737-b442-f1020c9fb896", "comment": "Malware payload (NetSupport)", "value": "cfe1b5aa2d70c6d58ac930bd2a7b7c4314d075bb605f5c9dbaacd0e1d32849c7a5bb06ff5f6cbf46d33f1ca96001b4ab", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698711018, "uuid": "9a3ffebc-464b-49a9-9ac3-bbb2f417c452", "value": "T1A1F533163293FBB2C0E1F67BE0ACA8154A6D747CE4F7B47A597FA553D93A431982B000", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698711018, "uuid": "c653b292-0de6-4b3d-b825-b14651e85e0e", "value": "98304:d1eFXamhRFY89YYc9jh23redpmQRiXuYESBZFR02jZbl7g:beHxYoY59V0redpmQRiNfZh7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698711018, "uuid": "bc5d36cc-450e-4c32-983f-d5ec0aca3671", "value": 3442116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698711018, "uuid": "058ea804-3018-4d13-8e6e-5e552ab9f685", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698711018, "uuid": "1773d67e-72c0-45ba-9f2d-290d6a87bdc3", "value": "p.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f0af49-77f0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698758516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698758516, "uuid": "3845d228-fb77-4baa-ad20-769bc83d5eac", "comment": "Malware payload", "value": "6768c4310c23f78b9584164cdb6f936f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698758516, "uuid": "15654886-adee-497a-abdf-6ebaa0c9dc42", "comment": "Malware payload", "value": "ffe2f8fec7f9ba8ff7877c6913820df6048f6d3df97dedf8d81efc3a51baba87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698758516, "uuid": "6e754264-1861-49fb-9976-2553af939d66", "comment": "Malware payload", "value": "920974d91dd465b81bbd9574af3d99d9745ae203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698758516, "uuid": "5449b597-a827-41dc-907d-2ab9c3d09e7f", "comment": "Malware payload", "value": "a379d7681f506343be1a975c4d7c5a336b59bcae3afbb656474087fda162653be835a2c42cc06bd19a99759dced39c30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698758516, "uuid": "77c6e7e0-21cc-47ec-8890-ebd5f03804f6", "value": "T10BD4238179FD6631F47AD7FEA354D9000371941766EAEB47CDC6B1CAB6A1B800AE0873", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698758516, "uuid": "c300a858-993c-44de-ae55-1ed02bebdf85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698758516, "uuid": "c66a2887-c9db-483c-b2bf-a8010140463a", "value": "12288:zLpPoahdqUyy/rM5fdo6vS7iYeTZlFCT+k67eqSMtuu4m9BkG:/pDkhgIpvnZmaiqt/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698758516, "uuid": "1e2dc96f-2672-4cb8-aeaf-597fc785b024", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698758516, "uuid": "3ba7eb91-fcce-4e11-a7ce-504b88b84f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698758516, "uuid": "80accadd-45f0-4d81-9339-947b4e8096d8", "value": "BOQ-AE200039828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14fbc711-782e-11ee-8907-42010a9c0042", "comment": "Malware payload (Kutaki)", "timestamp": 1698784981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698784981, "uuid": "bf29e1c4-74a2-4d9a-816e-8b600a9ae479", "comment": "Malware payload (Kutaki)", "value": "a1809e923de6cae635be84aa94afa7b7", "object_relation": "md5", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698784981, "uuid": "53c32c8a-fd52-41eb-928f-c9e0d3d8fe38", "comment": "Malware payload (Kutaki)", "value": "fffabbf5eb28e080d666156800c4d0a7ca5c986559fc5c3cc632155d12801fb4", "object_relation": "sha256", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698784981, "uuid": "adbe297e-9c67-4569-8f97-c1104ff9dd5a", "comment": "Malware payload (Kutaki)", "value": "5356d43b71caddec298f1c93625d72d57a95d9a5", "object_relation": "sha1", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698784981, "uuid": "7716e150-1dd1-49cd-a88d-208fe6dd1d07", "comment": "Malware payload (Kutaki)", "value": "1d03235db39117f1388c18d89c719dbb645405ca1215dd960851e76aa77fc1e3ee344c6b302194ae5f5b51c5b3070f58", "object_relation": "sha3-384", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698784981, "uuid": "b5c5620b-eac0-4206-b2be-abc23a16087d", "value": "T14FA53395B7931F6BDC934C8877271EB58981EB9803AD1D898C7581F270C9A4B8097CBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698784981, "uuid": "fac797cc-2dcc-4a82-8064-bf2e6ddc0426", "value": "49152:Tz47kLqtm5DmVmEZseFnDuy3lf7mhmVC1OAXlEjwIUqoZ9m3/QG8Jz:TzZLHGZFKYl6MVYOAXlE8IFA9m3/QG8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698784981, "uuid": "fef3e22d-f19f-4eb6-8f52-71ab3754f5e2", "value": 2155269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698784981, "uuid": "5fe1a48f-f945-4969-8910-f7d2ded3a831", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698784981, "uuid": "3f3f2a18-ed33-4844-a40a-97958c9a8f45", "value": "a1809e923de6cae635be84aa94afa7b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }