{ "Event": { "published": true, "date": "2021-11-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-11-09", "timestamp": 1636502581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e5e19d4e-5732-494c-a7e9-6b86ba8639f7", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b759f0c5-418c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636483316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636483316, "uuid": "dbfcf706-81b6-4b49-b360-e8229116de64", "comment": "Malware payload", "value": "dcd860525cc049271fb4a7ab2e055981", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636483316, "uuid": "522bc041-856e-4dcd-83c9-f737e3b37c4f", "comment": "Malware payload", "value": "00022259e4007e25bd78d36d83e56d0989de57b16419f9663332570d3139266b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636483316, "uuid": "f047ca51-2d04-415c-9bc1-06f37ad9f60b", "comment": "Malware payload", "value": "c643fd4f9cad5f7149f7c7524f15f598cf831c3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636483316, "uuid": "3875dad7-3dfc-4eb7-9a43-d3343374083b", "comment": "Malware payload", "value": "50245b6e71e9c7e771fad4a5117f301d6e1c502dd52a3b440046f6db33d71480800c3fe6e7a37eb4a58e85ec0d72e0fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636483316, "uuid": "e6b56d44-43ac-4e07-9fdb-b3d458a0a780", "value": "T18B94F15467F82F62F1BE4FF5A479600407B5BC9BA930E62D1ED220DE0571F148AB2B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636483316, "uuid": "41ec37b4-d37a-4029-a66d-f27c99c17204", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636483316, "uuid": "3c6d9af4-a5a1-448e-b8a5-aa03dfc1869e", "value": "12288:cjDGuKtFg8+H4/tSlUAGya4OhtGlcIcTf/XZ:cjDGdF3+HNH7a4OscIcTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636483316, "uuid": "a3a2f57a-d122-436a-962a-ac0c79048743", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636483316, "uuid": "0716c043-2a10-4bfa-9275-ffc0bfcca5ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636483316, "uuid": "014465b2-a3d2-4691-9678-1f34b139b4e5", "value": "PO_AMO_8100045923.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4129a048-410e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636429002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636429002, "uuid": "e19b41b8-6fc4-4431-87a1-c169ef136959", "comment": "Malware payload (AgentTesla)", "value": "64279a28c444a1045fc18e995baf4db0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636429002, "uuid": "c580150c-1085-4b37-82ae-b0cb0e1954a8", "comment": "Malware payload (AgentTesla)", "value": "00998de3ee877910348aea0a417b22168787ddb34f5d95103c532f99f82bdd53", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636429002, "uuid": "51be600a-a7af-4f4a-9b47-e24d4e88032d", "comment": "Malware payload (AgentTesla)", "value": "386c7e25aeee36aa584d49a283c0acd84521909b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636429002, "uuid": "2a76af51-f6d7-4be3-90b5-9392189b1fad", "comment": "Malware payload (AgentTesla)", "value": "64e55019c208dec808b9ff3f65dca5065fde29d3eec4f40b8f26ba5180d9ec947fe8e73c0f6b876c0646ba512d0152fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636429002, "uuid": "5bb51da8-f5d9-414a-adf7-4857eb2dc80d", "value": "T17D94123393E80A1FDDAA1A3D5D1396401260669BF907FB1F4399F0A93B233925693BD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636429002, "uuid": "d4e5f6ec-c5cb-4d81-b462-9484e5097dbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636429002, "uuid": "580757eb-f5f9-48c9-a593-005f8e4196f6", "value": "12288:MwCePYC+Pr8/FqBHVh8/FeONAI3sbhLUevE2nNBSU4:MwLPQPYMtg/VT36hHrN01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636429002, "uuid": "aa4d27a4-dd79-4b62-9b09-8e6b0a524cef", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636429002, "uuid": "1e18784f-c776-403d-8a48-6e4d46215f57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636429002, "uuid": "c383a350-820b-403d-9517-a14f9b2b5e3e", "value": "New order - C.S.I No. 0987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970db93e-4101-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636423562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636423562, "uuid": "2890f443-98d0-4e6f-8aa3-6998e280ebaa", "comment": "Malware payload (RedLineStealer)", "value": "ce4b137e5f5f1f7d1ff9c047f11072ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636423562, "uuid": "a1c7ab3c-bc6e-46fb-8761-cb95fb98b7ec", "comment": "Malware payload (RedLineStealer)", "value": "015205363f55147a1297126658c945ad876064831259f0b4d58f29357ccc7193", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636423562, "uuid": "5c6f03ea-f220-4773-b390-59781142f364", "comment": "Malware payload (RedLineStealer)", "value": "e1e51be6c0cb89f8138c4979e39399a0c6139b94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636423562, "uuid": "c9470539-0625-4382-a822-e48898860c1f", "comment": "Malware payload (RedLineStealer)", "value": "6bce76d779ace59e0570c14f72e17c7bd81f45710f5c2b9c5dcb01bfeecc9fdbc09b799dd1a50b999ea9aef1f1b7d06f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636423562, "uuid": "93a08143-0d9d-4f6c-a95a-eb1ecacd400a", "value": "T1AE84DF3166E8C874E0A31E316865C6E51E3BBC535920614AE7243B5E2EB3F8C86F571F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636423562, "uuid": "dd84f509-aedf-4bc7-bd8d-19aa5cd3c411", "value": "c8725b7ab8753c936cc4c98a181b2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636423562, "uuid": "c4ffa621-eea5-4a15-83c6-e7526e8fe3ba", "value": "6144:2mH9a2cSfMpyi6bUJqs+R8R/PxTsiQuzbgwu6QigabwVf:rda2cvTU0+R8xZTkunn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636423562, "uuid": "16cbe9f6-a4d1-4b69-9b09-f6c1b3b61ff4", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636423562, "uuid": "15e01f29-607a-46f3-94fa-cb444c087093", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636423562, "uuid": "ba11acf2-c3ad-4e31-9a0b-3b99a21acc81", "value": "ce4b137e5f5f1f7d1ff9c047f11072ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e92fa8-415c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636462671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462671, "uuid": "8e0c7530-7a07-41ed-9400-ea8d8b769a3e", "comment": "Malware payload", "value": "6b76b31674beb7e8aa442834dacd9b8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462671, "uuid": "fd91e0e8-4e1a-48b5-a022-1204707b3d57", "comment": "Malware payload", "value": "02a852aaa839120b0e557629b63a754cb302ebe2f11275d3e4fb68f4f1e70532", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462671, "uuid": "20ef9794-5a02-4594-9213-0660e6d8bf13", "comment": "Malware payload", "value": "d8f26c60fc804d46482850f3daf6466372798237", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462671, "uuid": "65b439d6-3aca-49fb-b8a6-828eeb891e17", "comment": "Malware payload", "value": "18b21416d8e7e27459b68e29623a1b97412e816d46339c17b142a160ca29c60e2e4156311cc67690185fa3fe41b9010a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462671, "uuid": "0de0906a-638c-4e73-ab5f-e04228978bd1", "value": "T1ADC4AF52691467F2C0D18BBFBF63737087749D861C1FCB2606A8F36C497AAE09E1B446", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462671, "uuid": "1e79601a-bc33-4524-86fc-f9e2cc2de94a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462671, "uuid": "bd4cf4aa-ab4a-407e-b8a3-44d2b96895c9", "value": "12288:Zhf3doyED1TKXK7My0AXcD7BvChdWsEk9KD1:TNoys1uG0+ss5i1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462671, "uuid": "97e5b3f3-fed6-4807-b55e-d8ccc776aa21", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462671, "uuid": "a7f1ed1c-10a2-4e38-bea3-662ff1d5515e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462671, "uuid": "7e794212-7978-4902-b93a-c5ee881db3c1", "value": "6b76b31674beb7e8aa442834dacd9b8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d6fa1c-41b6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636501452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501452, "uuid": "11e0f184-5fef-4143-af88-edfb1d6a5c83", "comment": "Malware payload", "value": "a00263b6c57e0370ad90ff45f9ab6e8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501452, "uuid": "277a4bc0-592a-48cd-9a39-41af7864489a", "comment": "Malware payload", "value": "02c8c4d08cdd2bc230e6ed2676d20867eb4fb733bf254432ac6d339d7406b8f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501452, "uuid": "a34b607d-aa16-4e5d-a619-63961e8d4215", "comment": "Malware payload", "value": "42cea670d11981cb7f03a51b108ec196b0319ac5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501452, "uuid": "58464e94-0825-485c-b22e-d533d49c4936", "comment": "Malware payload", "value": "6f5f22d74a54943d0768c9d3e1611c37b70531f9cec2cab5070ef3d6368b1ab25eb53fb8400caaf24cc3f21eafd131ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636501452, "uuid": "beb08278-0647-4afc-8b3f-c19f33103ac1", "value": "T130F31AEC8499F16EF48D44B6355B8AD07972AAAD837F4FF752E0FD3021016880B5953E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636501452, "uuid": "179daef7-d238-4c8c-98b8-f93ce6b1796f", "value": "3072:/dN35hVksHC50Uj8SGG5/2Kdo9CbXPP83UdBl7J+wl:/dN35hVksi5SGd2KOq383Addl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636501452, "uuid": "c36417fd-1259-4a71-85f0-dedc384ded9f", "value": 167952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636501452, "uuid": "2f8912a0-80fb-4184-8d82-46be56a6c1ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636501452, "uuid": "c201e3ac-f69c-4421-96d4-9cf3042b871a", "value": "02c8c4d08cdd2bc230e6ed2676d20867eb4fb733bf254432ac6d339d7406b8f9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7e60ad-4167-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1636467489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467489, "uuid": "e1b57f90-5fa1-4477-9a71-52c96dae4bde", "comment": "Malware payload (SnakeKeylogger)", "value": "86eee1379aceadf1174c1efd9102d7c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467489, "uuid": "edd84b50-f1e3-4615-a19f-84d1eb3f5754", "comment": "Malware payload (SnakeKeylogger)", "value": "037e00af3082e9d4e96ea531bce541b2ffba816bb8b30fbac0763130560d3601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467489, "uuid": "39fb8fec-22bb-4d42-8be7-d5a4d1d4dd32", "comment": "Malware payload (SnakeKeylogger)", "value": "1ee81e7949db2d78ae2a2e461ac96cf2011c4699", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467489, "uuid": "9dadb795-ce1f-42ca-a68d-1dccbabaac05", "comment": "Malware payload (SnakeKeylogger)", "value": "900a5e828282782b8750211fd7cf2baea94970df975d49d5993e0c9266b6ab468f3ab264ac2a0f0c904ebfb1259f8829", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467489, "uuid": "0f72b6ed-742b-4139-9d66-492b5b422f10", "value": "T1F264023F7654D83BC4699437D89F294047BC768AAE96D36C3BDE22AC65533F0042368E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467489, "uuid": "4ac40d39-0dbe-45db-9e7f-7bb044b4467b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467489, "uuid": "bed5d573-33fc-47cf-9ea3-fd88107cbde0", "value": "6144:HYUYJ6fPfMMkMMWZI/QC1Q629/pL8MIQilQnxxJr/56G:HpY6PfMTbJa6koH2JL5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636467489, "uuid": "fae326b0-293b-48e5-931d-f1bb0dd02bbc", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636467489, "uuid": "29f66d49-8d9c-4b99-9c84-26b3e42fd292", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467489, "uuid": "fa02c731-bdc8-4c28-bcf9-28bf4403fc6e", "value": "doc2021509979791.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e45d00-415a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636461643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461643, "uuid": "a73ded0e-1c45-48c1-aad3-443c91dc56eb", "comment": "Malware payload (RedLineStealer)", "value": "87726003343d1e14d3095bcdd372f4a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461643, "uuid": "75ed8ad5-9c92-4743-b512-6d5f4fa96b89", "comment": "Malware payload (RedLineStealer)", "value": "038152eae96d57cb15d542b84755d9feadee7d2012fc183a1937c448c211671e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461643, "uuid": "fef349eb-80e9-4495-8e40-0703bb767b96", "comment": "Malware payload (RedLineStealer)", "value": "da2823d54ca0d6509d9f952d324e07d267ee1ed0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461643, "uuid": "cc131885-b70b-424e-982d-e6a33f5f237f", "comment": "Malware payload (RedLineStealer)", "value": "64adf8ab015a75e402119c7bb187f92ea39b8b67f536d3cb5c0008c981b26731f6adc7f9370d45030331420a5b117776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461643, "uuid": "72e79064-f3f7-4899-be1a-cd474ccce51b", "value": "T128F49E22B581E872D8F314368A7A53B5C97D78301760D9EF53945A3E0F236D17A38B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461643, "uuid": "52134cad-ad1c-4d12-bc87-8b686cabd28d", "value": "5ab585b85d75f67a0dee6de3aca4ff06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461643, "uuid": "97776ded-df66-4f6a-8425-5e5501dd5076", "value": "12288:WeXNc1H7zpNd33Cl/js2HGqbZZg1BBpv4HxsouTAhC0YDnUxx5vBuwjrrOGEHj:We9c1H7zpNtIbZZg1Jv4Rs4x5BuwjrrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636461643, "uuid": "b58f08a4-9438-4775-9f2b-936340b43758", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636461643, "uuid": "2e9d17bb-1367-4b12-8990-a634ea1ff8e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461643, "uuid": "ebab7e26-5410-4bb8-94cd-9f4ecfc34495", "value": "87726003343d1e14d3095bcdd372f4a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ac5e78-4154-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636459067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459067, "uuid": "c7563a38-3ae6-4e4c-9dc3-35e854fd4b68", "comment": "Malware payload", "value": "2c88a95d136be447e28c6ba0c424f93e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459067, "uuid": "e8b747de-8b69-40ee-ac6d-882ef0e7c759", "comment": "Malware payload", "value": "045a680f5cff3aa889bd6e366a1445dc6c9f066b6601ba69f973c77cf37a5bd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459067, "uuid": "d729d44d-35d9-4305-9449-851f135d3865", "comment": "Malware payload", "value": "1fc109fa2f42ed744efa0d2f7b30ef06fa712de9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459067, "uuid": "c165ad95-b853-4401-b1a2-2f9e1c112bb3", "comment": "Malware payload", "value": "b3f6acef6af07ed1d7a2e1d63b418f8ae9764d862aa55ae5df4c2aa174ab66f616e644757a6b0692391a8500be42ef4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459067, "uuid": "1c9459c9-be0e-4913-a7ea-c052bce36e51", "value": "T1A4055B49F2809DB5E493263088AB2331A934AF8529285C056DBF3D566DF33C36576F8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459067, "uuid": "c9c2388e-1dea-4a0b-8fbb-c708124e91ee", "value": "7b484975ebc1a121d346391a74418697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459067, "uuid": "2b3ad408-bcec-475a-80a0-550d8a021350", "value": "6144:6ty9J2eb9Vmcc03Dl2QEE12/ggyHISePm7lDW/Bl5Wn7DYKbQAJRIl68hTnUE:R9J2ebzmccYDJ2tMIMS/n56D86mTnUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636459067, "uuid": "dba40803-d54f-456e-9b1e-6d7e3f07b7e4", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636459067, "uuid": "281daa40-a815-4cf5-80a6-8e16b85848c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459067, "uuid": "6aa9bbdf-ec7e-4db0-8754-77a0f3397a72", "value": "URGENT PURCHASE ORDER (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1ed7f3-414b-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1636455358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455358, "uuid": "7c8d2b8a-ad4f-4c02-a23c-858a34f0f536", "comment": "Malware payload (RemcosRAT)", "value": "5b5a0225a2b7b9a054417662c733168a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455358, "uuid": "3dda5b1d-0998-4b3b-98ac-70989c2e127d", "comment": "Malware payload (RemcosRAT)", "value": "04c53261b1220a894a02f5ffb39cdfd73f93481c0b5c8106d21c91b20205c62d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455358, "uuid": "a83db139-437d-4f88-9331-15c1894f3bfc", "comment": "Malware payload (RemcosRAT)", "value": "411535c9548f86034a6a9a603de521a86a3b5466", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455358, "uuid": "419281b0-255c-4068-9e0b-861e35dce3cc", "comment": "Malware payload (RemcosRAT)", "value": "55663a636e6a008a052df3adc822c85d92194ba5dbcb45548c12e666d2d3e8874f57177ee215cc14742719f5c19dc1f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455358, "uuid": "440fdc2a-142d-426a-ac60-16d3d6a4a4ab", "value": "T110056B54E588A8B1E4AA16354C7E933AA1347FE52624084A5EBF3E077DF32C32574E4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455358, "uuid": "b43364bd-f260-4590-8c44-6b8cb7967530", "value": "7b484975ebc1a121d346391a74418697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455358, "uuid": "47c1539f-0fed-41b8-a0a3-2514dc77d0cc", "value": "6144:6ty9J2eb9Vmcc03Dl2QEE12/ggyHISePm7lDW/Bl5Wn7DYKbQAJRNl68hTnUE:R9J2ebzmccYDJ2tMIMS/n56DZ6mTnUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455358, "uuid": "235f7e0b-4644-4759-a77d-a464c5fdf8d3", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455358, "uuid": "ed27c647-76db-47de-a9a3-c1aecd7c7017", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455358, "uuid": "741da08c-ed21-407b-bfb8-5db162ab9bc5", "value": "SOMECO Nov Acil PO_76565,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04d9ebe-4138-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636447254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447254, "uuid": "1e4f5db9-501f-4fae-bafd-8ac396455a64", "comment": "Malware payload (RaccoonStealer)", "value": "1464ae99aba9d814450f869cf640ed7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447254, "uuid": "e4bc2e12-1db3-45c3-bf18-044f9986b1d3", "comment": "Malware payload (RaccoonStealer)", "value": "0748cbae64a6051b9b5c6d33c28c0768949920509146abf3298803b0f86252d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447254, "uuid": "9ddb9128-e2a0-4bbe-87b5-bde91f7441e5", "comment": "Malware payload (RaccoonStealer)", "value": "3c5d73cb7259238dc9909ce4d7f886b26a3496a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447254, "uuid": "b8e3d392-fc23-4fcf-8859-beebe394ba04", "comment": "Malware payload (RaccoonStealer)", "value": "e82bd318b2e8999a3709868de355a0146b8218d972f30679c8b36c81503293436421bb6c20fd3937f3388a3534bb612f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447254, "uuid": "d8a3e918-3c4f-4335-91d2-6504df9895eb", "value": "T179B4F131B3A88825D0535E344D65D6B40B37F8329E70614AF2506BAE1FB3F9C96E532E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447254, "uuid": "a1ff7dd2-8e94-4ea1-ab54-d1eb0018c5f9", "value": "c8725b7ab8753c936cc4c98a181b2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447254, "uuid": "ed7a17d7-bccf-4c25-8cd8-d99d0b0faedd", "value": "12288:TASNdlkvJ/g1vQrJP6tyOIaoD54nunn5:dHlSpg6JOy8o2w5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636447254, "uuid": "c3785011-7c50-4df8-9c8d-6ba4d0d0b3d3", "value": 515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636447254, "uuid": "f4061830-06b3-42ac-9e3c-4e2c9f3f3bfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447254, "uuid": "fd159938-1cda-422f-b8f3-386037ab286b", "value": "1464ae99aba9d814450f869cf640ed7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8cef40-4187-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1636481154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636481154, "uuid": "6d205c6d-3234-402e-a758-351e5dcb277e", "comment": "Malware payload (NanoCore)", "value": "5a332393b78184d36b60df23a02cb72c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636481154, "uuid": "3aa5246a-8809-4680-b4af-20acc43f3576", "comment": "Malware payload (NanoCore)", "value": "07f511ce3b6a8fb409c1a05ea3e01a6d92422674224109c8d0889a017122098c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636481154, "uuid": "9aaaebe4-7382-41a8-9dea-ccc8d2941aea", "comment": "Malware payload (NanoCore)", "value": "f2910931eed05b20c9d95c03af2a416981fb2ed1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636481154, "uuid": "b8d19c80-8a14-4d2d-bfd0-627f2603d711", "comment": "Malware payload (NanoCore)", "value": "4f5654767db6df0e042fd39ccecd29a255aa369ec9fdce02a18993f494ab7ca69464d9d9308389601f95fed6916f686b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636481154, "uuid": "590f9649-eabf-4974-8a59-4473061971cc", "value": "T115D28D3847555136DEBE0B3BE5A01E00E339A7837403CB1EAA9D71CCD9D335A5AD12BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636481154, "uuid": "3eb56ada-2c1f-4558-8787-02c71b10ce1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636481154, "uuid": "3f29fa60-82d2-45ef-8669-baa1bb93d24a", "value": "768:JAp3wjhQ/bxBR7R0Ly7grMfutBIHb1M4hj:JS3wjmbtt7grM1Sy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636481154, "uuid": "c17d921d-51be-4989-9539-2ab78ea9610a", "value": 29624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636481154, "uuid": "055e33c7-9ad2-4251-8861-499c4ef569a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636481154, "uuid": "b4da1601-4a36-4cd3-a637-25be0de95eac", "value": "W3M1PaymentReceipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da077e7a-414b-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1636455457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455457, "uuid": "c1d6d0d3-956c-45d7-ab00-71edcc696ec6", "comment": "Malware payload (NanoCore)", "value": "14ce52a1bcd5e96848d720106c1a7fcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455457, "uuid": "c9f0d4c3-1194-420a-a0a4-5baddb0dee6e", "comment": "Malware payload (NanoCore)", "value": "0aeb4629d35069abee592fc8ee3cc33c1dc80f85284140225ae27208fcbb550b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455457, "uuid": "0c66e6c8-812d-427e-88a7-500d9102c4f4", "comment": "Malware payload (NanoCore)", "value": "9de87c006227b06d928b826cf71e0fca3bd0187c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455457, "uuid": "bc1c0ac5-097f-4dc0-9d66-2d1ef2e8efc0", "comment": "Malware payload (NanoCore)", "value": "86a6913236fc69de5b0b8ca09a4822db02379a20c8e4c415086c3bb2d1a354d4d6dd9772cd8e2dcd1dd4b15b57e5b4b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455457, "uuid": "17da461a-e2e0-4c4a-9d93-173a9c7057af", "value": "T1E7354C02BAC44C05C73E0771586E9428DA6A7DABA53D821C7F9E337B3BB7751052722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455457, "uuid": "108aa157-c01b-4931-8fef-15789bf0c997", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455457, "uuid": "6f048689-7358-4d05-9248-9bb66f87b9a0", "value": "24576:8Z0sh5BhvnYjp5wylGlrKq+2dH7RTdTxGGz:8ZBrKgbRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455457, "uuid": "ae4e0b4c-c71d-44a0-ac72-ac3f91f1fd7d", "value": 1061376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455457, "uuid": "d0f5acd9-9b5b-4413-b398-06f5331288ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455457, "uuid": "e2cbf1d1-2621-4a75-8586-bf59c788ae5b", "value": "WDC~039837653356-30983637.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948da10c-417b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636475957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636475957, "uuid": "febc4c9c-7b53-4bed-aac6-3a69ee378fa2", "comment": "Malware payload (AgentTesla)", "value": "3e7494e41b85a42442798111ce204a59", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636475957, "uuid": "e78a1241-d6bb-48d3-9809-8f49ca128867", "comment": "Malware payload (AgentTesla)", "value": "0c7226fc77c5c7c7faf21bf1ea075894bcb493c1b4e3fa727512810d614725d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636475957, "uuid": "8ab94fd2-dcf8-4eb7-891f-18f0b1c0786f", "comment": "Malware payload (AgentTesla)", "value": "20a170d4cdcab766bca9926c79dae55f60c04103", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636475957, "uuid": "f6699cac-517d-4b5f-97a5-0828cd51c844", "comment": "Malware payload (AgentTesla)", "value": "ff47e88fda78e9433554a82fc75e0470aedfbd56bbbbde0366e5e653a6ea1d5be286c0e484df45eba82e7827ebc56f37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636475957, "uuid": "23803f1f-8766-4cd0-96f7-a6bfb262aff4", "value": "T113B423EE34074986B501E99C6E757453904AADFF52A84CA13E1AB8EFD7E8C21F27F110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636475957, "uuid": "66dc7ec2-a661-424c-aad7-0f805cb2b991", "value": "12288:8qW4G8Zg1Np+b86n8BunmUzaD9p/4Sw3wf78y0A9X6qVGuQENIMw:1/tJtlnOD9l4Sw3u7ti8GeCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636475957, "uuid": "f76683bd-e8de-462c-bee5-3232c2c86710", "value": 534517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636475957, "uuid": "f55d2d70-c091-4e39-9185-1681fe4b0569", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636475957, "uuid": "efe13aa2-f802-434c-8a16-4decaecc7e61", "value": "overdue invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d9ce86-4166-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636466693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636466693, "uuid": "3486cb22-6923-42c6-9ac1-f855f73892aa", "comment": "Malware payload", "value": "c5590212f43797d3a2f26d0e8d0eb4eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636466693, "uuid": "51a7733e-9032-4a41-a603-5605a41480e5", "comment": "Malware payload", "value": "0f88c584adf854f18bcc5b83055fb772365e6373b8763a517fd506a28ea8fd0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636466693, "uuid": "e4944401-a038-449c-8566-9af7567baa6c", "comment": "Malware payload", "value": "acd97813c434d1d46195f1b6c1a84615e85c0916", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636466693, "uuid": "444f17f9-05f2-4246-a89f-5278e94083fc", "comment": "Malware payload", "value": "86401a06a3c399221133526c418331c2bdcaada4163fab5192dc890b68efb277117aca72951cd7395778fcde3ea8ea27", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636466693, "uuid": "244ddca7-7dac-43cf-85ca-bef9a97057e6", "value": "T1418423741340982FCAA7577A15226605467512CFE55AEBBF4BBDE0D13B333D298E0BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636466693, "uuid": "f90751a0-2690-4d9d-8562-436e1199cea9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636466693, "uuid": "689c3083-bdec-4b57-a582-87b12120915f", "value": "6144:gHMnMw9eMKMg1WvOut9Q9PXbVm824HWWAtqx43b6Cly1Ff/rsIgM5:gw9ePIGwQ6824HWWrx43nkXXgM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636466693, "uuid": "7830d4fe-6304-47a4-a500-d9507a2c6bbb", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636466693, "uuid": "129be514-cc4d-40b6-bc16-a550e6a073bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636466693, "uuid": "fd7cb86b-765a-48be-96e2-a4bd4f756eec", "value": "Transfer Request Form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c70f50-4151-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636457707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457707, "uuid": "027df054-9448-410b-a0fe-da3dc32c9291", "comment": "Malware payload", "value": "5d6b586049e9c6100040cae472503dc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457707, "uuid": "3fee995b-756e-4f08-90ce-612b818aec8a", "comment": "Malware payload", "value": "10a069e7bdbfac1dee67fbebf39c29f4c69ce0b7600c6a3aeb74b47411be8087", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457707, "uuid": "cb612bab-dc88-492d-b191-e267fc80143c", "comment": "Malware payload", "value": "f6125e10e3f0fd68676602553c4b56099b25f20d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457707, "uuid": "f56fc450-3ed5-4a11-a7bd-bbda5385323d", "comment": "Malware payload", "value": "8f0c6fb2f9aa1331490ebad9914527655c05e192bc381a1acb7b1402a2032641fc417666f99bcc300d4be94dcf0e4410", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457707, "uuid": "c374337d-8d66-4cda-a935-63ec838fec07", "value": "T180740211BBE5C81DC9F516738CDF251043B466C7F9E2EB3A6AEC622865233E986017CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457707, "uuid": "003eed9c-9ca7-4dff-bca0-18d09a91a91c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457707, "uuid": "f1f7f02d-9966-4fab-b4ec-71b8d049430f", "value": "6144:Un5oMTMkM00igHj6e/72fMuaD6mjczhnhmeb4dunq/4ZDJpw:U5oMTTf05DT/SfTsrQnhmv//4jpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636457707, "uuid": "39940e42-3c82-48d7-8b0e-a6a204d28693", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636457707, "uuid": "15aa4b10-6dbb-4c86-b6de-48deeb1bb738", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457707, "uuid": "22e41066-f6b2-47eb-99c4-be65dcb2b9e3", "value": "uCkIzRN4ZzUIzCY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8b1717-413b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636448481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636448481, "uuid": "72b1a4fd-579c-4556-a93f-d8f5d18b288b", "comment": "Malware payload (RedLineStealer)", "value": "3ee418ea0a0c03ad9dbda58da28dabe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636448481, "uuid": "54cad576-876f-4961-bcdb-8166516c3f17", "comment": "Malware payload (RedLineStealer)", "value": "125abd4f9c09ed884f83cebf8181ab9a073a8a3545b2aa09c8c0ac958ed78b28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636448481, "uuid": "7fc51354-73d4-4c10-a089-9e2f819a3c6a", "comment": "Malware payload (RedLineStealer)", "value": "f77f75febd340c9d7ead94af4b614b3743253bbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636448481, "uuid": "d932bff5-d8b0-4d10-9071-6c3eb0a68205", "comment": "Malware payload (RedLineStealer)", "value": "a500695e188abc3b1494e9ebaa86a3100e62e0f02d16f09b57a5ad134d85fb6341e56f0d428bb078846a27acdad17cdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636448481, "uuid": "a5659186-20e8-43bc-8ce4-055932b3c59a", "value": "T1BD74DF3176E89834E5A31E308921CAED4B7BB8115970A10BE750679E1FF3F9C46E271E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636448481, "uuid": "66bc73f4-93db-423a-9f90-2f562c33a39d", "value": "c8725b7ab8753c936cc4c98a181b2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636448481, "uuid": "893ff1d8-15e2-440d-8e59-82cc0aded13e", "value": "6144:GmH9a26wWHowmlMnbK+KkD1N76aKbfkjdnX/jVAfVbwLG8LC1uzbgwu6QigabwVf:7da2vWlmi2+KYTKb8jd7VAGq1unn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636448481, "uuid": "0a4d566c-c8d5-464c-9390-f69c40029dcc", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636448481, "uuid": "c10ce3c7-7852-4b71-b744-2b9654d96565", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636448481, "uuid": "83aba69a-2f33-46b8-bbb1-242715d1c998", "value": "3ee418ea0a0c03ad9dbda58da28dabe1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06e8fb3-41b3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636500082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636500082, "uuid": "e30fa250-b646-4ae4-a6b0-681bfa231453", "comment": "Malware payload", "value": "020b0db3d39dd077cabf1c2e60be4f04", "object_relation": "md5", "Tag": [ { "name": "DEV-0322", "colour": "#95A03E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636500082, "uuid": "8cd27167-80b9-4cc9-9d3f-2cf66a2d92f3", "comment": "Malware payload", "value": "134a570f480536d04a056da99e58a3c982aa36f5b314f48a01420b66b759d35d", "object_relation": "sha256", "Tag": [ { "name": "DEV-0322", "colour": "#95A03E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636500082, "uuid": "efd05ec9-35a3-4bb8-b29a-971a29dba45c", "comment": "Malware payload", "value": "9cfae4033c301ba4e00a8edbc31f7dcd7f907d05", "object_relation": "sha1", "Tag": [ { "name": "DEV-0322", "colour": "#95A03E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636500082, "uuid": "3898477f-cfe0-4a37-9685-52dbf69ed384", "comment": "Malware payload", "value": "970bd08306f031d0ee1a4e1f3ad2824e3aebd64257bd88d5bea9d1f10fa11aadc5d97f4fb9095bba9526620ee0575602", "object_relation": "sha3-384", "Tag": [ { "name": "DEV-0322", "colour": "#95A03E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636500082, "uuid": "47768220-e1c1-4404-a6be-538ee90a3fad", "value": "T18C911984E409B4F7C61B90AC968D2B431999754220A7A8303AEF7D4DFF33ADD0275DB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636500082, "uuid": "3ad86fe2-1f76-4980-a861-94b2533abf10", "value": "96:KlQkbvtMHNZvvvvvvvvvvvvvvvvvvvvvvvq/PDFrGtf+MVIOG9hGwdP2BCtL:KlVjtIbvvvvvvvvvvvvvvvvvvvvvvvqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636500082, "uuid": "0768ff8a-0812-470c-b1cb-46f4125fae07", "value": 4395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636500082, "uuid": "48dfe801-3f6c-4bf7-99a2-d90efb6df714", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636500082, "uuid": "55745736-185e-47de-8dce-4cd703c171c8", "value": "134a570f480536d04a056da99e58a3c982aa36f5b314f48a01420b66b759d35d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689d3183-416b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636469011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469011, "uuid": "8e193a45-d037-4260-8d2a-4a02fc88db5c", "comment": "Malware payload (RedLineStealer)", "value": "5c62e7336bed7e11a6b627f8e56971f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469011, "uuid": "e992e46c-99cd-40a3-9217-bf6f7ba179c5", "comment": "Malware payload (RedLineStealer)", "value": "16361779af23f2bf8e9061bbf7ab4b702bbec1ceafec1eb4e97dc23a7373ac31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469011, "uuid": "4a802e5e-cea9-421c-b52f-25cf4565e75f", "comment": "Malware payload (RedLineStealer)", "value": "433d7822a02e9baaca6397955014ad842e6c7c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469011, "uuid": "842c1975-304a-413e-9348-bb058597ed60", "comment": "Malware payload (RedLineStealer)", "value": "421cb7407f519173441ee6f33c191f2ba590282503442273cf8b844445b9f379a65276482fca0fadff62da0bf20e4b56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469011, "uuid": "7d12251d-d8cc-4f5c-a92b-3e9249a5c711", "value": "T1EA6430062B84E24CF0B73FF383DB7A1987A3ECB58B7659C61E489A0312755815F67239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469011, "uuid": "bcea3baa-141f-4da5-8310-2648f0cf66a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469011, "uuid": "6d50dad0-3fb0-41d5-823a-ae563769eb1b", "value": "6144:gsyxeOgYJu307mB6Ipcw4WIDXPnxZeePihXgJeOpX/fQP:gsyzJM307mB6Iew4WCXPnxZeePwXcn/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636469011, "uuid": "de0cee6e-7126-4697-8bc5-2c95a5658d7f", "value": 314264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636469011, "uuid": "cc1f9aba-7a36-4360-98cb-2e5c605e12f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469011, "uuid": "b923f261-8174-4ae5-8d7a-bd0b0e7ed33e", "value": "GenHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14088be-415c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636462717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462717, "uuid": "3fbab555-f749-47f1-9e83-e1de4b81c4d7", "comment": "Malware payload", "value": "43def8eefaaf8cdf55225bffdda8ec38", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462717, "uuid": "1e324e90-c929-4d92-b73f-6f106419258b", "comment": "Malware payload", "value": "16fd16f1795de27c016a22b16c4db01bf7f2197a91dfc98dc8f7ab9c4e85c464", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462717, "uuid": "20ea0102-fd4b-479d-9e78-97789d87d28f", "comment": "Malware payload", "value": "9f4ab9578dd5808293afb3aead4691cb162d3b41", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462717, "uuid": "0cbdc55a-1436-4db6-a87d-9c0c5b6a80d7", "comment": "Malware payload", "value": "74eccc336fef9419b3cd2c870f25cd7a6741ddb3685ba5faabe3bab2d56bcf618bc96ca1e5a66fd68c9154e364ff9fa3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462717, "uuid": "ed8027ce-65a4-4644-894b-5b95579a0a3f", "value": "T1E704647DF1474A888F8697B8130B2F81158CF51CF3D984B636B8DB3866D1D7A822293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462717, "uuid": "0942f731-c537-4b4f-a4df-a5e696dcd3ae", "value": "3072:TeAX5jG8CrsWJVF5yT9Fz0cP2yaQZMEhxd:fdG8cF5E3qk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462717, "uuid": "f03a975a-aa8a-4179-b017-6abb7dc5d459", "value": 173983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462717, "uuid": "f3ece24f-4331-4f90-881d-0f5cecc4772d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462717, "uuid": "8ad2acc2-3fd5-4494-bac1-8aaa2f18e118", "value": "items.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa10cd44-4158-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636461094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461094, "uuid": "63a877e8-9677-4ddf-8c97-0f4493d76d6c", "comment": "Malware payload (AgentTesla)", "value": "1dc43f5bb93b01962c4cc8da446daba0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461094, "uuid": "7d4ab19b-2a26-4b7b-bfe6-776841b17758", "comment": "Malware payload (AgentTesla)", "value": "1724f70b37f3d2d32eba0554b3edb0657c3d0048a6b4ec5985b4bde47bc7ba69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461094, "uuid": "2ae0c9cf-7956-4b0e-9882-738596b4a765", "comment": "Malware payload (AgentTesla)", "value": "209d614a5a674c35bb45edc1e0d7f84df5a1cfd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461094, "uuid": "98f69375-2d92-438c-a8bc-10f05da86fc2", "comment": "Malware payload (AgentTesla)", "value": "6d829d69db791801e06ee9ebf0cce84be80c6151d8b3c75087bae1a6c040b2aac4dae8b71d5fbc666c514ce4f9f8b155", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461094, "uuid": "22a76a91-8d3e-4a2a-b900-7f6896c8f402", "value": "T17B84239213466FC8FCD2AB86F698DEF744DBF09DFEB2C645B2170E342614E060128B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461094, "uuid": "0e33eec2-ecd5-47e4-9ae3-efbd28185d1d", "value": "6144:DdzgPobWMMbZ0Z3SJTXenOPDhXfAIQZPe3AJI+QkxTqmpMPVFLJ7KAbV555zjR:Zzoo6HbbeOFX4II4mlQChMNF17KAt5XR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636461094, "uuid": "f7cba2dd-0655-423b-9f38-6b1f6968123c", "value": 375189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636461094, "uuid": "0b711709-c1c1-412c-9ff3-a73cfb13fc98", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461094, "uuid": "62bba7fb-add2-4885-a61b-f439ae230e5d", "value": "details of payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ec617d-4169-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636468087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468087, "uuid": "91ab6261-9252-4687-b71d-6a9e7ecf6e5d", "comment": "Malware payload", "value": "c11c4c79d0d6f8ed80996c5fe9f73d91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468087, "uuid": "5b53ee55-5bfc-4779-b2b5-64e42fa9f062", "comment": "Malware payload", "value": "191018b2c61b46c04fba2acfd7138621ad327b5e918bee60e551c466aa9aca33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468087, "uuid": "21e03639-4335-42ad-b8bf-936603e0e22e", "comment": "Malware payload", "value": "f0a9bc691ab41c90c9ff71c8a5013ef47f33008c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468087, "uuid": "e47a383a-554d-4336-b307-f856a17c634e", "comment": "Malware payload", "value": "428c67a437a62f93a2707ab9aa00b3b2075173dde62da0b66e74b22b98059240a1c63871ab946220fd214f6e815c6a37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468087, "uuid": "d20d0dc9-d328-48ae-b947-c424bf51aad9", "value": "T14295336BE1209C64C16F0AB6110E974B9F38362686F881512F7F8BC3D4DC8CD5BA66DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468087, "uuid": "74501e0b-1087-4e53-ba6b-5f6bed8645b7", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468087, "uuid": "2f07a933-fef7-4ff6-8d8e-f6a675b5b65a", "value": "49152:EMH4G/V6NCh4P4cPhk2xwkF4QbFTaYWNa6nhx2:EowNBP4qNx7PBTVKV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636468087, "uuid": "ae4b85e2-f2c4-4ddc-83b8-85ee2e7d336e", "value": 1887744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636468087, "uuid": "bf29fdc2-c4a6-47a4-96fa-05d748eb6e8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468087, "uuid": "9fb96a62-6b4b-48ad-955f-471943bdf1bf", "value": "GenshinX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e94e86-4179-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636474888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636474888, "uuid": "c2d7b68a-ae97-424e-aa92-381264d9487a", "comment": "Malware payload", "value": "c00293eae6b7fede2e7d93d25f3dc367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636474888, "uuid": "d51a73f6-62ea-4ac0-a9ab-32ac57db2367", "comment": "Malware payload", "value": "19937ca8d2f65acd9b504031d21f2aaf5e168099eeb89a77fd2abe1ffbeac1d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636474888, "uuid": "9db81d20-f4fd-4c19-8723-5266dda3a179", "comment": "Malware payload", "value": "7ee19a00836b15aa0f16ae377d329d125608036e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636474888, "uuid": "fb9afa81-789d-4d78-bac2-d6f4ffe134a6", "comment": "Malware payload", "value": "eadddc10751a8f65e40cdf5a58d61308305212526707d2612fdc1558c803d1723043d68282e8c2b1e1ea3b51559c4fbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636474888, "uuid": "39a93ba3-3b89-4a68-af7c-3fa45d836b31", "value": "T1F0B4C07A3212BDDFCE278DB5C9502C50AEA47877571FC203E95701AA6ADE492CF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636474888, "uuid": "2bc4d269-d78a-48b4-a964-23b95f10f79b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636474888, "uuid": "d40f433c-59d0-4438-867b-d0e8b56b29b2", "value": "12288:zByqJFTP+VPE7gkACaTDBMgF6BevuUFIabPDG/iFO3sUofub:FyqCWggaXBd6037G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636474888, "uuid": "ca57f018-3f6b-4b1c-97d6-3f647da492a6", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636474888, "uuid": "10480cd9-9d60-4a28-90ae-7db1ea305c77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636474888, "uuid": "4b7b4034-37d0-4b41-b903-1b09f863769f", "value": "PAYMENT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e55066d-415c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636462605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462605, "uuid": "37ea4fb7-9266-43f9-ae26-be18f894efde", "comment": "Malware payload", "value": "c76d093169a3785ee40f792db79f29ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462605, "uuid": "f967997a-fb03-473c-bda1-27ff392861b9", "comment": "Malware payload", "value": "1a129b53070e067ddf5073440679c8b155d99d2c0ee1cb6326dd025dcc4c5cb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462605, "uuid": "d292a8d8-aefa-4064-abcd-2c5587dc4d75", "comment": "Malware payload", "value": "b2879b7a7ade44651f41a9751f1b054a064633a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462605, "uuid": "09b98dd4-620f-4b43-bc65-213b309311c5", "comment": "Malware payload", "value": "508a663635650a6ce4f0b3ab0c69fdfd1368201cef7c6c0d9e9fc4b705883240563d984494079be5ec1bd992e50242be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462605, "uuid": "8f7c080b-667d-4f74-997d-59b87117e06a", "value": "T181C49E57F6E7BA65E6AFC2BAC6B1C92D66B3349202B0C3CE774055892912391483D70F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462605, "uuid": "710b7712-406f-4e55-b8e1-3322ac7821ba", "value": "de92ddb295132323885964c44ba1a4fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462605, "uuid": "71af5675-24d8-46aa-9f70-a06c0824398d", "value": "12288:fHzhL3/Z3+AZXkOCH8bzbBSreg48k7NlKVWf9:fHzhz/ZOABkjcX1Q48kJsg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462605, "uuid": "e872aa3b-8058-4521-aa9e-f2375cc811c2", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462605, "uuid": "a632c891-fffe-4bc3-b98a-6a323a73bcf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462605, "uuid": "c9af5a52-3ce7-490d-832e-0da4b5fd4344", "value": "Payment 1205_1.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ff8099-4163-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636465626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465626, "uuid": "594f2008-5bfe-425e-82fe-c4040bc7b46a", "comment": "Malware payload (Formbook)", "value": "01f7b3ce8dc583ad00ed9479ef5f68b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465626, "uuid": "611349f9-a896-4f7a-9f92-62f2c536dd7c", "comment": "Malware payload (Formbook)", "value": "1ac1102efd7dc86e7079f8dd1a8c7ceba485c7fed3f9fe92c00dc55e7566abdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465626, "uuid": "2e0a7319-87f6-4631-8d7d-e3289de355ba", "comment": "Malware payload (Formbook)", "value": "b5b78257fb083cd898fe43f57cf81136de43dc9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465626, "uuid": "e8c8f608-e220-4d28-8a7c-c5fb3147e547", "comment": "Malware payload (Formbook)", "value": "6d0f2ac51fb639273ab2740941071a7ecccc82f5965ca675e1fcf0c387c1c134b642c7d48536e4401c6205a5eb85e3f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636465626, "uuid": "2f75eee3-2246-4595-bf28-b5b7cede4f11", "value": "T1BF94ACE06AE44063C85004F1EC2CAF7576B1AED47B2855E6F39CBF7A99F6D31864B240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636465626, "uuid": "b56b3e34-c9ac-4c96-b3fe-fc865cae7332", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636465626, "uuid": "5cbf0be2-09a5-4b68-9468-257754d9f846", "value": "6144:TbE/HUidODn4GC+RjWypPAYybaO+Q93jpNOQMfOrCT6eDt8xFvfDd4ow:TbWODnrnFWypAXJjFpUQI92eZ8rDd4ow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636465626, "uuid": "765a9a70-b072-437e-941f-782830b30308", "value": 419846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636465626, "uuid": "422c0750-dc20-46a8-a729-7d5fc0fee0f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636465626, "uuid": "2f58bc66-43a3-465e-832b-4d75b3b34b98", "value": "December_PO_20210034_from_Induvac Textiles_&Leather.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a58b5e-4159-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636461408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461408, "uuid": "edcb4ffd-fb9c-4e9e-92df-a0112749cadd", "comment": "Malware payload (RedLineStealer)", "value": "cc02b01bdb7ccd58ea0a2eb9ac3f0c81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461408, "uuid": "fe940c04-c958-4187-95ed-0d0579766a15", "comment": "Malware payload (RedLineStealer)", "value": "1b40867dde275738e50b3d41dc494c9839f6854324238b64b292db34ef35f454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461408, "uuid": "faf8e802-80af-4e59-b6f1-0484688831dd", "comment": "Malware payload (RedLineStealer)", "value": "e4279acfbacf4a4dedc79ff2e6bc8bb19c837f8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461408, "uuid": "724d39ac-abee-4962-8c2f-b78946297d75", "comment": "Malware payload (RedLineStealer)", "value": "401a14bad8df4dc594e8b0c6195180c309fa9b8225a252cbe466dc0103096a1326b56e766cd50a1ab46e28eaa7a40897", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461408, "uuid": "2daf83f4-64bc-41d6-89ef-a38c57586058", "value": "T1B91633DBFAA41A2CD594FBBD42D83058E2518C7CF44C3BD00DDF8149291A291F6AAAF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461408, "uuid": "3e51d3a7-d310-401f-827b-4b19f99d9830", "value": "e48cc266501c282987b27f2c1f654e2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461408, "uuid": "b7588508-143a-4d3f-85d4-c0d793f4d837", "value": "98304:1hp8yp5MgoAo8KfOtpQs5WZ14U6XPHPQI:fscKKQs5Wn4UiHPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636461408, "uuid": "861b73c5-e220-473e-be35-32bf23c82385", "value": 4416000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636461408, "uuid": "95d7e831-787c-4c4e-a701-9057e74ad31f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461408, "uuid": "8e6aec84-879d-43af-8be9-19476acdc3f7", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6bce66-415c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636462526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462526, "uuid": "ea6086fd-dc17-4c94-b92e-757f29bf7404", "comment": "Malware payload (AgentTesla)", "value": "54df84f8c18b2f6fc271fb7398f0efc0", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462526, "uuid": "ece91dfe-3cd0-4bcd-aaac-880e0c75760d", "comment": "Malware payload (AgentTesla)", "value": "1badd8930cbe84ebf539b1037632117549c09ddb0c09a208e5019c77985ce1d4", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462526, "uuid": "c95804a9-4d3d-4159-9fd0-9904b76c31db", "comment": "Malware payload (AgentTesla)", "value": "b8ef17d911b1c97055caf969e076cac2ae72b7b8", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462526, "uuid": "9e3c1307-9f47-4c94-bc40-f21384e4c41d", "comment": "Malware payload (AgentTesla)", "value": "ecfe017adc0b50bc65e67870bd1655f1f603c8e89e4bd9e1befc727d8a2575c6c300450415f493952189ebb651cf8de6", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462526, "uuid": "6b695a44-9950-4647-a40f-f947a5186b16", "value": "T14E94233233F77AAEDA4902386A570BF6CFBB077F944450A4FA02033BA3175A660D7595", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462526, "uuid": "1874914f-758e-4047-b2af-2b814a2b3e97", "value": "12288:4FuuARrKZQTA+Vy6h8j8BM/bHiD3F8by4J1:4F/AR/y6+cM/b8Ouy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462526, "uuid": "bf3b4d94-3410-4dc4-806c-dd04c43da4a9", "value": 421302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462526, "uuid": "d9a3cc16-2858-4fab-9cf9-d7e2c38a1156", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462526, "uuid": "64647b1f-27b4-4523-86c8-cbcc575ff935", "value": "FedEx Billing invoice no.380454605.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f235cc-4125-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1636439156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439156, "uuid": "eaef9da7-c547-4b9b-b3d4-5b0a0790397c", "comment": "Malware payload (SnakeKeylogger)", "value": "66cce6bdcbe2bdd1ede256d14dac598f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439156, "uuid": "668a7bfa-d9f9-4d52-98b8-97f9d6f71ec8", "comment": "Malware payload (SnakeKeylogger)", "value": "1bec2c1e77c2939352439c9184360c6c6855899b635c5741a3f8a1aa7d189365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439156, "uuid": "767f5f40-e1f9-45d8-8368-c8b016db8d91", "comment": "Malware payload (SnakeKeylogger)", "value": "6b3900b961132c37147810deabdf39050ac4550a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439156, "uuid": "cb30bb8d-4693-46ac-a222-9758ac2d0ff0", "comment": "Malware payload (SnakeKeylogger)", "value": "5d28a9833164c52bc14eb81b99cf40b79d974f9db331b6bfc82080c88bac064ecf79a53859c1b187810f37a721d8b642", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439156, "uuid": "9c2f4fe6-99c2-44ac-bbcb-193e8d591b3c", "value": "T1DC6412F153A8442FC8BD017B28A3628102B573D2D557E76D9B9C906B3F633C395E2B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439156, "uuid": "952e60ea-9578-43b4-8dd1-a4ddacb9d967", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439156, "uuid": "13eed156-2918-40cd-92c8-6a85132c88c3", "value": "6144:FvEEwqeMKM858ZuCFKeTjnagvoEWNf3DQIFFVa:vwqePJ5O9FKeHagvP4fL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636439156, "uuid": "84b0584b-36fc-4421-b910-8c3a43df5773", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636439156, "uuid": "525e6fce-3b22-47b7-a2d6-0e866979a7e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439156, "uuid": "ec485094-994c-4ce5-bd9b-ba9d3113fe91", "value": "Halkbank_Ekstre_20211108_073719_486930.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a099bb-40f2-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1636416948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636416948, "uuid": "fae4915c-3c2d-4ccc-ab44-6149da23a6bc", "comment": "Malware payload (STRRAT)", "value": "e80aa9e3f53ac19a6953202da5a5e3ba", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636416948, "uuid": "31ae606c-8cdf-40a8-96e1-0624c3334074", "comment": "Malware payload (STRRAT)", "value": "1d48b67ee8ea9aaf5ba3cca8b18dbc1c8970f296a8e359c17a19185503b8a8cb", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636416948, "uuid": "3bf6fda1-3ff4-498b-89c6-8dfd244c82b2", "comment": "Malware payload (STRRAT)", "value": "1fc769c6880aef29a20164a7ff1a3564a70d057a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636416948, "uuid": "0d3ffcc1-5693-4bea-8c3e-ec9d6db3c25b", "comment": "Malware payload (STRRAT)", "value": "9f9719ebf24b89536c5296d6cc6b473f3a59e3680c08bb61a460f11f3e2ba0b85fcf7b5c15a360d2a3e4e8e11c1d7829", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636416948, "uuid": "7692eb3a-8a52-46d6-a854-fc5119bd623a", "value": "T125A3C04BAE9A81F5D92B8332C44889B2FA0D1199D505B63F66FC090D4CF5C3D6B06ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636416948, "uuid": "7e5fbdd3-fd8b-49e0-83de-737dd3fe769d", "value": "3072:mgOIfoi5Q1PBhCjQ5RA8G3ubDh5SO84xPVVRo2Rf9KmY:mNIfn5Q1P64KSbNdP19R1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636416948, "uuid": "d50b4ae6-ec1a-4373-8d68-d1605eb01e71", "value": 105883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636416948, "uuid": "4006e4c5-50f9-4004-80ad-504a7c924c2b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636416948, "uuid": "cf71847c-c94b-4986-97ea-e9ed6cc4e23a", "value": "IMG0811.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367a52bc-4138-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636447022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447022, "uuid": "49f55a0b-a353-4a3d-9256-1efe21a6d2f7", "comment": "Malware payload (Mirai)", "value": "70988ec41b6eddb41ec1bc3222f8fab8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447022, "uuid": "3412f6e7-2335-46c2-8db7-2f332f72c2ff", "comment": "Malware payload (Mirai)", "value": "1d91574bc880dfb70eb8aaa3d3bc75d906bdb7b87f8ee3d3467a2ed3267e1047", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447022, "uuid": "0a9dce75-6bc6-440e-8e15-be444a64886f", "comment": "Malware payload (Mirai)", "value": "60af6f0fee0df7ff9e51c0f9f6070ba102f430a8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447022, "uuid": "487027e3-2249-432d-b3ad-d64516644db2", "comment": "Malware payload (Mirai)", "value": "396b21bc4edc9f4fb92bd5c18e9435a3fa8f67b21a0c85c753a8330d4630c389c92c4391d0ab82ea4f7a2a3d83aabd35", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447022, "uuid": "4c8db2c6-3e68-4d11-a1bc-01b5d9be0ff9", "value": "T169730785BDC2AE16C6C5437BFA0E438D332563C8E2EE7213DD156F1177CA92B0A6B161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447022, "uuid": "55cf2630-a019-416c-988b-ed345e0bf522", "value": "1536:At/1/M1UUI6MdbCfysm4mhtVTh2nt+WP+IMZqXkhAiSaSderwbZn9:AtxS8dWfs4mVh2nXPbGqXk/RSmwbZn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636447022, "uuid": "c7fc93eb-1016-4874-b958-95c6d3040e70", "value": 80604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636447022, "uuid": "1d874d5f-67d9-45df-82fb-dfb92cb77ac7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447022, "uuid": "5de4af8b-943e-421b-9c1d-738508917c44", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3eb5bee-4192-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636485914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485914, "uuid": "7fbb4a0f-8f52-4df4-8ecd-c961b49e29ec", "comment": "Malware payload", "value": "2b9fff3e29c645417f7f5b195480e320", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485914, "uuid": "da092cfd-e70e-4415-8cd9-7a264b2d3ded", "comment": "Malware payload", "value": "1ed10c9f172f806fbf120e242adf2430436064a3370280de27dc12923fa839e7", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485914, "uuid": "ffd5c392-10c8-4e36-a6f6-906e70bb897a", "comment": "Malware payload", "value": "ae5fe68fb8eea4907fa7d908d6ba719e558b68a6", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485914, "uuid": "404e0fe8-885b-4ecb-87b0-d790f1dc4488", "comment": "Malware payload", "value": "cf2b41edfac48861668465ffc99e767fc76c78f7af74d9888cbd129aef8487db957ae0162d34d50d6725df3d06cb4d51", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636485914, "uuid": "b7c963d7-2da5-476f-b9ef-3e0a2d29ded7", "value": "T1CEF328B26CC494ADD69D6431B408784617C46FC7BA25D94FBCE0E3A43C307922DA9FDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636485914, "uuid": "5ae69100-8e0c-4d2c-a69d-51faa2733eb2", "value": "0045789c6cef3bfcd6f0b95ad82c908f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636485914, "uuid": "9ce1de33-04ab-4984-8246-8a67f046bcb2", "value": "1536:YE7S/l0dAhCLSwlq/cIBPiM0j6AnacbI5cWU21e/j4AQJR4zOUG30u:YE7S/DhH2gijjtaK03V0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636485914, "uuid": "1fc5a111-799e-4d7b-a240-0805670aafd9", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636485914, "uuid": "b897c8cf-1010-44ac-9e42-f49f5a4a2c5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636485914, "uuid": "474cee53-e5cb-4e77-9dd7-6831224d49e8", "value": "AWB 2101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9735a0-416d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636470122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636470122, "uuid": "5f954d6f-2e7e-4a75-b81b-d7f03e312cda", "comment": "Malware payload (Formbook)", "value": "eccac6968a61d108e33645c3e0f1f894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636470122, "uuid": "693b4505-ebe6-49fa-b0ee-3c7ee05e125b", "comment": "Malware payload (Formbook)", "value": "1ed21fc2049e9b5697a5d8ec374c41bcbf83c6210fab4d58b6bdf1282f44c739", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636470122, "uuid": "84334bd6-5169-4077-b969-ac3ae9cb2db6", "comment": "Malware payload (Formbook)", "value": "d2af924951d216ea0dfa87d8a2e803b7f2ad0e96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636470122, "uuid": "b4105b78-1df1-4c9b-939b-b8e262bcb9f0", "comment": "Malware payload (Formbook)", "value": "8b9e3c2aa831624b644206c1819103c990333ca7b178baa92ca60eaeb8323ba3328d6e4287360924f69ea4f3b4bca217", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636470122, "uuid": "3333d129-8ba5-4568-8df3-45c11c2e28d5", "value": "T1E7740130A9A4A4AAC8FE06B4096E477642EFBD14FD344F4783473E8D3E77480543A6B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636470122, "uuid": "36048bb7-e4ae-466f-a034-4d1b77ddfcea", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636470122, "uuid": "9914881e-7fd9-4c03-b279-602476d9312f", "value": "6144:VbE/HUNlim/39bvz7ttEcUWbSaT754r7g5Z+abqjA+wJO4tplMnePIKo6u4b:VbL/Zv/tyKpMcHbOU+MO6lMOIKhu4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636470122, "uuid": "d2bf79e2-2b20-4017-a99d-82d7dbe66174", "value": 358224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636470122, "uuid": "0b97f344-0b4d-4b10-af05-c62420396b5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636470122, "uuid": "b3834992-30b9-4f47-858e-d2310c9b77ba", "value": "New Order.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa529a2e-41b6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636501468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501468, "uuid": "b8c3dca1-27d6-46dd-97f9-daacb4684a56", "comment": "Malware payload", "value": "bd9ed89994649c48f69590576a622fdb", "object_relation": "md5", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501468, "uuid": "7fa3fd18-877d-4430-b972-f0981f12ed41", "comment": "Malware payload", "value": "20e7e85dc03885c95684a89e78a79383ade8cef7d44529688888498825939096", "object_relation": "sha256", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501468, "uuid": "1e383b18-c7dc-4ad1-8bec-3d977cd7ac70", "comment": "Malware payload", "value": "b2e6d12901f24597d0ff215e13d4930177ffee77", "object_relation": "sha1", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501468, "uuid": "4df0212e-421a-4008-bd9e-092e157ff583", "comment": "Malware payload", "value": "1099ced9fda103295a892f49bcdeff7bf8297942396670f12ec807ccb06c684f096e9b518c5b45254ec3d632342f6ced", "object_relation": "sha3-384", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636501468, "uuid": "68f11395-de53-46f5-9c31-8bcaf8fa2c9e", "value": "T1735423279292313C8637C4825E41BDB22522868DB175F7D4B47BBCDFA2D50F8B6488DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636501468, "uuid": "7b4ca952-1434-4c5d-bd53-71501ce3489f", "value": "6144:G9mVGutPqpG9GtZZQi2pxtG5fUibKK/1UxbQen6J:Q8eptZCiUiOa6bry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636501468, "uuid": "e29a8e93-cf00-49b5-a971-fb0898bdd859", "value": 296604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636501468, "uuid": "734f8392-06a0-4fb2-ba29-e3179d8ef0bb", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636501468, "uuid": "e15d0dd6-c9e6-4986-b086-f8c1177326b2", "value": "OUSTANDING OVERDUE INVOICES.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2d100b-41b1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636499110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636499110, "uuid": "5f00242a-41a7-4434-90bb-73f131c7f770", "comment": "Malware payload", "value": "6c779ef382428fb5d6fca1919552fc42", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "NHS", "colour": "#41F3D7", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636499110, "uuid": "87ea38c8-adf1-47e7-b85a-919575959490", "comment": "Malware payload", "value": "2124777f710199d4051c9d67185dc4dbb55252d65b57642222eee444c5c06d88", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "NHS", "colour": "#41F3D7", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636499110, "uuid": "3b4c3f1d-e163-4225-a6ce-689c3a81cdc2", "comment": "Malware payload", "value": "a11e10f3d43eeacbfe3bb87649bf708e79d2eefa", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "NHS", "colour": "#41F3D7", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636499110, "uuid": "810fbb97-04d9-4b1d-af6b-a8f59b01ce70", "comment": "Malware payload", "value": "9d921785553a541369b6bedabc77f76ba8794058df4061a83bab18138821787923719586a08d127c4446a2ec68ebcf7e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "NHS", "colour": "#41F3D7", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636499110, "uuid": "aa35a34a-eccf-4d60-ac57-58bd9a6a083d", "value": "T12C463328F9AED01DD507E435F091E49B8408508A0F19F90B5E76922D8EFAED44B87FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636499110, "uuid": "6715b3aa-188a-4397-a8a5-bb527b1e5564", "value": "98304:0fFiSR9xfprOCPWTbLR6c9OwVgekn8MahYQKtAG06PtyxrFL1:0fFi6OckvRSO1PhYQWAGryNFL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636499110, "uuid": "2c883254-3289-490f-bb7d-67dd525573c9", "value": 5511659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636499110, "uuid": "ad25786d-9325-4035-80c2-ba4681ebb546", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636499110, "uuid": "f3332cca-df4f-4a62-955d-0658fcb53d06", "value": "2124777F710199D4051C9D67185DC4DBB55252D65B57642222EEE444C5C06D88.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71f43de-413c-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636449064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636449064, "uuid": "ac21b5da-c843-4ee8-96b5-51960363c750", "comment": "Malware payload (RaccoonStealer)", "value": "4b1033f5b4a28c72f872fa038c35f8e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636449064, "uuid": "3c444955-95c9-4167-af28-347d581a819f", "comment": "Malware payload (RaccoonStealer)", "value": "21301716ce1941af80e3fd44750c61348cb38ae02d322f4d8218ec4ceb2f1863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636449064, "uuid": "9ec31c57-1f6e-4c84-9762-0671ec638433", "comment": "Malware payload (RaccoonStealer)", "value": "0a15308aaa80b46c7992efb7a45c32c261577bcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636449064, "uuid": "a2e5efed-926e-4328-b5ff-55b87bb7339c", "comment": "Malware payload (RaccoonStealer)", "value": "20471776a962827cfd0c5c76d1e91841ab363f978734676f572bf25d94a6eeb90c0980ac5fb8bc8dde464af6a01c79c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636449064, "uuid": "66233045-5502-43d6-8bd7-5cdc1fb3280d", "value": "T180B4E111B7B0C039F1BA16F8497993A8793EBDB12B2490CF22C416EE66756E1EC70357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636449064, "uuid": "6739fe26-3d09-4f29-a3c0-33d0a6dcae5a", "value": "ef5891f13814421fd185279f57d98085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636449064, "uuid": "41dae3a5-03c7-4b66-bdba-5603c005fe27", "value": "12288:gGTJT3RJSq3vNfOuvapvnq/BoguRhOW5KCqeHehGLumF2Lh:bJd4O1fDpoZh95Zqelu3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636449064, "uuid": "60398ea1-25cc-4573-b4e6-8bca9ae9b725", "value": 506368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636449064, "uuid": "86b2328b-dcf1-461c-9e96-e14136dd8695", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636449064, "uuid": "2e0ad0b3-2a1e-43f2-9d45-ff1e89128380", "value": "4b1033f5b4a28c72f872fa038c35f8e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e1fd61-411d-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1636435470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636435470, "uuid": "50b42723-0d69-46e7-9039-92083e793c18", "comment": "Malware payload (NanoCore)", "value": "257965beac3194d7f9891621c2a571a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636435470, "uuid": "3765406f-9476-4c62-90fc-f7e37ba976f4", "comment": "Malware payload (NanoCore)", "value": "213e0a3b1c61d17eb7de2d8a1b5357534e1651c94536037ff8a432ed1b3d94e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636435470, "uuid": "a3204d15-2531-4dbb-91e0-f62716d95187", "comment": "Malware payload (NanoCore)", "value": "df0670ede69838c789f0160ad945316134694fca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636435470, "uuid": "fe1f9200-0ff1-42f9-83d0-b23ce4764af2", "comment": "Malware payload (NanoCore)", "value": "78b05d07106e6d73c150425cf3b4d4037c53fe0a21f124ccae4708921a0ad9e8f64e5d6d914a32c0828728507f91fb2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636435470, "uuid": "1b10da2c-405d-4231-bff7-b925b2ad5f6c", "value": "T128250202B6D18471D5325D72193AAB15AE3D3C201E20DA1FB7916F6DABB32C06635BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636435470, "uuid": "33cc331c-16af-400b-af95-edc1f733e257", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636435470, "uuid": "33de2f84-b3c2-47b9-ba35-5608238ca71e", "value": "24576:TAOcZ4Z62LslTonyLAE1/+HlFU2KTpQ+ZJgi+nDKrH:1zcEE1FlTPZJlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636435470, "uuid": "92cfd34a-0951-473f-a9f3-04c45f449ab6", "value": 1037297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636435470, "uuid": "e9e0dda8-03a2-4660-81dd-0df36dc55010", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636435470, "uuid": "f71551d9-6423-41a8-b9c8-173056158858", "value": "213e0a3b1c61d17eb7de2d8a1b5357534e1651c94536037ff8a432ed1b3d94e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d401d928-4143-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1636452011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452011, "uuid": "3e46035c-ae39-4f13-b9ab-dca6ce9999e8", "comment": "Malware payload (Quakbot)", "value": "c5c6558cb191bdbbca27d8df9217c0fd", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452011, "uuid": "92d6a421-f136-4f0a-bb8c-62c314ce7a77", "comment": "Malware payload (Quakbot)", "value": "2189be5a4f816bf225d58d58e2c63ce342e7aff13242b3564b0b59eac6798dce", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452011, "uuid": "e34072ae-5ab5-44a6-8b75-b652b311e741", "comment": "Malware payload (Quakbot)", "value": "aec35a61b0fbd1ffaa52565b2e80e0f200a330a7", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452011, "uuid": "470677fb-be3e-4ed3-953e-f743797b9daa", "comment": "Malware payload (Quakbot)", "value": "8c4fdf142c9fed87436f5ee553cf7f50d0023ad4613e8981bda26059dcd8d1468cc65edff2e2a686e0bb4251cbd90e6d", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452011, "uuid": "aeb0a3d5-f42a-4f10-9ea0-bef0103dcb30", "value": "T12AA3F18B675BC59FD589023CE31B275B0FE73220CC327A6619523E0486872BB5EBD5D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452011, "uuid": "8cc7ef7a-14cc-491c-bd87-34388b65b7af", "value": "1536:CXB5SOqcuTUdehXyvl0f4CZpUcab2GFVbgPuDF7exsylBviKsUCaMizq5cp:Pc6EehCfCZpUHKGXbBKsiinaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636452011, "uuid": "d53d074b-3956-4eb8-81f6-326a9ea636da", "value": 105293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636452011, "uuid": "f1e91f9a-9398-4a83-a65b-020f8160f2f5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452011, "uuid": "036df530-e994-458d-a25d-b622ff23f93b", "value": "Compl-1665615498-Nov-08.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e60694d-4126-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636439305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439305, "uuid": "1585f5b2-d1c8-4013-9535-869904ea57a9", "comment": "Malware payload (AgentTesla)", "value": "4a838e084d6e61bc17d9c86d5ee0117c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439305, "uuid": "67518536-718f-48ab-a101-f8c8986cfb70", "comment": "Malware payload (AgentTesla)", "value": "24c229161a689dd1013e0ed11a9b537b4311c309d5cda6b5b33c4d2d900536b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439305, "uuid": "7789620c-197d-4064-babf-c8972b48a237", "comment": "Malware payload (AgentTesla)", "value": "4672cfe35965c4f1f4ab460e0e03cd2349b78630", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439305, "uuid": "7f58db73-a5b5-4e5b-8207-c8b194228c91", "comment": "Malware payload (AgentTesla)", "value": "d74945fbac4965f2004f87cd215fce7c781672e712df30ca66a8f2c6fe90d6008c858c08b3b4bc227542edb8b635f2c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439305, "uuid": "dc1b6ec4-bf84-417c-a668-f49ac34f8633", "value": "T1C59412B1639C113FE8A64B3AE4637940967567AB2D03FFBE064C85697F63392E4803C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439305, "uuid": "ba0f6acf-ae5d-4461-ab46-93c6fab2d698", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439305, "uuid": "65579e55-8a3f-4727-95bf-66cd2a4db3fd", "value": "12288:hwvePCOViD9GD5AyFf9vhXCvSbwh5AKphkl:hw2PC0iZGDKyFf95XCvVh5Lph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636439305, "uuid": "69c56db0-53d2-4e0e-a220-d4356b1dbd8d", "value": 422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636439305, "uuid": "f00a3bed-ac8e-45ad-a269-0e8f2acb3586", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439305, "uuid": "fe7db0bc-fd17-476d-8c52-fa82181f1462", "value": "Proforma-invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8922ba5c-414b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636455322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455322, "uuid": "f61f8977-c27f-4ca8-8e33-b7ca41dd9e6f", "comment": "Malware payload", "value": "1478ebdcb69e1981289e009cf9631a94", "object_relation": "md5", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455322, "uuid": "f49be477-0374-4669-ad85-74a9fc27ea81", "comment": "Malware payload", "value": "26c27ec78f9073711383cea05e83e03d8c69e756e2b9c7bd27bdb9301e93b9c0", "object_relation": "sha256", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455322, "uuid": "5b75528e-3bd2-415d-8cc8-62205c39991c", "comment": "Malware payload", "value": "1f3aed4eae8e9a3bc2662284bceb7f1b8b1577a8", "object_relation": "sha1", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455322, "uuid": "8d9944fd-eb08-4a01-b42b-536a15971138", "comment": "Malware payload", "value": "e30284484f820c3379fe2991eee4eea01775e266f69e8260c8ff859ff6125301372d0ab58d0bd3cf763b2bfb104c0da8", "object_relation": "sha3-384", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455322, "uuid": "93fd75d8-6d45-4286-92a9-58b250887ac5", "value": "T1A78423844A7D098D1DA7FAED83494536D618B40B3440F37E6E4DB0F1E388B6D09B5B76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455322, "uuid": "e3b39f51-7af2-4057-8c1e-0cfe7886e10f", "value": "6144:qgnThtAmXG9ynt4zgubz48qEBNs4py1fUR84CdqCHR6YHLndUpPTiuF9tbyAnktm:1nThtAKJt4zgubz6QNxpy1fUa4CdqCHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455322, "uuid": "ae0c001d-7f3e-478c-8614-516c87bc2180", "value": 386426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455322, "uuid": "e4881274-3780-4aac-9ec1-96ddf41d9206", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455322, "uuid": "c7f104ff-724c-4904-a008-ce1960da088a", "value": "Tgm_09385345637893-09387654345678390398765345673893987643567(1).pqs.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbdfe860-4122-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636437851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636437851, "uuid": "c09d6ea6-4289-4114-b91e-15acca5c3b9f", "comment": "Malware payload", "value": "90a66ad42e09417183e440b3878bc0ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636437851, "uuid": "211784e4-8e1d-4523-8ecf-8f17a3093a5f", "comment": "Malware payload", "value": "26c4c223c77a8c7b2bfe4512e6259710daeb51e4172c8ebdeb9cbb1538f1248e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636437851, "uuid": "0b2bbad2-02ce-481d-954a-d7dbc8eda2eb", "comment": "Malware payload", "value": "dc6a000730b0ea44025c9285078598b76ca40639", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636437851, "uuid": "ae463361-b2a9-4d27-a287-d64dd1b4319d", "comment": "Malware payload", "value": "f61660a0c451c8a523fdbb4d9c74d12893de797899ee7b2a595e4901d7569bf586ed8899b7faeaf60b7a76a8d08ef640", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636437851, "uuid": "5649b7af-60f4-4a43-90f8-a3f9f642c4d7", "value": "T1C9653300436FE993FA0A42FFD76C2ECDB11557F933854C46EF90099A9B61A22D14FC6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636437851, "uuid": "39883f92-57a4-43f9-81c1-0bec1628ed5a", "value": "fc1300250f0ecc0cf4491b54efe75246", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636437851, "uuid": "af2cbe07-1502-4d8f-a38e-6ead618fa780", "value": "24576:H93FkArIG/mDL/H0qca8gh75eyVteZSU/PioSIuX9pHUrwjM:pywsjHzh8g5jiPioNuX9pHUrUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636437851, "uuid": "7e7450e3-f0ba-4af1-b4a5-5280838ee69d", "value": 1466977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636437851, "uuid": "1f5cd3db-9252-45ae-9cc8-10e24659c3d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636437851, "uuid": "b8826d9a-31a5-47ad-b7a7-f68734d98682", "value": "webmoto.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7b16d2-4168-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636467679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467679, "uuid": "bad993de-9307-4def-bc8c-4defd6be3457", "comment": "Malware payload", "value": "ef564e3dae71cea656274a61570e95b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467679, "uuid": "e32ea39f-321a-4067-84ea-12a75cbc6690", "comment": "Malware payload", "value": "27004c21d34c2a45f9511d535419300c8f3345118dbdeb3a9b80f26164108b7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467679, "uuid": "37a0af43-fac4-4262-8184-30b156cd900a", "comment": "Malware payload", "value": "7305983e82258b75a8c5310d87b4a06be27633b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467679, "uuid": "c2d806d7-ad62-43f2-a1ed-df8c0bfd6cc0", "comment": "Malware payload", "value": "f21d4cb470b844478610dc0d9ed2b2bc84d1f75f2d088d40023922f9f494a2869ed11c574bab8f20c4b244a75d433bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467679, "uuid": "a4a9e068-2eab-4197-bc81-afeca456eddc", "value": "T124C468B752FC21FBE0580B3854532A0A0F247FBABA33E91E5A7978F52735F915062E41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467679, "uuid": "ebf370ab-501f-4af2-ae51-de1183dcc35e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467679, "uuid": "fe1b0dbb-c664-44b4-b8b5-69e4b4996b8f", "value": "12288:Tw2ePH8G0kLoY0jZ/VTqHZljK7VQwSweV4KbF8xSPqm:Tw3PcG0MMHTq5Vnw3eV4U8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636467679, "uuid": "6e6caa90-466c-4f8c-a2dd-a1eceb20e76c", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636467679, "uuid": "830f1bd5-b502-48a8-a800-b937498b64c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467679, "uuid": "fb0645df-b144-4f6a-a2f8-1d0b01d2d176", "value": "Gia Kim Investment Trading - inquiry RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1a7272-415c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636462625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462625, "uuid": "74376e44-c2ed-45ad-9ffd-b38a6127f324", "comment": "Malware payload (AgentTesla)", "value": "1dd664469526ae60832474cee5f2d450", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462625, "uuid": "40534c0d-8d89-4d53-8331-77c61cd08daa", "comment": "Malware payload (AgentTesla)", "value": "272e43b9499d46b1a031e5711a479eada9225440810bd76bd04e7051a651cb16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462625, "uuid": "5af08617-742f-4f57-a4fd-320b943813dd", "comment": "Malware payload (AgentTesla)", "value": "c3e892c17854d04a66fda2f2dc3264b9f3a3c8c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462625, "uuid": "506a3a8f-753b-4ea2-a3a6-19cf1dff060a", "comment": "Malware payload (AgentTesla)", "value": "a2bad2a0c7b0d21983716b883d53f1c8f01cbc326b7c946039b2f7c4feeb071ba87a4d21652a7ad918da936a0d39836d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462625, "uuid": "3ade1958-2659-4409-8525-ed2c5edf25c8", "value": "T119A4122AB209881BD9B16733CDCB754113B9B542A9A2C71F7D9D6268E7323E70D0378D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462625, "uuid": "f07a4e05-b0fc-4b1f-9118-0c4175b5f231", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462625, "uuid": "63324455-8079-4c02-a83c-e3a83caa3d3e", "value": "12288:iOZ3VTpCJhyEXgYDk0BVj92kvyC7mFfpi7:tZlT/YYit86yXFfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462625, "uuid": "aa050214-8b8a-4eb0-8f39-dbff6d603427", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462625, "uuid": "b9f3124a-5fbb-416f-aeb7-00fd1b57da1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462625, "uuid": "ce823734-cd93-4403-a7a5-5c1ea05416fa", "value": "Payment Invoice Slip-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f690de-4123-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636438140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438140, "uuid": "542d9c6e-07a5-4def-a109-d28ef574eb2e", "comment": "Malware payload (Formbook)", "value": "39f0c4d63bd63a010b83f0bbe382804f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438140, "uuid": "b7c7e854-dddf-43c5-b93c-3eefe2506d6a", "comment": "Malware payload (Formbook)", "value": "2799af2efd698da215afc9c88da3b1e84b00137433d9444a5c11d69092b3f80d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438140, "uuid": "3dad7859-ff63-48c6-a708-acc9382d4971", "comment": "Malware payload (Formbook)", "value": "8dcf96155288e48ecde6be6204e1b538a125e6d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438140, "uuid": "0b03d831-114b-4f8a-b290-3e34b0c98316", "comment": "Malware payload (Formbook)", "value": "652b420c969aa7e6fa1c27bf31fd668edd53deabfc0e3095dbe4f3dd0f6197176e92ce5b8fa81ab45a131f068e04cb1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438140, "uuid": "16003ea0-47fc-4507-9f57-66c26b1dbcad", "value": "T1F28412725375492BC897077E4C7266D103B8919FEE03E66E8BC4D1BA7E7339228E2741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438140, "uuid": "6509feb1-2b86-4e3f-a5fb-58d643c7d4f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438140, "uuid": "bad13b5b-8bfd-4495-9143-854843c59ccb", "value": "6144:OIYxtwZeMKMLoLAQRr4YDS6iYVLp7OPA0gENYKrpoApQ:MwZePSoppDCYvaGEN7VoApQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636438140, "uuid": "8c237c44-c77e-4f4c-b615-b94e1ab9fa8e", "value": 385536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636438140, "uuid": "3466f58a-e8c9-4030-b10b-f57185ac47ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438140, "uuid": "d87db337-25c3-4f4d-8ae1-09a000ce03ef", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7cbd42a-415b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636462245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462245, "uuid": "66a85be5-4634-4305-b862-c1424b56b1fd", "comment": "Malware payload", "value": "d17695e9c272d865d398592ac4b74623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462245, "uuid": "b9b5420d-f5be-4c5b-bae4-dc92ae2e3a50", "comment": "Malware payload", "value": "2820898b2f7b07067f4873135fa66bff7315b29825ed11802eef98ddb934d171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462245, "uuid": "cdc66194-8aad-4692-a2b8-1acedad9cef5", "comment": "Malware payload", "value": "f41966de07ef6bf7dc4d96692b0be5a205e12cbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462245, "uuid": "ded1968e-c701-4888-bb41-bb26ca67a9a3", "comment": "Malware payload", "value": "35346a17a1581c38feded00c9a06a031ec728380f205a4bddb4c955226fb1f1ef6a7b00aa49940dd6bd1771ac741fed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462245, "uuid": "f9662eaa-425d-4f43-bc9c-006a78d9900b", "value": "T15B655ACD3E4ECF49D5E1663581FAC854C7F0B9B7E210D39A6A7E228824213C6B51BBC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462245, "uuid": "5d76458b-9e11-4306-8a54-91c6262bcce1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462245, "uuid": "1fa0cb50-01a0-4311-a500-13ad47f34411", "value": "24576:GH+eUJGC7oNcnJesrEc78EBWPYFO1/ODZJ85dfosGxiYgT6+VGjgT:GHgveOt4fPL/cJS2sR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462245, "uuid": "4cc39e96-00d3-4ef8-a261-c6f1caebf0b6", "value": 1503232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462245, "uuid": "154908cc-3be1-4f3a-933b-25269a179d33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462245, "uuid": "81879fb8-096e-4490-be98-94086f94b3bb", "value": "pago-caja.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c425784e-411d-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1636435664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636435664, "uuid": "cb97a555-b6ce-4df9-a742-1993990fab74", "comment": "Malware payload (Loki)", "value": "65e4730d75a2dcfbc8416d4726d28b9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636435664, "uuid": "831e7328-699d-458a-ba7a-f38b43e32dd9", "comment": "Malware payload (Loki)", "value": "282b2c8f35139c3a89785d6f043b15ae8d6eed0c9e6242382a4a6ec153bbeca6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636435664, "uuid": "4056f4a0-f3c0-4075-b929-23367565a011", "comment": "Malware payload (Loki)", "value": "34822115b0557afccb0a869158a3bfd16c715407", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636435664, "uuid": "164d33ad-bfcf-452b-8df3-b1ddfffac98a", "comment": "Malware payload (Loki)", "value": "e066394dc251ab932982509c12a1d152c6e74c9cd91607b6639a02020d748358b9335414ab1f111c61ebf05634f7e35c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636435664, "uuid": "d30ca6d9-7948-47fc-9723-99825605a936", "value": "T1BD541294E395593FCD290ABA68A376489734279BA043FF7DC79D90B13A1331290D2BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636435664, "uuid": "e30539ff-63ac-4fa3-9496-cdbebbc6c995", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636435664, "uuid": "11032c03-49eb-425a-8c92-7318c26f05fe", "value": "6144:ZTHiOw4eMKMGbyOsJaezLfSk4FELnjbYcA5n2p8SJtagdimkX7j:Fvw4ePvmOgZS03Ylsp8Yk81g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636435664, "uuid": "f1461b87-1004-4564-8a0f-971becf45de2", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636435664, "uuid": "57b03849-4a6e-410f-94d3-a7ef6ed9aa1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636435664, "uuid": "7ebbbf5a-2653-4a5a-9b07-3724b4d5da22", "value": "65e4730d75a2dcfbc8416d4726d28b9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66829d46-415c-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1636462565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462565, "uuid": "e7fe154d-75e6-4a85-9208-3b59e086c8e9", "comment": "Malware payload (RemcosRAT)", "value": "f399732e83799274d0cc8c3302d05cc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462565, "uuid": "79f83835-13b6-4d28-9b49-9eab5a514cf1", "comment": "Malware payload (RemcosRAT)", "value": "284d63bee40558dcdd96057cbc0a07fba210b2de0111da57530ff2083d0d57f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462565, "uuid": "2cd4fc96-db65-43c6-8d27-82f5691823b5", "comment": "Malware payload (RemcosRAT)", "value": "92425c899bb9d26b474084e89e9a3f258876c9cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462565, "uuid": "c8f9c766-9648-4e71-8fc6-51fd46e83111", "comment": "Malware payload (RemcosRAT)", "value": "56207c001205a3b676bfe88aea3278df6867f716b5d588971d19ac91393d336f3c40400c4c163c50c3c67d8004585642", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462565, "uuid": "7951ef6f-e4cb-4dab-b42d-5460545f43b6", "value": "T1E3055D46F2856CB6F45229344C3BA771BA34BF921526D803ADBB3C126DF32D12535E8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462565, "uuid": "91f6c9b3-0630-41dd-b645-4c99af7ffce9", "value": "7b484975ebc1a121d346391a74418697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462565, "uuid": "b9f4a8c0-823d-4686-b126-361ee91db24c", "value": "6144:6ty9J2eb9Vmcc03Dl2QEE12/ggyHISePm7lDW/Bl5Wn7DYKbQAJRPl68hTnUE:R9J2ebzmccYDJ2tMIMS/n56Db6mTnUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462565, "uuid": "84dd7868-5d28-4a7a-84a3-8cc51351d957", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462565, "uuid": "cb4b74c5-5737-4779-978e-463720b90317", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462565, "uuid": "3707d9d6-a27f-41a2-8fa6-26266c3736a9", "value": "Hemotronik Nov Acil PO_76565,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00a0fd6-414f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636457078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457078, "uuid": "5225f7d9-7cee-4871-b45e-391bd268235b", "comment": "Malware payload", "value": "133308aaf3f4f13325bb6e3564fc0159", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457078, "uuid": "b1f6628e-62ee-41da-ac11-f66ec44b72f2", "comment": "Malware payload", "value": "28a4e59984b5e7acd8a381065a41b61ec4459a7209f1dd8cefb95792dbcc4e6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457078, "uuid": "efea2595-00f9-4377-a82a-3f63430c17a7", "comment": "Malware payload", "value": "b456f6c1bf30146f9250625ec84a5c5f43ed5e1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457078, "uuid": "939e8d2e-6f68-4388-b66e-7acaf121930a", "comment": "Malware payload", "value": "2e6a82a4255958e8b2f440291b1264f6fa61077f6d557a50312237d6e10b62ed2bf9a46f5c269f39e235a8fe4c1de418", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457078, "uuid": "8c94002a-c934-4d12-b4ea-6e48f02867b2", "value": "T18DA4D0774113EEDAEF7A5FF8991035800EE538239B3ED285EE8E41A221F6961CF50D91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457078, "uuid": "0bb197b1-ffc2-465f-b2c2-c40bbd723d40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457078, "uuid": "8bfd93e0-aacf-4a25-8aab-07c1ddc0b594", "value": "12288:zvqJFTP5xA7qoZLlA03EgpuxIMQTKqd11x+YGYElS:zvqfAWulUjxIB/yYGYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636457078, "uuid": "c8fbe5dd-1963-4663-9665-cfa5c7d4bb8e", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636457078, "uuid": "942c9b1b-fb43-418e-b6bd-faa6af454768", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457078, "uuid": "c2921694-713e-4462-a822-8eaf61b2605a", "value": "Payment SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ee9b81-40f9-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636420237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420237, "uuid": "00992593-9153-4c9f-98bd-2d345d2fa37f", "comment": "Malware payload (RaccoonStealer)", "value": "32bb3c8fc17fbe2e0dee834e47d662e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420237, "uuid": "631f0097-be19-4e4d-a54e-a9d0891daa22", "comment": "Malware payload (RaccoonStealer)", "value": "28f66da1f413201a98d2bf07a8566bac1f8f93e8a9f8803bffef73e6b4b388a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420237, "uuid": "5940af90-4a84-499a-a15f-2b6163468d97", "comment": "Malware payload (RaccoonStealer)", "value": "4a0c0e77f829678cbba3d28a6ff0a9e5057bb70e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420237, "uuid": "e7a37748-840f-44a4-8e3a-af1f95d7ee0a", "comment": "Malware payload (RaccoonStealer)", "value": "b074350ebf6f4a34366956bbf3e835b07085b1d955cceec227b093cc956c5d15facbb6c6328839e59421dd41ac12c4a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420237, "uuid": "d43699f0-ceae-44c6-ac61-18f5e8a817bb", "value": "T1E2B4F131B6ADC828E7931D30CC7197A81B3BF8616960104AB7606B5E1F73F9C86E135E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420237, "uuid": "884c3337-1af9-4cd5-bda8-1f6ea55c0112", "value": "c8725b7ab8753c936cc4c98a181b2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420237, "uuid": "4b57f521-be4e-44cd-a801-0067944cfd1c", "value": "12288:CASnwWZ7zHrX6qvAjc/1v3CmeZ59bKunn5:4wW19AjkXeZLR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636420237, "uuid": "fe62351a-579b-4f66-a1d6-32404373e517", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636420237, "uuid": "e8dad9c8-6d9c-4b61-8623-96ee2dd49107", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420237, "uuid": "568a7025-6d72-4058-862a-a5927540b266", "value": "32bb3c8fc17fbe2e0dee834e47d662e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30c7059-412f-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1636443393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636443393, "uuid": "2be48879-a589-460f-ac0a-7af74f108f24", "comment": "Malware payload (Loki)", "value": "56f33f3166c91b2b65395f3fdf632c74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636443393, "uuid": "3ca8c4c9-bcc8-4744-80e7-8c99f1f65b6a", "comment": "Malware payload (Loki)", "value": "2c4ff26159b3cd2d596abb2377f67a84e6d953f6eaa6d6cc0d0bd255fddc82bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636443393, "uuid": "a71f96a4-ea77-4dff-8cf8-da81344c62f4", "comment": "Malware payload (Loki)", "value": "98ea7ef28b34b74d521954aa177b9db29bcc3af3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636443393, "uuid": "9999a05c-fb29-497b-8dd1-79d9e99e5e54", "comment": "Malware payload (Loki)", "value": "90bdf629a9b51cef4ccc4faa47a8d71929a123a7aac8859e7dc070569b15dc1dd40c5b1ea453d6a03eaa129707ddd6b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636443393, "uuid": "75a1420d-315b-4193-95b8-e832003c2401", "value": "T11074F235FF684236F21A06B50EF195B82D17ACA28541CC0B3245BE9C1CF2E8765D63AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636443393, "uuid": "8f66659c-d29f-4505-ab76-9320b575c9a6", "value": "3a196462f17f4821d4c80ed2f22a0dfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636443393, "uuid": "24550069-b1af-4f07-99d6-ae67c79a5c32", "value": "6144:SeSYk0sdrHKMqpl3Xz2UOFtiQqCPojtbS7FFQwGwZ1FpMZwH4x8dLp:SN0sFGplXz2UOFoJGojt2FN13MZwY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636443393, "uuid": "8a420c62-5933-45c2-a9f6-474adaac3475", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636443393, "uuid": "7babc4a8-cf07-4fb8-a9d1-6b2cb3ba3aff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636443393, "uuid": "01e825cc-6bf8-4d11-9cb9-89ed607edb33", "value": "DHL Delivery.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6f8c4d-417b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636475966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636475966, "uuid": "fec7ce5d-dbc1-4b5e-be0a-1629114c96ff", "comment": "Malware payload (AgentTesla)", "value": "8ce367e4c0aaff26ca6d3ea94e9dd176", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636475966, "uuid": "7e6fdee3-917f-46a8-bf26-4471d504f27a", "comment": "Malware payload (AgentTesla)", "value": "2d2c479a2698749a65ba7106db1ace61a92991eeced93a4ca000af782837687d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636475966, "uuid": "0d649e82-b440-4696-a095-a3c50421a833", "comment": "Malware payload (AgentTesla)", "value": "8c1edaed6c31cdbc6b75507f4baa3e234dce1040", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636475966, "uuid": "05af2feb-0a28-4101-a0c9-bf73802aad8c", "comment": "Malware payload (AgentTesla)", "value": "bf081628d997306de74c50a7e667efe564a35d3ca2ac828013273ef493c871a33759ec1e21950278083de71009b56cb6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636475966, "uuid": "9c4e067c-b82a-410e-a604-7280d3f5e2e7", "value": "T137F4BF357202B9DEDD6F8D718F542D205DA13C3B87EAC20B945B315A17FE292DE180EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636475966, "uuid": "9e03e391-405a-4141-b6b0-32de73040964", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636475966, "uuid": "9c05a07b-23d4-4cee-9c91-ab7619cca67c", "value": "12288:tbqJFTPGCwsOW1eeWPrO2ah1jDHEbrlGs9vdQVYJUEKl75jQWmc:pqDwsrebPrOl/HEf2VYJUEKlCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636475966, "uuid": "3a7e216e-db58-4af9-8b20-531acd9a9e31", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636475966, "uuid": "f8144911-f402-4c1b-bfcf-600dc232e67a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636475966, "uuid": "3b287859-0e97-4a7f-ac84-829b38f465d6", "value": "overdue invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a5a266-40fa-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636420547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420547, "uuid": "2e10cb3e-fabc-43f2-b671-25b0dfcdbcb5", "comment": "Malware payload (RaccoonStealer)", "value": "4e3694b69f1a6e248f2bd74fc89dc046", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420547, "uuid": "a609d881-3c0e-4766-98ba-4ce3bc115296", "comment": "Malware payload (RaccoonStealer)", "value": "2d85e863666e75ccb18a02a722332a08512bfad1474b88ccead4f04f3245c654", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420547, "uuid": "e0376a29-9926-4955-a22b-7e9748d11c81", "comment": "Malware payload (RaccoonStealer)", "value": "8d0fe92f31c25e4dd7db5dcd7e41ef7f3e87271f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420547, "uuid": "a6b930af-8a26-4dbf-af81-5e370d8634b9", "comment": "Malware payload (RaccoonStealer)", "value": "865077c878522353ebc593d997a2140a4e5113b69708a8a0efbdf3c3a79e73604ccdefe41afea57dc50fdbd52a046173", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420547, "uuid": "2901264d-559a-4f4a-aaf6-75112a6eedd3", "value": "T10FB4E031B6A8D834D56F1E304921C6A81E77B9129920507BF25467CE2F73BAC9DE132E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420547, "uuid": "d3bbc91d-d9a2-403c-b46e-3f29c281c280", "value": "60ab4a93298436a0ea920c16b7e59caa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420547, "uuid": "c61f14a2-e4b2-448a-88fd-de78710bef00", "value": "12288:F3nvQewBfiywSnbYGk0QiZs5Ab4Hxunn5:d1EsGk9iOVa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636420547, "uuid": "626e1d60-3682-4daa-a386-c9d7e07c047d", "value": 521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636420547, "uuid": "ba4edde4-62a3-4b14-a40b-9137ae875ce4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420547, "uuid": "ea188ff1-8ed9-4bb8-a709-363a15fc0b51", "value": "4e3694b69f1a6e248f2bd74fc89dc046.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f1d44d-4124-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636438650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438650, "uuid": "4073fbdd-355d-41ae-a947-fa2ad7a220c4", "comment": "Malware payload", "value": "47d18fe385b0751cfa1c2c00de849a7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438650, "uuid": "c2c5ffea-5fd2-493a-a8d2-3f0aa3c94536", "comment": "Malware payload", "value": "2db57812cda6221dbde0d3b72ce790af7df5306887f240e24fe0bb9e568fae79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438650, "uuid": "bd89c779-1386-4a7f-bd87-174ef36a01a3", "comment": "Malware payload", "value": "09f49dadce85cdb531283ab262c392ddf224ee15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438650, "uuid": "b043ca7c-3bb1-4ff1-9ab8-5fae2b74def4", "comment": "Malware payload", "value": "8cf2a037a17be4f01cb32289449777b470ca807da3fbb051a3431796a45ec8b5b900615865921b634f9aa70f6678dc8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438650, "uuid": "67b7256b-a463-4e45-94b2-b962c76b6e7f", "value": "T176E533215FB52DE6C018C23A709F1F0D59F90A968449F0EA638E38C307DF7475AA79B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438650, "uuid": "359600e5-5b2c-4062-a561-8f6032f89dd5", "value": "9bfd2dac39af50555ae9789117b36b66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438650, "uuid": "52eb25b8-b359-49da-854a-31e9d8a29e90", "value": "49152:C8xpZs5HOds/OZRVL4f2Gnie8Gby+/WG9u5KY:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636438650, "uuid": "46b52f68-2d00-42a5-903b-1489f1974294", "value": 3107840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636438650, "uuid": "6d5939b8-a310-4ae3-a5e2-04e97db5bc86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438650, "uuid": "9d692a30-1db1-4343-9e57-ff78400040c5", "value": "47d18fe385b0751cfa1c2c00de849a7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64687ee2-4141-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636450965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450965, "uuid": "a44cad23-3e41-4194-a1ee-9fbed3b7d378", "comment": "Malware payload", "value": "02ebc499089aa88b56f8040470c426d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450965, "uuid": "ecfd5437-db8d-47df-bc3a-111a31595c99", "comment": "Malware payload", "value": "2ddae379e000cc69e4f17426dd2c6a4613251f13cda341755b7b463e8f45612c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450965, "uuid": "4b226fa3-0129-4746-b5b1-f8cb6d62ef79", "comment": "Malware payload", "value": "23d278331c0fa3b6fd207e442fbe9efb2e046651", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450965, "uuid": "2889f075-7601-484d-8686-3871be2b480d", "comment": "Malware payload", "value": "61b9776f315dc1dc9b01e20cb5d8f2cefedd2b81665d0622010d02cac13a023b52012a4f6f46a5c926d27b4e3ea82e8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450965, "uuid": "83472853-ef70-4f6c-b338-c941d8516009", "value": "T1454733426C91C674C47F1E3370BDA8B11635B8A8C73A346E1ACF35615AFBBD2DC99920", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450965, "uuid": "3e96e72f-4c70-4bc7-8a0b-194e5cd5419c", "value": "3d767112fab1dd04bd2b8946076552a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450965, "uuid": "d5072190-5e08-4fff-8bb0-219810e1b4b8", "value": "786432:8zIjCd1WJ+FjmJQGAGu5Wte8UU0GTYlDd:8Iud1WIlu5AW48TnTad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636450965, "uuid": "999a1402-334e-4cb9-a512-8f40d67bc8f9", "value": 25547076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636450965, "uuid": "07138b22-131a-429f-b768-760624285a15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450965, "uuid": "dbe60d8f-fc9a-4734-a566-330597176893", "value": "smm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0999e4-4103-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636424453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424453, "uuid": "26edbe56-1b01-41dc-abd3-4de994606181", "comment": "Malware payload (RaccoonStealer)", "value": "f2b12cdd331f320e87f4dfc712740eec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424453, "uuid": "a83947aa-8200-42f7-98b4-2dd70225deb7", "comment": "Malware payload (RaccoonStealer)", "value": "2ddd23a3f10c202c4814ded80e326091c23be36f828c6e25e0a78ad34657a733", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424453, "uuid": "29bec6fe-27ae-4ce7-b2c7-e39a19ced5e5", "comment": "Malware payload (RaccoonStealer)", "value": "a8d437458ee415ba95a4ce771291240ed12b6f19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424453, "uuid": "8fa6ba0f-02ad-4b3f-8aaa-83429c92ea9b", "comment": "Malware payload (RaccoonStealer)", "value": "550e9b0bbc2b3279c7b70fede9011abc5f4f4f8a492a7c1aa3130b9394294baa54b8327e2278441fb2f8ee8c54b52f44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424453, "uuid": "bf9ce0e2-e647-4b8c-9be7-3e0266d2aeb4", "value": "T17FB4F1F0BE9CC435D5931E308862D2A51A37FC15662051AAF690E75E1FB3F9C8AE131E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424453, "uuid": "d9588cc9-6ce7-4508-849d-596f54b8daf1", "value": "c8725b7ab8753c936cc4c98a181b2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424453, "uuid": "07b9cf0e-0c01-48ed-a8a7-8d839f984e85", "value": "12288:zASMgQ+eaZ66F3lZ9K/kcKZtFw4hgE0QqSIbV2cfi+pmunn5:926FV28RtF/USIZ9iG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636424453, "uuid": "4dc6a220-393d-43d0-9732-ef4d9b2b2688", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636424453, "uuid": "983650da-617b-49c0-a001-0b04fe98e1ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424453, "uuid": "6d9e8cf7-5094-4780-a071-a60bf47a38e0", "value": "f2b12cdd331f320e87f4dfc712740eec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b76ca41d-415a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636461842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461842, "uuid": "293afbe4-9ca6-4120-8f89-721449cb1e01", "comment": "Malware payload", "value": "5fd6e468b599e0fa5845027dba9d7771", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461842, "uuid": "17156c04-c669-46ff-99f5-e01995f0982f", "comment": "Malware payload", "value": "2e3922c27678dd45b3cd465428d19c62a84cf8d242b8712919de61349eb5775d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461842, "uuid": "7383d86d-9026-40dc-9e32-44869d3bc81f", "comment": "Malware payload", "value": "c113b80a91c6ba3f27fc0d1da1cfe2ee49a1bb48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461842, "uuid": "b94a8812-3d36-4e88-86ab-c8492a0ed576", "comment": "Malware payload", "value": "8ab93ac3605199d21b027a6a2be4e5e68260df7c05da8ecd131fbda38c2d6d5d78493e4c498c61422737671946d92087", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461842, "uuid": "fc5798c4-d3fb-4e6d-9869-852920e8a8f8", "value": "T1986402597384D81FD4BD6636D8DB7E4043AC768764DBD72A6ACCB26914233E34803B8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461842, "uuid": "50948dfa-de27-4bd8-b291-ac50bc4405ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461842, "uuid": "6f7e74a4-67db-431c-8ed4-726e0dfb5e50", "value": "6144:iNrlIIfzMkM8GLPRRnO3i9sJ148oepaN3PiKyKf8kOy50pc:iNrlIIfzT7GHOSajHhpO3D7lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636461842, "uuid": "426d3939-0c34-4a36-b6aa-69f98245c75c", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636461842, "uuid": "a2cdd6dd-00b8-4959-894b-97fc359a51b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461842, "uuid": "4c7389b8-fd52-48e4-8dbd-054a5158e08a", "value": "IMG_651572,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf3c19e-4187-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636481151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636481151, "uuid": "98d18c63-df63-40a6-b13a-e9f4040d1bfb", "comment": "Malware payload (AgentTesla)", "value": "975b42b49f7e3a1cbc1575bcfa12dd8e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636481151, "uuid": "a8b684f1-620d-4e71-87e2-0b3ae9a16aea", "comment": "Malware payload (AgentTesla)", "value": "2eb02744feb7539fd5c9fe39ba39f9be1b9ceb347da963e75a493b8bb674201f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636481151, "uuid": "8f119f10-5de9-4a2b-aa5d-9162819bd569", "comment": "Malware payload (AgentTesla)", "value": "d84eb25af619809c1d18273f476220be5b379ded", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636481151, "uuid": "d9c9830e-1f47-4cc3-8922-a2269cceb39d", "comment": "Malware payload (AgentTesla)", "value": "3dbb885c090e22809c3865e1f9f300d5c31c6afd3a42c8787278ccb5b9a3aa0668727ec895aa5e835c95e7c0560e2877", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636481151, "uuid": "04829410-b410-45a8-96e9-06521043367e", "value": "T1ACB423EE34074986B501E99C6E757453900AADFF52A84CA53E1AB8EFD7E8C21F27F110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636481151, "uuid": "b161b0e4-85e8-4add-a920-0270332dc280", "value": "12288:LqW4G8Zg1Np+b86n8BunmUzaD9p/4Sw3wf78y0A9X6qVGuQENIMw:2/tJtlnOD9l4Sw3u7ti8GeCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636481151, "uuid": "d69f5de3-74ec-48a8-8e71-266426864df5", "value": 534505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636481151, "uuid": "0feb3df6-e3bc-48a1-ae9b-e7480c0815f3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636481151, "uuid": "dbb28291-24c8-4887-9929-279e3bf519e1", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5a73b1-4151-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636457825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457825, "uuid": "e931b4b0-bb09-40e5-a91c-a539b48cb840", "comment": "Malware payload (RedLineStealer)", "value": "6c785946fbf3d3d2d222aa290b7630c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457825, "uuid": "64b5e3c1-5922-46f3-93e4-aa0880c0f51b", "comment": "Malware payload (RedLineStealer)", "value": "2fdbbe32c94ec82a32e5c81f31a6d6ae0688d5be8a819de8d468d36f54760f1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457825, "uuid": "91e2f213-9bc1-41f4-871b-06a9b55dee1a", "comment": "Malware payload (RedLineStealer)", "value": "d8990a7d359c3054d2add6e1070370f2068759db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457825, "uuid": "7bedc316-742c-4697-aff2-a41a80dfa313", "comment": "Malware payload (RedLineStealer)", "value": "8fd7f8513271f5b18b3b7fcddb13c9a4f5a72d79f74347f86be8f06b8f51ec5116e7f2b9408153be485dc2424f8d5522", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457825, "uuid": "33ee0554-9964-4718-b991-239ead2e94f5", "value": "T1AB84CF14A7E0C034F6B712F44A7A83A9F93E79A19B3494CF22D526E957746E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457825, "uuid": "95d44964-f9d4-4d74-aba4-356952647cf8", "value": "5f60c500db75f47142be06e755ed4aae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457825, "uuid": "b8cd82b1-9670-4b4d-aec2-6f391d1d207c", "value": "6144:aTiGBJv0FRtcgO4P9fzYNPWd1x4jfNGN/wHvKr7gS/:8im9uO4+NPWdTmfYK+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636457825, "uuid": "a1cc9788-6fab-469b-b293-f54d3552290e", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636457825, "uuid": "6b1ce855-1dcf-43b7-aa43-ebd8933bfe85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457825, "uuid": "ec7b2846-fb04-4d72-a4a6-e92305ee4b01", "value": "2fdbbe32c94ec82a32e5c81f31a6d6ae0688d5be8a819.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b5f5c8e-4110-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636429797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636429797, "uuid": "806ec8aa-ef96-43b8-9df1-5923e5fb9abb", "comment": "Malware payload (Formbook)", "value": "a260cece98fd48c716cd50fceb1e9870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636429797, "uuid": "16132fa7-9a28-4c26-9ef5-450f6e3cb4ba", "comment": "Malware payload (Formbook)", "value": "2fe9760a9c5fb15b569a9003d41211e35871e52e8ac829a587ddb3e48a52a8bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636429797, "uuid": "aeff5e02-99df-4091-baae-0363aa9c7de0", "comment": "Malware payload (Formbook)", "value": "72ccc0363478c9949e7cee726ed4e733138a5e1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636429797, "uuid": "3ff695d6-aa63-425d-aa8a-f35b698a45cb", "comment": "Malware payload (Formbook)", "value": "4cd36725170414630519673623987f18b634b790243c4a15c1ee17b23ca1fe2fd791ec7d3d37b54a20bd43391f2042e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636429797, "uuid": "d77e8a45-b7ce-443d-9bd6-c807f65f4092", "value": "T16484127B92B9493BDCBA067F7872B941027862CB9D43EFBD834441E63D27361A045FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636429797, "uuid": "a56301ab-c624-417a-ae17-20238061afaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636429797, "uuid": "a8f1da22-1d53-4b66-b1c1-27fdd6af509e", "value": "6144:wKiCFUwReMKMSOyubC2ILtucgWv545W+l86MWc0ApMIRXEE1:q7wRePXORbC2kucgA54rkx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636429797, "uuid": "01671f16-0ee8-49a5-a950-cefe94048470", "value": 380416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636429797, "uuid": "324bbbd8-e48c-44a8-81e5-e14e8deedd60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636429797, "uuid": "4987f24b-ad40-43f2-ade7-367de88df158", "value": "AWN#INVOICE2021119.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500d704e-413e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636449642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636449642, "uuid": "db5739aa-c926-4fc4-9018-d2727837ab0a", "comment": "Malware payload", "value": "77c458e5a616e3988792fa9cc2db45e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636449642, "uuid": "007db1ce-e296-4aeb-a659-5b5de249f6cb", "comment": "Malware payload", "value": "3030e7c5876a3bed78333b27734afcb2b3c41939157fcd72cf7d21176cd830be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636449642, "uuid": "9a999c55-b259-40f6-a507-83b3e89a4000", "comment": "Malware payload", "value": "59ecd6971cbbff476f3f3fff3ab9e16cf10b279d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636449642, "uuid": "77bd4464-a26c-427d-9354-7ea3e596523f", "comment": "Malware payload", "value": "442d365b637d8503db05aa3cea820b1c2c4657dfe858d7832c035d35e159da20fdeb531ca0df54235f64162e8784036f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636449642, "uuid": "44af7a0f-6944-4e93-8d85-5cae42cdf981", "value": "T1DA522803BA540D62DBA4467809B7EAA5C1BF76609F914BC3FF90A90A0E741D0E83B45F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636449642, "uuid": "6be7d902-17e5-47e7-98d0-9213aab13618", "value": "4561c3ebc49dd43710d96dcce56d344e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636449642, "uuid": "155cfc0c-8d22-4afb-922f-b526e6c7e9de", "value": "384:CtrEumI1tE8e/LeVFvXLbkVjsefIVETWRd:lIw/LeVBXLbkSSiTRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636449642, "uuid": "d07b4140-89d7-46d8-8a9d-b0087b1e0b71", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636449642, "uuid": "fc9769f9-ba2a-4b77-bfe1-3f83ab75f73e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636449642, "uuid": "1de6a05a-d4c9-4334-8b6e-4a852747f395", "value": "RegRead.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609b6d11-41ab-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636496485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636496485, "uuid": "12989e0c-267b-4ee0-a767-4880cc0f0228", "comment": "Malware payload (AgentTesla)", "value": "877505548847d6159c6c38d9fd9b9886", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636496485, "uuid": "920a6d00-3e8d-4cdc-8f29-eb4b6435f2b2", "comment": "Malware payload (AgentTesla)", "value": "30920944b8b931f23815225c2155ca706d5372d3909db706de66ecf0b44bf735", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636496485, "uuid": "38988ebf-c6b4-4d2e-a3de-4f27ecb46bd8", "comment": "Malware payload (AgentTesla)", "value": "c9ce717bceecdb8e979370a3bfd614fdb282ed60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636496485, "uuid": "d569ce10-a4b3-4255-94da-cffb87426a65", "comment": "Malware payload (AgentTesla)", "value": "d2147ec746c663df3bb604a2509df532643c4075287ffc27c71d1b315670ae8d068fc53cf88a371b307046dd3ecd5c66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636496485, "uuid": "cc23acab-7344-45c4-9bb6-eca2d27222b7", "value": "T1EBA4D0774153AEDAEF7B1FF8981075801EB97C635B3DC256EE8A01A222F7960CE50C91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636496485, "uuid": "5a8ab6ab-c6b0-4765-aa6e-9a7a8fd0c2a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636496485, "uuid": "386ca3d0-3dd0-4623-ad7f-6833cf81f796", "value": "12288:sxqJFTPswdOeSBjc1LVt4LbsKB+Em9j7J:sxqYFjoLVt4LbIEmx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636496485, "uuid": "b96c8fd2-988f-48ff-b693-12c739ab69a7", "value": 464896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636496485, "uuid": "c5d2a794-e473-43de-bcaf-b0a24301b923", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636496485, "uuid": "43805f0e-b6ef-4f54-9839-5cf49d2653d2", "value": "SCANNED COMPANY PROFILE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ccbe97e-4152-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636458281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458281, "uuid": "eaf9d20e-d0a3-4371-a4b9-ff1fc6b34be9", "comment": "Malware payload", "value": "88b6eae06baac935c9946f5620f0b884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458281, "uuid": "72b8aef9-f1ef-4b87-bfc7-918ecd2f82e7", "comment": "Malware payload", "value": "313374c0671e5efb18ebb0b6de99e619251655e5348f2d9735a50c23cf110589", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458281, "uuid": "186442bc-ab5c-40e6-9fca-89b416de0c53", "comment": "Malware payload", "value": "ca1e97126a1045817e5623cbda92bb963f22e779", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458281, "uuid": "e4fda7c2-f19f-408b-9cfe-509aa78eebd1", "comment": "Malware payload", "value": "95758514173429e906abd3123543beb2cb0ba93016f50954dd4fd1641c27bc19d1dfb0ee5f043c6fe97fda7a6e8df24a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458281, "uuid": "5e497a4f-c8eb-4010-a3a9-f36f0fdf7eb0", "value": "T18AA41257534E472FCCFA17767C87374113363186A873EAAFAB4880A5E9173C72A92784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458281, "uuid": "1f40c733-4175-4d42-8fe1-678df220380f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458281, "uuid": "f085cbcb-c74f-482c-93cf-43ec58711fed", "value": "12288:mwhePoGokE/GdY3/bhYEbVq+aPNhMXNy:mwoP6Fk+/bHbV/a1O9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636458281, "uuid": "672f68eb-ed8a-4b02-bb55-777109275c05", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636458281, "uuid": "07a51a39-cdae-4402-9fcb-936a079755b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458281, "uuid": "198a825a-0a7e-4c01-9e67-26f40c5333e0", "value": "Shipment Invoice & BL-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c26883-4144-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636452308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452308, "uuid": "9cfcccba-3d5e-4e1b-8a1b-ebee73b38f20", "comment": "Malware payload", "value": "74c8c3d42d8017898c0e07a0d28a73e8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452308, "uuid": "ce5f4b67-5ca1-4918-b1ff-d9fa5f79227d", "comment": "Malware payload", "value": "317398e617675f2fe503edb40ed10c8cbd2642d1d5c157108e9426067fe007f6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452308, "uuid": "28ae01e8-0c22-445c-bc34-109cf587424a", "comment": "Malware payload", "value": "da2d6ac29db78b5dbb1a96fd79c9926edcb3e19f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452308, "uuid": "9bd192ab-48fe-48f4-86ae-dab161a1956d", "comment": "Malware payload", "value": "74bca31b720550d5c8c92fa686a372a9e768ed1664c4091724be877959a32b2c602f6ecfc29c7fafd40a38846efcc6a5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452308, "uuid": "dd90e4df-2f75-4f51-83ca-ba275d544eb7", "value": "T1924423C6D416DFBDCC86463CA003E0A433BCA395398CBC085EF5B4952DBD65DA58B1AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452308, "uuid": "deb63d91-919e-4e95-910e-09818163bd2c", "value": "6144:wqeeVl+asTbmu2LgI2z4CHneuVhfPyT6iY4nSEf+8QH:weD+hmu201zLtRa7ZQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636452308, "uuid": "fcba0bd0-ab12-4dde-9c85-075ae27fa38c", "value": 266176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636452308, "uuid": "1859d14e-3571-4c32-954f-2e1b45de4a6d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452308, "uuid": "d84cff32-1ee1-4ec9-aef8-28d65a5daf35", "value": "Dosya_0.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d1555a-4163-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636465619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465619, "uuid": "be300547-e1ea-4ace-953f-25aa6560462f", "comment": "Malware payload (Formbook)", "value": "ac11b54c53cbbfab6a0f839bcbc51a1e", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465619, "uuid": "c818687c-592c-4290-856c-16849dafaa00", "comment": "Malware payload (Formbook)", "value": "3206d4a7ee1ff19c900cd1956cacb379a2970cbce2ab476b401a95c92da6bc44", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465619, "uuid": "3dba7674-12ab-412b-9b8e-04c1a537ba9f", "comment": "Malware payload (Formbook)", "value": "3f4fac24a1a6214e1acefa21480439e83c100e74", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465619, "uuid": "bf1e559c-5954-4a07-bc02-9b4b61baf3e9", "comment": "Malware payload (Formbook)", "value": "da91794bac70b1f6db9064e3a842c5593b62739a02aaf9212c60cbd18bcffbbe7d127da8cf4c7f7d4da5d4299ad48b32", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636465619, "uuid": "e621f964-65e5-4f0b-b5e6-ec5025f97894", "value": "T1DD6423D2EE7F45B2C86E58D9F5A4CB2AE50772DB2F04C0E16161AB45FD0A932770C790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636465619, "uuid": "63980615-e8d3-4c0d-8485-b88eef0e3fdb", "value": "6144:czt3rPC8RjWyp1AYyfaO+Q93jxNOaMfOrCT6eDtuxFvfDd4oK:q3rzFWyDAzJjFxUaI92eZurDd4oK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636465619, "uuid": "3d367f60-3a22-49a1-8fee-b34ddbeca6a1", "value": 307264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636465619, "uuid": "b23f23bc-694d-43ad-8bcf-e3984b72fb19", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636465619, "uuid": "adeafb14-f54a-496c-8acc-8811427b776a", "value": "December_PO_20210034_from_Induvac Textiles_&Leather.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9653bd-41b6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636501475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501475, "uuid": "9beb8d8c-6a35-45ff-9aae-168eb8eeee6a", "comment": "Malware payload", "value": "b7114849a98887c8fa1f739b143670ce", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501475, "uuid": "516b3a8c-e450-454d-8d9d-f7d63b36beba", "comment": "Malware payload", "value": "328832bcbc602247d6cbabfa952f3d6b3f4c266a87c46964036b6c671bee47b5", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501475, "uuid": "079b2e57-7445-4164-92f9-e65b38b34f3d", "comment": "Malware payload", "value": "52901dd1c114e90f0baa88ff412271ea63f34f20", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501475, "uuid": "95aba4e6-fb73-4cfc-8286-172f025531e3", "comment": "Malware payload", "value": "784270b2e3bb884359ecfd2572c247847aedf2cddecd3cbf99b0b601d4eddd2598bbf0d6059ac3aca157d99f3d57dcc4", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636501475, "uuid": "f9531716-18bd-4370-aeb3-ad0ee926ef1f", "value": "T1F15423279292313C8633C4825E41BEB12522868DB175F7D4B47BBCDFA2D10F8B6489DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636501475, "uuid": "dccdee91-eda4-4034-a830-e431dd094e9e", "value": "6144:O9mVGutPqpG9GtZZQi2pxtG5fUibKK/1UxbQen6l:I8eptZCiUiOa6brK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636501475, "uuid": "d0f91a59-a58d-4229-aa31-e37563164734", "value": 296600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636501475, "uuid": "078ddbed-95e2-47a2-9736-8f7085281d96", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636501475, "uuid": "17c2f70e-0c3d-4ac7-8216-957049d9b8af", "value": "URGENT PURCHASE ORDER .r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78480b8a-41b5-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636500820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636500820, "uuid": "8040d94f-64a4-4bc3-aad5-5b0dfc02fcae", "comment": "Malware payload", "value": "79f50075518dae343abdf7e298b578f2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636500820, "uuid": "25b8f213-18c9-45ce-82ed-99b069977b41", "comment": "Malware payload", "value": "32f53fb7a6a053cad4e71a5e07a3ca346a056f97aa45f8e20505cf6cc016f5b0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636500820, "uuid": "d9aeabcb-930e-4127-a332-0008ae88173f", "comment": "Malware payload", "value": "7daedaea65038fd4264346ea232b037c82c76224", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636500820, "uuid": "9e62edc8-6e93-4d91-a326-a0a81dff9dc3", "comment": "Malware payload", "value": "71cbe6727e3d0a378fd513573520028d5bd86099ab23d8c9231e272b9ae606cd4d5e455021225be49a38a1072e3bd43d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636500820, "uuid": "f4263fc1-ae22-4115-b94f-5aef2baf0328", "value": "T13A4530027E009452C20A5F329A571F74A7B599CB33636B2182B268B54F3F7DAE4BC774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636500820, "uuid": "2424a64d-8501-48fb-b83e-7153fede3d2a", "value": "768:VFTkorup4j9dyRj20HycwoTdbsTsHl4cF7e//PIL:VFTkorupVbxsTsHl4cF7e//S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636500820, "uuid": "bffb04ab-4999-4a0b-93b5-1a6b832ea28d", "value": 1179648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636500820, "uuid": "6400e6b8-50a4-4b4a-8189-cb8fd0a7256d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636500820, "uuid": "f8539e36-5190-433b-84e0-aeef3d434dcc", "value": "Stolen Images Evidence.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f651338d-4152-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636458511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458511, "uuid": "154bbd1d-fc53-440b-b874-ace41b30c722", "comment": "Malware payload (AgentTesla)", "value": "d81e7147b4e428c44f51a2b5df96ec17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458511, "uuid": "71c7f6a8-82d3-4353-9b18-bfe5440fd6c4", "comment": "Malware payload (AgentTesla)", "value": "33ce082a006f04e5ffff0f486747cb08ae7f44dee113fdaeb4be781de66c1fb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458511, "uuid": "81e9e260-dc25-43cf-b02a-a950a3a1a0d9", "comment": "Malware payload (AgentTesla)", "value": "845b6ca63037f312da0547f01e56411404f42f43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458511, "uuid": "6aa4b4af-3b37-4b69-9ed7-8e12c9e21579", "comment": "Malware payload (AgentTesla)", "value": "a5d2d94a9beada2f3af0a0b876166c87cbfff5999a060bb10c397d825b683a3177d9dd8d246298dbb833d86642d114a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458511, "uuid": "68d62780-3cef-4641-ba94-8cc9aaa7b347", "value": "T10B94120F7308C42BD6A15136CCEF9D602779B58668D7DB2EA6DD229852A33E10453FCE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458511, "uuid": "54d84394-9f7e-4a9e-a246-e9a0d7791f35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458511, "uuid": "e1e14f13-8b4a-4e76-8505-0ac0f245e5a2", "value": "12288:og0wLTaRRNcQQFS8m7lK7NsztLTq8aDNV9y//S:p0aT+mlFv487NszJTq8aDNi//S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636458511, "uuid": "5069f080-dc8d-4f17-b7cf-bc7c8d61c577", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636458511, "uuid": "c8c65724-dee6-4a6c-a020-5dcd0bd5d79b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458511, "uuid": "dc08f70e-f3de-4cdd-8370-81e9bd587fba", "value": "6ZDoc#0021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2726eac0-4157-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1636460311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460311, "uuid": "6565424d-7a40-4ee3-bfbd-56ed43ec3808", "comment": "Malware payload (AveMariaRAT)", "value": "18dc8ddd5a68d80560e5d274a1ed57b3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460311, "uuid": "6d4edc6c-a2f4-49f3-9d8d-7651a173dcee", "comment": "Malware payload (AveMariaRAT)", "value": "34439182e1b2f709b7e61af6c12e45a99fbea2837c628f912fe8cec7fc2d4d7d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460311, "uuid": "410f51a9-d464-4266-acc5-68abe235c902", "comment": "Malware payload (AveMariaRAT)", "value": "a6c36fad63b795a85d5a76eef21b6309eb3288f6", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460311, "uuid": "ba166baa-f13f-4b36-b229-505338a37b7f", "comment": "Malware payload (AveMariaRAT)", "value": "7599714601a88deeef78c3b660735f989331999484fe85c5bdc8f3f69c39289c85ac1a62c43d83c669ee2dc0f8dc5a4b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636460311, "uuid": "2c2d3888-7b70-425d-a5e5-28a83799c91f", "value": "T1D8F4082D9D75D04FC447AEF62A68DB3610142D7C6B06416631E9B6EEF6323F868A313C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636460311, "uuid": "85c14165-def5-481c-8f84-e379c8109965", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636460311, "uuid": "f828b636-283b-4682-9413-8ba006744e23", "value": "6144:cTJWw9eMKM9vhIcFDJQnO9GXnVb4J7ipcBeApGfPsCGnExBpkNz07AFqV:bw9eP8XDKOYXqJ7iZApGsCGExZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636460311, "uuid": "84227081-3f2b-4f75-8bed-77b777b00cfe", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636460311, "uuid": "0cbd1839-724d-4a70-af3f-5e547762efff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636460311, "uuid": "a59d8c7d-0c32-422e-9d0b-9c82c3deb208", "value": "TT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42fb01e-418d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636483767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636483767, "uuid": "3fa23fe1-d443-41b8-b67c-e8c36d7f8376", "comment": "Malware payload", "value": "28889078d0b2c649464865eee0d50092", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636483767, "uuid": "624b6049-fc91-4e8e-9bf2-b46fa5afb0c0", "comment": "Malware payload", "value": "351801e6c4ceded8cadbd3ca87f21c9d981c223392e8bdd2d09449f77aab975d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636483767, "uuid": "b19ca50c-5968-4c56-9d7e-17d91dc3f6f7", "comment": "Malware payload", "value": "56323210d54413d7d037e60c7bc583e083c69a3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636483767, "uuid": "043a0139-88ad-4bff-82dd-83e182ac7e2e", "comment": "Malware payload", "value": "c4f3900f00edb0406b98a2dc5f26e95a0c931df75f23145aed87f71c9f98390ca6c28c674e4f76de17486bc414ae16f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636483767, "uuid": "c26a0b5e-70c3-4b33-8421-35e33479509b", "value": "T1B3B4BFBA3252BDDFCD238DB5C9542C90AE6478B7571FC203E95701AA66DE492CF208F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636483767, "uuid": "5f1f9842-669b-4647-9d31-9fbdb1a795b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636483767, "uuid": "af5ae547-d080-4778-bec2-70a778278f12", "value": "12288:9qJFTPZnsp4X0T0tI6sS63iSiL1isx07lGmSWnGrd:9qNnsaX0T0trzXhi80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636483767, "uuid": "faf5bfba-080a-4309-9da7-556a7f204847", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636483767, "uuid": "b08d4b99-1ac3-4721-bab6-a62bc2d65b3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636483767, "uuid": "a0e17f59-027d-457d-bf29-9de64efeea9e", "value": "REQUEST FOR QUOTATION RFQ 0099388.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c7a388-414c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636455712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455712, "uuid": "4fdbce3c-05bc-4bac-a4a4-7a6e3231cbfe", "comment": "Malware payload (RedLineStealer)", "value": "d8f7da9126f80196e3bea63590d9ff19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455712, "uuid": "35e5d07f-32ab-45dc-81da-156fb0d562de", "comment": "Malware payload (RedLineStealer)", "value": "35f942f7c250deaf91123ff806ff03769d730ac894ae55b4af5afb1a318a94fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455712, "uuid": "440cfe58-3401-4760-aa8a-4e6eda86ff29", "comment": "Malware payload (RedLineStealer)", "value": "05b218191b034e934aed71a2cf7bb41b4cc60b9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455712, "uuid": "94fe2bb8-2ca3-428f-97e8-be3aed3ce194", "comment": "Malware payload (RedLineStealer)", "value": "5f8f848c977d06758cb67df345aca7a7890c7c2e22241960b1b319d658ae24bdd2c9a4f46c7d08444d55c871369b2f2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455712, "uuid": "fa56c616-111a-466d-b3b4-7f8a81193b42", "value": "T16284BF14A7F0C035F6B712F45A7A97B8B92F79A15B2490CF62D416EA97346E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455712, "uuid": "7d4294a7-3e5b-4a43-bb1b-11d16aed1ee2", "value": "a24faa9f4919afc00d25c1c4d020aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455712, "uuid": "b078f8cc-7441-4ad9-adeb-74e7758c1513", "value": "6144:pZ7qFUcf16J1Fl2VOmrQHluT7VtEQ2c5vEbRIB7LV9/HnOf+/vQ5I/:wlt6vmVO/FuT5VvEbRINLVltV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455712, "uuid": "6cb5e667-10d1-470b-b71b-cfe7b6449980", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455712, "uuid": "08d3bfff-16cd-4fa0-b280-f6aa36aa619c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455712, "uuid": "e348c723-5bdb-43eb-acf0-734bec9ebdf8", "value": "d8f7da9126f80196e3bea63590d9ff19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811d5b15-4150-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636457456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457456, "uuid": "d7a152e7-2d2c-4faa-8a08-6477d0e171ca", "comment": "Malware payload", "value": "d515dd1ce74ad481f803ac910bb15853", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457456, "uuid": "746d7f12-e1f8-457e-8be8-8b9e7d5a4b5e", "comment": "Malware payload", "value": "3667133ff8a6bd86262d12e2ad933b85d25dace9943f28623ffdedf71158273b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457456, "uuid": "0fdb8fe5-cd03-4f62-bc07-a9646276c214", "comment": "Malware payload", "value": "f7016f8b73adb932c5be4b126d29ed79613c2eef", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457456, "uuid": "da0f8554-5580-4ab6-ae96-519cceb02e25", "comment": "Malware payload", "value": "3769b4f8d1dfbe0a9729cdf0b7bfc6c30e1667bd0e74b6c26ae4ab05de2b5372faedff4b3ca1dae22e4217c715d6ee89", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457456, "uuid": "1b833266-ae0b-4921-8ae8-0e07d3d6547d", "value": "T15F227D38E606F81AC012057CD1A583F5EA6C6163F7227D1C6094739E07A05E797DEAAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457456, "uuid": "90a6a1f0-59dd-4c12-9b13-44889c0fbbbd", "value": "192:ScIMmtP+RyLG/bWo+pYOKpRamWBXjtc3Et:SPXWR9B+pYOoRoTtMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636457456, "uuid": "0cfe877a-7569-4b32-ad8f-c30170a1eb85", "value": 10329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636457456, "uuid": "da3090dd-08d2-48e9-8f22-abebd0b1a37b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457456, "uuid": "7f258807-1e75-4604-b5d4-6bbe8eff76af", "value": "MV OCEANLADY.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe150ab5-4158-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636461101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461101, "uuid": "ef2d620c-e1e7-4a08-b982-2990bbec3823", "comment": "Malware payload (AgentTesla)", "value": "e050ff2eb1f2e3018a96004338cedb11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461101, "uuid": "e3458ada-6cdc-4b87-ada0-9effc04d409b", "comment": "Malware payload (AgentTesla)", "value": "3675904ce6797f625009be5911cd93f883fb56d9cfae47697a3defabb70dae23", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461101, "uuid": "a560d233-28f3-4141-83b7-a7c594e8dafe", "comment": "Malware payload (AgentTesla)", "value": "558666760ba603139823d90de3c153fd6cc429f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461101, "uuid": "fb8c8bfa-fff1-432f-b3be-972730b4daf2", "comment": "Malware payload (AgentTesla)", "value": "04e0dd64d88684c318ee26e1c16fb8349442e96faa27a3956688a992f6e75d40a07d5e69aad17b3778823a8cdee31953", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461101, "uuid": "b9fbc8ea-d984-4fef-8490-38413ceeec18", "value": "T1D49423D203D64B2FCDEA863A6CA3F6C246B2B1CBE863DF5D539788743A6274250507C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461101, "uuid": "cb891bbf-7ce8-4156-8dbf-d1d61f79f2a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461101, "uuid": "fc580a92-41d2-49be-bb21-1054b054a0c6", "value": "12288:GwrePVHbheO60Av4I+4mxQChWNF1fKAN6:Gw6P1bhxI+rQCANF1ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636461101, "uuid": "ad3984e4-d641-4a7b-a5c5-f71afe161ac9", "value": 412160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636461101, "uuid": "f0c3a697-5acc-47c2-91e3-29482fdc3d83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461101, "uuid": "d7d386f1-42cd-495e-ac12-30f0698a6c82", "value": "details of payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c9991c-4141-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636451016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451016, "uuid": "2446f7a2-575d-4fc0-9479-a05e661bb83c", "comment": "Malware payload (AgentTesla)", "value": "23f8198730a76ba9073fb0122dc963c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451016, "uuid": "194473cb-8dea-4b92-b23f-cb4a6bfdd073", "comment": "Malware payload (AgentTesla)", "value": "3699dfeed76b45d9e37ba47e3e62130d6dddfdbc553a972efec5a3893be48868", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451016, "uuid": "5a409c92-ef21-4db7-89a6-7610c71bd987", "comment": "Malware payload (AgentTesla)", "value": "95ab5a2a052219243d1c19d3c51ca215a39cbe9a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451016, "uuid": "be9c9d40-5cb5-4b78-9d80-6285e31786df", "comment": "Malware payload (AgentTesla)", "value": "83b4cf310184d83a2003a25b5b26a3da98e51854528aed57085fb01d8f926de2a4adbcc79da85864eb39b6eb76a2bf9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451016, "uuid": "2ee3e1f3-f72a-4b32-ae58-1c2cee438c48", "value": "T1F7D422497A7C95AEE34244708CB0E16DBE29AD146D555203AF46BF3F363EBD6C0262F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451016, "uuid": "bde950bf-2e61-444f-8d0e-3cec17f105f6", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451016, "uuid": "b7370ec8-27bb-4fe4-a996-a757dbbf87e1", "value": "12288:QVaViyhqQpSvRIEieGu4Cyh2rdCON5IULnx5JYwOO5lC:gaRhVfEieAPhq17dPJoO5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636451016, "uuid": "14d5d140-0343-40ea-a904-45a33e7d130a", "value": 605664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636451016, "uuid": "ba1c2d0a-6a3a-40b2-bd0a-e2bdf165fc64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451016, "uuid": "87793918-56df-4313-9e79-f1906a6f1a31", "value": "PO NO. ATXH-2021-0023 PNL GLOBAL_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a168bd-4105-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636425412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636425412, "uuid": "3d2e88db-82da-42ab-b2a7-f7c2f72621b3", "comment": "Malware payload", "value": "3c3c755028d448d6f561b14c3a1766e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636425412, "uuid": "32d1bdd9-0132-464c-b32a-621321762443", "comment": "Malware payload", "value": "3783ef4a8ce7c92ceebef3e11a00182683bfc09c58a1b1e7a080aa6d6edb56f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636425412, "uuid": "34cb171e-06a0-48be-aa6c-5f02c1eea2ed", "comment": "Malware payload", "value": "53ebd40b005c7e88aa4acc43fac7bd26c0e89648", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636425412, "uuid": "07d4e45b-df91-4407-8a19-811e5326b5d2", "comment": "Malware payload", "value": "9a8e197cbbd08470d0baadf4d4e8d959d4978acc924eba12490bacc5d795bacda064a4877dd6140b03c9898bf4ad17c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636425412, "uuid": "78e452b2-efe0-4c52-a9c1-b81bb209b90a", "value": "T16AB3262864BFC059C0E3EEB52DDCA9BAD99A94E3640C70370174633B8B52B84DE4F579", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636425412, "uuid": "da514dc4-39e4-4a67-bb57-3ecfd872dc67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636425412, "uuid": "b4b5f95c-b854-4035-95c2-838042fae983", "value": "1536:0O6h5Qf2jCwXY36H086yLTeo9OqNUhep8lqwjHNrEUJGuR:0O6fQf2jKb86yLaoAcIJGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636425412, "uuid": "2ff1c25f-60da-4af4-aef8-6947a7cb2258", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636425412, "uuid": "392ae8f7-3467-4281-9c17-da6d090963da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636425412, "uuid": "d4ec2f1c-9755-47da-95d7-eb4363e227a6", "value": "3c3c755028d448d6f561b14c3a1766e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aebe8da-4191-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636485389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485389, "uuid": "8271de7b-9f0b-42cd-a758-be19b80df7f9", "comment": "Malware payload (AgentTesla)", "value": "448202506a8f2e10ab180b39c9bcfc65", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485389, "uuid": "b64ff2db-c563-4403-9383-d023971454f8", "comment": "Malware payload (AgentTesla)", "value": "382519464ba2382980f3ce80a57fae4a7d8c1e5b07c4bc4aef9e1dcdd09eaf20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485389, "uuid": "0cbf3639-f636-4069-817d-5041f2abde63", "comment": "Malware payload (AgentTesla)", "value": "9c5081abd03249dec3e6722737bbca0a25db6ffe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485389, "uuid": "4d73e594-04d6-464d-b2d0-20ab0f759e0e", "comment": "Malware payload (AgentTesla)", "value": "0b0827ae95466e93db215b5da06c2095671afd6f1dc7dea179f5de21a123cfdd63b71ca4a3bfb2eef250df6b33de7d5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636485389, "uuid": "5b3c6b9e-0a99-49fa-97c7-360f1361de60", "value": "T128E4D095F940A6A4CD28D3312D7BC83507277DAAA8B4911C31C97F673BFB6E30026796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636485389, "uuid": "56378bd4-9797-4f3b-aab9-4d55e8a475fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636485389, "uuid": "79ac8cb5-d931-4bac-beee-2addec28606b", "value": "12288:NGjNT8UTZRwO/W5gyFzU7biCmEgWFG7xfIKnw7OsuONOMvT6mosppvppMkkkkkk6:EThTTNW5ZNM5rgi3Kw7OyOM8zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636485389, "uuid": "27fd4e2b-5984-4641-acae-7c59d6a4c2aa", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636485389, "uuid": "6cc376e8-3374-482f-ac34-4bec59fd6d5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636485389, "uuid": "47573037-d257-44e4-a9fd-222e418f578b", "value": "Purchase _documents#20210911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a7a210-4198-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636488447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636488447, "uuid": "da81f6b4-2f2b-4293-8e4b-86ae496f3f49", "comment": "Malware payload (AgentTesla)", "value": "518c7c50481206246ffa615104d0ffed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636488447, "uuid": "d8207388-e93c-41e1-8970-a3199c581c81", "comment": "Malware payload (AgentTesla)", "value": "396f5e897b03f6bd1507588f954e763452be48260efc811c58531bec45ea31b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636488447, "uuid": "a3f4288f-01d0-470d-b956-532be57e0acd", "comment": "Malware payload (AgentTesla)", "value": "74d5b6cff39d1033c89ff44bf0400964b0012533", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636488447, "uuid": "5d962eaa-f7e0-4f57-b261-abc8ec99f00a", "comment": "Malware payload (AgentTesla)", "value": "945c46f95131f843267118fa2f0cf3b9971d0b838c2f10c564fddec6be2dcf213faf9664fc29f89e159a7ffb47927311", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636488447, "uuid": "d9ca3f34-bf2e-4340-99a5-7460da977222", "value": "T11C94023B7355C52AD1B105B7C89FA90083ACB542BAD2D77A37A9337D09713E6890368F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636488447, "uuid": "417c3ccd-7c7e-4e37-9286-da608a9794af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636488447, "uuid": "0d25e41c-e964-46d8-8045-3cda18a07663", "value": "12288:aLQyBTv+WMpZ1dcL1y7Z+RA7yBe5CePDQ4Z1rFhb:wQeT4Eo4EyY3b1rFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636488447, "uuid": "08c40831-68fa-4c6f-a945-56fe90c270bb", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636488447, "uuid": "e9e95f85-eba2-4033-b36d-4c5d7482a399", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636488447, "uuid": "4a4c382e-7fc8-4e71-a86a-fe0b0fdef6c2", "value": "Order T21716008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75df632e-4151-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1636457866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457866, "uuid": "0748d08c-d713-4141-8fd8-fc81fc0cbb69", "comment": "Malware payload (Dridex)", "value": "84db8e976c2b36c0cd8dcc4a2e21f759", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457866, "uuid": "a21590eb-87e0-4b81-b345-e981613a670e", "comment": "Malware payload (Dridex)", "value": "3aba474b330e34be2bb82bda6d36b44948069051af351928edefca5dbd803d20", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457866, "uuid": "737cb313-d11c-4ef5-9c74-51b89d201c8a", "comment": "Malware payload (Dridex)", "value": "4821e78a4aa28a8fc45cc73fe2f48677d3a238ce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457866, "uuid": "4133c694-f465-46dd-bc6d-695233423a3f", "comment": "Malware payload (Dridex)", "value": "42e7f777dfc8eaf29df3309596e9f72aa19b381b55c4b36e52c4bef2b320af4cacb0cbb11d36916db351c08c235d7c7a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457866, "uuid": "96ffbc51-13d6-4f6f-bc0c-060997b98f76", "value": "T17993024FC4A67455C2F258BF458D29F0583A1619180FFE5A396C13741B3418FEB9F12D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457866, "uuid": "c2248933-e1a5-489f-9d90-a6568633b176", "value": "1536:8CW/PFFxgFzx5YVqHS2YzayhpSW4vHR05Q4r5UZKUbvYvytjDYcI+mo6Jx:83aFzIsj8aipSW4vHREQ4iZKUbvd0cI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636457866, "uuid": "ec6b4167-3731-45fa-ae36-3af61fae7720", "value": 95578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636457866, "uuid": "165b142f-0472-4032-af36-7bee78310e83", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457866, "uuid": "06c86035-c76f-49b7-b8f0-aeff43ad7634", "value": "INV 5179.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e46dad-4160-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636464463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636464463, "uuid": "0f7a9b75-eade-4d23-9cd2-0aefcaaf05d1", "comment": "Malware payload", "value": "ef669921322ed97d267380bb0ab20291", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636464463, "uuid": "f0125814-7f2b-4a3d-8d4e-f6b5d35257e5", "comment": "Malware payload", "value": "3ccb4131b2f8cf9a54cf003e6d29e841d83425aaa3b1c2fcc1bd253e855ff106", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636464463, "uuid": "e8923714-3a29-4fc7-b4ba-db20ef3ccb22", "comment": "Malware payload", "value": "a5a5f52606d5e278ea8410545edc71a399506e63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636464463, "uuid": "3f721c62-799c-41fd-9f22-a4b574d48d8e", "comment": "Malware payload", "value": "8b629ea1fd6fec52c8311315bda683a9329e25ebaa4aca209a42eb6af2660bc6b84f4712d30e30cf2d7da88678eee846", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636464463, "uuid": "2ada6db9-dabf-48e9-94ab-6253dbff8a2e", "value": "T124056B55E69468B4E44326304C3F6B746A387FA1646945126EBF3C92ADF32C33836E4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636464463, "uuid": "6e3a1c30-fc41-404d-a067-ad0b7a5a908b", "value": "7b484975ebc1a121d346391a74418697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636464463, "uuid": "9418ee7f-a1f1-4e7d-9efb-5e8ed81a5556", "value": "6144:6ty9J2eb9Vmcc03Dl2QEE12/ggyHISePm7lDW/Bl5Wn7DYKbQAJRtl68hTnUE:R9J2ebzmccYDJ2tMIMS/n56Dx6mTnUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636464463, "uuid": "a81c5183-6fd0-4bcd-bc40-220cdc24fc7e", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636464463, "uuid": "a7b82cee-ed34-4ec8-a717-1938243371bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636464463, "uuid": "163ab418-0acd-4291-a76d-a1d1edca547c", "value": "BIOBARICA OC CVE6535 _TVOP-MIO 10(C) 2021,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427d9087-413c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636448761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636448761, "uuid": "5d58dcac-3422-42e1-a273-d8a1a9f6f1bd", "comment": "Malware payload (RedLineStealer)", "value": "3a7f4a1f12255ddd24c956d5f25f0d08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636448761, "uuid": "78b5c440-5379-4d7e-8898-d69bc5cf3111", "comment": "Malware payload (RedLineStealer)", "value": "3d9663a2697d4d7bab892fdaad3e307adb72fa8b55b47dd4db396e9512b8930b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636448761, "uuid": "90550098-b34a-4a26-a862-d1754ba6e796", "comment": "Malware payload (RedLineStealer)", "value": "2d85497d96af1118e762e7afe9787c5fba7b5c6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636448761, "uuid": "6b1c32b9-89f0-43bc-aeb1-f388cabad62c", "comment": "Malware payload (RedLineStealer)", "value": "1f45a4ba57d302f89895873bc8756776ffc86c21655ed611f6a4a06ba7521a88c5801ab33fa2fde56dc908c22d408008", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636448761, "uuid": "b4191b59-ddd7-48ed-9546-539bf087c2f0", "value": "T1817403433F55F718E0762EB397DB651357AADEF19A3249CA1F489A021622103ED33B39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636448761, "uuid": "631c0e0a-94ef-4dc0-a3ce-2b91830b1281", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636448761, "uuid": "e9a453bc-6034-4c49-95e0-4cdce670c355", "value": "6144:MI5adQLxWbfm6cZjY+mQ3pCveJTWxX1pZXHUp:FbSOVNYRwNFWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636448761, "uuid": "bd7c79ec-203d-4184-8911-f85739cb949b", "value": 368536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636448761, "uuid": "c452a4b4-5748-439d-8100-650e004d0898", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636448761, "uuid": "28986139-ce94-4ac9-89ad-7b52b00a75bc", "value": "3a7f4a1f12255ddd24c956d5f25f0d08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251d0b80-40fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Glupteba)", "timestamp": 1636420365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420365, "uuid": "ba1aa7df-4003-4585-81ee-1bc494c00e0f", "comment": "Malware payload (Glupteba)", "value": "8a9e05ffd1bc86dfefa4f69944f43db8", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "NGLite", "colour": "#DDA34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420365, "uuid": "3458c228-04fb-4cf0-aefa-868b14e62144", "comment": "Malware payload (Glupteba)", "value": "3da8d1bfb8192f43cf5d9247035aa4445381d2d26bed981662e3db34824c71fd", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "NGLite", "colour": "#DDA34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420365, "uuid": "06487244-667c-4841-8f98-fb3144108025", "comment": "Malware payload (Glupteba)", "value": "66128391cf66844359ab7cc58c5f61f5761eb94b", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "NGLite", "colour": "#DDA34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420365, "uuid": "e061e158-123e-4e6d-91f3-71cfc6d77e39", "comment": "Malware payload (Glupteba)", "value": "4b2469da77698a28e275f02c308811078d22888df290241418f43c8d65e57d2d294be159ee539c6c5815a1d251576c8a", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "NGLite", "colour": "#DDA34A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420365, "uuid": "23993c78-ae56-45bb-9f58-337627e36442", "value": "T1F8D68D07F8A614F6CFFEE13085A692217A72749443327B874FA44AAA1756FD47B3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420365, "uuid": "da287bde-5054-4bd1-9c3c-5785bd6fb9c8", "value": "1cd364a9e949d5ecebd6c614e64bc545", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420365, "uuid": "78cd74da-384a-4535-8f93-e351abbb7613", "value": "196608:sKouOB/7eXB94InJrRx/2Xh0cGf7kz6bIHEvTVPEBBJs:lIYB9trWh0BOabVPms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636420365, "uuid": "bc77f8f6-c502-4c0c-81af-6ebd177b9936", "value": 13672960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636420365, "uuid": "99cee351-72aa-4b90-bf67-9eba91209f35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420365, "uuid": "88d5ce08-f3d1-4bf2-8732-9e0a76255529", "value": "3da8d1bfb8192f43cf5d9247035aa4445381d2d26bed981662e3db34824c71fd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3b2d4e-4159-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636461315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461315, "uuid": "1db9d6b3-4660-4f5f-9492-3a4919b15bd4", "comment": "Malware payload", "value": "361e5b57023e2b8b98994bf670aba13d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461315, "uuid": "e2f59bb0-5cee-476b-9072-0c412bfd0411", "comment": "Malware payload", "value": "3e1440a1b46c4ffc05088356578a64a9a7a34bf1a243e295c552501076a568e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461315, "uuid": "13fcebea-35cd-4eb7-bebc-5a75bd4e2be9", "comment": "Malware payload", "value": "1f109199c1b96b041b61870b3b6ba19cade68da3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461315, "uuid": "c066452c-d35d-4e85-b6ad-d74744db3d43", "comment": "Malware payload", "value": "efb51d07cdd16ac027b0da3c058c0bb9535358b4650e643fea884ce880670ac980fb95ef00f9015db8b6751c112f926d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461315, "uuid": "3c4ce25b-5d04-420d-8143-b34ee8e196f1", "value": "T176741379536808FBCA4C0ABAA8A322451370639BD417EFFE5748906D7D63B906481BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461315, "uuid": "e227ee21-92d1-4ddc-b030-db158aca4070", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461315, "uuid": "4678bee6-9d11-4c17-accf-b6687fb3b79d", "value": "6144:/PCcJwceMKM0pR5ahiIgixKE3ciP2mWJqxlNSUf6LmwtKgyA/xGXWA:XbwcePBpahiuxKXiP2mWkJSk66wJyix+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636461315, "uuid": "3435bc89-a574-4e26-81e0-8f22cd01ac2d", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636461315, "uuid": "cabd7f50-a9ef-484a-8f32-9f0d09bfa304", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461315, "uuid": "79856cc9-94a9-4f97-bca8-b92e6389fa0e", "value": "PO0221BichamProducts.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a6446b-4124-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636438703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438703, "uuid": "5713d6fb-c176-44b3-8354-3f24287886d4", "comment": "Malware payload (AgentTesla)", "value": "f30f856f979b18cfa2b76472f00566d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438703, "uuid": "f50f921d-ed1a-4058-9229-790b22584c1c", "comment": "Malware payload (AgentTesla)", "value": "3e72d442ec7dd43550fa787274c2970dd1da8de76674da49592b5d172f358f4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438703, "uuid": "0318df94-039a-46c8-9c98-4b8a96b61fd1", "comment": "Malware payload (AgentTesla)", "value": "c7091bb725eb9f16be72516677e32c5ec1388ffe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438703, "uuid": "1920b46f-3d22-4d24-82e9-ca6d6cfbd1ef", "comment": "Malware payload (AgentTesla)", "value": "f45383f453896405eca6109b001d55b407dafd9950ca11515b8318f0284a8f6b26db0560124de864803adb4f4753b660", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438703, "uuid": "56444b9f-d85e-4886-9d45-369aa5279798", "value": "T130A4BF7A3252BDDFDD278DB589403C90AEA4387B471FC243E85701AA6ADD4A6CF148F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438703, "uuid": "bae30151-bf6b-4c24-b2e4-c7cd67aff413", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438703, "uuid": "4e64537d-2f8f-4875-a243-7eb56be334cc", "value": "12288:7RFqJFTPwHHlBbyslUMvrYq+HTpyjTw0l0nm:7PqMlJjlU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636438703, "uuid": "96acfa61-d866-4abe-9f06-efb43f1efb11", "value": 488960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636438703, "uuid": "9f33aeb4-1466-49ff-a1f8-7f31c8d6a7ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438703, "uuid": "29ddc833-398e-4d41-8ea0-0c061794ca10", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7276268f-40f8-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636419635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636419635, "uuid": "9324c4ee-0aab-4c0a-92b9-1d91fa5d754c", "comment": "Malware payload (RaccoonStealer)", "value": "b8adca8a1fd79577199828f3c2b5df65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636419635, "uuid": "e5a461a9-4179-4dd3-9ce3-5902ec5328dd", "comment": "Malware payload (RaccoonStealer)", "value": "3e7a07fe52e896c4dac25c0df0ddae0bbe0e1714dfdad92c1c35d3d47969db3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636419635, "uuid": "86fb1181-baed-4c79-a1f2-9a9897b6369d", "comment": "Malware payload (RaccoonStealer)", "value": "b5eb557ce6691250cdb04872c6a33088c491d20d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636419635, "uuid": "5ab57e51-2900-47f8-a539-c9f6b52551c1", "comment": "Malware payload (RaccoonStealer)", "value": "b7a541d3907b7d9e28b8878a94d0549d36ec4fdaa00cc0ca0c8cbf3bc99accfd58c276d41807c4441f952e7e5b406af9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636419635, "uuid": "a1f3b172-e656-4a0a-aedc-c3a2886de06e", "value": "T158B4F1F1A69D8437E5535E304920DAB00B67B8236930510BF7945B9E2F73F9C8AE532E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636419635, "uuid": "77187610-96c2-4eb9-9420-5a2feb6f4618", "value": "c8725b7ab8753c936cc4c98a181b2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636419635, "uuid": "17a906ff-1251-4049-a227-c8023c06162e", "value": "12288:VASH4WQAoLjVZlfAnhgfEizShfr4Yunn5:rH4WQNjblf+iuhf45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636419635, "uuid": "c3e90348-1854-4aab-acce-ca1efd82a378", "value": 515584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636419635, "uuid": "c48aa49f-0e4e-447a-af27-cd3b0c1dc946", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636419635, "uuid": "6c1456b6-57eb-40c8-9c87-08b025a87a3e", "value": "b8adca8a1fd79577199828f3c2b5df65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315e6cfb-4138-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636447014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447014, "uuid": "57d5a580-43ff-40d9-9352-e470bce40a1e", "comment": "Malware payload (Mirai)", "value": "37c7332a2b7617a571bcf3498c108fb0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447014, "uuid": "5677da09-9d74-4ed2-b850-e501ee3acc87", "comment": "Malware payload (Mirai)", "value": "3e8ced20af8ef407bfeee313965b012c9a47cda1b059b5ffb434beb42ab09710", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447014, "uuid": "af1af2f5-7490-4de5-ace8-5b6ddd4a261b", "comment": "Malware payload (Mirai)", "value": "6b2454de4c7b446f7fa32c1e43c94e8da6bfb225", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447014, "uuid": "7e6260dc-01d0-4ba9-b2d1-cecd3020e8bb", "comment": "Malware payload (Mirai)", "value": "79ba4ff19171fb7d05fc0dd9e4fbc76ac05b90819a475f98ff3d604247d125c8f5b6397e1a18d65f7048b70623b23595", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447014, "uuid": "94ae63aa-3e1f-46a2-a41e-0977fc1a0a32", "value": "T1E9B3A35E6E218F7DF76D833547B74E21F25873E222E1C644D05CE9015EA064EB82FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447014, "uuid": "c5fa1dbc-1ca2-4abe-9de2-5d8b0342bf58", "value": "3072:NeKTASdaQyS73obltVJtPezXt+0QwPM8ftEwbZnopYN:NeKTAS48o/0P08WwREYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636447014, "uuid": "1305196a-11b2-4e81-8904-6582fb0e3005", "value": 109324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636447014, "uuid": "962d3404-5af1-422c-bbce-c2b50e2c2213", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447014, "uuid": "8a8fbfd7-c95b-4393-8dff-f31be6e7db58", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e71583c-415c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636462498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462498, "uuid": "2c84d00d-9a7d-4067-a109-60ee171d0df5", "comment": "Malware payload", "value": "57c69cb877e89c439dca08f66e625e46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462498, "uuid": "3352fa86-2f43-4849-9837-30b4965b0035", "comment": "Malware payload", "value": "3f0e642d8ab5410bab72b479c285ee8b267915a687977c0414ff0f67d75d10bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462498, "uuid": "8b83cdaa-b540-4f9f-8f17-240c6a1933c6", "comment": "Malware payload", "value": "0c3873b6249551440bf9e40d1460d5f8416bd11c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462498, "uuid": "1272d1c1-16f0-4e56-b64a-2add6f3ad5e2", "comment": "Malware payload", "value": "b2e281d7ec14b6e4cf30d727a170894341c6d6df881a42743ac7e4bd578373d3a9f43d5afed7269e791e548440c47d7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462498, "uuid": "1aff605e-4c12-4132-91f5-404ecbc817fb", "value": "T1FD6412697328956FCCBA463E9C33750186B462D52293F77E1B4C14CB6E7738342C2BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462498, "uuid": "87c2f8e4-a60c-41a7-bb7c-986c7f000b83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462498, "uuid": "959d488d-4c78-4cf2-bfaf-e1622c484aef", "value": "6144:+fy8wMeMKMgL8Z25qkSavnRZquPX1C5bemzSSJuC:gwMePFL8Z25JS2nRAuPXI5bemzS8uC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462498, "uuid": "b28d6ab6-9dbb-4d35-a82a-32aed0e7ec02", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462498, "uuid": "635d7435-3e5a-4c5d-9161-94ab3c901276", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462498, "uuid": "8b396fdb-d5f6-44d5-ba9a-3ddb55be7394", "value": "AO N\u00b0 03312021AONMERF-WACA RESIPFBM-IDA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3041d57c-40fa-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636420383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420383, "uuid": "c425f122-a3c5-453e-99e0-50f0e4aa3784", "comment": "Malware payload", "value": "53ff174fbeff97b6b5240bb0c6fc787f", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NGLite", "colour": "#DDA34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420383, "uuid": "2c1cc01a-8b21-4734-8b91-f46b90bf53e5", "comment": "Malware payload", "value": "3f868ac52916ebb6f6186ac20b20903f63bc8e9c460e2418f2b032a207d8f21d", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NGLite", "colour": "#DDA34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420383, "uuid": "e6127512-8704-4783-b698-877540e54999", "comment": "Malware payload", "value": "230cde320203402bc8a92a850586f47c662d6d3d", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NGLite", "colour": "#DDA34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420383, "uuid": "8cd989b9-c246-4850-a309-64954b0c7c49", "comment": "Malware payload", "value": "801e2e5bd12529fce9f80c3270177d50209ffee53481b95d685be40ac35a278d38ebba15b2a48ddd50e380f662525360", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NGLite", "colour": "#DDA34A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420383, "uuid": "923ab78f-dfd8-4c1b-b20d-7134cb98cdb0", "value": "T15FC67D80F9EB24F5DB83553085AB513F3330960D833AEEC7C6145E67E86B6D15A332A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420383, "uuid": "56e95c8f-f686-4093-a866-026f33e81b44", "value": "1cd364a9e949d5ecebd6c614e64bc545", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420383, "uuid": "b839a116-c352-4211-acce-55beece69291", "value": "98304:vdwW3Tk4Dz99NBhQp96xOB20J5O+28t6dIOsyKTocUbVqCUAiI+lOPXPwU+PWNzv:vdr3TJMpaOB20J5Ysh03VxPN5AhAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636420383, "uuid": "9c8df442-ce30-49cc-8a41-4e45627a85cf", "value": 12314112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636420383, "uuid": "bde9e671-8349-49b1-8934-f040d0ef6662", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420383, "uuid": "7e5400a1-959a-442c-b695-b42efefe9d01", "value": "3f868ac52916ebb6f6186ac20b20903f63bc8e9c460e2418f2b032a207d8f21d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e60b7c-414b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636455311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455311, "uuid": "f0b1225a-d313-4d94-abf0-c42fcbeef51a", "comment": "Malware payload", "value": "978a80c85db9eae55929fe53a639559e", "object_relation": "md5", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455311, "uuid": "8f18e562-ab5e-421e-a676-19c0945e9d2e", "comment": "Malware payload", "value": "402fdd8df4dc1754f97f89bcf2149f35c5ffead815e52c0984593853dabd386b", "object_relation": "sha256", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455311, "uuid": "6da2bec4-742a-4a40-934a-51ad295f357e", "comment": "Malware payload", "value": "b0555afbf8a3e436c5870521d8240f62943e9146", "object_relation": "sha1", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455311, "uuid": "5dcd1cf2-2267-49fc-97af-bbb49fbc3e99", "comment": "Malware payload", "value": "d3b77b177d31b531e4ae6bf41ddf19bb202bac591b43651339b5dd39c7c7b4cb8c0f1357ed7de2cc9ae59dd4aa1a2a0f", "object_relation": "sha3-384", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455311, "uuid": "cf288e3a-9ff0-4c18-acfe-cd1f2b129e5d", "value": "T15A7423FD7A46BEA5927B2EA91850ACD8970D73C0723882E5BDD07690930D56067C23FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455311, "uuid": "3b0218b2-f732-47d2-aa14-c6ca26af9575", "value": "6144:Qr9fnrRiBTKCw8Jf2biDPrwhHJvceUMrzJaC3klPUX4hrqTVuhQHaiie8O:QJATw8Jf2GbrGHJUOJbihrLQHfiPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455311, "uuid": "acc5888b-6868-4852-bcfb-160212959abc", "value": 370573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455311, "uuid": "59723aa4-dce7-48b0-a0ae-77c386925cd6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455311, "uuid": "c6b3f026-000d-4d88-911d-e67870d7ec56", "value": "REQUEST.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b36860b5-4142-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636451527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451527, "uuid": "9ef9680f-ac53-427a-8498-7259c281fb37", "comment": "Malware payload", "value": "fb460d176757aa316975a15dc97d892f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451527, "uuid": "517c21d3-d587-4cc7-bb2b-176e83a7ef12", "comment": "Malware payload", "value": "405b98c75012f0ab2953f8f9793cf48cff9ee2b97b678c77e1f7c9d610759771", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451527, "uuid": "e983cfa8-45f8-4501-87d1-af48bd17c939", "comment": "Malware payload", "value": "10ed4ca12a92ad2b7a8dae71958fa3dacf33e1e6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451527, "uuid": "7c0863dc-fc73-47c6-a205-9956061b9c6c", "comment": "Malware payload", "value": "9fa176b7ed0c8906a29e190e1416e37d0897f09668dcfd0ef359347b242fb0f9cb2a543ad5bd8fb7b8ee05e315b8e735", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451527, "uuid": "c7928509-dbe1-480a-9d32-af8845cab5ce", "value": "T1A4227D3CD606FC1AC01205BDD09582F1FA6861A3F3227D1C60A0B29D0B605DB97DEEAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451527, "uuid": "511c5be9-89f8-4377-bdb0-c0128976c536", "value": "192:ScIMmtP+RyLG/bWo+pYONMAamWBXjtc3Nt:SPXWR9B+pYONBoTtMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636451527, "uuid": "6942d288-4226-49c0-9e59-0b0589b551ae", "value": 10329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636451527, "uuid": "df2d22cb-f913-4476-8cc8-ba00318c2d7b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451527, "uuid": "adb5f0d4-ab41-4c25-ba53-9f78679b2314", "value": "PO#SC83994.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec09a25-4170-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636471276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636471276, "uuid": "6f126999-63f7-42b5-b8f9-fb17463369d3", "comment": "Malware payload", "value": "0dc21d6354bfc06c9d53b30e7f9adb3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636471276, "uuid": "09e575b2-b64b-4e62-be55-8a05951c7513", "comment": "Malware payload", "value": "4130124b5e4c5e58a3690850d45bdc232186e05cad6b8567fa9196354cbecdbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636471276, "uuid": "621cf487-9cc3-4ec8-aa39-1c4c69fdb6b3", "comment": "Malware payload", "value": "330bb7a08d637b2154b93fdf6777380021ab865e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636471276, "uuid": "54dbb542-693c-4776-8bbd-bc9b131a356a", "comment": "Malware payload", "value": "0411c2d391373db4d1356abddcd384c7be421e3741f52504adeba958ffab937a04513174e8acff19be2ee6088f0d3bbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636471276, "uuid": "28446f43-542e-470e-8f0d-eb1b8d52514e", "value": "T1C2F3E733ACC2A99DC36EA470B410A85556C55FC3A612D59F7CA0F3A03C35B832D99FE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636471276, "uuid": "ce807d9f-0d07-40dd-85d5-42855eb8f5f1", "value": "0045789c6cef3bfcd6f0b95ad82c908f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636471276, "uuid": "faca2da5-c36a-42b0-8521-55d5b936bde6", "value": "1536:bSRP0GZKU2WahFihVjR9X7TfzMML6kYaLSQxQjouJDyELn0I9NdUyG30u:OPQrhFi/cbQmwa0+eP0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636471276, "uuid": "3f8cd3b1-a2d5-4271-8278-26784304e717", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636471276, "uuid": "659b941e-e007-4e02-b1ae-5ac96c5c9a45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636471276, "uuid": "d5044e40-d26b-4352-b8af-eb6da0d328bf", "value": "Purchase Order 30,000MT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7cc7ad1-4116-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1636432717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636432717, "uuid": "d9e9c48c-9b46-4c75-9638-752a6aba885c", "comment": "Malware payload (ArkeiStealer)", "value": "2cac14488ea38d690b2e505130bf8764", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636432717, "uuid": "cb781911-7631-43e1-8b9a-968daaad10f2", "comment": "Malware payload (ArkeiStealer)", "value": "41548aea8398cb97deed3c8746255fd82c85273ccc7e82531e9dd82f5d8b8d5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636432717, "uuid": "d4509478-e774-43bc-943c-ef66275963c9", "comment": "Malware payload (ArkeiStealer)", "value": "10d68c71e90e4e0dae97a86c3727b22a7a96269a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636432717, "uuid": "4407e9e2-ef55-4214-9460-e5fb3735e0df", "comment": "Malware payload (ArkeiStealer)", "value": "d13e9817b546f38c93c069a3b005e37a18cb26fc5344c14b643ab4c172b7eaa5eb6975ae88f8d95bf52d4cfbbfa41fbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636432717, "uuid": "2d92df00-c30d-4368-b897-42b92c5ba251", "value": "T153E40120A7E0D035F9F656F849BA93B4BA3F7AE16B6481DB22D112DE52389D4DC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636432717, "uuid": "269c908a-088e-47ec-a894-f49abc0abe51", "value": "ef5891f13814421fd185279f57d98085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636432717, "uuid": "d6189b63-9ee0-436e-bbe8-fb574e3a0016", "value": "12288:SWT2KYT7DxVS0dnVlZ2Yp68BW6kE4riViEoxYovgCnW+FGm:RDYPHZdvZDfRkvmVipxYUWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636432717, "uuid": "13b08d20-9d68-47c1-b4c2-2226f25d5892", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636432717, "uuid": "9f8a0488-8368-42ee-9cfa-aaff471b77a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636432717, "uuid": "20d50d96-92e2-434d-8b96-0f50095dcf77", "value": "2cac14488ea38d690b2e505130bf8764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d0f340-415c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636462691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462691, "uuid": "5b07a770-14e3-438a-ade6-1a379c2af65d", "comment": "Malware payload", "value": "e1744ffeaede1509ce5eb48e8cb08361", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462691, "uuid": "b848c385-dab5-4699-a491-8ade180f3004", "comment": "Malware payload", "value": "415d8e7a309e0e7ea9cec8bd06f9170b0dc15aca3a553ff6fa7f6726997800a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462691, "uuid": "0a116a46-cbfe-402a-b047-e397fd026f9c", "comment": "Malware payload", "value": "6e969cc97c6371885f667004187aebe96a124a1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462691, "uuid": "f021e395-8398-4325-bc84-27caff3a7a93", "comment": "Malware payload", "value": "f417d5a5b0446f04c14f80cbd31f49e639bdb7281d87a09ec914e0286701f54169e194691299afb300a744ce47c52d63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462691, "uuid": "88939a85-2508-4e6e-98e3-4aa7cf839ad3", "value": "T11C6412163AC0CCBBD5CA56314BABFB9DFA3291505061498B83746E363C71648DD1E3FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462691, "uuid": "735925af-ef30-4150-8c6f-eaf4f03b0f83", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462691, "uuid": "7140d06b-6588-4436-b531-fd373605d6f3", "value": "6144:F8LxBsOMgmt3yfnM2m7VbE5t6unh5taXHxvWRcDMmvTMthKKaY:/O9q3WnPm7VA5s+uXGZmvG/aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462691, "uuid": "175988a0-929a-4b53-a783-66ba9caca51d", "value": 316931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462691, "uuid": "ce3068ef-ef70-46c9-8ddb-02ea7a48256a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462691, "uuid": "fd488054-424f-4006-b1cc-aca9fcbeecab", "value": "e1744ffeaede1509ce5eb48e8cb08361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7b0cd5-415c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636462820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462820, "uuid": "a155dadc-721b-4143-a761-7e686a245315", "comment": "Malware payload (AgentTesla)", "value": "b791b848daa612ca56e42c616ffceacd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462820, "uuid": "97a7c184-5e3b-4a76-992e-e5e16f6acb3c", "comment": "Malware payload (AgentTesla)", "value": "41ea161038efe62415e2476d68288ade993533746800d24becaffa97099f5961", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462820, "uuid": "a45a26b0-dae2-4d4c-b023-3309e0e2fdf7", "comment": "Malware payload (AgentTesla)", "value": "fc199cea91d06f9ee1590037bb6b33262effac73", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462820, "uuid": "6c3b7067-f239-40ce-ae5c-ee66ad11aa48", "comment": "Malware payload (AgentTesla)", "value": "6dda58330841840ba8ba568e56c84349652db9840f271deb46632d65f57ac67e27139938b9a2849124a3bbb962ed9ccf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462820, "uuid": "c68f67ef-8538-4b85-a073-0456edd7eac1", "value": "T1118423E3250999E07FCBA5EC7FF15298DBB343A1CDF192E58C0B440A4AE949CDE68315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462820, "uuid": "9d2718d8-4db5-4493-876d-5cc888cf9f11", "value": "6144:KDWyYvT6hD3dQSqXVtp7LHTBh6eeH7PXrOElvTJcfVNjJb66DBzGx0c6Z:HehhQSKXp3lsHTrOEltW5F9K0ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462820, "uuid": "f3ecd710-dd0b-486e-bd73-e26c27ffd7ba", "value": 384149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462820, "uuid": "483d16cf-9159-4aac-879a-651bb65695e0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462820, "uuid": "5a8498b9-56ca-49e9-ab0d-1f97c344dfd1", "value": "swicthable project blue prints smrtdoc09001 WOB 08112021,NEW.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e56cdf5-41a2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636492535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636492535, "uuid": "9071d736-1cee-4fe9-9cd2-f79ea471bb9c", "comment": "Malware payload (RedLineStealer)", "value": "db2ef30e8f821c8f00456941f5944849", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636492535, "uuid": "2af4d797-eed1-4d32-a7e3-7a6d25606910", "comment": "Malware payload (RedLineStealer)", "value": "433cf9125a44e304eca2c5cf3bfe2af0b1deafd1c5e8d13d559e1bac9de711b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636492535, "uuid": "ba0d6fd9-c5da-469d-908f-0488468d80d4", "comment": "Malware payload (RedLineStealer)", "value": "01a08a69f1e8e6d822ece577a9ebe84a0c7f5f60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636492535, "uuid": "337798b9-eeb1-4119-bfe5-edd75b9b16ae", "comment": "Malware payload (RedLineStealer)", "value": "8364d9128de7c30f9c9ee54794384c2de95451c385a2f6ed4b13b81b09874e8c799fc5cf34ff3c956a4b92aa82460e60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636492535, "uuid": "6683ae69-a860-4eb9-aa02-554c14c22756", "value": "T105548D10B7E0C435F5B716F849BA9368B93EB9A1AB3590CF62D016EE56356E0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636492535, "uuid": "821b4d24-89a4-4832-903f-1b046d00d4e5", "value": "a5effb4de201aefae267d5eef9a314ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636492535, "uuid": "7627f537-8e3d-454c-86ab-cf36e4d313c1", "value": "3072:6zyig02ASl6xXrDXa23CiVfcC5DBoLtJaIC4CrraxIsgUUirwX0m5Sl5nTk5DItT:6xxXoiVfcGB0vaIC4CrrqR3rC0z5+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636492535, "uuid": "082aa9cc-a8fe-4387-9883-8ea8ed5f175e", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636492535, "uuid": "01e3d932-5da7-4c54-af80-7542857f2121", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636492535, "uuid": "8cfa77d8-2495-4812-80eb-f532ebb176e3", "value": "db2ef30e8f821c8f00456941f5944849.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c744dacd-4126-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636439534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439534, "uuid": "b890728d-190e-4129-b3ed-3b2d196d274f", "comment": "Malware payload", "value": "f66c844f67bf22518a8a108ca6534230", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439534, "uuid": "785f5d7b-801c-4826-827c-0ec3a99f0998", "comment": "Malware payload", "value": "43991fd2e81e68346e4d93a18d6584b21264f4d4118671c5fe9a111a9693bdc8", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439534, "uuid": "dc97da77-c084-4067-aab1-86a282db6990", "comment": "Malware payload", "value": "27b9a6a507cd006151f5bcab842c7daccda236d7", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439534, "uuid": "54f63ca0-eb48-460a-a178-943712543464", "comment": "Malware payload", "value": "a8924b233097869d809e250199a95f9ccb07ad62adc9971101974736f4f927bdefbb2ffba08cfa7a6da2feefde5deb67", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439534, "uuid": "914fc7c9-ea70-4313-8d38-cd9c718ac319", "value": "T11BF423571DA114BEF2FF491B252050EE05B81E0D269F194EBE11DB2D287FDA2188EFB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439534, "uuid": "ba97dd7e-1e54-4b13-b591-e2242d82bea5", "value": "12288:Oap0GsPrzmxM+kZtebWP2nI6hy9LXbWpGRDFi+OUlwSx77HA:OJGG/K1utQWIPhgLXCpwDFiDU7HA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636439534, "uuid": "65a94682-fa2d-4a07-be82-8c3f6518f5e4", "value": 770154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636439534, "uuid": "a975ac42-ba05-4fe0-912a-0548ee3e7b5a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439534, "uuid": "df589952-3687-4e34-9df5-e38d641db359", "value": "RFQ-21209KM01.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7781a66-4159-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636461466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461466, "uuid": "19da7e9a-1591-4665-9479-5f9092ebeb44", "comment": "Malware payload", "value": "a922cf315a1f0f7479032916dee25fe2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461466, "uuid": "4e117b7d-b6f5-4e1d-ba89-2a48d0a56b76", "comment": "Malware payload", "value": "43f98fd0954ce20ba35a5117134425322fa2fbb7ab474709e3217dbbe94dbc60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461466, "uuid": "d6e433aa-6e2a-4d05-b368-da5e62d06df9", "comment": "Malware payload", "value": "720e243d5e291dc4f28c90eeb31c83dd1e6c5e69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461466, "uuid": "d103d126-e99d-47c7-ae40-fd61d53f27c0", "comment": "Malware payload", "value": "69c6c36a43537d2776928d6abf0871433d28a0e8d9c0ddbdc7cef73e09ee1d11f7f9bf3b3b01f750ed000589f307f351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461466, "uuid": "99b0f61c-a21e-4df0-ab6b-213206efc6b9", "value": "T196A4F1655AA0422ECEC96C354985ED3301B05EB2ABC6CEA926F4DDE73CD730BD421772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461466, "uuid": "1c5e64df-85b9-4107-b946-f2eba4e4716c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461466, "uuid": "2badebc1-a7a6-47ae-86f6-399809ed734b", "value": "6144:dmFwRM0M1G6aBvjh3Jai6XgK3is7JU619az8bE9msvb3kTA+TTMx5yosY3X7XR4J:kwRZ4GF2iZK3BczKE9msITA+Eyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636461466, "uuid": "20a7bcc2-07a6-49a7-9c54-30a4e6d4c0fc", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636461466, "uuid": "056b66f2-78ac-46cc-b172-149ace9f70c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461466, "uuid": "bc78a066-66ab-4a10-b1a3-d168a02f1438", "value": "INV9854784321.SCAN.PDF....EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6f448f-414b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636455384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455384, "uuid": "92136896-f46f-414a-bfcf-d17ab497337f", "comment": "Malware payload (RedLineStealer)", "value": "e2b9b0a78f4b10eb7a8e0852b252d874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455384, "uuid": "aac3c375-103c-4fd6-a0d3-9050ba9e116a", "comment": "Malware payload (RedLineStealer)", "value": "44466730828a6c6496bcf753e1be4e07b35811cc939ac1416cc0809ca547cce2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455384, "uuid": "c8ac396b-7363-40bd-96b7-e197932f3c2e", "comment": "Malware payload (RedLineStealer)", "value": "09162a9552f5fac6a540f09ba23e6f534b9efe72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455384, "uuid": "1b209937-7c06-4b09-b873-e0c478679518", "comment": "Malware payload (RedLineStealer)", "value": "b14a6125560365f7daaf4e88468e2a94c964340ed0e8842fec8ccbf0873c72b58f3aede2dcb6db76757dfb07213f0138", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455384, "uuid": "e6d29848-11cf-4e94-be3f-49f17c202877", "value": "T1E924AE3176F89864E1631E3048A19AA01B3BFC215930519BE7D0678E1F73F9CB6E235E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455384, "uuid": "fac40266-494b-4791-a946-d049e3f2ddc9", "value": "c8725b7ab8753c936cc4c98a181b2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455384, "uuid": "7025b740-77a8-456c-ab67-6f856200c59b", "value": "3072:oMzE8396sFbRAEgYOP1H20L1nHMPfIDtv+WrxpzbgqruXhs7sxkgaBChU/pZa9uT:jesFbRAHrNxVzWuzbgwu6QigabwVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455384, "uuid": "4232207c-70b1-45a6-9843-2e2681259d31", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455384, "uuid": "13f4d5fd-22c3-47b6-9749-a074c138168e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455384, "uuid": "e74bc0fd-f990-4610-8e44-aca40e3fa13a", "value": "e2b9b0a78f4b10eb7a8e0852b252d874.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db36f92-4187-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636481072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636481072, "uuid": "e48d8383-dbaf-4611-b990-b56d2fb9a8ae", "comment": "Malware payload", "value": "7fe5a32c24019d0c8e4f0b55d594becf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636481072, "uuid": "9d491c82-f103-4d8f-b7e1-0bb6a5964a4a", "comment": "Malware payload", "value": "45e4f403d0b3b2fe544cb526ddb8b491dee0f06d9a9a0dd51e402723ebef074e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636481072, "uuid": "80e3a25e-11e6-412a-996d-161d8beba924", "comment": "Malware payload", "value": "b34023d452fe6a2f22eaabb74192542f8bca7dbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636481072, "uuid": "89b5e7b4-44c8-4a1a-aafd-78dda6fd0126", "comment": "Malware payload", "value": "178a08c4d275b0f8fd48e68d842096916ad2f8463a6a6e70e9f1823ead522a84bd0c2f01c80030a721af3001c5658eac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636481072, "uuid": "54cd57b7-40a5-4b1a-be23-b81dedb2ed5e", "value": "T10CB4D0D2CA808695DC2D5B3910736D244267BEA9BDB5A65DCE4CB4B03BB32D31073D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636481072, "uuid": "26a8d455-2193-4dd8-b181-558e952d0a43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636481072, "uuid": "ff0694e5-daf0-4c90-a009-b84039ef47fb", "value": "12288:vwtePv0l0VnkN0ONvp7RPrpoQBl9u3LB5O6:vw8PsyVkNdR7ZrpduPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636481072, "uuid": "62763de9-4bcf-4aa7-b007-5d1a9ea91a6b", "value": 515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636481072, "uuid": "b0a15737-f163-4bd9-9ce0-8b4360470d9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636481072, "uuid": "9836ba05-773b-4d1c-be3d-862a65edcd52", "value": "DUBAI A' JA UAE 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e74dfc-4179-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636475013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636475013, "uuid": "25d9ae37-3da3-4028-b581-b813de38e50c", "comment": "Malware payload (AgentTesla)", "value": "a25ff6f118f43b907552b347cddcd6a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636475013, "uuid": "df523c3b-fcba-4016-b834-7c952572d0ac", "comment": "Malware payload (AgentTesla)", "value": "484f6592d90c1da40b43355a3ca07b1114407f90ac7096981b597a2d07b9d770", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636475013, "uuid": "e0962982-d451-49af-ae44-6e998db75f4e", "comment": "Malware payload (AgentTesla)", "value": "0f9387c7ae0fd606fcf3858cd8e7bfd883486cfe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636475013, "uuid": "a4b68bd8-38f7-47e2-9096-feb95a10c233", "comment": "Malware payload (AgentTesla)", "value": "55cdd66e624e71ddad7931e81a0e6012576401b8b6f0d8e9acfae20055176de3f3271878c67ee2efaaab04dc2f0f2ef9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636475013, "uuid": "a6f82d88-ca64-4984-b886-6eee194e8c1f", "value": "T15DA4E0724257AEDAEF7B5FF8985135800DE93C639B7DC252EE8E00A221F7550CE609A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636475013, "uuid": "e979bf70-61f2-4ef2-b7d6-a28e1714878b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636475013, "uuid": "413c6926-bfe6-4855-8922-b8b64066928c", "value": "12288:nJ3qJFTPqN2Fho8E12WNSLb5ImliVTAtgHEBrK9:nJ3qU8oB3NSZImcVTAtge2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636475013, "uuid": "5ca2a781-a246-4dc8-8a3f-92be8a5c65d1", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636475013, "uuid": "c880757e-13f5-497a-98bf-78f73a2c7b30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636475013, "uuid": "cdc29a2f-8d36-497a-8f9d-ae4be959887e", "value": "og7XPB2MCgUdGBT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf71af4-415c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636462681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462681, "uuid": "0b94872a-d765-48cf-870c-366d64b93bb0", "comment": "Malware payload (Formbook)", "value": "3831bff8f7ffe05dd6b4d64cf66e1b51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462681, "uuid": "130d487c-cc19-4032-921e-87f1ee8eec55", "comment": "Malware payload (Formbook)", "value": "48a55e83acb8abefebde16291d2a029f1a5400de4e7706a6708e06ca48de9592", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462681, "uuid": "d72bd0b9-74db-4dc5-9125-3eb635cf4815", "comment": "Malware payload (Formbook)", "value": "c0cfb7d0a8cfe1246d76b9c096345986a2da01f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462681, "uuid": "be3f46ac-d59b-41ad-af01-6b733504a928", "comment": "Malware payload (Formbook)", "value": "bf82a3b9794bdaf6c5ab8f1d4c5328fb033a80932771454514128f1a4501ad8bad82f53d3b924f20cc424459b87fefef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462681, "uuid": "b0af7111-f4cc-4f2c-95fd-bf8b039291cd", "value": "T133C4BF52652457F2C4E18BBBBF63B37087748D861D1FCB2249A8F36C497AAE09E17443", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462681, "uuid": "85c75d61-ef78-49b4-96cb-20c3049fc2ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462681, "uuid": "402f720b-df22-492a-9aa4-32c3d1cda1ef", "value": "12288:28u2GoyEvgOGyV6fJy/mjgPDjyEjjxi8rO2c1I1:8oybDK6AvyExrYI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462681, "uuid": "cbde2e88-b2ee-46dc-a58d-eca6199c7c73", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462681, "uuid": "1010f808-7621-4166-bec5-10ca8ad279d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462681, "uuid": "205b42c8-2f8e-471f-8b75-91ca3c9da90a", "value": "3831bff8f7ffe05dd6b4d64cf66e1b51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bed0609-410d-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1636428671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636428671, "uuid": "d3f84760-7bf1-4345-8b17-25d8dfe0879f", "comment": "Malware payload (njrat)", "value": "1856b06c2392d0a5e7b73f4e98e3a840", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636428671, "uuid": "5be09fac-77a7-4a94-968d-488272595ad6", "comment": "Malware payload (njrat)", "value": "48cc6bd83e2933df14dafd0ed0e119215ed134fc57167b768c48202b54d4bb41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636428671, "uuid": "c332169a-a1bc-42d2-9880-0e652c462da9", "comment": "Malware payload (njrat)", "value": "23a8cf21174428413fac5fe98b02035b9a8d6857", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636428671, "uuid": "b043c920-82fe-4da6-b3c5-7dd6721bcd24", "comment": "Malware payload (njrat)", "value": "a0d0cb9929a055e75e038a41798ace699099ccda57e8186f283c9d346069d614685ad204a8a56cdc02b4800cc1b37c07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636428671, "uuid": "754f8312-3a97-4da9-8282-2bba9cc3ad81", "value": "T1FB06E78CB784E174D5FF8BF1B492B2890B71A017A906930FD9F154D98BB3AC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636428671, "uuid": "71148700-8e56-4732-b4bd-f357c176e84a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636428671, "uuid": "ad27c97d-90e8-43a0-b848-d71973efe2d5", "value": "24576:Rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrn:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636428671, "uuid": "64cf3f38-211f-48ce-a313-8f56d4e9589d", "value": 3830784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636428671, "uuid": "ceae439f-d647-4358-a7ac-62ce58bc518e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636428671, "uuid": "b6c09cc6-8908-400c-bd89-172da9c2de42", "value": "48CC6BD83E2933DF14DAFD0ED0E119215ED134FC57167.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e908f2-4106-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636425604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636425604, "uuid": "18c1c29f-dd00-4077-bd2c-3dc579456588", "comment": "Malware payload", "value": "083df4c0414836b87a1aef006d9aa1aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636425604, "uuid": "f9ec8eb6-0875-49b8-a7cf-1f57d1b55d5e", "comment": "Malware payload", "value": "492c7df1c42b6365efa93c345a1fb22aa3d756dd97873cfaa0f183aca2e17fa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636425604, "uuid": "574a869c-3570-488f-8ea1-8b70bc586c5f", "comment": "Malware payload", "value": "ca2fe542a8daa2a418fe57883adb0b58d4effa3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636425604, "uuid": "8b418f3d-cb1c-4294-a2c9-809185c21935", "comment": "Malware payload", "value": "5c7cb7af1c91615877a007424efedd0bd8d585675c17cbb8a2332012275b4821d74cb78993cffcc4f4a72064f2a3036e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636425604, "uuid": "955769be-0229-46f7-8bcb-6d8dbb57733d", "value": "T11274121DD3A4853FC637177FF8A3B2815434A246AB1BE77E8B8CD0192E2335665923E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636425604, "uuid": "e5973528-2abf-4a5e-8e95-555c46373ff7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636425604, "uuid": "9c23bdf5-40f0-4225-8213-124cf4d903e6", "value": "6144:INmcawPeMKMCZykNM7SKHxMu5mMdGEGYSt4ki2bP567vXkfe8FK9+CRc:SSwPePfZdiuKHxMutGjt4qP56DQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636425604, "uuid": "37432a21-00fd-44b4-847b-7355e34276da", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636425604, "uuid": "a63bc1db-ed88-4079-a3b1-4c2fd05f465a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636425604, "uuid": "a9649d69-25ad-4591-953a-aee73afe17fa", "value": "DN2104006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ace6a73-417d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636476665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636476665, "uuid": "f661cdae-733d-48ac-aff0-93b9614565e4", "comment": "Malware payload", "value": "b49ecb1f0f1f92f8f8a21c5a62712d77", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636476665, "uuid": "706fed94-7b75-4f13-9ab2-b820215b448c", "comment": "Malware payload", "value": "496ebf6d8edd9137dfd8473160a033973e7afaa33d486f8d8ea608150fa51ad1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636476665, "uuid": "f6143e05-848a-47c9-a5fb-4ca562310a22", "comment": "Malware payload", "value": "a74c48556c425155502365affdbe4b82bd02c917", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636476665, "uuid": "7de46435-ba19-46d2-a677-d7e52220bc2f", "comment": "Malware payload", "value": "0bc3947a2c9cc70e7a6c89f9afdb041a3ccf1149b99ac5f58232c0f227cb114665ad4a335cdcf4536310a157960398f7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636476665, "uuid": "f9936cc1-91a7-40ff-a1c1-70c1c7184e6b", "value": "T12C84BE5C74290C6BCC9F097CDAA38B0AE9A5353043B9CAE74F7190BA9E53362453D772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636476665, "uuid": "1b6aca66-8990-49d1-9279-b952f96800c4", "value": "f373734e315a77aaae1f530b29486e51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636476665, "uuid": "818c6edc-05f6-481d-b28b-ff5dbb0ca819", "value": "6144:FH7/go/M746PR18MmFBJso9VBipjiRuiQ2TlK9YFx6DkPmvS7Bg1I:FH7xk4HPewrdQ2JlTPr7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636476665, "uuid": "76afa0b6-14b1-4c03-8de2-ca19803e775d", "value": 402563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636476665, "uuid": "094e2303-747b-4348-bff3-681a2a1a637f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636476665, "uuid": "8ef3b3ad-8b75-4a90-b322-9422ff446599", "value": "zuroq1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206bc1f9-4152-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1636458152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458152, "uuid": "5d82c810-9d23-459e-ba51-3815cb387e2f", "comment": "Malware payload (AsyncRAT)", "value": "1e971248030bee61b0ff0cfb7e7207d1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458152, "uuid": "61839f86-e0ac-4b25-8c9a-816cf18edefa", "comment": "Malware payload (AsyncRAT)", "value": "49aad1a3a10c33af43c0e7e27587fb37abb72b052664c1701b59a2a65418ad39", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458152, "uuid": "af445b6e-76dc-4686-867b-f7cac81a5854", "comment": "Malware payload (AsyncRAT)", "value": "0e932194082a97a806b58febac7b7895ca2fb054", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458152, "uuid": "aa22322d-c818-4ea8-9314-bc43f15a6e2c", "comment": "Malware payload (AsyncRAT)", "value": "1ada06d0019b76d41ec950e18c53b9c0f47835000de23c5a991c8eec6482be1c9975b1432e5b02c1e4e90c531a8572e7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458152, "uuid": "c94ef7b2-6a4c-4e85-9619-b5578355ffab", "value": "T1DA34F22B77E5882AC9664572EC97A9404BB8B683B897E71D7BDC736C30973D204036CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458152, "uuid": "0dd74873-f384-4675-9a1e-872fb12eb31b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458152, "uuid": "fd106d68-32b1-4cd5-8ddf-7e2eb46f8522", "value": "6144:7/lMoY9SJMkMLGSKtLYV6JqXGadXBAiPMBEojC8:7q3SJTssYV6JqXCiiEcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636458152, "uuid": "8c4af145-a131-4e14-9481-34fdadef04ee", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636458152, "uuid": "e67b00a1-71d0-4870-a2a2-02bb753ac05b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458152, "uuid": "d97ce380-a0b5-4c21-917f-34206462ac6b", "value": "Confirmation Transfer Copy MT102-Ref No-01018.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d9e71c9-4194-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636486709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636486709, "uuid": "7d3b33ce-be2f-45fa-93bf-e30782e246af", "comment": "Malware payload", "value": "5d56d8df8e076a3f8210779624d94688", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636486709, "uuid": "623f85ab-b70e-402a-ab00-e3533cde686e", "comment": "Malware payload", "value": "50b382187f7eb9e5e8a046aa37a52311deed74ad19fe92dcea4afa3a3fe534a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636486709, "uuid": "d93cebe8-ae2f-49df-ae50-39b5e3f806f7", "comment": "Malware payload", "value": "dbfb017cfb63c8f913a8d869854b9ffebe774ab6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636486709, "uuid": "203cb030-109d-4cd9-8539-8fed3f631de7", "comment": "Malware payload", "value": "ad3e86901af51239ed59b9fce8851d5095dabb54156e00f69a89d7a09b69c6744be06070ecbb4e397f6be7f54abf6e1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636486709, "uuid": "56ca65ca-a0f8-4db5-a17d-63c97f321864", "value": "T12EA4F15067EC1B62F2BE5BF5A43951000BB6BC9FA422E72D1FD220DD1976F0586B2723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636486709, "uuid": "52612f1f-c400-44d2-8fe7-cbd298b2f413", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636486709, "uuid": "55626a9c-2d4b-4410-bbbc-1779be8f7a7c", "value": "6144:ETfDHmwei+s81fr7q+HmPcvCR/Eeay0saL4kGEf33ld/61jOjxrMD4q/rN+Txpsz:EjDGuwfr7qbPceseaRsrkPeOjyNw0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636486709, "uuid": "ab7ab405-b526-4990-8ef4-935e61c14b22", "value": 479744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636486709, "uuid": "976dec2d-abed-4374-b787-eedb9839764c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636486709, "uuid": "3f4a8a37-ff4d-4a9d-88ff-b246be695297", "value": "CCF09112021_0001.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d39406-414f-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636457168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457168, "uuid": "971f06c6-9468-425e-a35b-8294fd77b023", "comment": "Malware payload (RaccoonStealer)", "value": "e97fb7d37884d1ae62a9062fb11cf689", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457168, "uuid": "5a0c8b7b-1a3c-41ef-a0db-9567cf3da1de", "comment": "Malware payload (RaccoonStealer)", "value": "50edf4a2c95ef6c29c69ab2c3590b94420c0c86c591b3213b11a85afb46d872a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457168, "uuid": "e79e541b-f794-4342-a789-35950571a374", "comment": "Malware payload (RaccoonStealer)", "value": "bb21322677a0704b02407d4b4391ab70c834d9e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457168, "uuid": "06499e96-04bb-47b1-ab13-a66d899ea33c", "comment": "Malware payload (RaccoonStealer)", "value": "aaa8a106066c4341ab3849f9cf9904756e0487757e2eebdda60802227bad0737bd5adaba6428e8f8dfc706af091c53ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457168, "uuid": "c36c036d-5968-41d0-81dd-0a6f2721b3db", "value": "T1B6C4E110A7F0C034F5BB27F459BA8269B93E79E15B2490CF22D556EE5630AE0ED7031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457168, "uuid": "86212bf5-fb96-4e22-8b14-cd662d97ae60", "value": "61f5dd277d7d233f85b676d434ad016e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457168, "uuid": "578154c3-7fd9-4b94-a7e5-f3f1db2638b6", "value": "6144:y3RfjXhI3uHkCUjIxnBHgvEgsIntKfwuZn7xWuX8Z44/QXHPY7hTf9cwWwFptQSt:YhL7KUiGhwuZnFjA4CKHPY7hTd/QSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636457168, "uuid": "5e59aec8-f7ae-4177-8294-58be5cf521e4", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636457168, "uuid": "c45ca7aa-ec11-41d4-b91a-415a4bce38a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457168, "uuid": "d5cda69d-5654-4bbe-8898-72ab666f24da", "value": "e97fb7d37884d1ae62a9062fb11cf689.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54bf9ad5-414c-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1636455663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455663, "uuid": "63e49584-652c-45fb-a6b5-4eb10ad8187e", "comment": "Malware payload (NanoCore)", "value": "4356de017e9863e2a2e2bd07edc015af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455663, "uuid": "c2749ae7-dd33-4b50-8e81-b87df09fa9c6", "comment": "Malware payload (NanoCore)", "value": "52a10c487aa308a2b572c6fe4337e2fb734cb7ada3940b07a67165d6010ff6e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455663, "uuid": "371003e5-b97f-406f-a56b-c9bb03e64bca", "comment": "Malware payload (NanoCore)", "value": "4e1eed8789ad31f1f57f10d2fb4333d20f0d211c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455663, "uuid": "5200761a-fd39-430b-95e8-34d7bee61b9a", "comment": "Malware payload (NanoCore)", "value": "967f7af6013116d137ab934f1c022131c08b2ee3472cbe5bbce61e3f6f1950d433f8bc019df1c7bb7e33da270974c48f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455663, "uuid": "2ed52b43-57b5-44a4-a809-81b2a6d8c088", "value": "T122A4DF9C7650B49FC867CD7789A42D60EA60A0BB530BD34BA05752ADAD0E6DBCF011F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455663, "uuid": "63b1bdc9-a1e9-4a73-aab3-0f1f075c5b51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455663, "uuid": "3cd0c37a-f7dc-4ae9-a39f-ffaad5959348", "value": "12288:rr1WMPqMd0HcTqmfKQbAwmglvlcEBDso6e1xK1P5+Hl8t:dWMPSHcTxBAwmgtfDso6Yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455663, "uuid": "c8c7aa91-bf21-4f2a-ad53-b2b0e6d56bd6", "value": 468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455663, "uuid": "04a57c2e-d35b-46c5-830e-f3f823e401e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455663, "uuid": "e96b0ac7-b34b-4850-8927-e84cf14bcc3a", "value": "REVISED PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee364b9-4154-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636459009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459009, "uuid": "6fe58d6b-aac4-4e50-beee-01870a6c7731", "comment": "Malware payload (Formbook)", "value": "56fdd92b2f4bcc373074379d6070aa3f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459009, "uuid": "815a8f0c-60c2-44c8-bb30-af95870803f5", "comment": "Malware payload (Formbook)", "value": "5304827b10cccfa3cf46d2bf1631cebd74081a9c8fd520809ea2377c26685ad1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459009, "uuid": "8d28b0ae-1480-4987-b19b-97f996629eb8", "comment": "Malware payload (Formbook)", "value": "97d8e8160091685e1155d3b704bbf00c37034b55", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459009, "uuid": "84ad794f-6522-4638-b9de-45bd8d455fa6", "comment": "Malware payload (Formbook)", "value": "79deda22d26c093333a5e755b5f773b141068630d5b3c0cec2159b3ac5b04c8301b5163fb3b2614450c492871a558ad1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459009, "uuid": "d23634a8-7031-4be2-8871-45e5e5cd131e", "value": "T146642381C6547FEED65DD0072B4FACE08E4D1884000A6F7E2AD2D9B0EFAD2597FD158A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459009, "uuid": "f018d137-1f54-457f-8be9-34187957a69f", "value": "6144:4YlDHXLzJqA+veNsqY4y4j2xkSHiq09djbwGf3XrGCdEAZYokwk:4YlD3hqAF+4yu2xQqqj0G/bZ3Tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636459009, "uuid": "15dd357d-9f36-441e-9304-7289f7e1c723", "value": 336837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636459009, "uuid": "e52e3e48-5df3-4d07-9516-81ddd5ed0f77", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459009, "uuid": "260aa89a-129a-42ae-aa42-567a6172b53b", "value": "Orden de compra.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37065fc-4158-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636461057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461057, "uuid": "d09c9133-52b4-43aa-91c5-e316aa0b00d2", "comment": "Malware payload", "value": "e6782cccf7cf9d4b9bef4b5d2c03c2be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461057, "uuid": "a57e1c7a-c046-4150-9dc6-a249f91a3360", "comment": "Malware payload", "value": "53f67506e236e2d2a5f4cdbb6cd797526118226ec8d61acef17730a58b640a8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461057, "uuid": "b322be2f-309b-4152-88d1-2e37408a94e6", "comment": "Malware payload", "value": "0e9743ca1d8077170b485b86a536900ecaf8f23f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461057, "uuid": "6c0fbe87-d2d0-48cd-93f6-d4139fe91d7e", "comment": "Malware payload", "value": "bd81ea0519d4c3096981fe1bbae3c55ab1bfc11baa4d891057b15c43ab34cee5ff9d9a877788f26fabf192b595500694", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461057, "uuid": "40f88390-b7df-4a32-a814-65ae2dc64538", "value": "T17B942261E3A0661FCA38473F59A3624216719756A843FBAD07AAE0D83F7374258C1FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461057, "uuid": "30b5c745-79e4-4749-80fd-c6ab81cd0433", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461057, "uuid": "7bc3711a-5a52-4ecc-9d70-e656b86c3f5d", "value": "12288:2wLeP9QgInSkHL3rD/Rdg0Zg+Sjfz8+r:2waPLUrrD/Dxkj78+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636461057, "uuid": "9bc101d9-b931-43e0-aae7-f60d9938d7c8", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636461057, "uuid": "460e048f-288e-4a0c-ab8f-2295c5c006ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461057, "uuid": "6124e5ed-6443-47fb-8683-556ea6b29082", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3fc90c-414e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636456505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636456505, "uuid": "b86fd064-00b9-4b71-9f82-cfc856e88a2d", "comment": "Malware payload (AgentTesla)", "value": "06bd284696b2dbe2b1d90835ac981528", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636456505, "uuid": "ccac2b3b-a31f-4f4f-9a3c-0abfd705b1ee", "comment": "Malware payload (AgentTesla)", "value": "544fde99c42be3cd9e1614ed764a94b16baafae7763c716086275eb185e6fc24", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636456505, "uuid": "18ec55fa-4d50-471d-8d0a-d4f67f159c15", "comment": "Malware payload (AgentTesla)", "value": "97e4e5b90b36866645970bac0a30dd8620ae3b94", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636456505, "uuid": "1728016c-3046-42d6-8c3b-2dd715c3dae9", "comment": "Malware payload (AgentTesla)", "value": "eedb0f0fbc6bb954fde24b02285d6460963099b665760203625ae09aec9493fa11de96ff34a881edd145fa5d673519ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636456505, "uuid": "1229f1b0-4aa3-479d-adf3-50565a988919", "value": "T18894123AB359CC2FD9A35637C99B7600475C728265E6D72B6E88B3FDA4833D2050369C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636456505, "uuid": "7b55bd2c-63a0-47aa-82a4-cb91bb4647e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636456505, "uuid": "88cd3600-8ffd-4638-b054-f069e7f5d286", "value": "6144:u3Go+h1CsMkM6ipwccdXVoNnjK3qR/+Lxb6JCEzotzwv/JZSDza+AI5lh8pD/:IGo+h1CsTpRVoNnMqR7JMS6zvRlh8p/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636456505, "uuid": "72c8a842-01cb-4690-86e4-15c8fdd90b62", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636456505, "uuid": "d5167c1b-c0a7-4a81-b069-aee0a1dcb253", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636456505, "uuid": "2e144934-f2b1-45db-85ac-80cb5878c22e", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b40420c-4141-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636450950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450950, "uuid": "f6adfaa3-79d8-43bc-8287-563cfdb1df82", "comment": "Malware payload", "value": "079e0092519c1850d893e791d43c8bc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450950, "uuid": "a0cd2a56-0e13-4753-accb-c495b711a619", "comment": "Malware payload", "value": "546683418bf623e8aa6e801d67d049adcbd0b6c10242b236d8b6234d3384910d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450950, "uuid": "8eece644-1270-42d5-b20b-fe0b94643805", "comment": "Malware payload", "value": "1a453e3e6e8162948f3fed92eebf6b3a59817199", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450950, "uuid": "53bc37b2-adbc-457a-94ce-0713172fa8b4", "comment": "Malware payload", "value": "a70929fea4195d28540f513d64dd2ba1f7350adcd24f6ddbe32499edda74f5d73b582a53784f7f2696a70ecda8812ebe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450950, "uuid": "6025afef-a2c9-4161-b7ec-3b35ddabac9e", "value": "T11602E612A7E4523BEB3A0E35A8B3A21043B6F3125C53DBAD39D4056F2D2336095E3F65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450950, "uuid": "3c21f5a7-bf6f-4205-8242-69994bc0a6a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450950, "uuid": "de064892-4630-4439-bb42-6d8290059fa7", "value": "96:6IxsM5j4wAu7ZYeNGiWmiIGYWPgLcvgoFlEIVcqazRWGQ6DDjUzNt:nxsM5j4aZY4mIGTdgoFPlGHQgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636450950, "uuid": "e1c2eb2b-9c31-4fd6-a91c-70e48f99e6ea", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636450950, "uuid": "f7bffa58-c44a-40f9-9626-f57bd04a6ffd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450950, "uuid": "3ba47b04-be2c-4c0e-999a-c54d8903c486", "value": "Entry Slip for PARCO pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a108a1-4146-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636453354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453354, "uuid": "82517736-0a0a-4595-88fd-608d74db1ac0", "comment": "Malware payload (Formbook)", "value": "889c0fd34a871f2e96a2eae5048b52d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453354, "uuid": "a4d2ba62-0369-44fc-9dac-e2be57e87fd6", "comment": "Malware payload (Formbook)", "value": "54f6efb3754fad10e00ade1703d634fb5ace8a18bfdf14b897147c536d6a8f4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453354, "uuid": "918d7bf1-465f-4717-8071-83aef07de83a", "comment": "Malware payload (Formbook)", "value": "6251ea693ba31418a38e55d2b76e938022014cbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453354, "uuid": "80fe1b1c-3c35-4ccb-9779-695d531a8096", "comment": "Malware payload (Formbook)", "value": "3840737142249cbdc29552f2a941200c3b942be106a99f555eb04a5117ce20f6f0614de045e514758190d55350914dda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453354, "uuid": "24f23540-e0ef-46d5-8085-c28532763f15", "value": "T144B4BE056E9ED32EF002CE3E85DB46A3FB239C248731C953BA1ABE3957BC3445646647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453354, "uuid": "63cfc83f-c590-43ef-86a0-fe78935176a4", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453354, "uuid": "71d3e98b-3da6-4b2e-b885-fc35b7ee8733", "value": "6144:bbE/HUXms1DZ5Bo7iZm8oIf/XbbnB8keFpPAAKlIUIg2909U9zp1+aAhel1mNRQ9:bbfZwC8keFpPIILowzyhel4QcDZ/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636453354, "uuid": "475effcc-9710-486d-a190-4fea5955bf36", "value": 504304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636453354, "uuid": "66ade0d2-e11d-4db2-a78d-beab5a9d6334", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453354, "uuid": "6b96fb04-4e37-48cf-bce5-a768cc78db96", "value": "Quotes808.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5392f48c-40f2-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636417007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636417007, "uuid": "8cd45330-b361-44c0-a558-ef56091c4125", "comment": "Malware payload (Mirai)", "value": "3be229f828a9ea7dc3ddd06e9b2ee57a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636417007, "uuid": "c9a0d82a-280d-4ef1-ba67-7847f4c2d5c7", "comment": "Malware payload (Mirai)", "value": "555517021ea6f219c6bfc76fc4e4eaed66cfd9086c0934663ca34980186f8d3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636417007, "uuid": "284bc00e-6b07-44da-8445-08120e313ca0", "comment": "Malware payload (Mirai)", "value": "aa9e8a89768ce06b411eb44ce34fa8f24be1c30d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636417007, "uuid": "61a75038-35c7-4d2c-9192-ccde6f1e312a", "comment": "Malware payload (Mirai)", "value": "57e400bff49aec045a2c0fbeff2ab206886906f52668cb23ab5331c6c1fded2df1511fa8a4b1cfc4d8b4ec3c4ab221f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636417007, "uuid": "74536f11-19b8-4137-9c08-611a7f12fcf8", "value": "T170A32A2579392A16C0D1A47E21F78710F6E2679E26F8C54A7DB30E4FFF216006853AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636417007, "uuid": "1a8b9644-2d94-480d-b707-a99966f5e4ad", "value": "1536:erI5EhsGIUoqSktGR+7F7tAyW8/efMEXqJ5BYMg96voCwU3aT56t+tId9k:4fIUojnxFevouaN2jd9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636417007, "uuid": "7b7a26c7-83bd-4b52-9f6d-6bd03e9adb72", "value": 105816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636417007, "uuid": "739701ae-fc94-4718-bf65-6723e926f952", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636417007, "uuid": "fd8ca063-4039-43d9-a5e6-980b3bb0248b", "value": "3be229f828a9ea7dc3ddd06e9b2ee57a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77968bb0-4116-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636432529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636432529, "uuid": "de8a6f54-8531-4597-91d7-b4044e737377", "comment": "Malware payload (AgentTesla)", "value": "0c422a8099762735abeb38e4f27c17b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636432529, "uuid": "5f43b15f-fe77-49d2-8e12-176266ca7bf6", "comment": "Malware payload (AgentTesla)", "value": "5569cbff330c8e021470ca6c820f6064e95aacb6c169c154e605d890f214f0a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636432529, "uuid": "cdf110eb-1d70-4ea9-a594-4bf2124e930d", "comment": "Malware payload (AgentTesla)", "value": "0124aec57715ff3a69e94f880d01a24c47039fd2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636432529, "uuid": "511f8242-c39b-4d6a-b347-bc607c0101aa", "comment": "Malware payload (AgentTesla)", "value": "6d7d550e7dba2b4b6090bafd0ae67636b26e426a6ef282473bf35e55fd043e2fcec950f9320b81cf1947e22abed64ea6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636432529, "uuid": "61e8da5f-fc48-43f2-a9c4-d86318e1c400", "value": "T1109423630AA1562BDCAD4A7824A3220502B477D62857FBBDC79EC186BFB73D55480BC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636432529, "uuid": "d19c5675-641b-48a8-ae85-38fc69ef4d60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636432529, "uuid": "9f644a4c-15fe-4cfa-aac4-520489a0eb35", "value": "6144:WAD7wCeMKMzYgxZ0FP7JEgb/CnY0JNud5m+J6z+xyr7Y73USh5rfX6xtR9aj6+Wh:1wCePxDb/wPJNgloR/Yjrzc9vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636432529, "uuid": "2ca852eb-712a-4d52-b099-40cf5a8d080b", "value": 418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636432529, "uuid": "2ca437cd-08bb-4d08-a549-43a05020b31e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636432529, "uuid": "2130ec21-615d-4fac-985a-d7d9d3b80fd5", "value": "swift euro 13,761.00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1d64fc-4121-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636437125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636437125, "uuid": "6d2b33a7-9880-4643-8662-9da87b2b74cc", "comment": "Malware payload (AgentTesla)", "value": "a795bd5d971be78ced66a8e8422784af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636437125, "uuid": "769270a3-344d-4924-a384-ca012967362e", "comment": "Malware payload (AgentTesla)", "value": "558e27897c555778aa57de3a10a7040cfab04603ff0d7cb6981a7ed55950ab2f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636437125, "uuid": "39379866-ef7e-4f12-880d-b7d8774054ac", "comment": "Malware payload (AgentTesla)", "value": "6ecd5529b019a0659c251ab56c03d535b18387c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636437125, "uuid": "d0e023a2-62b2-404b-b106-82ce460b03ee", "comment": "Malware payload (AgentTesla)", "value": "3a97eebb2656fc14c0f7b6e18b217eb8a437d850405c069618030327a869b63e257be4c5cf58a1c120138dabb45bdaf3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636437125, "uuid": "a2fbbd06-364c-40a7-982b-1942c5984152", "value": "T1818423A2E7A4811FC89A09766C77758253B025CBF203FF6D5B6090847EB7362E891FD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636437125, "uuid": "f8a766c0-ae07-4ee5-a5d2-d73dce65bb9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636437125, "uuid": "c6d5e1ba-e45e-4dd4-8f30-6bbf42bb9fb5", "value": "12288:HwUePnN6XZfztmFunUTGwRSQYHbQM3zlDB:HwdPIJfxmFuU7Sb8K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636437125, "uuid": "916d0087-b33b-499d-81bf-d382d76d3b7e", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636437125, "uuid": "ef1c64df-a6d4-4510-ac62-6539917261b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636437125, "uuid": "471c8c3d-550c-4d35-9ca2-dcc58e4df6e3", "value": "Purchase order #00163042.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17697d32-41af-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1636498080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636498080, "uuid": "b3f4759a-f24f-4e9b-9e81-577eae5a3c6d", "comment": "Malware payload (SnakeKeylogger)", "value": "c8cfd53729a5d6f6c88e8a4ceecf74f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636498080, "uuid": "339cf6e2-2005-43c2-89c8-8ead6baf192f", "comment": "Malware payload (SnakeKeylogger)", "value": "56995d6dc788b2e9f904d551a85d7991c26b64dbb1d39a50770395387db963f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636498080, "uuid": "df33a054-fdcd-4e2d-9752-7c20db5f0d00", "comment": "Malware payload (SnakeKeylogger)", "value": "4975c69810a1ccffff8351013431f1bb3466ed05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636498080, "uuid": "4682befe-f9d0-4697-9627-dfecb39f2b76", "comment": "Malware payload (SnakeKeylogger)", "value": "1efae191fca0b5ec8c3fa67f18a961fdf0b561cdedf444417ff03869fdfe877428d8b93c1f375ebebb9d2d691a187344", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636498080, "uuid": "c5136e00-738c-4219-8d7a-da93d2fab988", "value": "T1C9D4EAD1F150C8DAED6B09F1BD2BA5302497BE9C94A4410C569EBB1B76F3342209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636498080, "uuid": "25d9eed6-3dfe-4a01-8004-906c99e4ad92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636498080, "uuid": "c4578485-7bd2-4514-80b4-66a60a8c58c1", "value": "6144:kX2KwreMKM7/8HKPOvOewZaWy4j5cGK3SA7JcgYr9o:cwreP6/8xvOBZaQaGBA7Jcgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636498080, "uuid": "f11039f8-b89f-4986-a26e-8b1924356eb3", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636498080, "uuid": "48083ab6-cfe0-4ae0-8179-417920830697", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636498080, "uuid": "8b0d7b3d-3c2c-47ca-b5a7-1fcaf8b8ec9b", "value": "Informasi transfer terlampir.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69af9250-415a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636461711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461711, "uuid": "17d5c906-dc07-4f9f-a4fa-33310faac657", "comment": "Malware payload (RedLineStealer)", "value": "b8c1275e5ce29f67e85bf29ab4994d42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461711, "uuid": "b757201b-604b-4c1a-95bb-561e5ff3d088", "comment": "Malware payload (RedLineStealer)", "value": "57127e39e8381f5008ef721023300501ff39b9018907a46a34b7e40d317d8f85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461711, "uuid": "3576ee42-7f16-4a63-8f6b-def26811b9ed", "comment": "Malware payload (RedLineStealer)", "value": "533fa4d9974db22524b56335d0a2aee0f8a929e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461711, "uuid": "ca2c6471-1bdb-46bb-ab8b-7212d2c37ded", "comment": "Malware payload (RedLineStealer)", "value": "95817b3825bc94ae39704978b7ae97d4eb194c2190aa33b9af08b799449b42925e280eeabba3f14a9f579de24de2d6f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461711, "uuid": "d7cd1806-e2ba-4085-84b3-30541156e663", "value": "T13474BB232EBCFA18C0D93E3383DB7D1257FA5FD15B3289861B489A116624941ED2773B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461711, "uuid": "39b4e725-2b3f-4ea5-bb6f-42d68f2f8a96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461711, "uuid": "9431ce71-4c96-445c-ad0b-34649572d2da", "value": "6144:QcX3i03ncdsfXP+Mx259N/zDsTxJs1h9NOgkZGolzjdWy:Qs3Wdsngb//47mAgkZGolzjdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636461711, "uuid": "58cdb510-516b-4c78-8fc5-ddc9eb9ba072", "value": 367512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636461711, "uuid": "117267ec-7878-49fe-a413-53f5432db090", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461711, "uuid": "6bb9a1fc-5783-4935-bb00-7c78f73b1b8c", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23ee07f-4142-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636451632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451632, "uuid": "405ef7bf-1483-4818-965f-1a8e226e4e65", "comment": "Malware payload (Formbook)", "value": "d9f2ecffe72fc450d4286ba7d78a56cb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451632, "uuid": "725b1961-8e91-4769-a3c1-2259f797ee36", "comment": "Malware payload (Formbook)", "value": "580fbb995ccbdb6810dbbc1ccd811b8865cd56a2c5ba77be3381834b17557c1d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451632, "uuid": "16ef7692-272a-41a7-bcff-0ec0fbd7cf4e", "comment": "Malware payload (Formbook)", "value": "8d4c76963c906fa44bde239505b1faee5fd58ccd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451632, "uuid": "2e87bde7-9ac9-43d2-b2ad-59c9835dbe29", "comment": "Malware payload (Formbook)", "value": "f0f7beb358a0c42e56bfc4919f76a51fe5efac907b6576fff47e9e1448d7502d95b0905de2f5045bfccb798478054741", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451632, "uuid": "a08f560d-dcb4-4ad8-b4a6-46f90a8b8867", "value": "T1C39423DB6E1FA3748945A4F2E3908B5E26139524FF230F8E659D642FED970C0A344B38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451632, "uuid": "6f89b141-ca7c-43fa-bf84-a5e9555763ce", "value": "12288:gdJeFAQx9skPvzVACltetZJIHZ9ho7uOrCGseLets:greF3bfetZJWZ9IfeGpeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636451632, "uuid": "92878fb6-568d-4150-b1e9-619c890ca35b", "value": 438090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636451632, "uuid": "5e4ea587-1ad1-4449-a3ef-1524e9e42994", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451632, "uuid": "4b78a713-6f62-487a-b739-2459f35c91ec", "value": "PICTURE DEAWING DESIGN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af2ee78-4157-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636460425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460425, "uuid": "40f0f733-7c5f-465d-8ade-119350a6d1bc", "comment": "Malware payload (Formbook)", "value": "5336c524e14753aeacf55d47d243a5c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460425, "uuid": "48155d63-85bd-490b-85c9-f77e857d3f09", "comment": "Malware payload (Formbook)", "value": "58de41e1c48a304c1f7f289fe5c8976d82b8968aae89497adf7c60cda25deaaf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460425, "uuid": "e07b0aee-7551-4fb7-9ce0-59c7bc52e2c7", "comment": "Malware payload (Formbook)", "value": "57dd79737e08b2669fec5926fb6d283e36fccee3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460425, "uuid": "a3aa9408-f37c-4cb8-bcc4-15a22b47e7b3", "comment": "Malware payload (Formbook)", "value": "78ee9d18d0bb6683a835ab881914faba9781c038705d239031168a80889035a7822e57fe7400ec31681ac216e9fd1235", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636460425, "uuid": "84b6d8fb-1e49-4868-a3fb-1354007d0300", "value": "T19064122173B4E4AEE0F216B6153A7A7B8EFDA025A0756B9707403E69B962440CD0F3B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636460425, "uuid": "4ca99f90-7808-4ef6-ac9d-10ca035dd837", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636460425, "uuid": "2492d1aa-1d2b-4996-99be-9753917edc24", "value": "6144:mbE/HUbSRS5yHZIHRAFP9+yETiVl4e9hwuIfLNEWNLRlRf:mb/iXsWt9+yFV9auOVfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636460425, "uuid": "e6166084-08c7-48c0-a600-1bb63e70a1eb", "value": 318859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636460425, "uuid": "b46f17ee-4827-421d-91af-279a46361586", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636460425, "uuid": "e5149791-9507-4d4d-b240-ca1cc3c1300d", "value": "5336c524e14753aeacf55d47d243a5c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe8ca8f-40fe-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636422362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636422362, "uuid": "7249ba3c-8aa2-4846-b567-40bff1f02789", "comment": "Malware payload (RedLineStealer)", "value": "9e9886aa3cd9f656c0d8078808aaa5f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636422362, "uuid": "2dd8c4dc-6a1e-442b-974e-1fa90d90fda6", "comment": "Malware payload (RedLineStealer)", "value": "59b9bb991a243cb4eba9584cde55d56e470d72e3f7aa191241b6271a6d61e35a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636422362, "uuid": "1c0c4fca-8a7e-40f8-b958-393c796d40fa", "comment": "Malware payload (RedLineStealer)", "value": "06d8a404cdaff4922c639873937e162fd2a96672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636422362, "uuid": "fc3d70e9-d467-4f4d-aa19-e6591177fbc4", "comment": "Malware payload (RedLineStealer)", "value": "d661a8f9962f0883986c5e20029befdceaed4ca4f36d71fcdfbbfa1e723d13f0c8996ca9d6da3c32f383cdf4f0ef4faf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636422362, "uuid": "3d5bb31f-596b-4d22-b6b8-152ed0b8e3d5", "value": "T12084D0316AABD838E5A31E304831D6E54A3BB9115570510AF35067BE2EB3F9C99F331E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636422362, "uuid": "c92653ba-7600-4bce-a6c7-fef6c7933c04", "value": "60ab4a93298436a0ea920c16b7e59caa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636422362, "uuid": "fb57e95c-746f-48b2-8a9d-35bca1f6131f", "value": "6144:L20VTBgjdc3qLX7LdIR8479CWEbOKDtuEuzbgwu6QigabwVf:a0VTBPaLX72gJOK9unn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636422362, "uuid": "3c7d6775-4785-4775-b545-f8b9c1b438b3", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636422362, "uuid": "be24fff5-5f14-4eaa-8145-a2bbec4226b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636422362, "uuid": "2e37bc36-d4dd-401a-b45f-a315deaab562", "value": "9e9886aa3cd9f656c0d8078808aaa5f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4e46cf-4169-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1636468291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468291, "uuid": "dd00d480-51f7-4689-8640-f7088ab9678d", "comment": "Malware payload (Loki)", "value": "d28302f7ec7c6bd6e39c9f51a0d504be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468291, "uuid": "3679aba9-6d8c-40f7-9d67-520aa3e02ac6", "comment": "Malware payload (Loki)", "value": "59f2170c893c04bcc42a697a8dff0c11466df6822ea3de885b02b3075df9bfc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468291, "uuid": "c59748e0-cec8-4be0-8da5-7af4a955fd34", "comment": "Malware payload (Loki)", "value": "c747e5b7ed3738b1d1b7fa6690e6c2661da094d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468291, "uuid": "7a70331b-1631-4e92-bb9f-6f53f619dd07", "comment": "Malware payload (Loki)", "value": "1bfbf17cbd5735fded00f91285605e35a310b4bf8a1c6cfa85c0d97f22ff60b83bf73844462a594c5d57ca929e63ea2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468291, "uuid": "043dc1dd-96b0-4336-b0ef-f82f31ee86aa", "value": "T1805412B2D358443FCDA30B7A18B3F64049B121CA7197DBAE0B8CE4666E673E251907C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468291, "uuid": "2569743b-202d-43ab-9bed-892171dae69c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468291, "uuid": "6b97106e-d1bb-46d0-b105-4fa52e53d542", "value": "6144:vR17wNeMKMJEej0bMu7z68NeVz+lIU466n4IHyHzLmZjvgGrr:7wNePKEfb7X68cVzNRn4I+LejYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636468291, "uuid": "06cfac3c-e369-408d-80ba-ff0d4c839c5c", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636468291, "uuid": "26c0d9bc-cb20-49a4-a034-816dac6fcf6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468291, "uuid": "e8356bc3-e499-41d8-b8e7-938c1e1da9f1", "value": "PERMINTAAN UNTUK TAWARAN 09-11-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca281059-416a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1636468745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468745, "uuid": "62c33632-d2fc-428f-a512-251a66203da8", "comment": "Malware payload (Dridex)", "value": "e3b213f2470d2d56bba276efb815ac94", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468745, "uuid": "a1e0d1e4-08a2-48db-8f69-7605dd5d2bf9", "comment": "Malware payload (Dridex)", "value": "5a57cfde14f90fc9402104b82803b9ac6378c3e29a962ae3175a45fc75226782", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468745, "uuid": "2e1ac9c1-6f29-4a21-9d04-ae20437c870f", "comment": "Malware payload (Dridex)", "value": "7399d621e70ec81d0d2a12cf4681ac8036cb624e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468745, "uuid": "3c40d4cd-2c6f-4fa3-bd7b-e5650f185290", "comment": "Malware payload (Dridex)", "value": "5eeae2a17ebfddd4634ae69025d38da0e98cc7af07571f99f9384a10e77e4d9fc2fc7d10eb0eb1cb6c14290bdb53f0cd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468745, "uuid": "095e8194-2699-40d6-afd3-135627267ace", "value": "T12A53F1EDE0A8B090CA3DADBDA08E6D72A85E6046E1D5912F1C4DBF64067235F1F0F539", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468745, "uuid": "2102578a-aba8-47a9-b0cd-fb2fd8cc3c30", "value": "1536:8CWpPFwJpvc1e+BwT8YIbDMz+1d6xsW56eX/EYYbqRpbK:83GMrbDu+1d6xsTevEY2qRpbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636468745, "uuid": "aa639d8e-2cfe-414f-a68e-c98049d44497", "value": 66030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636468745, "uuid": "9f5c80d0-2450-491a-bcfe-10cfeddcd89e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468745, "uuid": "bee23b9c-e4ff-469e-b402-30fbf4b74f01", "value": "Order_29985.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b05a91-4123-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636437943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636437943, "uuid": "9a3ad852-1b24-480f-ac72-d5272fcceeec", "comment": "Malware payload (RaccoonStealer)", "value": "47175281fc3b878d17e9916f3665d637", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636437943, "uuid": "5b54c55a-657f-46b7-be2b-9c8caeab7ba8", "comment": "Malware payload (RaccoonStealer)", "value": "5bef66e78bc9dde4afd1e97c60615aa35ffe17e2f619b69f152153cb858bd769", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636437943, "uuid": "9b61cf73-92a8-4f41-a5c5-1bf3a66e2b69", "comment": "Malware payload (RaccoonStealer)", "value": "9d3919e9561ee7cffe9422809b010df533533bcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636437943, "uuid": "c0118974-a45e-4723-ab40-ace7f36ea9b4", "comment": "Malware payload (RaccoonStealer)", "value": "d611ed166d2792d947c07690353e86af687e8a7c93f6b729161d10ee442635732831d1c3eaad2334bfcd10007c6ff70c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636437943, "uuid": "d81fac77-7461-494c-b619-9eded15644b8", "value": "T19AB4F1B0FAADC874E1A31E303864D6A10A37F8525970510AF7545B9E1F73F8C86E672E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636437943, "uuid": "64390413-0d60-4bfb-9fd2-d682f989e057", "value": "c8725b7ab8753c936cc4c98a181b2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636437943, "uuid": "d4576902-f4b9-42af-9870-dedf794c7aef", "value": "12288:2AS2WgMctiN6leWstfMqR9yaAUYs4pIMunn5:k2JO6KuqRqLcv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636437943, "uuid": "99d3c579-fc94-46bb-baeb-2810339ec00a", "value": 515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636437943, "uuid": "967c4dca-2038-45a3-a925-5a49505b5c53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636437943, "uuid": "639e9e1f-1a0f-4016-825f-e4dbe23abc3c", "value": "47175281fc3b878d17e9916f3665d637.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f056e328-4152-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636458501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458501, "uuid": "de6c854f-8b2b-4857-878c-44bfd981e5a0", "comment": "Malware payload (AgentTesla)", "value": "f1fe7d71f82c6940df397e33682c7984", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458501, "uuid": "69950770-13ed-4f47-b30d-d5a744157312", "comment": "Malware payload (AgentTesla)", "value": "5bf15729a60943cba75324e46b37a87f78eb023d8d1c8c2ede3701fa6051a225", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458501, "uuid": "21aad0c3-ecb3-4cf4-a7e7-44e124459916", "comment": "Malware payload (AgentTesla)", "value": "d33d901a577113cd859a6911eabe69647d7349cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458501, "uuid": "fda28955-e05d-4edf-a095-d3d6b9278649", "comment": "Malware payload (AgentTesla)", "value": "5d2890b29185ca34e0db96d8f0287cdb202443d4cd091ad0929ba638b854bbef222031744a4eed92f2e35566faeda0eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458501, "uuid": "5f2bf83f-d352-46b8-a58f-927320c567de", "value": "T1BD036C604B5D4632CE2ACB37E4B2424067785707B45BEF7E3AC6B08D5CC335763A16AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458501, "uuid": "a86bf2c2-ea86-4719-8953-9e395f7fe8a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458501, "uuid": "6c2ca260-2d4f-4a8d-b17b-fe19c1304513", "value": "768:3DxKokJS/SpxUoihmeK2wN5hK4UKBN2M2Z6jZPu35h8:zxDcSsCh10a46MccZPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636458501, "uuid": "4bde0ad1-c029-4f97-9915-ae3c59b499ef", "value": 39352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636458501, "uuid": "1ee863d9-9e27-4f2d-9f8b-307891eae8f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458501, "uuid": "29f4ef9f-653a-4eed-b516-d43982e9a92d", "value": "24,000.00.PAYMENT.COPY.PDF.Gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1014ff-41b6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636501365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501365, "uuid": "d65eabad-61f1-4618-841b-2e896ed41ed5", "comment": "Malware payload", "value": "12bd46f3cc0e1d8d6d6efbfc4396ee80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501365, "uuid": "2b70e9c2-3e8c-48a4-b09f-a2eeb5ae89ed", "comment": "Malware payload", "value": "5e25b453ec6eef14d6a88aaca2f1e33b6c18ee2ee662d7e154274b52147b4bc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501365, "uuid": "1d352e14-9269-47c6-a910-c96464b55b85", "comment": "Malware payload", "value": "7804d932c553d127d9529bc65d908411eb00623b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501365, "uuid": "80878c9f-d836-481b-a3f2-6a35860cbd82", "comment": "Malware payload", "value": "9101438b434a14598e5a4a44a115dfa4d8396478e02f4a40ce5dc35ebd47637f39339f4dd4cc476cd0ae61ad2d0a15c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636501365, "uuid": "fe408fbf-8cc2-4cb9-a4d9-189ecdef3d35", "value": "T10CB5230537914E12DE6F01312DE372B6C672BC466F06421F3688756E6EB3F904D62B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636501365, "uuid": "9943ee98-adb1-4d11-870b-54a2eabcb27c", "value": "6e98cc039d1deda318d20745eb3114e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636501365, "uuid": "d339036c-fceb-407e-8876-7eed61c85a6a", "value": "49152:IUIQ6zIlro0YbopVwbXE+CPALfLwBtn+/I9yBFeYFOKGBfmP/SA8Nj:evE+XEBOfLkt+/uE1gfmP/SA8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636501365, "uuid": "bc9deece-cd36-4da9-ac1a-8555a048616d", "value": 2461696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636501365, "uuid": "5e16e962-57a8-47df-a462-6a1b1a2f2e35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636501365, "uuid": "6ed57823-ef7c-4123-8935-2030aceafd52", "value": "5e25b453ec6eef14d6a88aaca2f1e33b6c18ee2ee662d7e154274b52147b4bc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020826c8-415d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636462826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462826, "uuid": "8a2f9554-30c2-4884-97b9-f73e2b36c8c3", "comment": "Malware payload (AgentTesla)", "value": "17df9e9a9ec586a56948560d7612aad6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462826, "uuid": "1f96039d-b5bf-4b0f-804b-61f18796c137", "comment": "Malware payload (AgentTesla)", "value": "5e510053221aa12350a36ec2bbb324769f9aab5770ad087f998c9bfb88aedc1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462826, "uuid": "3ee62b2a-0028-4cd8-a987-58015b04a6b5", "comment": "Malware payload (AgentTesla)", "value": "20dae0f4489f2c0a9ba1be115ae05aff248281a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462826, "uuid": "334f989c-a52b-4419-b113-c6761afaaff2", "comment": "Malware payload (AgentTesla)", "value": "ab3d96076ebd42c5c7f03364faa8b88e80f904394794a09040e93cf92d268951d86be0384de29e9042460e678ca716d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462826, "uuid": "9ec4d28a-8807-4b65-a207-832e6c153818", "value": "T193A4E0774117AEDAEF775FF9980035800EE67873AB7DC255EE8E01A222F6950CE20D91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462826, "uuid": "ad5d5381-15fa-41b5-816e-595dca250609", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462826, "uuid": "94b49819-e9a5-4115-97af-e73feb594428", "value": "12288:SGCqJFTPIW89BxCK6lRHVpHYGw2R4YKyffqXOfg/I:SGCqGLxyfJZrf4Ofg/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462826, "uuid": "1bc17af7-9f17-4956-b513-dc04a32cff8a", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462826, "uuid": "f5653b7a-6270-413d-80e4-c3d143e05b9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462826, "uuid": "9404eb96-722f-44c7-b74a-efdd69ade94c", "value": "swicthable project blue prints smrtdoc09001 WOB 08112021,NEW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eafc8fc8-4168-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1636467941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467941, "uuid": "0c94ae39-b8c5-4eb4-8e6c-66a05b537017", "comment": "Malware payload (NanoCore)", "value": "77135502b21338825a1fa7a9ed2d7297", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467941, "uuid": "03763aed-b423-400a-b3db-5fc3ba83148c", "comment": "Malware payload (NanoCore)", "value": "5e56b94e3be34affd39e1807de617daaaff2bf6844e49275e98d9b3b6b5216d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467941, "uuid": "59a22b1e-0a84-4f58-b111-7782db10f45e", "comment": "Malware payload (NanoCore)", "value": "29bd61080f60e8715985758e53bf981ea54aeb56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467941, "uuid": "5af37f7a-4cd3-4295-bcf5-47b914961a7d", "comment": "Malware payload (NanoCore)", "value": "bbfeb8950e515f3ddfd025eb608795d9658ad9cb6951b71afbbc77f366506ca01e308e4fd3a04ce007d131834ad2e94f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467941, "uuid": "ef61e9a8-b52b-42fa-affc-02f7c7e19376", "value": "T1478423659318197BCFA11B7A64737B000271A28BBA4EFB7E17EEC0916E633A1CC15F54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467941, "uuid": "94ce29c6-a232-4374-b9a9-9a94ab67d2a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467941, "uuid": "e6b0c682-2622-42de-bad0-8899d8034229", "value": "6144:1MWEwLM0MkgATQgDQ26BSmoRUINq65OC1hVJOpDDHKIOFHyvzVRQZ2:SwLZFDkkQ26BCnM6cCdJOhrOFCRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636467941, "uuid": "e3f1952f-b289-4f3b-ae2b-9d0a24d1d8fe", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636467941, "uuid": "477bc6da-3dc5-46cc-b443-518fbff6964c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467941, "uuid": "5502d251-5c4d-48e2-b5bc-4f4e7c140226", "value": "Payment invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27880b73-4100-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636422946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636422946, "uuid": "8a96d63a-a896-4026-acaf-9d51bbf6cc7b", "comment": "Malware payload (RedLineStealer)", "value": "afcc4b04e2eab31521da31eacb1e937f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636422946, "uuid": "52a70bd7-e798-4717-adde-1d0fbf33b36e", "comment": "Malware payload (RedLineStealer)", "value": "5f963d03d89af1f8884fdabc754589aa619cfe95bde8671601ab632bcc6aaa69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636422946, "uuid": "2718b697-4177-4c8a-b12a-924d00e4d217", "comment": "Malware payload (RedLineStealer)", "value": "d4dd2a135ee2a7da8ad255198dc2abf8ec1f15fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636422946, "uuid": "f21938b5-53c3-4e8a-90df-a2e0cf4b3c5a", "comment": "Malware payload (RedLineStealer)", "value": "6f0634668e5bcd41a692d459d9509a9fd1699e22ecec431a470370520b15ef0bea7a4c2fc575a83afad85fed48929752", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636422946, "uuid": "259a6eaf-b659-47ab-b049-c6a0f0b72733", "value": "T1A7348D3076ECCB31E0E31D3048ADB6A50A3BF8A15960514BE654679F1FB3B9C86E135E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636422946, "uuid": "752d048a-64d2-472e-8aba-598b52c4435c", "value": "c8725b7ab8753c936cc4c98a181b2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636422946, "uuid": "45d9828e-c30c-4e84-9595-6f59d02e336e", "value": "6144:xesFbRAKSPOzBU8+CVohuzbgwu6QigabwVf:YsAKGaU8+CKunn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636422946, "uuid": "ad35bc07-618c-4a58-af6e-7eef7f2dd49d", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636422946, "uuid": "6191ce49-b7f7-4896-9032-ae9be42c814f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636422946, "uuid": "07406be6-08d0-4a18-b65a-ab2ee6f2e737", "value": "afcc4b04e2eab31521da31eacb1e937f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe3c606-40fa-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636420329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420329, "uuid": "a66be90b-e7ca-4488-8726-7fc73cea7599", "comment": "Malware payload", "value": "7ad20914b12a067cc22e96a3be06f67f", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420329, "uuid": "52fb03b7-6268-4333-bca9-8021fa58bb56", "comment": "Malware payload", "value": "5fcc9f3b514b853e8e9077ed4940538aba7b3044edbba28ca92ed37199292058", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420329, "uuid": "412f9dfd-d896-4388-a967-8bb6e5136142", "comment": "Malware payload", "value": "e5529e48e82636357fecc23802f86927a2af114e", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420329, "uuid": "789bfd1e-316f-4177-a5b7-148a0d327fab", "comment": "Malware payload", "value": "13cc2d6093ec8e5d81902ed04866c985fe4cbc136d001b4c69c0b677671568a5244f8182f1d0aeeb3d535b1e81d7a85d", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420329, "uuid": "1922f13f-adb3-4c6e-a278-939a5dcfda33", "value": "T1C5B37B22B4C1C472C5B729324974DA605A7CF9700F659FAF6398127A4F641C0AB3BEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420329, "uuid": "5f005545-db0d-40c3-86f9-1d93ed42d3ad", "value": "b12e1c40a1bb3ecde19201b32f996256", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420329, "uuid": "bdef5b35-5979-40d9-9507-2e1ab8d97c22", "value": "3072:/hV2O+xstLmt+uyNaC5gTqXO8EifGACkq6r7VjBZ3:pVvSsBDUifbr5/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636420329, "uuid": "1aa7c396-e54f-42ed-b037-9980e0543060", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636420329, "uuid": "007b642d-6e11-403f-baab-4af714b8c790", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420329, "uuid": "05a9f810-21c8-4452-92a6-0b99038662de", "value": "5fcc9f3b514b853e8e9077ed4940538aba7b3044edbba28ca92ed37199292058.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef38ef33-414b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636455493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455493, "uuid": "1c3e9894-abb1-4bc6-a6f2-9ac18cd55ab9", "comment": "Malware payload (Formbook)", "value": "9a17f177e499d2a6ca20085ce981d862", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455493, "uuid": "86ac8d15-7a37-4f40-ace9-c5ae050755d8", "comment": "Malware payload (Formbook)", "value": "60261a3b0d0f1d5d89d3cb663cc9b296e9b99c8b5de1309d64c6611ef1a7dc8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455493, "uuid": "a2933dc3-cf6f-4735-8b79-388ec0329a61", "comment": "Malware payload (Formbook)", "value": "e9d4bf19af3303522ad2fb11847092e22850ba87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455493, "uuid": "7860f2ae-6a81-4b33-be59-90612b4f3695", "comment": "Malware payload (Formbook)", "value": "330d1604f0648026475e4c4452249f51083acfaf48e393537c9640543b1c894cd75d27afad672606c8c608b8d2589acf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455493, "uuid": "04ce23da-fa36-40b9-b067-2296d1cdc57a", "value": "T17E6413D62BC049FBC9C1147131B2BA9EF7AC4A5A4242D6475FE20E377B2934BE325187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455493, "uuid": "08c4a5d1-829f-405f-b5d1-f031bbd4b602", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455493, "uuid": "c9439843-e64f-4152-97a4-fd056777886a", "value": "6144:F8LxBsxxuIniSzDwtBQA3IC18tHlb7TBDh+RGVPZWUU/Lhir57:/bFtwtBQP4cDB9+tUUThkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455493, "uuid": "c6477749-7bc6-49c0-aacd-0d31d34c1caa", "value": 317349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455493, "uuid": "81884de4-038e-4318-aca5-119fd0e224e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455493, "uuid": "b5f41f94-136a-40d8-8049-1b6553bed495", "value": "TF -11082148.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c58873-414b-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1636455470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455470, "uuid": "7089908e-990b-47fd-9844-6539973ea0d4", "comment": "Malware payload (NanoCore)", "value": "856d6e9c4b97b5dfccb57aa023d0d845", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455470, "uuid": "b5d1963e-6615-4d0d-b7b2-2e51390fddea", "comment": "Malware payload (NanoCore)", "value": "604287f77fbdd4d607fd7ef722a07a80864aeb255279bde7fce0da23f726f0d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455470, "uuid": "a3d0855b-dba4-4ead-889f-953fc11b0b4c", "comment": "Malware payload (NanoCore)", "value": "f5bf296e5e06ef668b3c2ce7c99ab7736160e594", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455470, "uuid": "30844d32-092e-4998-a30d-a1ceed6d6928", "comment": "Malware payload (NanoCore)", "value": "9057196e2034b906319c77460b40ea8d4b773d0c92777b69c49ce8753050c19517246b02c451e0cdbe8a3d5edf37dc09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455470, "uuid": "f22df16d-87e3-4af8-8d12-a05dc7e9ca4a", "value": "T1CEC4CF91E285C9E7E9F911B1CC5B9C1021A96D7ED0F0560E619F7229B5B339320EBE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455470, "uuid": "a6e0e054-92a8-4d29-9dd8-6e05abab8d7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455470, "uuid": "d71cb062-3312-4c8a-baf7-0b7ed9614910", "value": "12288:LwlePfzbMWOWBqubwhlvrVBe+fHMmhoHwniiVj6Ks:LwEPvMQ4+w3rVo+fZAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455470, "uuid": "6647348b-da18-4b4d-8bfa-cbdd59ce89db", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455470, "uuid": "7b244516-6cd5-49b2-8988-715ec215f34d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455470, "uuid": "19530d54-0c6e-406b-aa69-c9adfd644d57", "value": "0X-498746467849-0498765456784.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086f31c0-4172-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1636471856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636471856, "uuid": "7104edf1-cb7c-45eb-93e7-390528370f4a", "comment": "Malware payload (AZORult)", "value": "a2e262f38eac13a05353920efd6a42c0", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636471856, "uuid": "e9b12243-880e-47fe-9df1-8407f21af70d", "comment": "Malware payload (AZORult)", "value": "60c9fd4cffd93f3e75059ea4147569d0035927c1d3a347fd6cad3077fa873464", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636471856, "uuid": "5367aa21-bdff-4c3f-b1cc-9d71f1a3c26d", "comment": "Malware payload (AZORult)", "value": "625f5e4c86574f5e9facc88a4829fe77591c4497", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636471856, "uuid": "f3277f6c-6a1b-45ce-9768-3633647af131", "comment": "Malware payload (AZORult)", "value": "4316eacac99e7719cea53d71093d2f8904af3593c993d6b92f425b10d1492dabe475589fa531e43f46e5206e9f9be0e5", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636471856, "uuid": "d8d69b46-fec3-46d0-bb82-e94778c335c4", "value": "T145D28D244B994623CC3D0733B9A119409778ABC37443DB1FA99E61CD8EE33250AE65FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636471856, "uuid": "24ae06f4-9284-4b79-ba52-e09cba907fb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636471856, "uuid": "b7cccee5-2769-446b-a53b-15f6a03b442c", "value": "384:s4IzpdjKL2xrH6237tFCyHv25D51iK4K8/8jzw6prwIIO9I+RZFee0v1yi7SaXiM:Yzpx3dHveWK/ltIOC+IyVrMc+94q9h8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636471856, "uuid": "04ac08a8-30ed-4fc0-a54e-5a61ab04fb76", "value": 29112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636471856, "uuid": "bfb2ccc0-6384-48fc-b6dc-05799c2a42f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636471856, "uuid": "afbbf7a9-7eff-4a1f-b363-942cd5218e8a", "value": "bin odogwu2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19cf765-4158-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636461080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461080, "uuid": "76d3645e-c8c7-419b-baca-b83173ebe6fc", "comment": "Malware payload", "value": "1b46553b0eddc10b8dd962e3d2d060c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461080, "uuid": "8fdcc3be-355c-4e85-a889-8c2cab4e60a0", "comment": "Malware payload", "value": "60da6c2f0f43cce70ed009a733d560e61812ae324051c560bdd1f9000106b3f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461080, "uuid": "40f4a88d-14d1-4279-8fcc-f7e338154fdf", "comment": "Malware payload", "value": "c7a7f03b4290755bddc8ab5e3cfd5cbcf9c90d5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461080, "uuid": "6f8f953b-023b-43ba-ab5b-eb118e1c0769", "comment": "Malware payload", "value": "bb33e17bd59403849b328953a0bc8017f6b7592cda55d7bd5f13492310358d641ec66cdbc938525893216511da662b10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461080, "uuid": "e954f092-081d-4ca2-8788-66bad31de3ab", "value": "T10A8423A403A1993BD4DE4336A8975E000279A54FB58BFB7E43CCD26A3D673D2D1923D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461080, "uuid": "eeb7b859-bd11-4640-98dd-55233e5ebd0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461080, "uuid": "f5809746-9441-4d5f-8c0c-b1f8af269e4f", "value": "6144:kAEwcM0MYJsCsOn64G9kTcjCPX+n8Lq06+28BvkYFBS0RrsXk1d4Xv9:MwcZHeblHWTXOYq0PPBsaS0RwX8dw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636461080, "uuid": "3b237686-0969-4fa4-9032-285d7267db68", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636461080, "uuid": "8b254866-7493-43bd-b90c-039e607b2a7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461080, "uuid": "947f5d7c-da12-4616-a79a-9e425f1b5199", "value": "\u8a02\u55aeT21716008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957b0174-40fa-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636420553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420553, "uuid": "c7947d19-0424-4446-9d2b-f5f63fc0917f", "comment": "Malware payload", "value": "1d6229b2af3142658019bbbbbd73fc67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420553, "uuid": "04ab0a7a-0171-45c3-b2fb-630060e3a0e6", "comment": "Malware payload", "value": "6222eefee474d78baaad16537ef8f7c320513c49591ed609d15d657a2f37b0e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420553, "uuid": "ae33e55d-8366-499b-bbef-0185d3d7338a", "comment": "Malware payload", "value": "345f2ca18e22f39165ba0e29a8fb3b7990377a79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420553, "uuid": "43e95f50-1e50-4800-88e6-d9db4c8e347c", "comment": "Malware payload", "value": "6f6c646a12e9f058aa5111b0167f072e3778deaa0a0d7e8a17f478d6f480f292b75eab2b8343b842c8844361637ea5c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420553, "uuid": "4a51b339-08ec-4702-add3-a48156508d68", "value": "T1E66441B700A291A6C54D2735F0711F0B36BCD6251680B69CF40FB2AAEC1E65D9EF83B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420553, "uuid": "962b4287-e05d-4a47-861f-6eeee3c38cca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420553, "uuid": "c037c341-2427-4615-9427-c7b11c91695b", "value": "3072:wfsJ2eQMrLghtKTZ/C4YGe49rGF2iI4DaG1gCD16/zqYg6g3x5EWpWjErd9vKlDb:JQOLytKU1d2C6zqH3bvAjErdQy2TPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636420553, "uuid": "d9c4c29a-68a6-461a-bea7-d72b0e35a86c", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636420553, "uuid": "50fc374e-cbf0-4a01-b39b-fbeada119d19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420553, "uuid": "2353cc55-6c23-4b99-abf0-14efc8ff5cdf", "value": "1d6229b2af3142658019bbbbbd73fc67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca7b611-4105-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1636425048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636425048, "uuid": "e91aa2ff-8ef8-4cbf-b862-98e4c24636a9", "comment": "Malware payload (SnakeKeylogger)", "value": "8a7963d7133ebc61665a6bff75a49373", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636425048, "uuid": "f53f7179-12b2-408d-a15d-4671f92f75dc", "comment": "Malware payload (SnakeKeylogger)", "value": "6240c5ac8172eb0c3ec2ece35c4818aea8e6a28abef8e9c4e630901de8b6a816", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636425048, "uuid": "583cbc3e-4119-4695-9923-41819facb668", "comment": "Malware payload (SnakeKeylogger)", "value": "becc0a605a1a51470893ba7e3c0c98f0b99bcfcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636425048, "uuid": "d19d133d-10ad-40be-ad4f-a03e2bc210bd", "comment": "Malware payload (SnakeKeylogger)", "value": "ded8d634c8a5d55a55bd1205de8c9dfbc8f7171af496c97c380b3389d03e89167da3ba96b4b4793c027781f6bccfcff3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636425048, "uuid": "667aa490-28c1-46f7-8ac9-f09485e7ff83", "value": "T15764127067ACAC3BCAEE067E68637441627427DF502BEBBD4F9880557DB338284117A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636425048, "uuid": "4c04b779-46b7-43b2-b018-d5a644a5e66b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636425048, "uuid": "156dbcbc-d498-4b36-9221-62dbc23bebc1", "value": "6144:RBfOwFeMKMP3GV6j1Sn7Ro9jWJCgrtI7xHRGfpdUbAx:+wFePu3GV6j1Sn71ttIyfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636425048, "uuid": "300d0d2e-7d44-49bc-a89e-6670df80f64b", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636425048, "uuid": "0ce3d516-73a9-441f-8fdb-e815ea045f4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636425048, "uuid": "6b8b5a4c-22d0-413c-a4c4-9a32310aab5b", "value": "7372733376636.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81dd3abc-4151-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1636457886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457886, "uuid": "19d29ac7-2be6-42ce-af81-adb860520779", "comment": "Malware payload (Dridex)", "value": "00c2f013185d00827a8cdfe0430d7f81", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457886, "uuid": "cac4775a-01c2-43c7-8c56-4ffd258fc8f6", "comment": "Malware payload (Dridex)", "value": "63e2f7481766598443cee2da0916f275fe95d76d0729f62f8933c893b2468e35", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457886, "uuid": "e3394146-45d8-4af7-b6ed-ced076807dae", "comment": "Malware payload (Dridex)", "value": "f603f5857c9e67badbe72575d10a1e25a6f6b89b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457886, "uuid": "0912e33e-0448-4e0e-b704-64b36f48e4fe", "comment": "Malware payload (Dridex)", "value": "be6fe214a820300849d1668eb5a90952629b7dba7522ce4d778d934532699d375d2e97284e57110ce1d0d01f39a46675", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457886, "uuid": "187ff478-f783-457e-b0d0-adc4a96a13e4", "value": "T1A283028EE4E17858C0EE58FD86CE18F15839250F0506FD2E386D52AC576618FAF8E16D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457886, "uuid": "3bdf819f-dc84-44f4-b2d4-fa2187694cbf", "value": "1536:8CWhIPFFxgFzx5YVqHS2YzayhpSW4vHR05Q4r5UZKUbIYHVWTr:83FFzIsj8aipSW4vHREQ4iZKUbIYHVkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636457886, "uuid": "3e82064d-bfcb-400b-9bb6-474b0aa29ecc", "value": 87120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636457886, "uuid": "b58a7d01-cd21-497c-8958-2f6ecb94b9f2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457886, "uuid": "e610e1a5-cde6-4707-aca0-652def050d9d", "value": "Inv 27362.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15fa5e62-4146-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636452981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452981, "uuid": "baf2eecb-585c-4bcf-a7f1-ab8ec9067a26", "comment": "Malware payload (RaccoonStealer)", "value": "0d049647c9597b5b0da270664071e355", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452981, "uuid": "789b8f10-0cd2-49c9-86b1-ad93f0235a05", "comment": "Malware payload (RaccoonStealer)", "value": "648d4377805a064953a5f314f4038071a4d50fe85088e75c59136aa2a3d8c864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452981, "uuid": "8ed4e7a3-dd98-4816-bc76-d055619cecef", "comment": "Malware payload (RaccoonStealer)", "value": "2d77bda64ccc1b6839af0d377fcc62e332ed61df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452981, "uuid": "c4f3e25f-f6e2-4790-88f0-d4240e549bc4", "comment": "Malware payload (RaccoonStealer)", "value": "0aa83b47f687096699689cf4c3e3fb0cfb5e2a5cca11dbe2a8bb2518fe9f063f75044a523aad40959b6fb92d65860766", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452981, "uuid": "c754bf3d-2b7f-4d7e-ae72-a85722f9f3b4", "value": "T178B4E100BBE0C034F1BA12F4897A97A8B62ABDD19B2594CF71D436DE66356E0ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452981, "uuid": "b774cc2c-17a1-4411-be50-a05ef5618ad7", "value": "c27d868890d7216564b6eb99c44121ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452981, "uuid": "9018b7b2-8b1f-49d1-bb80-a757d7591ce0", "value": "12288:BH/2oCL5H0uvwcs45oESXF28PkfPvWkjXNALT:BH/2h5UmXm28Mnvne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636452981, "uuid": "da60f34d-a405-44a4-ab01-a5ac7412591b", "value": 514560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636452981, "uuid": "ccbc74a8-427b-4e77-8673-412e5a735413", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452981, "uuid": "be32f925-27d3-44fb-9acb-b5b63d939b01", "value": "0d049647c9597b5b0da270664071e355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553792d8-4179-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636474991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636474991, "uuid": "63a5bcd5-9992-48a6-81d8-f7812da62067", "comment": "Malware payload", "value": "593ad516358ff2c5347e16b3f161f7ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636474991, "uuid": "6ce4e013-8f18-404a-b71b-13d403ad10f5", "comment": "Malware payload", "value": "652223c535df588c3eae9f4e5662684886948c15f2f1fd153afba042f6593d2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636474991, "uuid": "9bd8d0d2-c4f7-4fcf-b304-acd6aad0e616", "comment": "Malware payload", "value": "7d4429f8a324cda7a3b38d304174403ce7bda6c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636474991, "uuid": "1b45c699-34ca-4a44-aea1-005285f6770a", "comment": "Malware payload", "value": "786bd5c831714e67e21d41e3f52e98ac676716430c85893530fcb7ae18040b87d0460248347370f7a388d23c0f7b5f4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636474991, "uuid": "7b0d8b65-ed9b-4683-943c-baacb4f6bc75", "value": "T1ABA4CF334257BEDAEF7A1FF8981031D01EFA7C635B3EC191EE8A419225E6960CE50D91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636474991, "uuid": "daa8bd87-8a62-4df7-810f-4ba2452f82ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636474991, "uuid": "98b8d2f5-d2a9-4d4d-bb9d-5af0df227aef", "value": "6144:r+GrfWILZT1NRdqCY86P7OM9SMnotvGMbP7B5vjTDWw1Uq2m8MeGUeaX5+/6ABVq:r+qJFTPvY7kc+5zT3B1Uq2m3UeG5La", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636474991, "uuid": "03e6739c-cdf0-4a15-a431-9ba6aa9b05fc", "value": 450048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636474991, "uuid": "b94bea3d-4285-4e66-9b97-f390516a81b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636474991, "uuid": "4485e91d-f4d9-4663-816b-435373388416", "value": "Competitive price against order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69bf31c9-414b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636455269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455269, "uuid": "0fe238a0-a65e-4506-8aaf-cd8e0466aef6", "comment": "Malware payload", "value": "01ce828e270daf382fa16c01db41adc5", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455269, "uuid": "3c2d070a-e476-4c33-aa5e-1ee3b1e69985", "comment": "Malware payload", "value": "65e0e286c45c85929a42af8dbca161ae1fade1c60905cea4f9201b29ef5d899a", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455269, "uuid": "c416a8a6-fe44-41f5-b0dd-1c736451a5b0", "comment": "Malware payload", "value": "84f3c2c680f3e4c10961373125fccf2a78cb68c5", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455269, "uuid": "12035ef8-cc7a-416f-9b91-0d0e38e98264", "comment": "Malware payload", "value": "773a036c2e17fc5b1bf9e098d692fe530a3755e828977d4c7220cb8718006ca3be9ea5b7d75aa38bff0c10c602706a6b", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455269, "uuid": "b88eeba3-c6c3-4f27-9f09-e40ff6d4a53c", "value": "T1ECA42314884BDA2E5139E0BCC28C9A7A79CEE40836D139AACD09F525F1C98DDB177B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455269, "uuid": "9dc19076-74ec-4707-b1f8-fe0d5e033886", "value": "12288:AOdn4ZR6/iGbbAwkhrsCe2rrOvxxrisuTyuIv55:9nQGbbAwkhICLrC+zxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455269, "uuid": "4f1cf50a-f148-4434-991e-e56cbf98c049", "value": 468036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455269, "uuid": "dac7adec-1969-4729-8863-aec7a668c562", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455269, "uuid": "e3aac929-a5c6-40e1-9177-b2333c83f826", "value": "proforma invoice(1).ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1471d9-4150-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636457474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457474, "uuid": "d3faf682-4edd-4398-85c2-b313d2749c76", "comment": "Malware payload (RaccoonStealer)", "value": "fa5e0b9dd2cd2684fb54cc7f39f229b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457474, "uuid": "9914f204-dc12-42cd-8e7b-f24c9596137e", "comment": "Malware payload (RaccoonStealer)", "value": "67a5471d59ca74d55eda2a899d27e0c650b4bd66747461f1bdda634dc96d0c18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457474, "uuid": "a3a4427a-93ca-437a-8878-4288b6df34b5", "comment": "Malware payload (RaccoonStealer)", "value": "9f36eb3d78929f1877f0e4f4b2fa74eb580bac17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457474, "uuid": "02381fb0-4edc-430a-a460-efc266e44d29", "comment": "Malware payload (RaccoonStealer)", "value": "7c26614bd4e2dc05df74266230e306eefa8d27b5594c6175c1a4e61b65ffda11981e11dd523ba1321c9024e65bd4e883", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457474, "uuid": "4493b3fd-4f58-4bdc-b6ae-b49e90fbbf1f", "value": "T1F1C4E11067E0C035F5BB12F84E799368B93F7AA1572494DF62C526EA67346E0EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457474, "uuid": "64e718c3-8bb7-4289-946b-13cad97459c4", "value": "a24faa9f4919afc00d25c1c4d020aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457474, "uuid": "50baa7cc-84a2-4da2-ad4a-591f0a42a802", "value": "6144:jenk054Pb7lo1r5zQVNXWfrPuR8ZuJZ9384GapW7jlbIw6mXbvh3vwWiAUyRfb/K:17JGr5zQVYrm0uZ3ll0JIUbvhsAUEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636457474, "uuid": "b6cd8f57-9c77-4c15-afe2-7ea9af95f244", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636457474, "uuid": "1b90aa46-b5ad-4779-b71b-19cde05c6255", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457474, "uuid": "63b76caf-b590-4646-af69-4be93966c298", "value": "fa5e0b9dd2cd2684fb54cc7f39f229b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a78690-416a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636468704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468704, "uuid": "38bb53d5-8e4d-4776-a25d-9315722a02f3", "comment": "Malware payload (AgentTesla)", "value": "f9e562fbff965e06d71064f32afa67f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468704, "uuid": "7c9e8be6-51ce-4dce-ac98-a91e649db5bd", "comment": "Malware payload (AgentTesla)", "value": "67c9655cbda8a8562a7696a60e493036757c15999195a6da534f972d6485a4d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468704, "uuid": "380398b7-e468-47c1-81e6-1cafbfcc958a", "comment": "Malware payload (AgentTesla)", "value": "95b5a9ce5a7f04e577786dad452c29a13f7a2423", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468704, "uuid": "989bb64f-49c2-4940-82d2-56925c408839", "comment": "Malware payload (AgentTesla)", "value": "1023f457f0e049d1a4f7ebd82dbad6308c9a98560636095dc59bc93ef516858db6e92409030c8352ebaa71378c98a44c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468704, "uuid": "67f1931f-8c0a-4d58-bfab-c8f25394d8f0", "value": "T102841242C1CCD0D7C15387B10D2636B9DB776D3A99109F0B8F82BE5C7AB2550963AE9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468704, "uuid": "67e14478-607a-4c1e-b93f-07d6f5bbaabf", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468704, "uuid": "3b1f1177-e012-4c13-9f8c-6798c6ea0361", "value": "6144:+bE/HUzstiTRl3ATmBBBJ8UU+xYN1n2+nMlI1CNzCb3wHwCdn9m/w0SYq7p:+bfstiv3+mBBBJlUuYL2+nMSMCbAHwGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636468704, "uuid": "fa35f964-0281-4989-8d2c-155605d7a588", "value": 384503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636468704, "uuid": "c8b85410-167a-45e0-b130-f2a60ea8f4ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468704, "uuid": "fd746a7e-0463-4c80-836a-2ca9d53e28ee", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73efe0a3-40f8-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636419638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636419638, "uuid": "2cf6fad1-24c8-4a7a-90ed-165abc1d6a45", "comment": "Malware payload (RaccoonStealer)", "value": "2396a2e6a0ad417a05b622ea1d230bbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636419638, "uuid": "b7e23a1f-dbc8-4ce7-8965-b4a9c559b73f", "comment": "Malware payload (RaccoonStealer)", "value": "6836cc02408e5fe403bbbe81444b28ea1522bf1a6000e718195c0b28112ba6c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636419638, "uuid": "9e1ffb5a-9f81-4981-b29e-2a9d748fd062", "comment": "Malware payload (RaccoonStealer)", "value": "041042d5116701b7d19fbd5008ffb6918e6e9445", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636419638, "uuid": "ae8127e6-be6c-4173-aef7-8cdf35d12425", "comment": "Malware payload (RaccoonStealer)", "value": "c2c3d7d7356053161763db5017d8db3afca464cad1379132a7b94388bed9782bdcdaf51e41d135562300c385149e9068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636419638, "uuid": "d3c1357d-c1b7-4614-a17f-c02488f9676a", "value": "T1D0349C3076EAD825F1A31E3048B596A41B3BF8625930514BF758679E1FB3F8C89E131E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636419638, "uuid": "de060407-1973-4c71-8443-a28f2ac8b93f", "value": "c8725b7ab8753c936cc4c98a181b2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636419638, "uuid": "74078567-e804-4ed2-b4d9-8c0c50d6ffc9", "value": "3072:6MzE8396sFbRAzkJfQL3spDi3mu5WrxpzbgqruXhs7sxkgaBChU/pZa9uD6Vdyhd:xesFbRA+QLyi3duzbgwu6QigabwVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636419638, "uuid": "37494a10-e91e-4e49-a620-7cac52e31ba7", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636419638, "uuid": "d023de8c-cf80-4ebe-8dcd-cfa39f1e634b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636419638, "uuid": "583402d1-c713-4e2c-b9ea-a49bb4c1c511", "value": "2396a2e6a0ad417a05b622ea1d230bbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deda17b4-4158-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636461049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461049, "uuid": "3ba78212-3ebf-4011-9046-0f148b0a072a", "comment": "Malware payload", "value": "987105f7184d924abbe38eeceecf56d7", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461049, "uuid": "fed87d00-c404-4dce-af3a-28ecb41a5ed0", "comment": "Malware payload", "value": "6920a20b8f4efe8dea10ea3496e329fcdb06d6ff36189e4f16f0fcb864de9af5", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461049, "uuid": "a8c13113-53c4-4020-921e-56ec1d431674", "comment": "Malware payload", "value": "e5e6afdbec657a6a68dab4559f12e1c2bf1b5616", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461049, "uuid": "88599fd9-e8b1-4f49-aeaf-f073dfd4a739", "comment": "Malware payload", "value": "04aaefd773b990c8fc208b9a039e5e07d89163331f3f4a934afc9f6bee99dd399b01c3af04fc13962d46a24ea6f44fdd", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461049, "uuid": "d7a81436-e715-467c-a8b3-43cc036cfd42", "value": "T1FB8423DBEB679202B45BD31540AB370C9950D3C1A604D0BA89B9E81FF374AE96F31F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461049, "uuid": "4567230e-1941-4028-83b6-caf9a012cbb6", "value": "6144:66knAeJCtrKHFjn5Z49DqKNq9rsT/lDECPQmLSuHgncAY3lY88azqAEm/uqFBfvp:66M+rqjnU09rUREOQ+jpZn8amALuqFBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636461049, "uuid": "47b6d825-ec60-4f6c-ba25-6f1f964fc534", "value": 381484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636461049, "uuid": "874fc076-fb98-4ebf-a271-9a455424af45", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461049, "uuid": "4872649f-33f7-4141-957a-642eb847e763", "value": "NEW ORDER.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeaefef7-4158-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636461075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461075, "uuid": "853c06fc-c432-4881-8cec-c70f462dee68", "comment": "Malware payload", "value": "4630ce9bd1fee20516bf62cea575a2fd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461075, "uuid": "72eefd1f-365c-4730-9bbb-411a2dbd521b", "comment": "Malware payload", "value": "696af21363abdc6892fa25b8959f0ae718fb236e7efbd838a9a0931b04534e30", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461075, "uuid": "a6ca8365-13fb-46e4-92e5-0f8de0599edc", "comment": "Malware payload", "value": "66a80bbef0f284cbaaec49e12ff3eaf4f027748b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461075, "uuid": "34c3e6f5-deee-40e5-b5ee-6ddbbb8b62fa", "comment": "Malware payload", "value": "4c2c4704363af0f583e2dcd136097ceb0f6c2f8321019853610a225acc387227b558101c6d24ad8dfe72393d711d21c0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461075, "uuid": "7916d64a-70c4-4263-a908-00ba541f7806", "value": "T1A77423C648F63917B0E49210F68F860957CDAC1A69CE7D84C3AEE25374F3BA1D6821D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461075, "uuid": "d72e3b53-4b99-44d8-b2b6-7c680461f4a2", "value": "6144:5RN1JsCsOnu4G9kfcjC9X+n8Ly06628RvkYFBSERrZacv7dsW0q58e:5X1ebTHWfVOYy0RPRsaSERVaI7dY4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636461075, "uuid": "3554a899-b9c7-418e-98f8-bdfe76d9c799", "value": 369106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636461075, "uuid": "809cba34-8147-4128-8870-6d2b00f26f60", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461075, "uuid": "3fc84c07-a7d1-4848-b014-66b2fad316a4", "value": "\u8a02\u55aeT21716008.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4cdc62a-415c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636462696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462696, "uuid": "9aa8a276-74cc-4401-b224-13e6f5eaf518", "comment": "Malware payload", "value": "6807709a74cde5eafc0f8c668a13be81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462696, "uuid": "ae6e8c42-69b0-47d5-a587-5264a0234ce0", "comment": "Malware payload", "value": "696ba6fed0994cac4e47993f336820499cd3faf3ce4713d4e0be0ea0d91748af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462696, "uuid": "7cda941c-6680-433c-a1da-dcb94faad448", "comment": "Malware payload", "value": "460279d69c1ddd6d36ed25e7985e9e2bbad7ad65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462696, "uuid": "254a863c-c9f0-45d9-8632-3acb88ff4113", "comment": "Malware payload", "value": "5f1e359e2fb478f9aced1a47934d5a864f0a5da051386c7ba706a4037b92949ec26bd5eba10f52a21ae989316590849a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462696, "uuid": "1ca6d884-6c12-4f39-9dc0-5b466fa116bb", "value": "T14994F025F343D816D5B912F2985E99C01234678AE85FC20D78F9FEEC68333E64652ED8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462696, "uuid": "45470e49-3490-4a8f-bd01-4bcf58035158", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462696, "uuid": "284ddd8c-9d7f-4098-92f4-8f5cb63995c8", "value": "12288:/RONl01TzxCxAbF6J4lfjexPnLBIEiHgs:ENlWTdzF6JSbkDBIEfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462696, "uuid": "7e41f038-eea7-456f-94c3-2341f5d1aebd", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462696, "uuid": "355ae924-d803-4f4a-86f3-298f7849e01b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462696, "uuid": "c7af4562-0e67-4904-b9e9-ba9be75e8a38", "value": "SOA & INV FOR OCT'21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a211ad-40fb-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636421135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636421135, "uuid": "ee46b91a-6d62-476f-9261-d2ed40582c85", "comment": "Malware payload (RaccoonStealer)", "value": "5b3eec598b466dd2b2751a7130b2e88a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636421135, "uuid": "b5d22275-7537-4d75-8a6b-874a1bfbfb1d", "comment": "Malware payload (RaccoonStealer)", "value": "6d0bc7c4ee68531cf6c42617eacd69e9687412efc44b3930845f2d0c739cf6b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636421135, "uuid": "77ed61ea-7b71-4db1-8617-f6c5d058f75f", "comment": "Malware payload (RaccoonStealer)", "value": "f7c302e8bdeb6c7fb12afe7f42b46753983c70d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636421135, "uuid": "972fe3fa-8a58-490d-aff5-61e0bcd5c852", "comment": "Malware payload (RaccoonStealer)", "value": "1e77ceb459aed2fc4e18fe90ef6c3012f7d46ae222fd72ea5b18f7c20a4509f452c4d3a20933216ea51ed447e1953afb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636421135, "uuid": "58a37ebd-f257-4ddf-bf76-e293d9a7e4f6", "value": "T18EB4F034B6ADC830D1B3AE304835D7A41B37B85259249106F7506B9E1FB3AAC5AF570F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636421135, "uuid": "af0c99bb-51b2-48c3-a350-b1d40d9443b6", "value": "d258636f72d347eaf01f17dafac75115", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636421135, "uuid": "36c86e56-58c9-4870-83e8-75f3d2601574", "value": "6144:3W/2+Fp3jBpbeNYO2H72xqs996OaAtCsjvWxl03dWIRxV9MaYiOb1Auzbgwu6Qi0:m/2azBpyNms6OaAtOxgRb9MnrAunn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636421135, "uuid": "382c5c3a-7708-4cee-a010-b6fc690a7d72", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636421135, "uuid": "cd383105-f3fa-4033-a3c7-960453ba01a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636421135, "uuid": "fd53839b-61a1-4553-a0c7-3c2a6ccf1c96", "value": "5b3eec598b466dd2b2751a7130b2e88a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e756f2fc-416c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636469653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469653, "uuid": "2fa832a6-76e9-47b4-8459-e9099634b872", "comment": "Malware payload", "value": "7c881a807b2a4e5914100200ba475e02", "object_relation": "md5", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469653, "uuid": "7b6fba09-0a5d-4da6-8a2b-a5caefbe6a1f", "comment": "Malware payload", "value": "6d9b656d552af4fb573d52202172e101db0be7875bef3b782d651a98f096897e", "object_relation": "sha256", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469653, "uuid": "7e506756-e963-4489-b970-c0c4b8d6ed88", "comment": "Malware payload", "value": "5cf2b3cdf524f9dff3474a55e38a67bdc253b9d9", "object_relation": "sha1", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469653, "uuid": "c5441a2a-23db-4ccb-9b85-032a566289ac", "comment": "Malware payload", "value": "133550c9a5e7395cff1fe1435f1f5f8fbcfdbd42320de3139724628acb06d3c0e99c92e69a66ddeb5160e51184fde945", "object_relation": "sha3-384", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469653, "uuid": "ed98446f-30af-4ab3-b690-c4c085983774", "value": "T1716302E2C46B1115254CD7CF6FB89A0F6281DAF9C7C42CC6497215A9B380A388F27F29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469653, "uuid": "3e4d37d3-5e53-47b1-a3ce-ac71574447b0", "value": "1536:8MIQpCifxNWGCM8hsUBz0blrsRsMrGIckulBoFDq:tIQkGCM8hsMAbl4FGVkulV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636469653, "uuid": "f1ad0b3c-dd2f-4810-8e75-3df2349f12c8", "value": 70601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636469653, "uuid": "6fe168db-4f88-4d75-91fb-488ee76749d1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469653, "uuid": "64b5e91f-aa35-4507-bbd5-3d30f01ec897", "value": "etoccaecati-4500330.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e35206-414b-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1636455479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455479, "uuid": "7e02e853-f0ba-45e7-b056-c71ccd82d214", "comment": "Malware payload (NanoCore)", "value": "9f54d94a69a3de07d8ac178e8bd70c6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455479, "uuid": "ee73af1c-4bad-4f44-b54a-20bcd5470a73", "comment": "Malware payload (NanoCore)", "value": "6de2494fb7cbdf76e1ae485bc075aee8a10922af8394b7e477cc78cd02ba888d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455479, "uuid": "79ca1034-bad7-4c0e-88f9-94fe064d0c7b", "comment": "Malware payload (NanoCore)", "value": "60cb013cc134a51a66a5e02264f26c25e4febb7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455479, "uuid": "d7c975d3-0270-4e51-b37b-a841d5cc477e", "comment": "Malware payload (NanoCore)", "value": "d7e732069ca4b75ea0007c78ae24a647d5567da769e8da47b736b8ad9d5e7d4e61c4517759947d786be0b96ab452b7ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455479, "uuid": "a1d6ec44-6336-4b41-bc37-4a72aacb7511", "value": "T1689422B95751943BCDBB1E3A28633880863533C66567E7FD1B84E0912B9739123C17EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455479, "uuid": "99804e10-7e01-48e0-b1ac-34047296da90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455479, "uuid": "a61290e8-1f27-4cd9-af7a-2a483b47ef0d", "value": "12288:9w2ePzYp6vw8Jf2abrGlJUoJdqhrbmqW2t:9w3P8gv1rbrGAo/qBKq1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455479, "uuid": "085c876d-898e-4b82-bf00-a3c8180aff71", "value": 411360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455479, "uuid": "ec62da8a-7f69-4250-a9f5-ca10ac5b75ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455479, "uuid": "6c0b7b29-37e2-4d6f-bb67-53305d1bbc96", "value": "REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "becec3d4-411f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636436514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636436514, "uuid": "0b64c6ab-0ea1-4bbb-952f-ae77c4d61454", "comment": "Malware payload (AgentTesla)", "value": "70c1a705af28923926d48b9181d383ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636436514, "uuid": "b601bf8e-5ad8-4cb7-b297-90b424f60f5c", "comment": "Malware payload (AgentTesla)", "value": "6f71e1c2e52e6eaa0c0fe2e5110f80e32709388b387802bcc7f30643100bc2f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636436514, "uuid": "a0514861-af24-45c1-949a-29175117ab82", "comment": "Malware payload (AgentTesla)", "value": "f4fdc968e1b39e4108fea4c36e505074b5befe0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636436514, "uuid": "733fc729-005b-4256-a7c6-2d93b9e76d1c", "comment": "Malware payload (AgentTesla)", "value": "447f8bc8eb5cd0263660e9dedc7f90847736e91db7979f9ef7cc3c2fb900af552128663cefeb7aac3e94684bd5cc7ba7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636436514, "uuid": "937d5c82-3a8e-4662-84ae-27e2741fafe8", "value": "T164A2C07EF55B0E489F4696A8061ABB65064DF41D73C840A237BCDB387A5C91B8B23D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636436514, "uuid": "0c114f04-3090-430d-a101-93df8e55811f", "value": "384:K9XRj1NyLvQlXwSiccVBYHxw691EET0L+lpY48ve8Msca:K9XhjyDQlXwMx1hrrmM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636436514, "uuid": "4c814df9-5a1a-4875-bbb3-31ccc318c696", "value": 22670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636436514, "uuid": "d8f6916f-3774-4ecd-8fc3-cc0f512c1682", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636436514, "uuid": "99c889f5-7d4c-4b98-89f1-0cd5b281b343", "value": "70c1a705af28923926d48b9181d383ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68da1ab-4146-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636453277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453277, "uuid": "807c3751-ff0b-47c9-94d6-f4253a8dc78e", "comment": "Malware payload (RedLineStealer)", "value": "b27420b0584717d80426051a2eed04b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453277, "uuid": "20967729-0802-43f5-a714-66811b37c67c", "comment": "Malware payload (RedLineStealer)", "value": "6fea9860763c59a75a73b1ffd7078adbce3676659e40bd068deae8fbb46e9b91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453277, "uuid": "3d3f5571-51e4-4410-a167-a1d09124132c", "comment": "Malware payload (RedLineStealer)", "value": "56017cb740dcb5902c524dcaf5cf38056a409cc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453277, "uuid": "e98fe756-5dae-4c55-b8f1-d0d6ffe3ef64", "comment": "Malware payload (RedLineStealer)", "value": "dfe6b71a7f9273bd579289193d51dac5d9e729d8324bff53c9b0a540b717b964f21360be0bd0b3ec0c76508358466c92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453277, "uuid": "746ebbb1-262e-42ad-9b10-ea51a25fba87", "value": "T14D74CF00A7E0C035F6B656F84A7593A8B93F7AA16B3480CF12D516EE9635BE0EC70353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453277, "uuid": "65e3312e-034e-4fcd-968b-bc032d5c58c1", "value": "ef5891f13814421fd185279f57d98085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453277, "uuid": "d7d85d94-273c-4752-a442-a993f95584d8", "value": "6144:5+/ZMyxrJZFEv1Ft6+hQOj6eg7mGrg4Q6nFM5EvZ2+F:nqrF2f0+zi5rg4Q6n8eZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636453277, "uuid": "8a80da7e-2116-452d-a0c3-d72d3381f2ac", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636453277, "uuid": "7bc9c99c-a0f2-4557-95a3-c13d020dfa7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453277, "uuid": "c672830b-68fc-4801-8998-c86bbae4c805", "value": "b27420b0584717d80426051a2eed04b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c23da3-411e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636436170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636436170, "uuid": "1bbaf524-cdda-43e2-b9cf-1655bc09179e", "comment": "Malware payload (RedLineStealer)", "value": "fae2de88584cb436988cb180c60af4e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636436170, "uuid": "4bb4ac44-3e68-4e4a-9abf-fd50896e34eb", "comment": "Malware payload (RedLineStealer)", "value": "711cf1b385095bccea46165ce96cacdcaf55dfbf10d794813de3e2b83b8a5628", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636436170, "uuid": "65b3bdc3-5f8e-486a-b928-af073a29c3b7", "comment": "Malware payload (RedLineStealer)", "value": "47fc1da4b94a86562a572456e775850243e7472e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636436170, "uuid": "6730bad9-0501-4a74-b8c9-352a36a33c4e", "comment": "Malware payload (RedLineStealer)", "value": "9c88706163e7c78e4e72ca8b67960d8b5611fd92dade20fb9257b60beb085f5735f857cc1a52a5b89aa82a3b3a0532a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636436170, "uuid": "15fb4292-6fcc-4b4a-9434-6658debf5662", "value": "T1F174D0316EA98864D4A31D305964C6E10A3BB862E874A14AE750D78F1FB3F5C9EF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636436170, "uuid": "d4ab816a-6d4c-4e8f-ade9-1e4e531e57b7", "value": "c8725b7ab8753c936cc4c98a181b2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636436170, "uuid": "df0f21ac-7ba1-4a67-8dc6-ccf350511a36", "value": "6144:3mH9a2Tuz5wOCoTgR06SUx2PZuIcaMNY7O55kuzbgwu6QigabwVf:2da20wVoTgu6SZwlaMNY7O5aunn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636436170, "uuid": "623de8ab-d8d9-4c59-9497-e857f890921b", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636436170, "uuid": "3ae55d3c-ea5a-4e42-9ada-aec2b183ad46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636436170, "uuid": "48634bc7-1252-452f-8f95-fe0a787f45c8", "value": "fae2de88584cb436988cb180c60af4e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5533bd5-4146-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636453275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453275, "uuid": "d1e361b7-7323-4c05-b683-2863263beaa3", "comment": "Malware payload (RedLineStealer)", "value": "aefdc40e285bc58ec6eece43aee86b12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453275, "uuid": "d95dbbcc-f71a-4e27-9ce5-c120de8fe373", "comment": "Malware payload (RedLineStealer)", "value": "71969efec3ac9532f61645ada15979988063af02926ef55b2c7720c64f1c532e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453275, "uuid": "c4f9c61e-08e0-45e7-b40e-3226b2886ea3", "comment": "Malware payload (RedLineStealer)", "value": "2f21718a6ddc6a1e5c34b3d4fd338da72d695969", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453275, "uuid": "3c4e2345-29e3-4718-95d2-0ed494cace32", "comment": "Malware payload (RedLineStealer)", "value": "32ec3749b5d4d98b349fe103fdfff608e1934a4ce22dd00f7e7cde625d6537aba73cda7c2d7d68e278af9e3d56978663", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453275, "uuid": "9cc422ab-37df-4dff-9586-f4c1114bdaa7", "value": "T1CF74C010A7A0C034F5F716F44A7A93B8B93F79A1AB3494CF52D522DA9635AE0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453275, "uuid": "254ef554-9559-4264-a485-dd328b3e9a2d", "value": "ef5891f13814421fd185279f57d98085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453275, "uuid": "e7b92bd3-626a-40ee-afe6-138309144b78", "value": "6144:pwh/kAKSFPA2xnZXW+ttaQaLnngMX9sg3561FpiUvNvsaG4t:qdLzlhW+vBongysg35612ONvVGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636453275, "uuid": "9c4d8ec1-a284-4997-9e01-e92d6b09af7d", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636453275, "uuid": "c24c08b9-02c5-446c-83e5-44b647dc9a90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453275, "uuid": "12da5e85-db44-46c7-830f-31340c62dd5a", "value": "aefdc40e285bc58ec6eece43aee86b12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f981ff9-414b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636455332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455332, "uuid": "fa0497d4-a14f-421c-aaf0-05adf1c8cc73", "comment": "Malware payload", "value": "b9732526d8390713fa67cc33aeabdbba", "object_relation": "md5", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455332, "uuid": "fee713ff-0556-4a79-aac1-05ea5597911c", "comment": "Malware payload", "value": "71ac7d2cc8dafb65cd7acf79f946745e23ddcc67ff2a362d2af9b6bd3af4b9f3", "object_relation": "sha256", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455332, "uuid": "5eb1e4ec-feeb-4f93-a16c-66262ddedf36", "comment": "Malware payload", "value": "b35f1a1b3d707349a54e24ef7b7321c38cb3aefe", "object_relation": "sha1", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455332, "uuid": "2baa690a-ccfd-48e1-98c2-2621a2e74874", "comment": "Malware payload", "value": "4b6cb9cb8a7d4f04324bfb78daa9461e3ce5839681b53ab85785ce18f25ad6c83cc7c7a4058e2a065e929b05bb8c72de", "object_relation": "sha3-384", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455332, "uuid": "8259fbbd-e636-4a10-9296-0ad38fcefbff", "value": "T16AA423119F49AC16C858EFCB7F20139BE71BC1D3797886AEB862895C8681785301F9DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455332, "uuid": "c2bd54b2-518d-4559-9ba6-1f872b1508b6", "value": "12288:y6FTcb8JThhMDUW4DUrYX2ghlt7EVkavvhYZG6TrqBiD:y3EThh/zYYX2OqpvheJBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455332, "uuid": "c1f184aa-028e-4e60-a7b9-f512cbead089", "value": 487559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455332, "uuid": "1daf2c3b-9655-44dc-9169-b34b39a1d139", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455332, "uuid": "2b9f62af-d9df-46dd-8793-f7761b0dd267", "value": "Rqm~093873536733-0873654356783993gh.ppm.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd614b85-4153-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636458845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458845, "uuid": "27d32278-b42e-4f55-b735-933d012348ea", "comment": "Malware payload (Formbook)", "value": "c4a1bdd685e346b7604f93357a922875", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458845, "uuid": "dc902b18-c1ec-41e1-8737-0a92115f4b19", "comment": "Malware payload (Formbook)", "value": "728b23f75c1140a1763dd7c75083f2ae57afeb6ffa3d7b33a9ba1b4904c4566d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458845, "uuid": "b65e1aff-6b02-4e23-965c-061346943740", "comment": "Malware payload (Formbook)", "value": "6b8fccadcf1977f5850faa1c47617343fafc0ff4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458845, "uuid": "c9cfba24-17b2-4fcc-994f-40a7dcf44534", "comment": "Malware payload (Formbook)", "value": "0464576e867885173f4d0e18e306e65862c934850c46411bd3f8fe9778fdb244835d3ad5b3031fc14f781db599187e61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458845, "uuid": "3158e79c-27e0-4a9b-8604-faa40ead3ef4", "value": "T1587412657748A81EC899157388DE7EA043B8788BB4A3D32E779C73B418923E31513BDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458845, "uuid": "75774528-bc98-4c56-aa81-65c53b1b8d17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458845, "uuid": "ab647e54-45ac-4d3f-bc82-99ed9a532cb0", "value": "6144:hC9EDghMkMs4P2CW2RT9cERCtbjqg2vcy8a9KI75uhPLTDcfAYGQLomQVHb:h1DghTjPymtvqg4ya9R75AzOAcomQV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636458845, "uuid": "a76fc16e-870e-4d77-9a07-0553bc2e68ee", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636458845, "uuid": "2a74bfcf-9abe-47ca-adaf-9bedcb9a8562", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458845, "uuid": "49910200-dfe9-4af6-b9f6-e81eab5c84a8", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc930b5-4163-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636465553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465553, "uuid": "477729c9-dec2-45c0-8593-921353c51cfd", "comment": "Malware payload (RedLineStealer)", "value": "532dd2e01f0fcae0cd3b758405326357", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465553, "uuid": "dbb5abc7-70a7-4206-a955-1bec42aca645", "comment": "Malware payload (RedLineStealer)", "value": "72e7b4c70e737e0de819b5745cb0149317f2ced194149ea119fd6d727f08a407", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465553, "uuid": "10e1db2b-4b6a-4e5a-9c2c-d489755260ee", "comment": "Malware payload (RedLineStealer)", "value": "d751e638bed3d2360036a501a8ed32094b599026", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465553, "uuid": "397cb0a9-5833-4537-9b32-da54048a7428", "comment": "Malware payload (RedLineStealer)", "value": "dea344fd40176c026557cd58b03e168298a2867d30fa64bc3fa57d717049624b9dcc6987a7f4f0dd9997e0ee6d48a360", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636465553, "uuid": "a2ec9f5c-9f27-4e39-a8bc-6e4fe309b42d", "value": "T11B549E107BE0C435F5BB12F449BA93A9B93E79A1AB2490CF62D116DE57356E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636465553, "uuid": "21981523-fb8a-4472-b120-faa85e60a1f1", "value": "3680a4ad647eee3bc552c106d95885d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636465553, "uuid": "7a3a207e-b206-4638-aa35-453132fca85d", "value": "6144:2fEm+5oQT0JNuIg59PClsUXaloNmZe+1awAJp:oK0JAT59PClsUX9fZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636465553, "uuid": "e7541da0-b5e4-47ca-8b70-3f39702cf3f1", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636465553, "uuid": "0ce67460-6ca2-4957-846c-17056ef0f19c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636465553, "uuid": "7a03e441-c4b1-4f0d-83ca-f7cc90149afd", "value": "532dd2e01f0fcae0cd3b758405326357.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a061d81-4159-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636461255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461255, "uuid": "70b3a014-e0da-4058-9298-f80c9586e3da", "comment": "Malware payload", "value": "1184bbba750598ef879af712da176866", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461255, "uuid": "bcc3e962-3ed0-4369-a557-cbb0f0541235", "comment": "Malware payload", "value": "73457f829788bccafe2bd2289bbdc547ed1ab807e667cd7a824f0907778cd4e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461255, "uuid": "e204c55a-660b-4612-a508-d3b59e76e4ce", "comment": "Malware payload", "value": "083008c110fb08aada5d04277ecedba2a5b1df43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461255, "uuid": "46baecd8-74c6-48ea-bd61-78adbeaaec09", "comment": "Malware payload", "value": "cb3e989f6438b4ba13f6c7414b654efd31a712099bdafa34bc9dca374ec123a7771f3bef7342b8974b963144493b9303", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461255, "uuid": "c076de12-9b5b-491b-b805-5a2c4272b393", "value": "T1E8B42334501013F66BCCD9D4AD8BE1A152362DB66F47636A6EA3F3A58BCDC23A44470F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461255, "uuid": "88a61605-10e0-4945-bda5-d33dc9d03055", "value": "12288:rA3GsNX2VB1hLgZWkhjH0UhNzHQQMFvLQewuESeXcd72:vas1OokhjUUnzHWvLQxuEhcR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636461255, "uuid": "ec702dfc-432b-4094-b394-f2ae3667cb45", "value": 498210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636461255, "uuid": "6ccaa8e0-4f99-4a9c-80ff-5df83ef32bee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461255, "uuid": "024b6baf-ad8d-4eb1-bda3-13dd53efeb8b", "value": "Swift.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1257ac-4148-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636454040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454040, "uuid": "881d505b-e8b7-40d9-96df-fe94a3686f3d", "comment": "Malware payload (Formbook)", "value": "1dd3fc2a5d2b97ecd8dd1ab1024ddbd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454040, "uuid": "e5a6800b-5964-4075-bbe1-2fddf17214a8", "comment": "Malware payload (Formbook)", "value": "745918c719c623204c2c339cc9c2073260f833c4082d15bcb890a6848d872b71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454040, "uuid": "fd237960-e0c2-4bf8-b579-88e16d96297e", "comment": "Malware payload (Formbook)", "value": "ef8971faa1070deafec511163737cf49cc34ca1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454040, "uuid": "3107e9bb-44f7-4e0d-b1a2-c5d8f5f3ca28", "comment": "Malware payload (Formbook)", "value": "d5fc13b89166f372041d4af78d4a44ae7015dd8cca00ba259c585138f7f0e2a75b49b3953c63ae897238f0879057e47e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454040, "uuid": "f1198545-90ba-4c2a-a544-d729a3a83daf", "value": "T107355A6363A470B1C0631730D92F87ECA915FA303760A5897EFAAE6D6E72641F42F153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454040, "uuid": "efb9a4db-8eb5-47c3-aae2-f78ec825da09", "value": "6e392f8dc2c8cc2d39a7098cedc92259", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454040, "uuid": "016a8802-d7e6-414c-9910-6071a7f2dade", "value": "24576:qXl9a+cwnxqZ9vh9aRWBDvHnVDmlRZYtYtb0v:qXTSQ0iSHnVDmlRZY2tIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636454040, "uuid": "652ddac4-9956-44e4-a007-94ecb613c2ec", "value": 1133056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636454040, "uuid": "64bcabd3-1b70-47f0-8be2-b5ca67ebbf19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454040, "uuid": "a44bba23-62f2-4185-9505-183f8a8b2a89", "value": "Proforma Invoice, New order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a86e897-40f7-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636419112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636419112, "uuid": "96568131-d54d-4fa0-8f31-3ce6a2f3bdfc", "comment": "Malware payload (Formbook)", "value": "091792f86ff494dba1a1e72625f0bbdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636419112, "uuid": "093d806b-714c-4fe2-8a8b-1a6dbb57ee0f", "comment": "Malware payload (Formbook)", "value": "74825f8f5dd7d626ff09e1805dc75ecdf92271b8d2148a9bbc8f5cb01b56703a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636419112, "uuid": "3c7ed785-846a-4f25-9a7a-97b53f119b47", "comment": "Malware payload (Formbook)", "value": "bce0540b335ea8fd50dee64c83569a3e4d6c1f69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636419112, "uuid": "4fc54196-0032-41e0-a471-b2ec311c06ba", "comment": "Malware payload (Formbook)", "value": "d9a8b32d84898de4124b106372253606480144cb4fd6f0d78e34150388867c9b0aa6213fee97cac23ee312cc38d9c45b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636419112, "uuid": "defed2f0-88eb-47f4-bcc4-faad792ba70e", "value": "T17C355C67B3A064B2D1130734DC2F47EC6512FE313B2065467AB9AE6E2E79A12F42F147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636419112, "uuid": "09f9ce2e-0b37-4610-8dc7-7d24c14ab6ff", "value": "6e392f8dc2c8cc2d39a7098cedc92259", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636419112, "uuid": "b0d452ff-35f8-42ff-ab7a-bcb0756bf625", "value": "24576:qXl9a+cwnxqZ9vh9aRWBDvHnVDmlRZYtYtb0v:qXTSQ0iSHnVDmlRZY2tIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636419112, "uuid": "c48ac39a-8fa1-4a73-bdf3-82396ee84c48", "value": 1133056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636419112, "uuid": "2454f86f-83ee-419b-828a-7166c7404926", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636419112, "uuid": "9b77e26a-10b6-4904-aafe-34594e1a5ff8", "value": "PICTURE DEAWING DESIGN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a91d466f-4144-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636452369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452369, "uuid": "20f23d0d-470a-4810-8cf2-8866109d8354", "comment": "Malware payload (RedLineStealer)", "value": "83b444c8b672ee1aaa420ba054d15e38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452369, "uuid": "2d078175-7830-4604-8fa1-522581a84745", "comment": "Malware payload (RedLineStealer)", "value": "759d0f88d2b8e63b2be28ebc82ce615c98df6e093db80c377a3b23284ec4c4e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452369, "uuid": "2fa00985-b7ea-4f6b-9633-c478f3baa577", "comment": "Malware payload (RedLineStealer)", "value": "374b2cd428b4692219b2755db90924582e7e4c2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452369, "uuid": "008df2fa-0f6e-4aca-8183-f196571723a7", "comment": "Malware payload (RedLineStealer)", "value": "e8e63df3582746274c93eb66108a91644bbfe1ab40b76a3fe3bad1a1aa599fd00317e5c659c12f034ee3a3e2c41f2949", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452369, "uuid": "73f8d92e-7eb2-4c7e-bd3b-8d687693c511", "value": "T1A484CF10ABE0C039F6B713F449BA9378B92E79A15B2095CF22E512EE5B356D0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452369, "uuid": "078a3517-5657-47b2-87c8-aa64468cc9fe", "value": "a24faa9f4919afc00d25c1c4d020aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452369, "uuid": "3e0b8c59-b994-45c7-a339-1a41552c1f89", "value": "6144:l0J9F303jsK4ku28MtIV0b4lBvFe8H8pBWqpzvuh5:m9F30TH4kuVMtIV0b4lhFe5nJvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636452369, "uuid": "7ba65fd7-4f9e-4f9c-bc2a-b62283c9b800", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636452369, "uuid": "04b1a744-c984-4753-a9ef-1ffa365f173d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452369, "uuid": "fea16b4e-652b-459f-a752-af3a2734aeb2", "value": "83b444c8b672ee1aaa420ba054d15e38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8ac56f-414b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636455462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455462, "uuid": "41d2941a-fc06-48ac-8573-762adda27105", "comment": "Malware payload", "value": "4e10a8223bd8728c134c09f25ed3690e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455462, "uuid": "1375b7e8-048d-411b-b22e-c08a45288485", "comment": "Malware payload", "value": "761c802a29db89305abf3cb2dc2193a8329cb5780a8c0209b64999232bfbbffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455462, "uuid": "c642ee04-a1ee-460e-98f1-40e9de7d7097", "comment": "Malware payload", "value": "0fd04115fbf744dde5e6156c6cf86b617d14cafe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455462, "uuid": "39bd9600-dc18-4ea7-91d2-fd6e25e8ce2f", "comment": "Malware payload", "value": "00b20c63acee85808ad6a19178a2cbecf8dac39c657d6a711d7f0abf50c408525b5e7fba21da1a914a04516010028fdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455462, "uuid": "fe56338d-a9c0-42ca-8012-ed9700350a97", "value": "T18C256B01F6C48C05D27B067248BB9438DAB62E6F657D81187E9E337B2FB7711052B72A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455462, "uuid": "9772ffa5-eae8-4172-8886-ed8aef97eeee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455462, "uuid": "633a8f3a-6530-4dbb-95a9-4c40692cbebc", "value": "24576:etuiQDh5BhvnYjp5wylG5tfVRjefaFew1HBjY2SXwT:UuiQZtfVRwaFrHBjWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455462, "uuid": "22d1a331-58ac-413e-b307-1e127a44328a", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455462, "uuid": "67c3ea7d-33ce-4372-85ad-87683a4c0b16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455462, "uuid": "054c7c65-a220-44b3-8499-fc0ed9e2cb2d", "value": "TR)98376534563789387-COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b80b19-415d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636462986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462986, "uuid": "107a79f5-bd83-4fb9-adc9-a64b03d17eff", "comment": "Malware payload (AgentTesla)", "value": "319a32c92304f33c90b36ffc7e7c3edc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462986, "uuid": "89e806c5-8b65-4a99-a4e7-56530ded7e78", "comment": "Malware payload (AgentTesla)", "value": "779785fafc9e723c5f35f4fe715f36accffcef354f314296890e5b307b5370d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462986, "uuid": "70a541b3-7ff6-4d46-b15a-795c0267281d", "comment": "Malware payload (AgentTesla)", "value": "69de052cca84af22d6eade2d2ef63438f51b44ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462986, "uuid": "3847e393-0372-4211-8444-4488853182b8", "comment": "Malware payload (AgentTesla)", "value": "995076259ff1d952650d34f5ef64073930df6d81639979c2904bdb1d5a31f781435c129389e31ef48851c3e00fb800cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462986, "uuid": "2c27b6dc-e47e-43cd-adb7-e122d9656a97", "value": "T1F3F4AE3A3142A9DFC6278FB585213C605DAC7CA7FF5FC1629817306E95FD8AECA105A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462986, "uuid": "2c50b79a-90bf-4c6c-800b-e374c51f98da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462986, "uuid": "037f482a-0778-4fe2-bf79-81e75d02fcf9", "value": "12288:c9uqJFTP2u0s8TyseCwhggqAL3KWnu53cMESv+lg1zLHYob:5qKupsysv8KW2zLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462986, "uuid": "42bff9d4-6b5f-42a4-ac26-d60ecc8558b4", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462986, "uuid": "75bbe230-a7dc-4fea-982a-c6848153d3b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462986, "uuid": "10fec29d-ae64-43d9-9828-26860ec575b4", "value": "Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88eca39c-4150-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636457469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457469, "uuid": "798ba39e-8428-4ee0-b14b-a67ecf6dac5c", "comment": "Malware payload (RaccoonStealer)", "value": "770ee5d0122db5049a305241ea4a8126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457469, "uuid": "bf9ada25-5a48-46da-b321-0098f7364314", "comment": "Malware payload (RaccoonStealer)", "value": "77e3f86564d1ad0f5e67e5d3619d9299bf669a9fce943c698dad9b3a46dadd35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457469, "uuid": "4fe7a93d-e760-4a58-9739-ceee8e807288", "comment": "Malware payload (RaccoonStealer)", "value": "e5b0e7f3811d349d16abe43cbe37402effaa3810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457469, "uuid": "aaac3c52-edec-47ce-904d-ea8bc308af7c", "comment": "Malware payload (RaccoonStealer)", "value": "b7e2af7cc4c7e4675ada53585cbdf51b4f001adb73e4ab51f7e0338993fee4f71a8459bf3314ff64c81fa4ed90baace3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457469, "uuid": "6f99fb5d-d0cc-4df8-9a9b-7933dc29bf56", "value": "T115D4D00077A1C039F5B322F8797593A8B52A7DA1973441CF62D63AEE9634AE0ED70317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457469, "uuid": "55564100-d16a-4244-a16b-3a9967772c74", "value": "2bde03b8e77a01221a51ce447d5c160e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457469, "uuid": "364dc935-6824-4c84-9f62-8a450ebc6ca6", "value": "12288:O6foMUoUuVeY7gL9ARUTqinKM311Fywb9vbCOM86P8kV6A/oFXp:9foMU1uVhiFTqiKM31ZhM1XkFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636457469, "uuid": "28de3671-d443-4e18-8868-96b840a0ea15", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636457469, "uuid": "6ad85792-895d-4d61-9c19-26435d8babdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457469, "uuid": "5c6ff429-4019-4061-8cbc-5c3624c02855", "value": "770ee5d0122db5049a305241ea4a8126.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4736e7e-414b-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1636455475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455475, "uuid": "212ae3ef-6302-42fd-a05a-f5c675f7946a", "comment": "Malware payload (NanoCore)", "value": "5be404f072c6115da6124f4b3ce1271c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455475, "uuid": "f701ad1d-2b61-4358-b490-8a6dcc2ca1ca", "comment": "Malware payload (NanoCore)", "value": "796965555d8a26cdb16c53ddfaef4ea3f12023a13bba62f0b353cac6083e6553", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455475, "uuid": "9b1e2538-b468-4c02-8704-832ce1ed78b4", "comment": "Malware payload (NanoCore)", "value": "3a32239b2f994d38070c9122d45bb251114454ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455475, "uuid": "a6ac9ee0-d923-4a22-b99e-758670012e0e", "comment": "Malware payload (NanoCore)", "value": "95bd1ff20c45620aa732153eb41a26b9911070870f57a671cb0a83f4df69a504c0c1303c725b3728c01d79b668735843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455475, "uuid": "dde4ee76-a790-440e-aadf-279bf9a89584", "value": "T190B4E192F34688D7F8B912729C2FDC1211925ABED0A69A7D31DE733569B33530053E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455475, "uuid": "0e1ef4e6-596c-4810-8b7c-9dda3f409700", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455475, "uuid": "69594bab-6f89-48d7-8008-83c837e1e237", "value": "12288:ewPePd6OzBGN4J/EGoOLIxoeIwtUUbJIq:ewWPdvzcAsGoOLIHnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455475, "uuid": "41197a09-9a01-491c-ac73-0d2048d902c7", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455475, "uuid": "f02f989d-9ef6-4a80-9c9b-654ff59c7f22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455475, "uuid": "6ec7d765-f3b2-43dd-8763-dd5f52d276f6", "value": "Tgm_09385345637893-09387654345678390398765345673893987643567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33956f20-4192-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1636485672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485672, "uuid": "efb76b8a-8ad9-4d6e-af53-08536deda6dd", "comment": "Malware payload (Loki)", "value": "47333f041419db94400bfb7a4821d90e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485672, "uuid": "6a40198c-12fa-48f3-9f93-b5de9465c39b", "comment": "Malware payload (Loki)", "value": "7b12e253b0bf89ef0535a8dc539361954c67511bcdbc709060c0b1e6ed539cb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485672, "uuid": "7f1371f9-6e3f-43fb-835a-c68643b13d95", "comment": "Malware payload (Loki)", "value": "63859b8c81f5e8cdd693848269a7530ec3e64cae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485672, "uuid": "2d488435-5a44-4a90-aaf8-8c684b371621", "comment": "Malware payload (Loki)", "value": "10f5a172efdb77f1129bb32f4118362fef28f374d9213649d485e6f728c1e6cc85fd787f156ee19319f8bddf30cc8301", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636485672, "uuid": "53254811-7db2-4f5b-9d57-24017bced454", "value": "T10144124B90DE85ABD7B248350B7BE37EF3BBC3C44157295B17B40EAA2D62843451C8E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636485672, "uuid": "22d019e7-ed1a-4650-a991-998c6aae1baf", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636485672, "uuid": "f7252969-7652-44e1-846c-d2e6354aadad", "value": "6144:rGiWRaHMszpI3Bq9ZSt5yYLb0qkP+C97M:iassUBUZysYH0qkGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636485672, "uuid": "92cd30e3-372a-4128-9829-26f35feddca6", "value": 263177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636485672, "uuid": "cdf64f6e-1079-469d-bf89-82cf4fd6260a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636485672, "uuid": "84ccca07-e091-41e8-81fa-2a9144e75cab", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2987e2-4153-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636458550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458550, "uuid": "71f2f47c-4846-4780-9324-341db7523522", "comment": "Malware payload (Formbook)", "value": "53def552983bf7b221d950b04af48a4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458550, "uuid": "e37d2ea1-3ae3-478e-afa8-14f5008f3b37", "comment": "Malware payload (Formbook)", "value": "7bc7100b7f264478967c50cd333b481fe108f1edfd60db59ec277809781cc59c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458550, "uuid": "3509288f-270d-434e-85f3-7f326abbe809", "comment": "Malware payload (Formbook)", "value": "291892fc546e2c8fbe3ef2275ab7fc8769d9ed0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458550, "uuid": "6afa1307-4925-4dca-bbef-19667a7be74d", "comment": "Malware payload (Formbook)", "value": "cef28f57b4c6d9e8f3276c4a0660ee858454e75c7ab758c728cda835f70bbd91a9248b21b5306cd2b86d2f173244d25c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458550, "uuid": "4f5cc03d-8320-48ae-a255-400c3fd18c6f", "value": "T1D484025BB758C52EC9A56132EC8F7B4007BCB9817DD3D32EAACD635E50623E2054368E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458550, "uuid": "8cc79e63-6f03-48e8-a945-d5734236fd6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458550, "uuid": "5c9d61b4-5d1d-4829-99d3-570e00aa434e", "value": "6144:HNDcvtBMkMcBEH+IPJUzgyXzdhuMVSYO1JhAGIp1+6RS+otAtFAZp:HCvtBTDBASBBVZsJh7IpInDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636458550, "uuid": "a277fb03-866f-443f-b0a0-ffe08dbee432", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636458550, "uuid": "5f13238a-2e5f-4fe8-a9c2-b912a76214ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458550, "uuid": "db6e696f-7bcf-4428-8cc6-aa55ee34a827", "value": "RFQ - JAKOB SELMER_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6751b5-4123-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1636438067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438067, "uuid": "0ee66450-2c91-46e1-9ebf-0f6213948dce", "comment": "Malware payload (ArkeiStealer)", "value": "67b1f7e4ba514b60246340b9510a6541", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438067, "uuid": "73441c8a-6b41-4809-a41c-7e1e75fb3a14", "comment": "Malware payload (ArkeiStealer)", "value": "7bcb1651acd3600e337049f24d1e240eb35898abf286e273acd829a02f7b09d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438067, "uuid": "a07a5822-d042-4bab-ad11-6e2ae101d21b", "comment": "Malware payload (ArkeiStealer)", "value": "8b95677fa6bc8ec286d009078653351daab9b1ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438067, "uuid": "c9d6b659-dfb7-40c3-af44-7d86a517d674", "comment": "Malware payload (ArkeiStealer)", "value": "9a490628528df4ab70f92c10374fb0cf489d9cb5bfdf722c11fad11f8fd92cf0e0024c184973b72252d5d0ebef9b1ce3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438067, "uuid": "d17a8066-683b-4787-b3a8-cd2906ea04ff", "value": "T171F4F1107BF0C035F1B722F449799639AA2F79E2AB2450CF22D516EE5A706E0ED7035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438067, "uuid": "d2ef099f-974f-478c-a136-9a6e55c4f334", "value": "a24faa9f4919afc00d25c1c4d020aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438067, "uuid": "11477558-94f6-4e99-ad74-ef905db937e4", "value": "12288:t7xJ4dOwfGzhK/GF6+WH9IbY+/LOovzybbsHERl0:t7xJ6Owu9KuFfaEYKubDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636438067, "uuid": "7b0b960b-c956-49f3-803a-af8afcf23fba", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636438067, "uuid": "b08e845b-0a19-4ec2-ad8d-e595ca8cdaaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438067, "uuid": "77ad8e80-31c7-44e5-9b61-fa4af094e74f", "value": "67b1f7e4ba514b60246340b9510a6541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd57f615-4184-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1636479944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636479944, "uuid": "0c29c071-a3bc-4e86-8969-4ad0c0d107e2", "comment": "Malware payload (NanoCore)", "value": "e66e6d1d99b8833f45d22666eb5ad243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636479944, "uuid": "c0fd8fe3-d264-4fe5-ada6-46602127c358", "comment": "Malware payload (NanoCore)", "value": "7ceb354c4f419b3daed055ae62d5b1aaf58a7b715f8e9de08e5379e7e70ebeb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636479944, "uuid": "0131f632-fd65-447f-a8a9-45ab6236dae9", "comment": "Malware payload (NanoCore)", "value": "7d43ad5a2f6b1892a806a419682169880465667f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636479944, "uuid": "c0fd9f10-9915-4546-835c-8c7a95d32877", "comment": "Malware payload (NanoCore)", "value": "417964dd456d0250921754b35eedf39ab3ce84490549dcf7a0ea28382b4c777f44bbfd5d76318826b754d23250d89e57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636479944, "uuid": "6142241a-a9dd-4835-9e51-5cddebb31a80", "value": "T187D28E35475A5233EDED0B32A5A01A049779E783B403CB2FA99D60CDCEC33125AE527B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636479944, "uuid": "b92c9381-4606-4b73-af5a-f087ef5eaae8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636479944, "uuid": "4d51caa9-ed0d-4a6b-84aa-31e70edfa8ae", "value": "768:gcpnHD/IZKPBMmRonhSUX5hhTrMMqhhy7:g+njNPDunh97hTrMMQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636479944, "uuid": "885c99ad-3685-411c-adc9-f201e75e55cd", "value": 29624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636479944, "uuid": "3c7ab95f-95c0-4967-9dcf-2be8ea89f254", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636479944, "uuid": "9bd7cb61-f227-44a4-afc5-a14db44774d3", "value": "T1M28CPaymentReceipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d051a898-412d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636442556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636442556, "uuid": "67caf46a-993f-4c89-8e7c-dbb651cb52c2", "comment": "Malware payload (AgentTesla)", "value": "4cbd6e07436af3c293ef310d539541e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636442556, "uuid": "0134e4a4-6976-49cd-92b9-98ada2b0e851", "comment": "Malware payload (AgentTesla)", "value": "7d7919b340e03db5cd98de9d6905167bd7d8e62de6d3d9e408a0ecca45794545", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636442556, "uuid": "e56c4955-808a-4948-a823-54bfab39bf23", "comment": "Malware payload (AgentTesla)", "value": "65e2fa1140dd3666a7613550aeb6d7a1e95f00c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636442556, "uuid": "1d8abc22-24d4-43d9-a2fa-bd63869d4cd1", "comment": "Malware payload (AgentTesla)", "value": "74aa0280d895af0ac4aa6ebdb7a1fbe1455d50eb2f404712b078d7b44dd2aa3813d04beb77eec3be508a5a83452ffa71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636442556, "uuid": "07eb9dc6-ce5f-49cd-8dd1-147e752319d7", "value": "T197E2E1E7966D42F64DFB70FEB51E0D5175C504B3D5B023A684FC4069CA38B8662AD8B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636442556, "uuid": "982aa4e1-abdd-469f-a92a-4a91d2a5c2d1", "value": "768:LbiH4JNFhCuFJ8sgZnEds9edFijldCk3+dTD0l6YkG1d/vnn:pz4uF+Vxp9omDCeB6YkGnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636442556, "uuid": "688cf91e-b6da-4b8a-a39f-8487ce7f8ea4", "value": 32458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636442556, "uuid": "727b21ca-6dba-4ac8-adb1-3c4345c2ed28", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636442556, "uuid": "bc841066-2193-4d53-86aa-a34e0150078e", "value": "Documet_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c26c2e-4127-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636439711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439711, "uuid": "86ebf88c-4fff-4d7f-9b96-1923d2fb225c", "comment": "Malware payload", "value": "ad8824401484f12cb785527f4221246c", "object_relation": "md5", "Tag": [ { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439711, "uuid": "59e7f789-a05b-4c02-8490-339010bd84d0", "comment": "Malware payload", "value": "7e03237473fdc68809389a43b3b7ca775353970a6f809ce977556b8d6c49abfc", "object_relation": "sha256", "Tag": [ { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439711, "uuid": "3e925125-0dbc-4ade-ace4-71a0e9206278", "comment": "Malware payload", "value": "4de7ca0d7ca1593e9aad091b6ebc4b544f32686a", "object_relation": "sha1", "Tag": [ { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439711, "uuid": "3f7fe6f5-fa7d-4a2c-9f70-84f3122d4679", "comment": "Malware payload", "value": "364831957cd0bc5f710d9dd292578ae2d74870ead177e1aa5f3bcdd5e636607986b8bed2055bab44e2db8576559c134a", "object_relation": "sha3-384", "Tag": [ { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439711, "uuid": "b83b6694-5ab1-4cf4-b6dc-a3b288f28aad", "value": "T18443019867F185BED07AC4F3A779286F9A60F4F9B3513EE9D9C9C14740401AA0C8C9E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439711, "uuid": "b2c1bedc-df99-4674-9520-a626cd9873c1", "value": "1536:4mS5ivqDuQ+iaz6+ys42K6y7+Xa96XFprrP:b4vgayKfx98P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636439711, "uuid": "f85ba957-2b7f-4007-8fcd-3c44c84526df", "value": 56569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636439711, "uuid": "57e93873-b95a-4182-ba65-30e65a59d6a9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439711, "uuid": "c0fdee5e-2731-4d33-8a86-716f4ede073a", "value": "suscipitnesciunt-4890405.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d4bb3c-40fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Glupteba)", "timestamp": 1636420398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420398, "uuid": "a14db3de-e1d5-41be-b9b4-bea3d97913e0", "comment": "Malware payload (Glupteba)", "value": "eb1d1ffe82fe0b45b239211004c79c3d", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "NGLite", "colour": "#DDA34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420398, "uuid": "5eeaa7bd-7d02-4475-aa1c-681ac40f8431", "comment": "Malware payload (Glupteba)", "value": "7e4038e18b5104683d2a33650d8c02a6a89badf30ca9174576bf0aff08c03e72", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "NGLite", "colour": "#DDA34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420398, "uuid": "2a8b81c5-411e-49ce-8c7d-1d6c5c09094a", "comment": "Malware payload (Glupteba)", "value": "d56b0d300e16109b5057d4377ef6c12fce41e71e", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "NGLite", "colour": "#DDA34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420398, "uuid": "0bf45edf-6ec1-417a-b57b-0718822fef2f", "comment": "Malware payload (Glupteba)", "value": "0837b6ac22eb4d1c7483b923d9fe724ad0e2cdd8420042a1d825a7cd3658c753a6496287b1ad017c33828ca07e264467", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "NGLite", "colour": "#DDA34A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420398, "uuid": "03be148d-7994-4d3c-8fb3-cd425d30d22e", "value": "T19DD68D07F8A614F6CFFEE13085A692217A72749443327B874FA44AAA1756FD47B3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420398, "uuid": "6143df0a-4485-421a-922f-e7d52620624b", "value": "1cd364a9e949d5ecebd6c614e64bc545", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420398, "uuid": "0e278930-0972-436f-b142-0e20a9bdbb57", "value": "196608:GKouOB/7eXB94InJrRx/2Xh0cGf7kz6bIHEvTVPEBBJs:zIYB9trWh0BOabVPms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636420398, "uuid": "c1ae8c19-cc93-4160-9597-e88d27543acc", "value": 13672960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636420398, "uuid": "9144fab6-29a3-4a37-acfa-9e367de468fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420398, "uuid": "4836b1bb-6c15-42a3-95a9-eea38095c163", "value": "7e4038e18b5104683d2a33650d8c02a6a89badf30ca9174576bf0aff08c03e72.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bab02f2-416b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636469016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469016, "uuid": "3e99508c-c865-427e-8fe1-7df250517acd", "comment": "Malware payload", "value": "9432a6eb216b36df257014bbf0620c8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469016, "uuid": "1b811be4-5504-4a89-9e8b-694dc1560f3d", "comment": "Malware payload", "value": "7f7327629c895b5d1fb222fb7beffa1aa0f909f0f2d8e6afbb001b984fad099a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469016, "uuid": "f0418237-cbe0-428c-af56-602b26aad9a5", "comment": "Malware payload", "value": "c88f238110f528b75f1a40f0776e8286a892ec8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469016, "uuid": "61296074-47d1-4a1f-b6dc-74c0133c6dab", "comment": "Malware payload", "value": "c0f8d5e8dae71a430355ec572ea5da30fe077196e3b39ecf2dbfd58812cf991533f3431473dbbfd93a028b0bf8fdc800", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469016, "uuid": "c8c730c3-609d-411f-a1d0-129eb20f305a", "value": "T10C9423A9A325837FCA6D1BBF4443765045746387A017EFFD4B8984762FAB36381827C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469016, "uuid": "e6349200-9cbc-4753-a31b-3c7b307a6155", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469016, "uuid": "869bef0e-9a1d-490e-8b35-e89bde3644a8", "value": "12288:GowNePwHMuvCU21rb3WOhMozCHkrDaOB0cdwMM:BwcP2MogriOhM/EPaOpdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636469016, "uuid": "c077becb-6e37-4946-a134-f739c8564fbe", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636469016, "uuid": "b705e009-4ee8-465b-bec3-8d2f8fce79be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469016, "uuid": "f4ee10b1-81ee-4f8c-a8fe-c8b5e4088edf", "value": "COMMERCIAL INVOICE BILL OF LADING ETC DOC.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecae8ec9-4181-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636478681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636478681, "uuid": "abf13829-dfa1-457d-a09c-ce0332f69c3d", "comment": "Malware payload (AgentTesla)", "value": "85bc4867962535835485440d3280c202", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636478681, "uuid": "73ec0ad9-c91a-493c-8eb2-641575313118", "comment": "Malware payload (AgentTesla)", "value": "7fdca645a9f95e1c786813672c8614b1de9152e7423268b9c127b728ba496d91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636478681, "uuid": "766d27e2-ec94-4880-a9da-f012ca5046cd", "comment": "Malware payload (AgentTesla)", "value": "79154557e6a9697f2a6a658c75df2c2fee550ed4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636478681, "uuid": "564d96ce-322b-41a4-b5b3-fe851a0505a2", "comment": "Malware payload (AgentTesla)", "value": "8595582159d01d5bb2cf4f2dbeac1f95bc2abb8f4da472462765b6cd0458959347b6038a566f0c32b7e04d3764744dea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636478681, "uuid": "39a9a239-4db8-4e2a-8b20-22cb7b68e0b6", "value": "T175941229FB54842BCAF656369D8B612013BC6183A8E3DB1E27DF321C67723D2404369E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636478681, "uuid": "3d08e906-6804-409e-b8b2-cec6dbb387b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636478681, "uuid": "14809b97-4079-414d-acb1-3962581f5125", "value": "12288:j7YzXAR/TlllLlBhkXZSlpuUN/GQ5/lwxBi3:sXAtTphkXclIUNOQ5/lgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636478681, "uuid": "2a931aa1-194f-4897-8608-2f54fb29ab99", "value": 412672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636478681, "uuid": "207059e5-6eae-444a-85d7-01319fa4f3ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636478681, "uuid": "81cb1e81-b2ff-4b42-a4ec-8e24d7ac14ac", "value": "PO#202111-DHAWANPO COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75abdf86-4147-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636453571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453571, "uuid": "c89419be-cd78-4518-9c2a-66f499121af6", "comment": "Malware payload (RaccoonStealer)", "value": "b6d9671df20580533a015600d37fbb3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453571, "uuid": "5285ae6d-9d13-4b1d-a1fc-3e9be147c351", "comment": "Malware payload (RaccoonStealer)", "value": "8049eaaf077474109bad0b447367fdab49bf2339d3dbae95098c726a7f117cad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453571, "uuid": "8056e41e-a5c4-48c3-b72a-f3f7571ede22", "comment": "Malware payload (RaccoonStealer)", "value": "4cc9c4c333d20616e81c8cd01f51bd8010f5826d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453571, "uuid": "db1e5fe9-2852-4635-82c0-dc9b0b97be05", "comment": "Malware payload (RaccoonStealer)", "value": "0da14e043e29eab4ded7caf7239f69c37c3fef094c161e0115e020383dd0425085f7c1c099957287ba4217a9ffe0e814", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453571, "uuid": "aaf7cc9c-7b4c-44c8-be60-e47f6d40ce8b", "value": "T18CC4E114AAE0C035F5BB12F48E799368B93F7EA1AB3591CF61D116DA56346E0EC30387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453571, "uuid": "a6357c93-8c14-4717-9305-f91097ff638f", "value": "61f5dd277d7d233f85b676d434ad016e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453571, "uuid": "04935758-eef6-48d0-a229-d1ce471855bb", "value": "12288:7+5AOSjgG54l4c/9rNLf9z3t/5itPoB6HdQz7KkXj:7PbPO4cRdVz3nMH6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636453571, "uuid": "dc20ca1d-85f1-4522-9065-59a018271fcd", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636453571, "uuid": "4c473b37-f458-4d56-8586-bd82451e34de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453571, "uuid": "bbaebdad-e88c-4c77-9e1e-76cb31440217", "value": "b6d9671df20580533a015600d37fbb3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2755869-4168-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636467819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467819, "uuid": "75647dd6-0d10-4688-ad9c-ae7cab5fd180", "comment": "Malware payload", "value": "2af645f58d7d4ca560cd4f89150ce463", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467819, "uuid": "bb7bb596-0e28-4df1-ac29-b1c9b84807f1", "comment": "Malware payload", "value": "80513394a54a077c33cdd1829184ba48cdcd4142b19a182f282c4fa255e4949e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467819, "uuid": "4896d8f9-4139-4832-a801-1971bd54dd9c", "comment": "Malware payload", "value": "22b57c4dc2ee1a9fa8d40d526ff399781dec4e26", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467819, "uuid": "86dc4aa3-74d5-4556-ae9f-46987217d0c7", "comment": "Malware payload", "value": "f707001f0eaf6e48b85a96b45f00baf95096c87be787dac8184c72276b584b2386d9c2e1e5d7d52e4727a73cf3d7f1ba", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467819, "uuid": "0bb5f1cc-9d3b-4d65-a661-bae65490dda8", "value": "T1917633C9EA48E98DD204679DF6A3CA60B219C01D84E377A983C50FE365FFF84D488D95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467819, "uuid": "1854fdbd-3566-4772-91ef-cb6d7b33b4d6", "value": "196608:WzZICzibz91gACf95LuOYFtxD1E+0iljQlUjeY5R8p:Wz2On6LFt4cNh5Kp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636467819, "uuid": "6eb4af51-7bed-45d2-b22f-56cde4e9c71f", "value": 7234143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636467819, "uuid": "a85a29f6-a3b4-4fdd-aed2-ea93a36974d5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467819, "uuid": "08aec4b8-235a-4ed1-b265-104e8c329df8", "value": "Setup.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a56c09-40fa-11ec-843c-42010a9c0014", "comment": "Malware payload (Glupteba)", "timestamp": 1636420411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420411, "uuid": "08aa6cb3-f379-4ab9-82b9-37c0effe0836", "comment": "Malware payload (Glupteba)", "value": "aedebba95462e9db10b834551e3abc03", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "NGLite", "colour": "#DDA34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420411, "uuid": "62ebe325-9a8b-43c1-841c-81db2d378bcc", "comment": "Malware payload (Glupteba)", "value": "805b92787ca7833eef5e61e2df1310e4b6544955e812e60b5f834f904623fd9f", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "NGLite", "colour": "#DDA34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420411, "uuid": "912c40f4-5f2c-43ac-8842-8e9013a8ddaa", "comment": "Malware payload (Glupteba)", "value": "551c8f9200aa77d9bc94260a516522619016e2b7", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "NGLite", "colour": "#DDA34A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420411, "uuid": "86527047-7385-478b-aa04-fddb145bc2c5", "comment": "Malware payload (Glupteba)", "value": "6c2f02f93de3c96b0e51a581a054d05bafc49ed7988885ad3431648dbb8bfc4d065849bd9b39ea23067e360a5ccd6302", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "NGLite", "colour": "#DDA34A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420411, "uuid": "bc24fa2b-5a14-4b16-ad91-66abd30b7c4d", "value": "T1FC965B90FDEB50F5EB07683085AB523F633192098339CEC7C6045F93E85BAD15A376A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420411, "uuid": "9f469f3e-21bd-46f0-b9f8-2157d074749a", "value": "1cd364a9e949d5ecebd6c614e64bc545", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420411, "uuid": "2c2a283f-a89f-4235-b963-4517a600ed0b", "value": "98304:DRIAB5BpuaeE99e65N4E0XwuK+xmgQGjrFIpFAjOiz0UAi:DRtB5rfd5N4bXwuK+RNIpF8OiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636420411, "uuid": "a4db66b7-6035-49c4-a689-4091b7c32b0c", "value": 8707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636420411, "uuid": "78966fa2-34dd-4910-b74a-57c476dbd412", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420411, "uuid": "0ead83b6-ce4c-480c-b77f-883d4595f706", "value": "805b92787ca7833eef5e61e2df1310e4b6544955e812e60b5f834f904623fd9f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03370349-4157-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636460251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460251, "uuid": "a8ef9fe7-723b-4d73-b01c-f4313f0cbb42", "comment": "Malware payload", "value": "b80985f7f4f020fafa7eee7527736cf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460251, "uuid": "6adfb340-96c8-40b5-93c8-131fac69111f", "comment": "Malware payload", "value": "812f94c4aad86fb9a3de8512a150a5ca7d64f561c36a464970b4c661e40d592d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460251, "uuid": "4cd5a2ff-4747-4a77-99ec-a10145f4763d", "comment": "Malware payload", "value": "8f0a8898677933a774c4298e48d39a6ee5e54127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460251, "uuid": "cb1524a0-7552-4c07-9b5f-98143d2ed0c8", "comment": "Malware payload", "value": "9419afb72f86580a8132b8fbef54b4b4182fce6a855c1c1b1b83905d35c486e3b4d9c8cca3407d83e021947acd122b6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636460251, "uuid": "2aa00707-619e-43ff-b0b7-68167b887c2a", "value": "T15DC49DA1B69094ABCEE85A776E0BEE300B217DECE115C56932DC3D9F74F66F30144292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636460251, "uuid": "3bfc840d-9480-4701-a4e3-f3c4804877a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636460251, "uuid": "26794ee8-57ea-4f55-b2e6-66a414cc63c3", "value": "12288:4QfHzT4Y7ls1o6LaR2GgeoL3wamVReFZ1lL5nMMMMMMMMMMMuMMMMMMMMMMMMMMM:5fTTD9EcMLYDwlL5nMMMMMMMMMMMuMMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636460251, "uuid": "2337482b-1905-4107-92fe-4940c8372296", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636460251, "uuid": "3e98998e-b156-44d6-bf98-d07b8b5e1e26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636460251, "uuid": "cb6d2ebb-a623-47bc-989a-72f3371897e2", "value": "PRODUCT LIST NOV AND DEC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b722687-4179-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636475109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636475109, "uuid": "aeda976a-aaa4-4e02-a3f6-d21d437fa8ce", "comment": "Malware payload", "value": "848514d3293e05eef636c27ee777fe29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636475109, "uuid": "902e2550-4917-4d46-aa5c-7c15eea60b5d", "comment": "Malware payload", "value": "827adb7149301b3ba792a95aabfae0457354e38f87f6dd2da629a1cfe5c30801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636475109, "uuid": "8570292d-7ea7-4a06-83a4-aab7dde66ee2", "comment": "Malware payload", "value": "0386b781ab84c9309d24eb15ef68628363a21fb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636475109, "uuid": "7c9c2735-bd32-43b0-bc98-affa8e3a6f43", "comment": "Malware payload", "value": "5556d93f834fc86a7f9329c01ace0816ddeea0a59c65b51740e7b88dca7a08aa25833f772696d5d0092b5876ea158938", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636475109, "uuid": "4c3957ab-5e8b-4573-abd9-ec152386e8c7", "value": "T1B5D26C28978A4633DD2F4B36A1D05500F379A783B403CB1E69DE70CDDC933965A9427E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636475109, "uuid": "fbc82a4e-d6ef-43d7-a8de-ebb18b8d6c0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636475109, "uuid": "5e2641d1-4953-46be-a4d4-e25c0b44a585", "value": "384:547ApUomD2xrH6237t3wtCKlGyihj0PX4KI8ScjpAg1Me5TpoAaG/e1yi7SaXiDd:4Ap3aCKlGyiJK/rMe5SzGL8rM2rsEAh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636475109, "uuid": "23e5d4bc-e480-45c2-8607-a54987b2e77b", "value": 29624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636475109, "uuid": "ba272270-9ef2-4c8a-aa61-519fa01243b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636475109, "uuid": "d9ada614-8c12-4314-97df-dda90bb61208", "value": "doc20219119979791.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14394c8-4150-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636457510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457510, "uuid": "0d02fa4d-1e39-458b-b168-5d76bd7717c8", "comment": "Malware payload (RedLineStealer)", "value": "9122b88a7376f51d049522cf9a234478", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457510, "uuid": "d38bbe43-5484-46da-9c8f-bfa95dbc0625", "comment": "Malware payload (RedLineStealer)", "value": "829225fc19a57409d03967926eeb1ee6b4da7184af8e25f80ffeba6633b46c82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457510, "uuid": "6426d4b8-8d9d-4f0c-a6c4-373231fe243c", "comment": "Malware payload (RedLineStealer)", "value": "91bc40b24745fd839bbb16a59d86576d67e984e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457510, "uuid": "1989eead-5469-4537-9a8c-daa009beedde", "comment": "Malware payload (RedLineStealer)", "value": "209e5eb1a27bafc58d630b2d0d506b84c3303ae459ba08e13c1e87fabfb7005bd12aa100fddd44abd28beb2db4b1e3e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457510, "uuid": "7c113b32-be89-4a83-91a4-4844d3ac839b", "value": "T15B74D000A7E0D035F6B712F85A7983B8A83F7EA1672085CF62D516DA9675AE0FC70317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457510, "uuid": "893ebb97-378b-4853-a3f7-17ecb8e49692", "value": "ef5891f13814421fd185279f57d98085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457510, "uuid": "3c8530e5-d4e0-4b88-a6ce-a10a80de62f4", "value": "6144:40oL4JoQ1sycyMnm3T8R5ghjsi+ioQfeIEgfuTxgsa6VFSRQvoYLAqi:bQ4JoQ1sryMY0S4QfLsxgsa6VKaoYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636457510, "uuid": "7844bcab-3b0b-40a3-ba3c-3076fa3a3260", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636457510, "uuid": "634a98fe-ee94-4af4-b629-c84c46880d5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457510, "uuid": "112eec5e-c861-498c-90a6-e629c575b3c5", "value": "829225fc19a57409d03967926eeb1ee6b4da7184af8e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863c6709-4152-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636458323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458323, "uuid": "d89f0a9b-efc0-40cd-8039-26827469e7e6", "comment": "Malware payload", "value": "513beb16ccc381cf43994efe720d65fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458323, "uuid": "2a871275-157f-4ce7-9210-3a9bc0b18c6e", "comment": "Malware payload", "value": "82adc1ae5adcf8277a595f34021ff3724d380c87a2b03477ef7aa7504b2c6b77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458323, "uuid": "a2759ce0-89b2-4dd8-baba-50f4c144cade", "comment": "Malware payload", "value": "ec2cb37a26e26dd5eb624461c38058d884ccb28b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458323, "uuid": "ad905645-508e-40d3-b0ac-2eaa19b29a5e", "comment": "Malware payload", "value": "8ac0c027d48c2767de6797ee6327086a83833193ebea822292d714e7ac8d0f820868a43fa4a21426d257523074642567", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458323, "uuid": "685c3837-9a13-40e7-9bf2-b02f0e5fdffe", "value": "T1E7A4CF50E90DACDAD7E5C1B3B86A9B100274BBDBD2F981AF22A5371451B33D32077D4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458323, "uuid": "c316a685-d0d8-412c-8d44-62b36272f672", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458323, "uuid": "a6b61189-2f86-4895-8a70-2cdac4ebad28", "value": "12288:M+OvriTKIXINJxdJ82cE26/V3f02BH3x:+vOTpCdj3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636458323, "uuid": "2b40a1e7-ba93-4eb0-83f4-6aea2a89ebec", "value": 478720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636458323, "uuid": "398219c9-a0d4-4ce3-973a-9f33cdde9ecf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458323, "uuid": "3d10689a-0edc-46b8-855c-24adad8f3dbb", "value": "Vergi \u00f6deme faturas\u0131 9 Kas\u0131m 2021 Sal\u0131,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b034caeb-415c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636462689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462689, "uuid": "f2e9c21c-c19f-48c2-8c89-3329f84222cd", "comment": "Malware payload (AgentTesla)", "value": "53304066492cf25a43986c75bf62770d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462689, "uuid": "14d79d2c-3968-4708-9343-b9b398d675ba", "comment": "Malware payload (AgentTesla)", "value": "82e67fb6ddde10cd0e8ac2809c5036d5a1f16ff3b6e3502f919b434e52487355", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462689, "uuid": "18cfa82a-9111-4a5f-b7b9-792410eeff71", "comment": "Malware payload (AgentTesla)", "value": "a4c45dde33885f88c61ef407eeb5a07aed73a238", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462689, "uuid": "42972673-4ab2-4944-85d5-8d6423885e4e", "comment": "Malware payload (AgentTesla)", "value": "6fd1b526c68f090e2ce7cc975ebf13f8a86c803c9139400d5bf4ab8a114a9844da04134907130a7e7c84753ff5795543", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462689, "uuid": "9a282d63-df3f-4be2-9b75-ab8f8ff0c463", "value": "T130C4BF7A3252BDDFCD279DB589543C90AEA47877432FC203D81701AA5ADD8A6CF248F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462689, "uuid": "5aaa8a86-6e1a-4215-bbe1-f8965189ca92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462689, "uuid": "cbb29156-af15-44e0-9a3d-63b5716d835d", "value": "12288:9mqJFTPk2eOnsTPfw3duFwf7iejLvLUigFPJa8vb3A:cq5e2Ww3h7fDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462689, "uuid": "4f9ecbb9-ad9c-4029-9a71-6c26eaa3d693", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462689, "uuid": "6a2e94f2-bf75-43ff-a161-7743f32b45a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462689, "uuid": "01046776-fbf0-423c-99ca-e9e7d50d5ea9", "value": "REQUST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21319811-4149-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636454288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454288, "uuid": "cf72337b-14e8-4ba2-b0dc-33cdc45e780c", "comment": "Malware payload", "value": "d7a92414d96064fb95e27fc4ea9295f1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454288, "uuid": "59183488-247f-401d-ae65-1ce40468eba6", "comment": "Malware payload", "value": "84a140e00c5ba9c84f4ae11c5ff86b82765d467d058eefcc2e99be3774f8aea3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454288, "uuid": "8945a379-6d49-4071-9e46-ac4195516e18", "comment": "Malware payload", "value": "63e813e7f603ad4d9f2512fc7a3bd30d2e7a963a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454288, "uuid": "0b2d450a-54ba-4cdc-89db-35a80a84bec4", "comment": "Malware payload", "value": "4bf16c020bccd4cd1c9705c0331aa9569994059c64c9486f6a3b19840a5a1c06666ef249ab390e503d56a91d12e291c1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454288, "uuid": "31219fec-2f10-43e6-8aa1-55e484cb8227", "value": "T1FF921610D280F1F1E263447A8922486C2AA75B123BC762CB4FD85DDD6F177EBAC78843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454288, "uuid": "0b7a9b1d-47cc-40c3-892c-9d3d816bc223", "value": "e58032bedd69f2414975fdcf62e7e84b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454288, "uuid": "09800191-c8b8-4caf-ac9a-b1637bd09189", "value": "384:NS0uiCzcXBWIOrJ0mE11d1TRUYhbQz5csSGLfP0zL2Y/AHl/JOJX:s0uiCzOX6+RSYhbQz5csSikn2YctJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636454288, "uuid": "66ee951c-7a9b-453c-a421-d0b4a34cb4fc", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636454288, "uuid": "1df169e5-5438-44ea-9213-3e43e0abd1a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454288, "uuid": "12b26146-d83d-4c37-bfa3-2dc972c12ffe", "value": "SecuriteInfo.com.Trojan.Packed2.43458.7662.10458", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8615d14-414f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636457173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457173, "uuid": "265aedc0-a71a-4a10-8d3e-40369e4144c3", "comment": "Malware payload (Formbook)", "value": "1fc0c2e7e6b8420483111ce7d0be97be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457173, "uuid": "6a4bb28c-0a39-495a-95f9-0d3931ba2635", "comment": "Malware payload (Formbook)", "value": "84bbdc0b303d03c1ef4ee6d48dedd94181d8fc5650a20b557a555b0917aaf879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457173, "uuid": "cf59f7e8-d27f-4428-a31b-d3acf6d6f7d7", "comment": "Malware payload (Formbook)", "value": "dfd4391cb69b4ae27b7b2a7d78e79272e69e24d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457173, "uuid": "835b9f9f-4221-42fc-b00e-c713072cdf95", "comment": "Malware payload (Formbook)", "value": "af8c635fa7aae0d76070e51759234cf43581f00d1745e90852e97580e7e35742b596778c204c4700ca5aaf6097488205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457173, "uuid": "e2738a3d-0c25-470e-88cb-b4ceb0e7cca7", "value": "T18CA4DF94124554E3E6F23B318F26CABA97680E783C75D10E65E67D2BB7FEAE30907410", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457173, "uuid": "9e95ea7d-578f-42e8-8ec3-1592a157f2fe", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457173, "uuid": "f655f043-4552-4bd4-9191-fea1d6ac9f88", "value": "12288:LbLoNpRAK+/c5euoq1HyUdmBvABqSh8TPE:LbLIA1cIuoqRtdmBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636457173, "uuid": "8336a40e-ce2b-4351-8b1d-8c2513d819ea", "value": 493501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636457173, "uuid": "0a01b4ed-7041-4b8a-813a-6a4a89581439", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457173, "uuid": "3bddc67e-5a0b-4604-9dd6-6cf20e301d8e", "value": "REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d1e34b-410b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636427828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636427828, "uuid": "e62ab851-65a4-4366-8274-a4064ab431d0", "comment": "Malware payload (Formbook)", "value": "e13f4dfcb77ff3beec28d80ff2a770db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636427828, "uuid": "7806c0d1-b253-497e-ba4d-048b29cf0a78", "comment": "Malware payload (Formbook)", "value": "853cf471b4618048136973c2fb757f26f28d701fbe804285fa52c6f7388b4d12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636427828, "uuid": "1cb64812-e740-4784-9ca6-cad83639d1e6", "comment": "Malware payload (Formbook)", "value": "8c68e428f86c45a80e41b48593df327499052410", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636427828, "uuid": "91fefffc-21b4-41a1-9546-dadbb267983c", "comment": "Malware payload (Formbook)", "value": "9862165b2e6a260716f1894c9505be7bb1831f98cecd224a3c6db5197f016a89925a31fdb91a20ceb1896e3237a2fc3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636427828, "uuid": "4db7b392-f9e1-423a-8cb9-0e916f54423c", "value": "T111E4BDC39AD011A5EE990F3141326D385323FF6ABCBDF98D5E48751217372C29277A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636427828, "uuid": "ea60e677-3d52-4302-8daf-a753f3678601", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636427828, "uuid": "53c50603-6e27-428b-a3e7-1159a0643d93", "value": "6144:e8LxBfj12e7OA2wpE2xp6StTUPSg29JuiDlsscQcWddB6Je3t3E6nXHs:zHfzxpTRUPS9bSVQ1ddB60d3E6nXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636427828, "uuid": "7004d66a-2901-4718-8653-2eb4cce62f23", "value": 687739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636427828, "uuid": "6e001133-0dbf-46dd-acda-d4636de6dfec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636427828, "uuid": "94c0e657-4ffe-4208-b2a3-9b9fd4e9d5db", "value": "tt copy 200393903.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25b457e-4159-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636461457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461457, "uuid": "a450c54a-4d7c-46b5-aa08-462c97deb75e", "comment": "Malware payload", "value": "6a71eab9d6772283fbab5642d90680e7", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461457, "uuid": "c61db0dc-e98c-4e81-b393-6d01dcaf3e12", "comment": "Malware payload", "value": "86c623c75ae308fab4ec3ca485a838f5e5819f8dacfd0d8dfe0a6789f08ce50c", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461457, "uuid": "702640c4-7fa3-439d-aa68-f444c6ec7f3d", "comment": "Malware payload", "value": "443d75d228f16aa459eb7a4aebeecf243aa04ffd", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461457, "uuid": "4ae3c8d3-6be1-4064-9ce2-b6c304b67fbb", "comment": "Malware payload", "value": "e481184a1d8f96b39b4a30080800c7fc06539c7c4f02badaa6234ea17bdeadc5a59c8f1de06082eae1c8f944ae4f7eaa", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461457, "uuid": "48c36450-2c72-430d-967a-740e0b1a55f7", "value": "T142B4F1651AA0412ACEC96C354985ED3301622EB29BD68EA936ECDDE73FD730BD421731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461457, "uuid": "b2c8c7f4-e2ae-42a0-a9c1-5f7c3b4e7d1b", "value": "6144:hmFwRM0M1G6aBvjh3Jai6XgK3is7JU619az8bE9msvb3kTA+TTMx5yosY3X7XR4J:QwRZ4GF2iZK3BczKE9msITA+Eyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636461457, "uuid": "8d469262-2007-44de-a429-b0d33e27750e", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636461457, "uuid": "56581899-2675-4934-8e14-1799ac57702d", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461457, "uuid": "1960c738-d37d-454a-aeab-9e73f56e840f", "value": "INV9854784321.Scan.pdf....iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62428fe1-414b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636455256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455256, "uuid": "6a1c12f8-a489-496e-abde-53f1edd6630b", "comment": "Malware payload", "value": "40cf1b2365f4e6b1e631af2828db010d", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455256, "uuid": "d6cd7aca-d1d7-4055-9008-bf0bf2df1fc2", "comment": "Malware payload", "value": "87479482a298bc819f3f3f704e3321aa9426e34ff9e7d361fb839b33d9fadd50", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455256, "uuid": "219567c0-7640-4bf3-986b-60a08504d3dc", "comment": "Malware payload", "value": "c75d26574a4db58e2bb05fab9c3032134a9ec7a3", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455256, "uuid": "1170cfb7-3858-4196-9832-835742e5c403", "comment": "Malware payload", "value": "6b1281279086e5057e2a981fce141f02528894858ea2bff3be22490f12d8627ad803a96389e72d0557bcd96155029ba6", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455256, "uuid": "e520e8b6-ddaf-4a4b-8541-75308e9df5c8", "value": "T13CA4234A77ABA293579D48804BB7DC093F392716EB07D87F9B1B897AD602DC34144B0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455256, "uuid": "4fa67efe-2fdc-48cd-87ec-cd3eff3e6f05", "value": "12288:wCB41yrjsu9zSoGufWgR0B8AlHsADufl1Poh3QAXAJEM4:Q1gIu9z1tOX8uDClyhg5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455256, "uuid": "9462fded-4027-4f5a-a7e2-3d9cb01dff81", "value": 488719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455256, "uuid": "6e325752-0c85-418d-8d52-367cfe8c4e32", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455256, "uuid": "1e8700a9-b3ca-4570-8d44-6cd796fca321", "value": "Rpt~093873536733-0873654356783993gh(1).ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b7a875-41b3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636500091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636500091, "uuid": "01e28ea8-b18f-41d0-b611-897956643f93", "comment": "Malware payload", "value": "2443968bb4d1c9f5e99d4dd09fd754af", "object_relation": "md5", "Tag": [ { "name": "DEV-0322", "colour": "#95A03E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636500091, "uuid": "0f32dcf3-2ae9-4865-a33b-12e96cfc867e", "comment": "Malware payload", "value": "8785f1049eed4f837e634bf61468e6db921368b61ef5c8b4afa03f44465bd3e0", "object_relation": "sha256", "Tag": [ { "name": "DEV-0322", "colour": "#95A03E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636500091, "uuid": "707c8286-ddeb-41c5-9dc9-366e2940fd32", "comment": "Malware payload", "value": "d239b5bf253eaa8580f57fae633bad8fd7b604d6", "object_relation": "sha1", "Tag": [ { "name": "DEV-0322", "colour": "#95A03E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636500091, "uuid": "63f23541-3746-43bf-8387-5e0c83441453", "comment": "Malware payload", "value": "79ab4025200675985e833f8104c61eae5218bdb11d163a7900c56ffa57c9b64b123699f91bb3803c896bb430acba02a9", "object_relation": "sha3-384", "Tag": [ { "name": "DEV-0322", "colour": "#95A03E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636500091, "uuid": "64fdb4b1-979e-4711-bb99-5b432d27af88", "value": "T1A6911B84E405B4F7D61A909C968D3B431999754220A3A8303AEFBD4DFF33ADD0276DB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636500091, "uuid": "19da8131-eb57-418d-a785-a1fb5cbd7e1a", "value": "96:AlQkbvtMHNZvvvvvvvvvvvvvvvvvvvvvvvq/PDFrGtf+MVIOG9hGwdP2BCtKD:AlVjtIbvvvvvvvvvvvvvvvvvvvvvvvqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636500091, "uuid": "98157853-4d79-4ad1-a92b-9fe33b53203b", "value": 4446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636500091, "uuid": "50aedb0f-5f2e-4601-937e-9ac2f6f81558", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636500091, "uuid": "75eaa2ff-7369-47c9-afba-ef03cd7cef42", "value": "8785f1049eed4f837e634bf61468e6db921368b61ef5c8b4afa03f44465bd3e0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91af055a-4104-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1636424842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424842, "uuid": "e73653d8-5aed-4692-b869-2f7692783a65", "comment": "Malware payload (AsyncRAT)", "value": "35ff5f54ce6916b53bddc3b3d4acb854", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424842, "uuid": "49172a73-3313-42df-b1fd-2d3c22bbe4b2", "comment": "Malware payload (AsyncRAT)", "value": "878ae0892199581e106ef623d98801cab28341b1b969eaeff6a3704c580dce76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424842, "uuid": "4f01097a-8003-4118-abcf-84e1c2499264", "comment": "Malware payload (AsyncRAT)", "value": "f90ecfdef0c315285a43ee6f14717679916453cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424842, "uuid": "9d5f0920-3712-46ad-ad6a-8aca0baa3eda", "comment": "Malware payload (AsyncRAT)", "value": "e5e3181c69ac70166d059013bb91ca35fb8947e1f642785d56f644879aabeb5e6c2c077f05cb50f443e9b0ff0b6e8e13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424842, "uuid": "7848f945-cc6c-4d10-a87a-dd8bd80f78ba", "value": "T12DF501816EBC085AD4EAC6309D7E4A75E9237D13BA75861B3158FD0DEEF3340489DA0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424842, "uuid": "a75b59cd-395a-4c6a-a1bf-58c633da8e7c", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424842, "uuid": "e5cdff48-2c84-4548-91c1-26ef6d0545ff", "value": "98304:GbpCFEmjWSCAhmOk8iNgtUNIEzaNWeU+/4c:KGpKfoLUX4/4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636424842, "uuid": "2f4a1543-af08-4ce3-ae61-9e332aff265b", "value": 3424472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636424842, "uuid": "19e1cbd3-ea98-440c-880f-434dce868ec2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424842, "uuid": "5329bc94-803b-4355-9f41-5e812f8a97c7", "value": "35ff5f54ce6916b53bddc3b3d4acb854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944f0d00-415c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636462642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462642, "uuid": "aa451fae-865f-4a76-8180-a6c1a4e3dbd8", "comment": "Malware payload (Formbook)", "value": "957e62c8805a2d236fc460e0e57b019e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462642, "uuid": "ff66b881-5e3b-4d0e-9191-fed2f3f46914", "comment": "Malware payload (Formbook)", "value": "87b30f92275cf7dbcc9a89aad43219b0415e7459448b328a98bfef1257c5bbc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462642, "uuid": "d19769cd-a093-4056-8070-6dc389f5038e", "comment": "Malware payload (Formbook)", "value": "ff5b72ed8f96c84db22f98a831ce067018434847", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462642, "uuid": "fa04f19c-4002-485b-9fd6-efecb321579a", "comment": "Malware payload (Formbook)", "value": "a4c97e802c67e8bee32c035128971edd4e84af8eda1720917f9378df8cb0313548a6ce32133d08f92ad720749ccb976f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462642, "uuid": "47ae203e-7b1b-41e2-9a7d-38adf8df93e1", "value": "T1CC84D03413B59B5ADABC0B392420500027F7648EE737E67E7EE510EA2675F015BB2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462642, "uuid": "f19cffef-18a3-4b44-bd77-e2f22599fea2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462642, "uuid": "6ee1287b-a956-4701-9450-2d3e37a30a12", "value": "6144:6zO5kJ/Ugsi9W3s5Sr2YuSVBWn/dk3f9NEbAFdLPlptgEw:6zO5CHSBuSVBNVNPP73tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462642, "uuid": "2287e61d-9540-442b-9b63-3542b5b7a614", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462642, "uuid": "6a308add-ba64-4a02-b4a5-eecb727a6871", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462642, "uuid": "59128da1-a787-495a-afe7-ef0b9006d86a", "value": "PO03112021STK#Approved#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec6f29e1-410c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636428430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636428430, "uuid": "28216cca-e8f6-4e7d-b6d3-71c756f4023f", "comment": "Malware payload (AgentTesla)", "value": "a8ca36f1681f2492eeadcac329ea9614", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636428430, "uuid": "09e6d511-4f7c-4898-a142-11ff9e28a15f", "comment": "Malware payload (AgentTesla)", "value": "87dab01e6a94845c788a41a7f61fe3371f11e36286c176b04a1cfc76dc399923", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636428430, "uuid": "d07ad83e-51c2-42d1-b638-844551401de2", "comment": "Malware payload (AgentTesla)", "value": "5a6e4fd3df355650d4bd007309829c8ffc557fff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636428430, "uuid": "2cb93104-8030-4ee3-9aa9-a4238e96dcbd", "comment": "Malware payload (AgentTesla)", "value": "d22947e9df38e0ae327fbd6242b5b8dd5982f379de30ca826bfcde4490a9fb4b719f54bdcacd79be97014e16b49d8c74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636428430, "uuid": "72669dce-4612-4707-8dba-d5523b2a2036", "value": "T1B08412B0D3B1D93FD96A0B38A893610514F56B87A443FB7E038D50957F233D1A8E2B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636428430, "uuid": "9e0a924f-1068-435a-9e80-0c3721b4484b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636428430, "uuid": "55d654b3-ac29-4c34-93e9-ba274687ce36", "value": "6144:ZP3uwLeMKMTbKoSR9Q93LLBqrIyn7qO1VU00o5yq1FUzvj9OVsCb6kZV:kwLePPvQ97LArI7F0dyq1Yb8VsCGUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636428430, "uuid": "1ff4313a-1bc0-47fe-8e1c-e3417cccd8df", "value": 388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636428430, "uuid": "8d1076e6-8e3d-4c4a-b5c0-45c0c234514b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636428430, "uuid": "c5f2b040-2f25-4571-a06c-0354b678358a", "value": "Doc3105.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed256d79-415b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636462361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462361, "uuid": "2feb3251-34cd-450a-be0a-bf4e99981960", "comment": "Malware payload (AgentTesla)", "value": "de8ba3669bfb241195cde17a23478df9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462361, "uuid": "d4829a48-9278-42ff-9fab-8798f6404ffd", "comment": "Malware payload (AgentTesla)", "value": "8903d2eab032609849c63b469d3ee7af4769ca84b1fd5c5b08a4946aee47b012", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462361, "uuid": "371a0d09-cbda-49c8-ab29-e0011ac9a866", "comment": "Malware payload (AgentTesla)", "value": "f636f711b64dc72d9fb78a23224ce7badf2678c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462361, "uuid": "0caf5a06-ced8-44b0-b686-a9b4ea3cddae", "comment": "Malware payload (AgentTesla)", "value": "c1a075488f58c416a8d02a29c20927f771aeccf55e363f68388f088bcf5e3b1fc7e6b2c42df82da3c48755eb99331864", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462361, "uuid": "f7781ba3-f6f6-4afe-a647-98913af5f205", "value": "T142842327E12B8D7AA887D7B8433D7B009A0E2049273D35E4AD12D8FBA3937D5571A1F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462361, "uuid": "4d848394-2dbe-4fb0-98ca-115ed9e5234d", "value": "6144:Zj4lHcztt0wccdxVoNnRK3qRP+Lxb4JCEzoVzwvzJZSDzK+AI5lb8pDd:YcZzoNnaqR7JuM6zfRlb8pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462361, "uuid": "5ef3e8dd-93bf-47c9-b49e-a2305a22ad0f", "value": 373318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462361, "uuid": "8cc3e329-6c19-4c00-aeae-fe0464069024", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462361, "uuid": "3e98e959-8a63-417b-8ebe-507a233f0907", "value": "Purchase order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35414765-4138-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636447020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447020, "uuid": "4b2d6b47-8b36-4d0c-8889-fba0f4312c0b", "comment": "Malware payload (Mirai)", "value": "89c391ca151e91d14c45b7c58ea43167", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447020, "uuid": "82d2614b-cca9-4da1-a071-52bde42f27e1", "comment": "Malware payload (Mirai)", "value": "89b88aeaa86263db1e215cdd69694de3321ddef8da5a120183380455df1bd9e6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447020, "uuid": "6e4c3fb9-d0c3-4a99-a3fd-540c8e1c6562", "comment": "Malware payload (Mirai)", "value": "d5e56d7798ad6fd493bf872d555c67a17a7d9ab6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447020, "uuid": "a56a42d2-7e6e-4de1-b8c6-80e58ad7a3e0", "comment": "Malware payload (Mirai)", "value": "9dd79fb0dae41c9ea8ea429eb21c17399497a658dd9318a766fa972ced8e9349159ac4515ae74492a7fe85618952649e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447020, "uuid": "61e32d67-c6ec-4d93-af61-92a917b8ac40", "value": "T16FA3074AFC829F11D4C523BBFE0E028D335367A8E3EE7112DD256B21B7CA52B0A67551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447020, "uuid": "7f685872-dd62-432b-b1a1-712db4bb7a2d", "value": "3072:uCBx6qfW2NX+A5SC8RLutHafkIIBtOSG7xF0H8YwbZnV:3Bx6qfW2NOAF8RL4HafkIIBtO7gxwRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636447020, "uuid": "77f22030-6372-443d-b604-8fded4540399", "value": 106748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636447020, "uuid": "c12846e5-1a95-472c-ba45-7368dcc05643", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447020, "uuid": "ba66abd1-28ab-4f10-971a-d7bdfcd0adf6", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bea2fa5-4136-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1636446173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636446173, "uuid": "ccce6ace-5c7f-4e01-a370-f74b6d2810a7", "comment": "Malware payload (RemcosRAT)", "value": "2bb79871004e882e6d7a41b9b16e7353", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636446173, "uuid": "12908810-f5d1-4fd1-b786-cb10db705bf8", "comment": "Malware payload (RemcosRAT)", "value": "8a25ceb505dd2a4edf42f9be624def15d5f501c0dfebd0f8ed53b7ada0c56df4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636446173, "uuid": "ee694657-f365-4d28-9ad8-87c564f71276", "comment": "Malware payload (RemcosRAT)", "value": "6483769c5e068b1aa19687cdcc17d1d11202a857", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636446173, "uuid": "56a16deb-c2e5-4a7f-a936-ecf987dde3e0", "comment": "Malware payload (RemcosRAT)", "value": "b2fb2d844db68c7af7bbbf359ebdfe10246d8a498f8ff23c8d3487b6c50ff487a229b01161b8d84bdeab28f7a7dbb494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636446173, "uuid": "003e81e1-82ec-42e7-8f46-4940f421581b", "value": "T1C1054C21F58468F6D49712344C3A2365A679BF912A5408469EBB3D07ADF33C2393AF4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636446173, "uuid": "f9950eb1-e7cb-4841-8fc5-8f61dc563704", "value": "7b484975ebc1a121d346391a74418697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636446173, "uuid": "47c5e73c-0d06-4c44-a8c7-ea0ed45878e7", "value": "6144:6ty9J2eb9Vmcc03Dl2QEE12/ggyHISePm7lDW/Bl5Wn7DYKbQAJRPl68hTnUE:R9J2ebzmccYDJ2tMIMS/n56DT6mTnUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636446173, "uuid": "f6582e2b-3a6d-42dc-b6a7-4ff1ffed514d", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636446173, "uuid": "bdc24f59-38d8-43f0-97d5-ee1f6efe6fad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636446173, "uuid": "8b446dbe-f5b0-4c1f-a560-aae17d161249", "value": "DHL_119040 receipt document,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0e9bd9-417d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636476691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636476691, "uuid": "b398ed6c-6fab-4394-bd32-deef3c332173", "comment": "Malware payload", "value": "fe81c4c019a882268737d1ca01d47e17", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636476691, "uuid": "f9201dc0-98a3-4e89-bc0f-fb2f948f8d1f", "comment": "Malware payload", "value": "90bbf967f85123383ae0a63fba8962671c3f7672dad979d069fda2d9756e375f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636476691, "uuid": "da362788-819c-4f7c-a8d4-db2e9199e44e", "comment": "Malware payload", "value": "f3d4c3e9f4cee46d113e1376e504e3e96e634f68", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636476691, "uuid": "7c195ff1-9b96-45d8-abb7-ae92a26284ba", "comment": "Malware payload", "value": "b7e60f6348b42453909e0039e7b40500c4f7a9052ed124642d32d1695af8e8fcc707b2233f3147ed8f070fccd5f97f44", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636476691, "uuid": "d92d8c9a-4456-4fed-af21-8db10de8200a", "value": "T10284BE5C74290C6BCC9F097CDAA38B0AE9A5353043B9CAE74F7190BA9E53362453D772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636476691, "uuid": "8d5eea51-20c5-4827-9a02-aa88780a1a23", "value": "f373734e315a77aaae1f530b29486e51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636476691, "uuid": "92966786-61c7-4ccb-b8b5-022790fb39c1", "value": "6144:FH7/go/M746PR18MmFBJso9VBipjiRuiQ2TlK9YFx6DkPmvS7Bg1G:FH7xk4HPewrdQ2JlTPr7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636476691, "uuid": "ea591ca6-9c8f-439d-ab30-4686b42afe16", "value": 402563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636476691, "uuid": "c39a6fd9-f596-4a5c-8aab-0799da0c3caf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636476691, "uuid": "2a6bf684-529d-4f34-a1ac-5bb53a6ec7e6", "value": "zuroq8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79bcccfc-416b-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1636469040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469040, "uuid": "24c8f31e-e449-42be-9c89-0fb0ed9925f0", "comment": "Malware payload (AveMariaRAT)", "value": "cef3d5c15a2cb7e858d1c8b94c6fdabf", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469040, "uuid": "1684954f-7a44-4bfa-8b1e-15f4b46dbbc8", "comment": "Malware payload (AveMariaRAT)", "value": "90f94ee783ccba421832948f0ae353726520f7f72ad72c9ae4d45656ff30f880", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469040, "uuid": "964509ae-156a-4ba7-9043-14f912c101e1", "comment": "Malware payload (AveMariaRAT)", "value": "e196f142e6c3ae76e11c3dc6a7e86aff374dcdf2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469040, "uuid": "4e33f5f5-e1a9-4d16-bd43-1ff91287920d", "comment": "Malware payload (AveMariaRAT)", "value": "2b2564d1e5e09e7b02ed123bd0c4bd59db9695d093a05ed37a2588d9d1f2cde7490470f32409301eb6c8bf5e6dd6baf5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469040, "uuid": "d763a889-18ad-40bf-b685-caf35c23f6d3", "value": "T197641220D2A0C0ABE53386741A6E4F294BFFBD141E608E475371291DFA73AC2E51F35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469040, "uuid": "e140b922-c88e-405b-9357-260c6a32066d", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469040, "uuid": "8f9729e5-d0fe-4ec1-9a48-354c2c225e51", "value": "6144:mbE/HUbzxHxJhb1wBqWXUimhK9mmPSgYFB8LEu7YQDH1C6flU1AeUpxL2g:mb/VRJl1wBD6hK7YnqYc1C6fm1AtxLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636469040, "uuid": "e35065c5-8d86-4a7f-8cca-cfbbfba252c7", "value": 319708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636469040, "uuid": "feea6ab4-a3dd-4d8a-87f2-ca84cdee7130", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469040, "uuid": "76f6de75-3658-4b12-9c51-990dcdf52aa3", "value": "LISTA DE PRODUCTOS,XLS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9333708-4144-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636452503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452503, "uuid": "b4fb8a82-05df-4892-b0c3-06e9b4fab97b", "comment": "Malware payload", "value": "35806916639b81c8e5a0e87158385afe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452503, "uuid": "762b89d4-464e-4179-8356-056fc4303542", "comment": "Malware payload", "value": "918f98e66f1aae5bebe260cd5ddb4336318dc9a4193f130ac680ce3847bdfa9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452503, "uuid": "ad2d1751-b7fd-4beb-9e84-5dc2200c9105", "comment": "Malware payload", "value": "1d015d5d3551effb2aade815a0cb889c902d450f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452503, "uuid": "a84983f9-4d3e-4114-b2f7-d9052c4a7bbe", "comment": "Malware payload", "value": "80c7911042954a2ef9a052d94faca8c9dcaecc0df22f09f8ed5b5ebc108f16e448e5f63006db5acdabbbc0e086806f52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452503, "uuid": "d118cee6-535f-40c4-9bcd-75487a873cba", "value": "T1C8056C92D2947CB5D86221344C6B572261397FA13A2B58065EBF3C177EF32C12937E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452503, "uuid": "b2054f1a-efd4-4820-ad49-e013791f5af3", "value": "7b484975ebc1a121d346391a74418697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452503, "uuid": "35b66af8-161a-4c26-803d-cc75d93554a6", "value": "6144:6ty9J2eb9Vmcc03Dl2QEE12/ggyHISePm7lDW/Bl5Wn7DYKbQAJR+l68hTnUE:R9J2ebzmccYDJ2tMIMS/n56Da6mTnUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636452503, "uuid": "547968bb-c273-4205-a6ba-4d9342cccb59", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636452503, "uuid": "68c4c24d-db46-4511-8365-ead6cab3e80b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452503, "uuid": "3771811b-3752-4ba3-a6ef-53d4839de392", "value": "PI 01KSD-AB2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f33642-4146-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636452977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452977, "uuid": "b0a001e4-220c-4cd7-a84d-246729c35f90", "comment": "Malware payload (RaccoonStealer)", "value": "a1cbc7aafa8e36e4df1fd759def71e9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452977, "uuid": "6d5677a0-1191-41a2-b1f2-e689926403a2", "comment": "Malware payload (RaccoonStealer)", "value": "92f09a639a1571411d84698a3efd2b50b203423b7baa78fd367545b0a56b42bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452977, "uuid": "fbe842b9-cd19-4e22-b6fa-84cd06639b3c", "comment": "Malware payload (RaccoonStealer)", "value": "00a53beaa38c2f0d7e976c846120f8d4607daa3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452977, "uuid": "263cedcc-1977-42b8-8011-5ac812edd89b", "comment": "Malware payload (RaccoonStealer)", "value": "77855a4d7230cd40aff3fa73c6737e55aaf4e4938cea6a9236e345912b31534932c5e630acc2a597501abdb2719bcd3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452977, "uuid": "b5a564b6-621a-41a2-ba4a-bd7057430199", "value": "T116C4E020A7E0C035F5BB62F45DBA93A8B82E7DA1672490CF65C522DE57386E4EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452977, "uuid": "991abcda-8c76-4935-8545-7d8e8e633e75", "value": "61f5dd277d7d233f85b676d434ad016e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452977, "uuid": "47f4a1d7-e4ce-4d24-96c7-50508ebfc170", "value": "12288:Rbi780Jd4nphqyXAGlsh3D5jS4o55S6HL8PjwdV:Rq9d4phbw5S1TjHMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636452977, "uuid": "f5ad2709-81ea-4040-8ca7-4eec1200bd21", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636452977, "uuid": "3403066b-2616-4ee8-8eb5-17b2750e0115", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452977, "uuid": "8b92db77-f61e-41e8-babb-c3fde7b6d6ed", "value": "a1cbc7aafa8e36e4df1fd759def71e9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ae1c41-4143-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1636452006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452006, "uuid": "9f680c56-05f5-4c55-9776-6aaecb12b2a7", "comment": "Malware payload (Loki)", "value": "036fb99170815a3570a3157335e66dd8", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452006, "uuid": "39b94d25-24d6-4113-a8c6-7c4b3e05b01e", "comment": "Malware payload (Loki)", "value": "959a1f5fbef23f7ed04a0f7a011ebd9f3ab823a0f25e0c3c5ec03378ec716b37", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452006, "uuid": "41c1ee1f-9fa5-465a-ad72-cfbbfffe8907", "comment": "Malware payload (Loki)", "value": "af9f8c77c9aaeb50532f4edb4575be4dfb8c558d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452006, "uuid": "ec0a01b9-dfeb-409e-b64b-ccd4a292196d", "comment": "Malware payload (Loki)", "value": "f41e465359393b5d132a7ad24c2374274e53eb68ceb509c04dbaf765f5bda9e60b2615836b2f6a46ebd57f37b3c70884", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452006, "uuid": "ebb84ec5-d117-4358-9486-f74d3dbd76cc", "value": "T1DF6412B5BB81E3B7D323277C58288954167CDDC3CB21492E3295321AC7B1E51BC39BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452006, "uuid": "9f83a437-7c4a-41a4-bef0-6feaee80d89a", "value": "6144:4SrlXZt55e3a/WE59pbBRlD6OYJVAmMjs9zpc45PnKSxirqn9tXlfYpy:5XZ3+afDb9DEVAmsezC45nx8E9Ipy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636452006, "uuid": "606d88c8-fec8-4e3d-b7d9-8817b59ce4ae", "value": 318696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636452006, "uuid": "4dcf3cf7-7fde-476c-853c-9b725c3f7c13", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452006, "uuid": "8ecf3f28-51e2-4fed-8790-45bcd37e4a6a", "value": "EPDA MV VTB 36.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a0fef8-4126-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636439243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439243, "uuid": "975dc8a6-fbb5-4a92-9601-a2d26bb65608", "comment": "Malware payload", "value": "97182c50da2cd7d4adef4c9f444aee4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439243, "uuid": "deea77b1-0039-40ba-8688-3cfc907a0569", "comment": "Malware payload", "value": "95dbf9f2a923566a44a163e18dafbcaae017e6adba0c1134fd915dfe95b3d30d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439243, "uuid": "1f46b8a3-973a-4602-ba4b-74af3f3fe99a", "comment": "Malware payload", "value": "b2bb60e79f160972fe1082689e2fa310f4f073d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439243, "uuid": "70eca068-3b5d-495f-beeb-eb7f7eb6ff0d", "comment": "Malware payload", "value": "cff9a605aa9624862e87225823440e3f817181d185e4bdeae5d10d1ede263214c070bf0d7a4d753c1862e074e0033954", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439243, "uuid": "e8f06582-ffea-4aec-baad-1069a390305a", "value": "T1C1F1F900E7F44633DAFB4531A8B3A2904330F3166953E76E78D8016BAE277D48AD2B65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439243, "uuid": "cdc3008b-2363-442b-8cf8-3f2e9646c514", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439243, "uuid": "730df484-722d-4349-b2e5-43be773b9db2", "value": "96:i8deGuPTCfb7t408i7l635FPpGwWxeXmR6vQIqH4zpJUzNt:Jks7/l63/NWxeX+ImWje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636439243, "uuid": "9b5a1120-953f-4a0c-8f14-e536b8b98c16", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636439243, "uuid": "ee69bdf6-5b6a-4d5c-95f7-4b91e857d8a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439243, "uuid": "1213dfda-3dfc-47aa-bcba-4524ff7ab09b", "value": "RFQ-SUR-MEDICAL00962,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f526cd9d-413c-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636449060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636449060, "uuid": "8e3fc8fb-d8e1-4e41-a3ad-d185230930ec", "comment": "Malware payload (RaccoonStealer)", "value": "4aef7f5ead7d2b6cec38712cd32c320e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636449060, "uuid": "2c29f060-ff5f-4170-9da0-8106bee31ed3", "comment": "Malware payload (RaccoonStealer)", "value": "983cee3f2f8bed3fe80d8072d55a2011d2734cc074c8de181f95023cdccad3e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636449060, "uuid": "638e61bf-5690-46f8-aacf-c454950b32df", "comment": "Malware payload (RaccoonStealer)", "value": "08e776f47c84486c4580665cc32aff22c2c8dac2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636449060, "uuid": "e4ec318c-aa35-4e94-949f-887c2fae6c37", "comment": "Malware payload (RaccoonStealer)", "value": "483d77ac00c59b9cf3df15ecd7cab0f55be90fe84a511a70cf2d0fdbe9c5106fd9af3c2f756da07278e298cc499fdb09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636449060, "uuid": "c2c96d46-e666-44da-b17f-c6203a4158bd", "value": "T137C4E010A7E0C038F5BB62F44A7983ADB93FB9A15B6594CFA1D516EE56342E0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636449060, "uuid": "9ed8ef1b-998c-4905-9831-5f6347b0aa6d", "value": "a24faa9f4919afc00d25c1c4d020aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636449060, "uuid": "bbff71c4-59a1-4667-9f22-c2701afb30c3", "value": "12288:3V25nUYajwQP+Qif/MKiis8e6HDWDzbmRd/cmFf:385UYajLGb/MKiis8eiDWfbkVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636449060, "uuid": "356daafa-33c4-4dde-8286-34db3c6463d0", "value": 553472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636449060, "uuid": "ffeba125-454c-455e-942c-ce1e9a488771", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636449060, "uuid": "1c985248-192a-4e41-b3c5-6348e174efb9", "value": "4aef7f5ead7d2b6cec38712cd32c320e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7018d43-4117-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636433118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636433118, "uuid": "eadbeeab-2979-4fa6-9bec-6818d081b684", "comment": "Malware payload (AgentTesla)", "value": "ace80d9eb4e1b4c7fd7983b768705ef7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636433118, "uuid": "3ed36e93-6c9b-4071-a0ac-2251640eae8a", "comment": "Malware payload (AgentTesla)", "value": "98f5ffcada482a6c74b4cde60ff25be635e9a7d61373ecf13200bc497dc2582b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636433118, "uuid": "6727a412-0453-452e-b875-d407fcfadbfe", "comment": "Malware payload (AgentTesla)", "value": "97484b7a1dfa1f56dc78bc8cde8489c8052d53d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636433118, "uuid": "4549ae74-4116-4c38-80c7-218c3d572fae", "comment": "Malware payload (AgentTesla)", "value": "4835a90924365efb6bfa1c746a2eb5144ec897e1f41561edcbb1bc306b8f6416922c34f39f549930406d89f337d10759", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636433118, "uuid": "28dafc14-aca2-4b0d-8fd8-cfe55042a58f", "value": "T123A4D0C67BA05853CE05D63DD22E6F0659272FB86BE1E20FD64574637BF37C90802A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636433118, "uuid": "f09510c0-13b5-4f28-9052-43e65cc23402", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636433118, "uuid": "f533886b-636e-4fd2-b000-35b02d723292", "value": "12288:9whwPePLyqHBaCsdM2RY2LCq9SjRDbrRJ4UNVJU7NmeeK:2hwWPfoCsdM2RY4XsFrIUNVBee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636433118, "uuid": "c598057f-10fd-47e7-8983-83713c410882", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636433118, "uuid": "9b36c0ad-b7af-4150-a0cb-eb3e7cd4260a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636433118, "uuid": "b9d76443-5e1d-4e93-8f78-1b531a8b32da", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d367ee8d-4125-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636439125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439125, "uuid": "aa757784-7d1c-4b19-9bbe-14510ec58b08", "comment": "Malware payload (AgentTesla)", "value": "40c60b14a43ef1e8a0c3c60be520746a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439125, "uuid": "d0fcabde-03ba-4fd5-8b68-023b1a538360", "comment": "Malware payload (AgentTesla)", "value": "997fc575e5c26ec6ebeadbc57f8378151a48966297121044100edc1fa91a0192", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439125, "uuid": "7f6854b8-1618-428b-9b2e-6fb25d9447ea", "comment": "Malware payload (AgentTesla)", "value": "b574b6c24a9d8cecae0deaed37790b6efb06d24f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439125, "uuid": "e8ec5c0d-e52c-4347-a440-85f2cbc55757", "comment": "Malware payload (AgentTesla)", "value": "47904a2cd57107a7a631ebec30f18ae586661cc644527aece0f8171deed714e1b61ca707f42daa1bf79ef34587394189", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439125, "uuid": "bfb6c24f-d4cb-4b5b-9949-1040942aa556", "value": "T1F5B4BE7A32517DDFDE278DB68D502C90AE643877572FC203D85B01AA6ADD4A2CF248E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439125, "uuid": "0c990da3-47f5-4130-8602-94876b025ef5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439125, "uuid": "3425cfd6-44f6-4f50-bfed-e25f347653b4", "value": "12288:8FqJFTPnq6UZXJVtqsGYt3PoAAvoazgPfD/x7bvEzI:oqDq6UZZV+Y1Svocs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636439125, "uuid": "63d16442-f2c2-443d-b316-d3fcaec3f8f0", "value": 512512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636439125, "uuid": "5db5286f-bb0e-4a3e-b4f5-d8f26fc81f0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439125, "uuid": "205e9ac1-3f2b-4555-ba35-b4702887e7ad", "value": "184285013-044310-Factura pendiente (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10424a12-412b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636441375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636441375, "uuid": "6aefb1e9-5119-4b64-bf50-2ea78ae2cf75", "comment": "Malware payload", "value": "0548c15a53d84b49f04a0903eebcbbd9", "object_relation": "md5", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636441375, "uuid": "329c7c10-a761-4bd6-8ae7-f6a57df8ebc5", "comment": "Malware payload", "value": "99c190a10bc8d43f696368584ea05abe3977f8f6994eab610660fb154309aad9", "object_relation": "sha256", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636441375, "uuid": "149b10e4-f6ac-4851-890c-ba0b415c903e", "comment": "Malware payload", "value": "42c4086ee9537fd7ffadf6ca62c83e6e42e01b87", "object_relation": "sha1", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636441375, "uuid": "029e76f5-e013-4c83-b6dc-563dd74bfe6a", "comment": "Malware payload", "value": "b2871fb78bb2e9cb76fabe9900c4d0bb72946491721d03b99616705c5d96b7e0dc460f8d17a34acdaef5bf4c974830b4", "object_relation": "sha3-384", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636441375, "uuid": "ee095045-ce56-4caf-b94b-2cb20448cd9d", "value": "T114349D16BB9BC9C2E39C563BC1D7A2100339D7A65733DB0BBA8D13F50A037E69E41646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636441375, "uuid": "7408602f-a312-4a47-919a-26dc69e5f3b6", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636441375, "uuid": "cd916085-b159-4b08-b958-867294c8addb", "value": "6144:5lY33cq8yM25SYqfexvvpbZwaF+2qDXkDCKQgKogG2ss:fY33cq8yhSYuedvl9oXwagKL+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636441375, "uuid": "35e80855-4cd3-473a-9bad-641aed9d3c35", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636441375, "uuid": "dd1585a6-c873-4a9d-9a8f-b7e5eecab64a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636441375, "uuid": "1d69e0f9-b168-4a36-a637-bf52f08057e6", "value": "Ffazaxqvhcosemtvlwbhlnxp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4b474e-4133-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1636444888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636444888, "uuid": "ea1723b2-d190-4de3-b48a-c715ec272de6", "comment": "Malware payload (Loki)", "value": "43158c05c7a6757eb07a4dc0feafdcb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636444888, "uuid": "c837f0f4-73db-4992-9229-1406d0d11eb5", "comment": "Malware payload (Loki)", "value": "99f21ff769a035461b4e83a82811ae8eab0a02ce804b00f10116048701619a30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636444888, "uuid": "a9af3cdb-5b65-4798-8a79-2ac304128e6f", "comment": "Malware payload (Loki)", "value": "cc1312c545516d124a9d46659dc72d0bca23139a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636444888, "uuid": "0d2fff6f-9bbe-4410-9b4e-e00d28a4f2d1", "comment": "Malware payload (Loki)", "value": "7be50f8bf60fcdfb04a63d98f5eb8e06bb4dc6423dd970c4b5d37496ea0fa7c0d38d2e5d305e123716243668b24b67bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636444888, "uuid": "a2617484-7c2b-4311-99b4-a443119459c3", "value": "T151843A56731B8546E818AFB49EB33B710320EF6654315F13D2D67E6DB03B29A6E80F42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636444888, "uuid": "a7b6d738-66bb-4c30-8818-549ffbd48755", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636444888, "uuid": "067b8e84-15a4-4e14-8021-f99fbd4d375d", "value": "6144:FbIG+n2kc7SBWPTJzCFso1ZoccR79XDynJYiUB/DPBl:/FdPVzCBoccXX+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636444888, "uuid": "9dba8d88-b8ac-4cdc-8c48-9f384d1dd893", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636444888, "uuid": "8b4359cd-3477-42b3-8281-27db585065c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636444888, "uuid": "1a7e2315-e50a-4a76-87e2-82a00112c3aa", "value": "2tSPPrzs7DVXvNf2nDFh26KHz5UUh7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d0d0eb-4162-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636465309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465309, "uuid": "b96033d0-b1a8-4c33-ab9e-e8fd06cd6665", "comment": "Malware payload (Formbook)", "value": "277707f333971d894214e2dd3eca46c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465309, "uuid": "f42fc54f-c236-46a5-b414-8f562a5dd75c", "comment": "Malware payload (Formbook)", "value": "9a476d9eaca8d1c370dd3b25a1b99fd202321df9ef39e1254ddf6170d29e700c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465309, "uuid": "847f5078-fc00-4fd2-8090-79a90aab48cb", "comment": "Malware payload (Formbook)", "value": "7594df29a2bfb1ad881310af57e18247c49434d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465309, "uuid": "a9273e1e-281d-4773-838a-e23ab96f27c9", "comment": "Malware payload (Formbook)", "value": "9e0b5c109fd0499472391e9596aaa15a8a4b9568b1765bd6001d64d881de26ddf01d0fee5e824f603a266350b98d450d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636465309, "uuid": "5e5d722b-dd75-42fa-8d42-9d8f15440f27", "value": "T1F8056D61E695A9B0E46636308CBB2339A1357FE1752949026EBF3C122DF33C12574E9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636465309, "uuid": "b57e1bab-0831-4f5c-80b5-0a9bed1529d2", "value": "7b484975ebc1a121d346391a74418697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636465309, "uuid": "262fb361-11b5-406c-9c82-b49e0dd23a8a", "value": "6144:6ty9J2eb9Vmcc03Dl2QEE12/ggyHISePm7lDW/Bl5Wn7DYKbQAJR0l68hTnUE:R9J2ebzmccYDJ2tMIMS/n56DE6mTnUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636465309, "uuid": "f0023050-e0e6-4ea9-8359-f9c3ca246c25", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636465309, "uuid": "f4ee4a7c-3db2-4bf1-b806-66b4bdad204a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636465309, "uuid": "7a513b65-b91d-439a-8d14-12f95812f58c", "value": "Request for Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6eca87f-4148-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636454164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454164, "uuid": "29130386-a601-44c9-9ea4-f7c5f0b84a0e", "comment": "Malware payload (RaccoonStealer)", "value": "b68543c7e6a539ba98c0e76a18ddf904", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454164, "uuid": "4af4371d-af44-48ce-be0a-7c3d291de6a2", "comment": "Malware payload (RaccoonStealer)", "value": "9c1aa3258dc36abfd0cf8d90ad0b823d917ad1d24f6e19a499c5638690136aad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454164, "uuid": "ee6a8b8f-edb7-42bc-91d7-4ddae501f7ed", "comment": "Malware payload (RaccoonStealer)", "value": "eec566939f415e0b98cc80b82b7a317ea9341c5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454164, "uuid": "14de1ab7-9b8b-4479-9518-6d8c78d405c3", "comment": "Malware payload (RaccoonStealer)", "value": "08913c4ab2d1007a465221b2918d29614adb629933993576ab9506d1deb84152def4c76fe83fde24cdb064f15d7031dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454164, "uuid": "11948d37-0066-45ca-aeca-8ba746426889", "value": "T196B4E111A7B0C035F1BA12F8597A9369B93E7DA16B7880CF62D517EE26346E0EC70317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454164, "uuid": "8198a5eb-b84e-4477-98c8-cc1cde1dc017", "value": "ef5891f13814421fd185279f57d98085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454164, "uuid": "918a60d5-caa4-4f4a-a682-42b7af4ccd50", "value": "12288:ud3uWFuw3GqITfb+85xbYvkN8bok4IJovKOHWFGVAAFPo0W:ud+Wgw3GprxU8N8snIqKOTAwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636454164, "uuid": "149f9d4a-e138-4f89-893f-d0be3c9c423d", "value": 506368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636454164, "uuid": "3add41d1-b3d9-4bc1-a0aa-8070d9067502", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454164, "uuid": "2cebf1a2-d77f-453a-80a6-7aae8d69835d", "value": "b68543c7e6a539ba98c0e76a18ddf904.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e83f022-4154-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636459035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459035, "uuid": "d8248558-5c60-44a2-aa5c-a8bd31ce59bc", "comment": "Malware payload (RedLineStealer)", "value": "0932fae95e5f72b4197925a188e117b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459035, "uuid": "0a745f11-2824-4e09-8c57-1568b55c2f06", "comment": "Malware payload (RedLineStealer)", "value": "9c42fcdcd8bfe4c41f22cc186219a0f2879fa0d53e556106e8842a5efabcf5a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459035, "uuid": "45fe6801-ddb9-4542-82c9-dc77660dc376", "comment": "Malware payload (RedLineStealer)", "value": "9cbff90ca6f5821c369a56af4f459ae158abe2cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459035, "uuid": "fb90c3a3-d312-48ff-83d1-c75bb11c4926", "comment": "Malware payload (RedLineStealer)", "value": "5c69fc69f3376a5e1c59221885e826f0d8d826f835f2f6fd2309798742255c8c03cbc5e62513b580b2589ce9b849f0ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459035, "uuid": "941b4f54-c122-4660-a8d8-4d85c5c079e0", "value": "T126243A1C7758AB21E77D8435CCF00100E3F6D99A914BD31AE9C035EAEA92BD8E715E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459035, "uuid": "480e3d97-abd7-4c0b-867f-74dd38cc88df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459035, "uuid": "f207d21d-7941-462c-9e9e-4921b1c2b81a", "value": "3072:p1Sv67qr3AE1+RJVAHuc5+FfK2Do35PwGPl2I:pKFOSHP5+hKGiPwGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636459035, "uuid": "881db078-ee22-4852-bb48-ce23fd650462", "value": 223480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636459035, "uuid": "171c5153-f5fa-4f5e-b886-983caabba0e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459035, "uuid": "15df659a-bf43-4d54-b1c1-cefff6f6b12b", "value": "9c42fcdcd8bfe4c41f22cc186219a0f2879fa0d53e556.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2df554-4104-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636424757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424757, "uuid": "f36dfc03-7500-4ed4-ba39-17ef30627815", "comment": "Malware payload (RedLineStealer)", "value": "c0b25d240cc48677dd24e0e20c539deb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424757, "uuid": "c60892bc-b6b8-4cf1-9130-73143480dc12", "comment": "Malware payload (RedLineStealer)", "value": "9d7e314361860f13fbc4e7c226aa9e8191d916dde45802597a7bb6e794a2f218", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424757, "uuid": "1f0a24d1-585d-4945-936f-15784a98ad93", "comment": "Malware payload (RedLineStealer)", "value": "f70b06661ad931c2fd77b2ba017991bb4bb2a14e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424757, "uuid": "9d1c183c-44b3-4d25-9da6-56bbf5fda8b8", "comment": "Malware payload (RedLineStealer)", "value": "00541d461cc06d6826df54f75795b369d5619c0aa49261ee98c88e66fbb7671b3a659212548bcdbe8a033a1b8cd551f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424757, "uuid": "9f18b896-a8ef-47cc-b4ff-ec35553ce0b3", "value": "T10F349D3176E9D860E0A31EB048B5D6B41B3BF8615930510BE750679E2EB3F8C86F635E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424757, "uuid": "d409f4c4-d9be-4b0b-9238-c0442d77a437", "value": "d258636f72d347eaf01f17dafac75115", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424757, "uuid": "ed2983ce-c004-48a3-9d7e-fa2fe810ebf3", "value": "3072:UVTO8XEfribRd4n08l66zlG2kfq+gBWrxpzbgqruXhs7sxkgaBChU/pZa9uD6Vd2:UCribRdqMelgS+Quzbgwu6QigabwVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636424757, "uuid": "d77925fe-f50a-44b1-aacc-9da2cdd882d4", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636424757, "uuid": "d187ff36-15bf-448c-8212-4cc4931a3cee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424757, "uuid": "086fa5a2-1485-4f47-8043-96bca7ff8695", "value": "9d7e314361860f13fbc4e7c226aa9e8191d916dde4580.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d64c2f-41b6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636501267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501267, "uuid": "a4cb0fcf-f94b-4561-b7c4-23f728f9156a", "comment": "Malware payload", "value": "cc37429c1a2b65de8dc5e27c79b614a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501267, "uuid": "13b60267-7dd1-4431-bf11-5db54c46dcca", "comment": "Malware payload", "value": "9e85c87886896c25a34bfdca7eaffd5d89e773bffe5edde32ac3f3b3f298c83a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501267, "uuid": "0d642fb1-8297-4e6d-837b-52e338d2c08e", "comment": "Malware payload", "value": "99dfc4fa08cc7373620f489ff1da8495eaeed67c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636501267, "uuid": "f951168a-e042-43a8-95f9-1b29a8e3d557", "comment": "Malware payload", "value": "bbc99a69e014e5831bcf9fb66aabe77b0a0d8703c1c8b050a6ae3218a69eefff295f2872d0811dd16d0431b4a34dcc26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636501267, "uuid": "3c941a8a-b459-497c-9d80-b96bd5765312", "value": "T14F24D019A6DD59E5C01E46BDBC6031242375AD5A2513EF1E4F40B0E86E7B3A08632FEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636501267, "uuid": "a5c83edc-14ce-45a6-9eee-413d4e8a29d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636501267, "uuid": "44297923-7d37-45f6-aff0-839de4534c86", "value": "3072:PhGiZdWkZEeFh3DYs5Q8GvSQQDrb4D3Y4jqw5grA1rlTz0zP:PoiLZEeFBDr5pGq1D3Qzz5gclT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636501267, "uuid": "1e8c2fe2-eb1a-4613-9da6-d3a185223fcb", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636501267, "uuid": "e5b9af89-3d1a-4e01-801e-1d4377d8c353", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636501267, "uuid": "c7872931-26f4-47ab-8072-475b461370ea", "value": "9e85c87886896c25a34bfdca7eaffd5d89e773bffe5edde32ac3f3b3f298c83a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db250f5-414c-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1636455651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455651, "uuid": "0a54bc17-dac1-4f79-905f-5bb05055923c", "comment": "Malware payload (NanoCore)", "value": "61be9e01a81fbfd60e77ccf5b3951c8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455651, "uuid": "1ab6e4a2-b3a3-4e71-9c5f-e7ef133a77cd", "comment": "Malware payload (NanoCore)", "value": "a044962e2dbef3676d217bb3d8bf88fce5534586f32837fe3f91ef4e748423ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455651, "uuid": "390a3296-10e7-4b97-a12e-0d1c7ce4f095", "comment": "Malware payload (NanoCore)", "value": "995d4cbd28f002b0a83a7b9c3253f6a8c89dc0da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455651, "uuid": "3f48ed9f-75e4-4450-baa1-a33234b4f82c", "comment": "Malware payload (NanoCore)", "value": "71025f6f1cbe090d259679f3c0528fe2cf7664d3e3a22ea4058038609341075323188bdcd791da1f070efd197b25fec4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455651, "uuid": "152d2d7f-2fd4-40c8-a82d-4d660ec1910a", "value": "T14A155C02BAD58C05C37A0731485BA12CDAA86D6B653E8218BE9E337B2F77B11055773F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455651, "uuid": "61fdcf3c-9e2b-49c2-a589-2f83c126e9b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455651, "uuid": "a28545c0-bb18-4d95-8c20-cd283e4a9cd4", "value": "24576:wgEzh5BhvnYjp5wylGy5hdV08mJDro1A70D:wMZ+l0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455651, "uuid": "93abcf3e-c7bd-4e96-8b9b-8344e7e30f2f", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455651, "uuid": "ea1b596f-87a9-4e03-a7fe-8bbbd6a378c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455651, "uuid": "e6a6f39e-50a2-480a-b583-2cf95e059db2", "value": "PURCHASE ORDER EXPORT1024 SCANNED DOC_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4593b9df-414d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636456067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636456067, "uuid": "fbea8678-50ea-4713-80f6-f08fecff0076", "comment": "Malware payload (Formbook)", "value": "b82dfdf9ec6fff6c1100b93e14d30cbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636456067, "uuid": "ff6b5282-3135-4c5b-bc1b-2d774adfda87", "comment": "Malware payload (Formbook)", "value": "a18f7cb393133e6b54f23159c1480d371097db37e16bbe40592cad1342306843", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636456067, "uuid": "70f1a161-ba24-40fa-9746-3fac10b2df86", "comment": "Malware payload (Formbook)", "value": "4b5d0e84efd4bb8cc4b4d658a579997bf41bbb0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636456067, "uuid": "76a5ebb9-5243-4b3d-8178-85ceefd3e5b9", "comment": "Malware payload (Formbook)", "value": "ca35d9f5e0d404a4703f2db2310fb739c0f125b964d9de372a73fb1dce40cc047c85ab1d2509bde9148877d7c4c0eb31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636456067, "uuid": "e4139ed7-66c3-4754-91e7-72a35edc8314", "value": "T1E774025AB265882AC98A5137DC9B7900077C3186A9A3F32EB7FE53ADA4353D111437CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636456067, "uuid": "133941f3-ea60-4fd6-a6f5-34837ea7a1b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636456067, "uuid": "540a84ce-cb21-4586-9608-65a37a897279", "value": "6144:1WTe6SMkMGtvJIAgwka0dSG1iRBNPT7dnXEBoaPhhGyqls3cB7boM2t:1W66STvJNk+Gq3PTZX+o8w7kD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636456067, "uuid": "696c5c9d-7c45-4bbe-b97a-5ffe1f766ad9", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636456067, "uuid": "c8649a9f-924a-4b44-97a2-e271ac308c6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636456067, "uuid": "05bc172f-b735-4b1a-94de-e095b37928b2", "value": "kA1GNOTJ2VgnL02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125aad85-4179-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636474879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636474879, "uuid": "24b20a6e-6fc8-4d39-89c3-5331e4aa0a6b", "comment": "Malware payload", "value": "b1343d0ca05adf9d609cb2bfbcd79b44", "object_relation": "md5", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636474879, "uuid": "9ceac0d1-b4bd-4f38-be29-78d851cab7e0", "comment": "Malware payload", "value": "a23407d6057e0203bcc4e1b0a77ad8eba2edfc035e5962697c354a8bf362f30e", "object_relation": "sha256", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636474879, "uuid": "7c6ae1fa-9554-4f46-9b8f-f77d2ff0709c", "comment": "Malware payload", "value": "90c4a66fa1e8872cbf6f9c84ff8b0800eddddca6", "object_relation": "sha1", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636474879, "uuid": "d41b40b5-c911-465d-9c50-c72219472216", "comment": "Malware payload", "value": "d44a8fb4929f16f4f514bf437e319ecb0d38c49a7bd6d3704ad1a5bea443f6c25e965c52455aa8545c401755052dd40e", "object_relation": "sha3-384", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636474879, "uuid": "a51d4988-8c56-41d8-bd34-560edaa6d047", "value": "T17B9423D18C6EDD350A1C0034C35907A0A322927CD7AFEFE86A96B927D31D85A0DBD5ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636474879, "uuid": "66d20068-be36-4b45-af4d-a61035020815", "value": "12288:GWeNJC3CIHfE7akICa5DRMgnSBuvuUTIibLDGoWu:2PC7/Wa2aNRfS47fGo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636474879, "uuid": "edf98025-ab07-499d-abf4-7e08ba57e5c2", "value": 440897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636474879, "uuid": "68582f10-594e-49a1-b78c-faf822ce8008", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636474879, "uuid": "0a18abbf-c05e-4d26-8182-c63d63dfd256", "value": "PAYMENT SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5315fd13-4144-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1636452224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452224, "uuid": "563a2ea7-68d2-4101-aa54-05406af7fefc", "comment": "Malware payload (Loki)", "value": "95cda983b01a1425d46a0690c4d27b62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452224, "uuid": "2071d8c7-e4a0-4e37-8749-132ce72850ef", "comment": "Malware payload (Loki)", "value": "a28729214322b6d5f62ab95648edd82c57a584c22ec19190169ba5a49f56c2d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452224, "uuid": "a6235fc4-4aaf-416e-a649-1f7d136f29b2", "comment": "Malware payload (Loki)", "value": "65fef7fd8370d292b22f20ac697d91c99f67a677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452224, "uuid": "e93d9143-b6bb-4746-bb47-938cf99891fb", "comment": "Malware payload (Loki)", "value": "f8586a93090121f6d467c684f46b206b15ebde999775e7cdffb6c69f2a67ac6b226a1c971412e4d1d53a083380252ad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452224, "uuid": "1a5cf796-3129-4a79-97d8-140c629a095d", "value": "T1415412B117A4492FCD6A0B39586337C1567061C2A843FBBD4F9C90EE3A773A5D482B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452224, "uuid": "d76de22c-2e60-4d60-aa8a-19b382636b8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452224, "uuid": "440e30a7-826c-4d79-96da-662b89f4652a", "value": "6144:GAgt/w2eMKM5xuHPBEHof2tl5uOv9JG11usLLOIFs:sw2eP+IZf2tuOTG1D/Fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636452224, "uuid": "134f69c2-bd40-4378-9bd9-57f3ab4ece30", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636452224, "uuid": "43cdbbfe-a952-4da5-bcdd-c9b21535747c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452224, "uuid": "0a23b1db-8438-4e9d-bb42-e560e8b301e8", "value": "csrss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9893795b-416f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636470809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636470809, "uuid": "dd621edc-d753-4af8-9c57-c96b1dfe8f8a", "comment": "Malware payload", "value": "71ac899e8d150653e15324d1c95abef1", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636470809, "uuid": "1421bd82-6e2e-456e-876b-4e1038ea7883", "comment": "Malware payload", "value": "a34bb8987a662420a026d7ffc1e21ce6ab94031bba6d72f0cee49e03242ecbee", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636470809, "uuid": "bda50349-1510-4d7b-8d56-5ae464e0efd8", "comment": "Malware payload", "value": "cdab3aeb3354c311e7a822c68317d4d375ac37a0", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636470809, "uuid": "5bef0220-175b-491e-b6a6-39d0849e7f1f", "comment": "Malware payload", "value": "6fccb793af3e7f2a6d2d17d9a7f910142ecbc4f2580ac698d501623d91e0777d48f5498a36780ef73798a0e33aa65c85", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636470809, "uuid": "61947ba7-46ce-42e1-8728-bbf63c05b2e3", "value": "T1E9D5230676C81B73D5AF0670A28BC326D676DCB45121891B939F0A0E2DF39B4A7B33D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636470809, "uuid": "295ce0d4-9fd3-4798-820e-a20fc9f95935", "value": "49152:VX2uY5AMbbFIjKFiguez7buCnIrgmzu6kKWtMpL58ALkdyEKxSnzKxf5j2FVZzCp:RY5AMbbAKFpu27Cbrg+kKWYF8/yEQSYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636470809, "uuid": "18ecbe44-b0ab-4683-9439-84445b2387ae", "value": 2862592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636470809, "uuid": "550302b2-63a9-499f-9461-f790095c200e", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636470809, "uuid": "313ced0c-e680-4fef-b467-ec813b6ef7e2", "value": "BSDs-4933.PZTOJFSSIFHXAAYTSKOMYAGCHTHAOF\u00f1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b57e2f-414b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636455341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455341, "uuid": "4ac6a312-3c09-4e87-bb1d-dd52c057aeb5", "comment": "Malware payload", "value": "ac059c6c073a67c7324e6925b49ab207", "object_relation": "md5", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455341, "uuid": "5a7d4233-c7e6-4e49-beff-37f1f3f66b70", "comment": "Malware payload", "value": "a36e87aad0c47a9f72ddc46d5cd60a5a78b79d497beebb073a47079df15db361", "object_relation": "sha256", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455341, "uuid": "8b134f91-4f8b-4deb-9054-0ef9d00c8fe2", "comment": "Malware payload", "value": "190ba39a3aa2ee6e5238285d0d46d3cd36868d44", "object_relation": "sha1", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455341, "uuid": "3a4d4dbe-2f21-430c-a2eb-aeca5e72938f", "comment": "Malware payload", "value": "7b770ee2cc0bdeae3817b0c14f51068634350932528d6cf16010c58e88184806263c14a78ee432fb15b37221ef51ff92", "object_relation": "sha3-384", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455341, "uuid": "55f2c704-c2d5-4029-b03b-ee95ab603c24", "value": "T111A4230DE4304B504EAB7E97E337A666F831639385AC935DC2391EBA576572FC2934C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455341, "uuid": "65b1ff62-8f4d-4769-b148-5b1b0fe0e882", "value": "6144:9Bi3e3YgzPWjPuElGIWJLVWrlY+EmbT2YsbqyD2m+V8eYZZcj8TQwNf3ojvKqUfQ:9ae3Dzy3lGj6lX2jhcVyihy4jvKqwdKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455341, "uuid": "a6c24891-ae83-4cea-af05-39dc83c0c3a2", "value": 489542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455341, "uuid": "685c87ad-b31d-4561-84d5-badcb8782301", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455341, "uuid": "d43753b6-60cc-442d-bcb4-04e2b749a0ba", "value": "TR~98376534563789387-COPY(1).DOC.Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba783ee-4136-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1636446199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636446199, "uuid": "f05a1a57-2aca-4ed8-a0bb-fa08550de962", "comment": "Malware payload (SnakeKeylogger)", "value": "8e0e81937b0c09df0e6e90101047b9ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636446199, "uuid": "f022bef6-45f2-458c-bfe4-25b34e9e6702", "comment": "Malware payload (SnakeKeylogger)", "value": "a43b7ff656ef0e90bbb96801904d42f2155e694357d2784651d2ae65c18a92d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636446199, "uuid": "0c3fad1f-e26d-424c-8ecf-4336ab7bd06b", "comment": "Malware payload (SnakeKeylogger)", "value": "35fc01f9ed6bc94fd42111ed0acb18383f7d636b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636446199, "uuid": "d7052d5e-4f68-4cd5-89cf-d9c7df1731e8", "comment": "Malware payload (SnakeKeylogger)", "value": "869172a7b7edd5ce4243e67bf13d95c4428173841fe926d3962263a65eb7cede31e2aa92dbe810398b098ab516b70b62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636446199, "uuid": "879e6303-9595-4015-adf2-90e279aed685", "value": "T19F641222A3F9417BE972457F5C5376C062B5625BA207FF3E4BD8A0A93E733839181391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636446199, "uuid": "64b9c836-1082-4331-98a0-fd039f96a01a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636446199, "uuid": "8ba3b591-f2a7-407c-b3eb-88b208ee281a", "value": "6144:jRjjOw4eMKM7p4kYXB++q/DVnLNzf4oEEwy1KcuyMXme7OQ:Iw4ePmC++q71LNzf4Ji1KcuyTe7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636446199, "uuid": "9d933a5a-897f-4d1a-9fea-3280c6b5c9b1", "value": 322048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636446199, "uuid": "97ce98bf-32cd-4bb0-97a8-9e03cb8be53a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636446199, "uuid": "e61b9372-fa56-435b-863f-031d2185bc54", "value": "Halkbank_Ekstre_20211108_073719_486930.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5985d490-4145-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636452665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452665, "uuid": "d02b95f8-f4e5-4113-83f2-7a1e5950c375", "comment": "Malware payload (RaccoonStealer)", "value": "a3fc5e91df0749643eb7200f9a5ddd76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452665, "uuid": "eea9c4dd-c451-4daf-a044-442df57f2ad3", "comment": "Malware payload (RaccoonStealer)", "value": "a5ab7f1f608fd4733f908f7327b7294e186ee229cea5bd87711c5cda425bd4de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452665, "uuid": "42044217-3c2b-4066-914d-17bab1ce7df1", "comment": "Malware payload (RaccoonStealer)", "value": "d75d86bed1249ee0a5c316b5a77a376baa6ba81e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452665, "uuid": "e344ed7c-1f58-480e-8ba2-d307d9856df2", "comment": "Malware payload (RaccoonStealer)", "value": "9385d99e51cc63349e7647162f6fb5daf6509cb21b969b5a02a523e26cc0c6660547a86813cf47d4fd1d1a91f3f07f80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452665, "uuid": "2c43aab7-5e85-4d30-ae1c-3dca9305bd4e", "value": "T1D2C4E010ABF0C035F1BB12F48D7A93A8B93F79A16B2494CF61D526DA66316E1EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452665, "uuid": "687c5e85-72a6-42f5-927f-8015bd1e7f4a", "value": "a24faa9f4919afc00d25c1c4d020aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452665, "uuid": "ecc9058d-bb15-40c1-8843-aa45d52c2446", "value": "12288:Mh8WBU9rTDUld/KJvzvmeVAqVp6rb8hH/WSJs:Mh839nDUL/KJvbmFmpebsLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636452665, "uuid": "33a43d44-2cd1-4a3f-91fe-7daa1e9927c5", "value": 552960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636452665, "uuid": "59fee5fc-f5f1-49da-a6a5-80a674232359", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452665, "uuid": "a7309bd1-8d99-4678-8449-6af3d1c6ef71", "value": "a3fc5e91df0749643eb7200f9a5ddd76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80674b09-4140-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636450582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450582, "uuid": "3c52e0df-4fb4-46d5-8e78-0b01a353df94", "comment": "Malware payload (RedLineStealer)", "value": "6e4f4af122a17a5eb19697b8c5b1fc90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450582, "uuid": "5f2a6285-93bb-4928-b71a-a4509d9ebcb6", "comment": "Malware payload (RedLineStealer)", "value": "a5b1dbef3b0861671890210eae3a824f4358eb065f9f8badca87c1658a1d8e0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450582, "uuid": "8b0f93be-da28-4688-bb7c-0f46360fe54d", "comment": "Malware payload (RedLineStealer)", "value": "3772e9a6f555d58719ee14bd2c3ff4b09246f1d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450582, "uuid": "82c86773-4183-428a-b67c-2761883b560e", "comment": "Malware payload (RedLineStealer)", "value": "5f3235f5262455378685f673985f3f1e7884808aed0c10c7cf830985cd6c389c0276973403ea5368548e54050659c5e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450582, "uuid": "0e3c2fc1-dca8-4744-ae48-793ed322a1da", "value": "T1F874C010B7F0C035F5B756F85AB993A8B82F79A1AB2481CF12D516EE96356E0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450582, "uuid": "64ada463-a619-4558-9f3b-76926f05bdf8", "value": "ef5891f13814421fd185279f57d98085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450582, "uuid": "4190e795-7d68-4870-9670-2f5e1f91a3d7", "value": "6144:a8rP1RqQA+GRyiJKezewBAQkLBSxKqMgRdJmEgmdP7gfwz6AFE1mvtUMq8:5P1QQ9AzewBHkk4qMgC47gfwz6AQstU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636450582, "uuid": "ab47238f-8272-4251-aae4-9f6990ae939e", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636450582, "uuid": "f3140e08-6bf3-45b1-b368-8b44959fd8d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450582, "uuid": "968a51a3-43da-4fde-9ada-087f4594995a", "value": "6e4f4af122a17a5eb19697b8c5b1fc90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727e0414-40ff-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636422642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636422642, "uuid": "e9ccf0f4-1ded-4088-97ab-15036e719b85", "comment": "Malware payload (RaccoonStealer)", "value": "a010561e15341a6f4cc4f809cd2d6b37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636422642, "uuid": "5ec52a9b-ad4c-4a09-b61e-0100b96c4dcf", "comment": "Malware payload (RaccoonStealer)", "value": "a5e226b09761a2b1ac21f6f690800dd384b118904be5e88ce9b2bf1e0ee615d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636422642, "uuid": "2f4bbe3e-4b3a-4d30-999a-28878d3222fb", "comment": "Malware payload (RaccoonStealer)", "value": "55643bfa2c9dbed876f1157cc2a2dfd2aa18e09a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636422642, "uuid": "8199f88b-f99d-4f33-a694-ff17520a4f3e", "comment": "Malware payload (RaccoonStealer)", "value": "a0ea9532edcd98714a72d407fb4c45e942cfa2019969e78f554ff026e6cd8cf8ea3aa2a7313fc9b0391e7ca984721b10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636422642, "uuid": "16a0f7f8-0148-47e4-ab66-b826aca8fe9e", "value": "T14EB4F030B3E8D575E0935E344C71CEA50A37B9519A30104AF254A7AB2EB3F9C4AF572E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636422642, "uuid": "4abc5d7c-86b4-4efa-8c63-b5ce968fbe6b", "value": "c8725b7ab8753c936cc4c98a181b2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636422642, "uuid": "1a4c85e1-e5cd-4720-a1d0-813cceb2f7ff", "value": "12288:5ASMfNPwCWXSiLz2V3C7AoaVjbkkqb5k9FPsP9unn5:HMljWCiLiumj3qb5k9FPsW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636422642, "uuid": "8b0c9b8b-cea5-4224-b15a-6d7a073cdec8", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636422642, "uuid": "f4e27dff-00d6-4c78-8b39-91e3dccc2d11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636422642, "uuid": "b2b5153d-7a41-4b24-9436-d815e996bc5e", "value": "a010561e15341a6f4cc4f809cd2d6b37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360226b2-4144-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636452176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452176, "uuid": "4920d2bd-43dc-4fe6-ab1d-1b8151e17926", "comment": "Malware payload", "value": "650458b34bb8cf456107814222012fde", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452176, "uuid": "39a66f89-a17c-4587-b484-8324f06b5273", "comment": "Malware payload", "value": "a61e84c84a04da94ab4321aedd54e9aa87d1c58ef16167fa0fd2ce12798dd3e0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452176, "uuid": "b3cb8b44-6001-488a-8761-f55bfa7c0dce", "comment": "Malware payload", "value": "8b77353465a07bb116ac8081efab57e2ef4bc103", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452176, "uuid": "373051df-2d27-4f0e-9126-0f302a9f3b8c", "comment": "Malware payload", "value": "331807db329e3a22e01775d7c0d8d1c950bc906e12b1733971e81f6b507049be9362029ea8e6f4af1524cea30e775d32", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452176, "uuid": "dcb76929-921b-4b47-89a1-7e9765ffef6f", "value": "T174342334ED872E77C43C8DB6AA06C9F079358450B34BE109A5E90ED47A80286DF171EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452176, "uuid": "7686ca56-35a4-413a-807b-7f7ac39d447b", "value": "3072:X4USgyJDuFE1fvP8Ka6340/e/FUhk1qoAjVIwnoOHOTS0UcVT3q5PtdC0/D4nCfn:xqJmEiGoUe9USkTTYS0UcAdC0/D3bTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636452176, "uuid": "56bfb4a9-0332-458d-ad6d-05581bd759f7", "value": 253148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636452176, "uuid": "b62e3b3b-5413-411e-9440-866f76cfe01f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452176, "uuid": "a9d9844d-6989-47f7-a207-5dd92045a297", "value": "08_11_2021_Belge5.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981031b2-4168-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636467802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467802, "uuid": "c7ff31ad-8dca-4c3b-b49d-c6f0f16fb78a", "comment": "Malware payload", "value": "28a83d71f4ac4b4e4a8656d0bdee32c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467802, "uuid": "6c6edbe0-83c3-4af9-8c07-e66304e52330", "comment": "Malware payload", "value": "a631bab4422cf7cb90ef75eed32279197085b7c246daf53838c7bf21c9e22ef2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467802, "uuid": "19e14c27-a9be-4c9b-b1af-ae90b06cdeb7", "comment": "Malware payload", "value": "de98962fe03bbc3c368309f56fa3eb5a50243219", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467802, "uuid": "39a27d08-194f-4499-a575-b60c91725f7b", "comment": "Malware payload", "value": "5fd701904283a84e8e61ffd52d3816ceb7b1c8b068d7eeccc1e0b4e8bb1fcd97f4aa1b5b3f03be45bbf81122a5cfd0f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467802, "uuid": "8c38e434-605d-41f0-8473-0bcdf90db59d", "value": "T1DD9422A04308453FDD7EC53DA4A236815674A2C3859BFB6C870DF5A61FBF3A260A0BD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467802, "uuid": "ea983c3d-53ca-4a37-ad17-20dad98a06e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467802, "uuid": "96d72351-5fce-4035-a686-4e25f97a5e8e", "value": "12288:ywcePOQC14f3QBopfq/A9FaCvGrZCu5afVoQEINIzlQ:ywVPLfACSiFX8kuyV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636467802, "uuid": "1decf3cd-3c4a-423d-be88-ba6da0f15056", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636467802, "uuid": "e977f916-22a9-4a3e-bb2b-10f5ce346ca3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467802, "uuid": "880f8fff-b3d4-4550-a174-68c501a33590", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8d5d1e-4150-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636457471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457471, "uuid": "2b2a8563-fd1d-46d7-b440-0eb9c27ae2af", "comment": "Malware payload (RaccoonStealer)", "value": "f8adccc14be890a2606ac0822ca23fa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457471, "uuid": "3f3946fe-264c-43bd-8f3e-2d7f6c86164c", "comment": "Malware payload (RaccoonStealer)", "value": "a6ef4df2da289c7494453df35117b375124fbe5b6dc7d6bc571f4218efc24e8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457471, "uuid": "f14ac039-8428-409c-9cfa-2a8dd47d3855", "comment": "Malware payload (RaccoonStealer)", "value": "2041c62bf9c0f766c7481e689fc4aadf3b7f7ba6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457471, "uuid": "b6a29107-bddd-42ae-92da-166b18083000", "comment": "Malware payload (RaccoonStealer)", "value": "7d8900c891103056e7c353c5a61b2de2893836814bcaf73fca3163a09fc54366c8f7721e90c347b575e69e67ad6c60f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457471, "uuid": "1239038a-bc7f-41ae-923e-87008cd0a548", "value": "T1EAB4E000B7A0C039F5F712F81A7993A8B82F3AA1677495CF62D516EE66346E5ED30313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457471, "uuid": "de84c652-e86c-4b12-9496-d5855e9093bb", "value": "ef5891f13814421fd185279f57d98085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457471, "uuid": "0c029660-3921-4779-8101-8e7f19b95889", "value": "12288:46HLIo4hkc7wUAEjPevthZHtKGJlqh0e:4skGUtjWhZzlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636457471, "uuid": "7273de8c-9da4-4238-be49-9ac488b831df", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636457471, "uuid": "52933f68-d0e3-465b-b4c6-21e3917fec17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457471, "uuid": "bb79db9c-a46a-49cb-ac8b-3e853658e43c", "value": "f8adccc14be890a2606ac0822ca23fa4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d635552-416b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636469073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469073, "uuid": "bb493352-f33b-4c7f-bfab-4eed0e46e2b5", "comment": "Malware payload (AgentTesla)", "value": "5a57144d532cd9050adf35e92c913e5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469073, "uuid": "9fad07a7-f407-4571-8e3b-35e9362eb5b4", "comment": "Malware payload (AgentTesla)", "value": "a6fa60322d2b89f1ca47bb2c08257595dd8c0083d8c48562827745487d2cfd90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469073, "uuid": "52e2e170-d5a9-4bd2-989b-8fd8e5df178f", "comment": "Malware payload (AgentTesla)", "value": "e7a9bc011b09fc0b7172e9ac6bc62636f6c73a90", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469073, "uuid": "226b9466-9ba6-4790-9927-5ae2165f66ce", "comment": "Malware payload (AgentTesla)", "value": "1a38e4449d058df00041a2993c2b8258f763ada299e1e3d43d8b90cd08b539b2866bd84d9484ba3b14e82f77eef216d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469073, "uuid": "85c85f0e-b54e-41f4-925d-e3ddaa44593d", "value": "T1249412267B50892FDAB54377D8DF294003ACA2C79851D77F7ACD539884E23E44B42B8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469073, "uuid": "fd1bd6f7-1300-47b2-820e-b88d89060258", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469073, "uuid": "822cd380-7f3a-4f2c-b017-a87760105a86", "value": "12288:1S25NT9YuybnKM+8XGXFgG3Jz+G16Ect:g2nTCnnsXFHZC1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636469073, "uuid": "27225ac1-e9cd-4aba-a529-ccbff755f853", "value": 422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636469073, "uuid": "e39fa19f-b459-4476-b99e-c120a9901d92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469073, "uuid": "13453e10-014e-4d91-9a0d-0e57ff8da163", "value": "New order PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8b05d7-4130-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636443788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636443788, "uuid": "163a03ed-7960-422b-834e-1fd8951be6a3", "comment": "Malware payload", "value": "ce745a746f4ca8df4e9d83388680143d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636443788, "uuid": "6c6f3ad2-ee5f-42c0-9461-176281df9110", "comment": "Malware payload", "value": "a867b08a91450491a1a7bac89b087e743c9dc68edc8c37f2fa320b609485c5bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636443788, "uuid": "99808262-eab0-409f-9c82-d847c428b41a", "comment": "Malware payload", "value": "2b8b28433e676b3ceb6904325aab87f369424111", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636443788, "uuid": "aaae9bd0-6cd4-471e-a777-7b0260fe8d15", "comment": "Malware payload", "value": "a679de12af5473ddc39b26783e7a34293a41afef2f09fd0420c0c3c95c0329f541f56efe540af778d62f140292dd3c32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636443788, "uuid": "6ad640ef-80d8-4679-afeb-13553d70e0dc", "value": "T11A76E907BAA59A11D0099A37C6D7102843B7DAC63723E70F76D723562E433FE588E5CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636443788, "uuid": "b0816508-2e5a-4296-bc03-24a5e0ea6e74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636443788, "uuid": "793ff01d-7382-43be-9eb8-d888942505b2", "value": "49152:705JEXo7ismZK0Sl/5Pv4xjCMSaSexRe6RpKyZ3uuFCvN78uSnr0ngZqANb8zSMM:705Jwo7iiv4xjCMSP6xZ3vFOAEbs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636443788, "uuid": "5998e709-29d6-45a2-b77c-fafcc1c45d21", "value": 7773184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636443788, "uuid": "dc37f387-de25-4273-949c-6388514a3109", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636443788, "uuid": "1e3b2f59-fad6-4a7a-8879-8331851a3f44", "value": "ce745a746f4ca8df4e9d83388680143d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b61e0c-4138-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636447256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447256, "uuid": "853df10d-2637-4803-8184-0e7167eca7dd", "comment": "Malware payload (RaccoonStealer)", "value": "0c7ba74cfde9d375e63513bdea4f8de1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447256, "uuid": "703c997e-2ca9-4900-8a3b-4cdc0638b5c4", "comment": "Malware payload (RaccoonStealer)", "value": "ac11a8568f5ac13845c000c26fdb61ff8b15519fa02003b17d6285668ee7fef4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447256, "uuid": "a6c37b75-4ff5-4d30-9678-2c1d8554ca7c", "comment": "Malware payload (RaccoonStealer)", "value": "d859374e023ecca81920e855a5b9c5c846fb97ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447256, "uuid": "8c8632f3-aeec-4069-913c-ed7d1dac0823", "comment": "Malware payload (RaccoonStealer)", "value": "8105bd7625fe8de31f679ab14149c56c4cc183123e14b0d227faa0676d8e144b0b2bd6120cc155482a6debacca0bf18b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447256, "uuid": "0c90612d-40b3-4681-a3f8-07dc87a0a0a4", "value": "T1FDB4F130A6E9D574E8630E30496292E00EFBBC4159748106B350D79F5BB3FACAAF535E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447256, "uuid": "0570ea78-0b19-4862-b597-9921f3d01c90", "value": "c8725b7ab8753c936cc4c98a181b2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447256, "uuid": "741946e3-8f69-48cf-af14-f2edfe4ead07", "value": "12288:JASCmmn1QFHSzJ85HLVr5ip3qxmOzg8ODfVfunn5:3CmmnWFo85hrwp3qxm0Ob65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636447256, "uuid": "0f057b3c-bd64-443a-af3c-f4665781c283", "value": 515584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636447256, "uuid": "bcb9e774-3648-47f6-ba8f-2d39be562e0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447256, "uuid": "ae2a4108-cbd6-4bf2-b249-75c4cbceccd2", "value": "0c7ba74cfde9d375e63513bdea4f8de1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5040f234-414c-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1636455656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455656, "uuid": "7f6b76ea-8b00-4d78-bf3b-a54dba7e4090", "comment": "Malware payload (NanoCore)", "value": "1fda50ebccc562ccca11102206d9b012", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455656, "uuid": "04cd68a2-d987-4e3d-97fc-cc278135f32d", "comment": "Malware payload (NanoCore)", "value": "ac2f3ed29fb9202b0398997a0c2255b34ff7074301bd16a7c70dc42ff56b17a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455656, "uuid": "d234bfc8-9440-4b6c-a34b-617042dc1ec0", "comment": "Malware payload (NanoCore)", "value": "58a68fe0d5293bee49362d925fdec3d834bc7796", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455656, "uuid": "2abd9a5a-2594-487e-b6d3-526343ec4a5b", "comment": "Malware payload (NanoCore)", "value": "0c354dce985c5bbf2e9ef731a4e6d4274d6abaef215835ffd8e4bb5558623b9cd2d011641c965f816bcd96d28a3cdd4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455656, "uuid": "628e1722-6307-4ad8-a7fc-8c32103b8695", "value": "T1C8155D137AD48C15C37A07324D5B912CCAA46D6B653E8218BEAE337B2B77761061733E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455656, "uuid": "12c08455-81c2-4a19-925d-df0af7fe1166", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455656, "uuid": "9f6efb31-0792-4f34-84f2-0262593dce29", "value": "12288:Fujnx+R7c+h5BhvnYjp5wylGGE69Eg6YDYdEbmmrHPCCQP9:4n4h5BhvnYjp5wylGFgEg6YNxrvCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455656, "uuid": "71241283-522a-45e7-af00-1c915fe3eb74", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455656, "uuid": "644c1949-4514-4a88-9475-24b95a7a95cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455656, "uuid": "e668cd9a-8ba4-4397-a521-1754ac4e1c6f", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49481e24-411c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636435028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636435028, "uuid": "7f24bff6-6eaa-4ea5-9a2f-cf6a8c9bd08b", "comment": "Malware payload (AgentTesla)", "value": "3cb26a3d5c0f2cb7ac8419eadd9ab129", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636435028, "uuid": "b39e2ad8-c2ae-4c2a-bedb-00d3134740ea", "comment": "Malware payload (AgentTesla)", "value": "af145881648df9ee47d507d207277b5ee687a132567226e6adb14b62b916854c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636435028, "uuid": "ffc3ba22-6189-4545-ab58-790622f4ff7b", "comment": "Malware payload (AgentTesla)", "value": "e898765fd679bf5a0fc17573a41d04dbfa8defbf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636435028, "uuid": "2a8d4bc8-23d2-452f-a3db-de0ed1d080e8", "comment": "Malware payload (AgentTesla)", "value": "890a37fe6328f933578ccd5733b06959248bd88d107736aef0237365557cb843fe47ba3b8ce64dc33043ff0d9b447069", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636435028, "uuid": "9ee9b7a9-c540-46d0-aa88-cf50eab8c125", "value": "T1D58423B5A3440137CAD64A7E99B3A60053753293F487F76F4BECF13439133829291BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636435028, "uuid": "48d653f4-05e5-4ac1-b589-90b91869b0bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636435028, "uuid": "66653ee3-4128-4bd2-8e3b-681b24d2d24f", "value": "6144:zYi7KwxeMKMlfOsiDYLY6NiejLmJcn8pAfLpAhi5XLc/2ySzsug0dTmqim6m1:UPwxePONiDcVmjeFAhiFLXySoug0fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636435028, "uuid": "8bef6222-2d20-4f67-a63b-f946ef99e1ad", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636435028, "uuid": "1834699c-7979-4eaa-a5eb-95ce7f627ca7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636435028, "uuid": "66a879b6-c3e6-476d-b3d0-1fef93b95e10", "value": "QUOTE 002242020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5316e1ab-4191-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636485296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485296, "uuid": "7f6ad78a-799c-4bc0-84d6-b12611adb6fe", "comment": "Malware payload", "value": "6077704f09d93f44db2dffb1b83322fa", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485296, "uuid": "0f20d11d-a51c-403c-b3f4-b0ea8123e22b", "comment": "Malware payload", "value": "b093e1eba85ec1175b8bca609cd5709f937c4d84b4f7b0e38cd53f21eb549439", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485296, "uuid": "79021f32-2fd6-48f7-8a92-37fa56bce4be", "comment": "Malware payload", "value": "3bb3abf4d2dfc98651d3be5447478d8bbdbabe58", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485296, "uuid": "74ee5416-7374-49ce-bd17-60e23a43eac3", "comment": "Malware payload", "value": "edb620786f34a59f309be55cc848412a1e8d8ff59bfc2916aae3aa4723f92fd217473c7e1aefb18fb5405bf40183ce3a", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636485296, "uuid": "3053b504-9cf9-4a24-8163-ec3dc4c228e7", "value": "T1FD240246C90BEC29CEFF2678C13734E7D811410615E8E6781DF8717EDE4A7432AA6A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636485296, "uuid": "ef58bd34-7b7e-4de4-94a8-33bedee9c69d", "value": "3072:ETFM7swQVQXm3MCO2p9w1HCIOTKEhQ0aV73aFdVGvLZ8WRDyEY/z3zQvqNvI7J:ETO7tQVQXeM31uTKmaV1KWRgsl7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636485296, "uuid": "a37a365e-ca12-4adc-bfbc-f4eff23bc3df", "value": 227439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636485296, "uuid": "99f26e95-e191-4695-b5c6-d250d96ac8b0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636485296, "uuid": "6c621970-fa27-488a-9050-a4d580343cb3", "value": "usd.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e40abc-419a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636489240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636489240, "uuid": "c1cfc5b7-1e9e-4adc-8f73-7b86bef8f3ec", "comment": "Malware payload", "value": "06b4fd7c3d1966efe2747227379e2649", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636489240, "uuid": "8541a887-2cf3-4e38-aba6-b482f26a3745", "comment": "Malware payload", "value": "b0bd95ea0aa5de9849e555fc8a62f51e1406c6b4dc890ce9a63c9807184d9f0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636489240, "uuid": "c9049a70-82d9-40f8-9299-3133c7caa7a6", "comment": "Malware payload", "value": "6d1f81c6b8041395342e53476247109a3ca3f433", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636489240, "uuid": "68c20174-674d-4d38-af09-c2118370e766", "comment": "Malware payload", "value": "7178aa9173423e6597a8b0ffe8f053b70846097de53e2473386fc0e842eedda6d60bb5bb712635ce6061ad2b178d5498", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636489240, "uuid": "e61fd426-b4e4-43da-aa1d-87d23b5389ac", "value": "T112B40292F34412B6D8BE09328476AB0046767E5FC095E61FB29C7A650EF33A11663F4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636489240, "uuid": "632dae4d-8e89-493a-86b0-d2b126adb656", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636489240, "uuid": "d7d856d5-d08a-46e4-935f-a40a2f5b5492", "value": "12288:xwnZ8RMypvHVDrFjbT9DkGvHa9Albquxr5FbnVe:xwnZ8KgHVDpZn6ubB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636489240, "uuid": "960d56cb-abe2-4d2b-89df-6bf45c81f53d", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636489240, "uuid": "b01f5f7b-5be6-42fb-9934-6bec5dcce5e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636489240, "uuid": "f903ef74-86d5-4a5d-a413-5d5809a47f1e", "value": "Quote.png.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5270f9-4126-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1636439488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439488, "uuid": "d6fae547-9d9d-475e-9c01-3283cc8247ff", "comment": "Malware payload (DCRat)", "value": "684a3b271324de6a9e6a8fa0a55709cc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439488, "uuid": "b736ccf6-1fb6-47c9-a605-ae0f7fdb7aba", "comment": "Malware payload (DCRat)", "value": "b1e69f43be53051d18527a3c4cd94094b4207a077fd96eb74d0d30f7730b08da", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439488, "uuid": "65949eab-4974-498c-aef9-6005415d6257", "comment": "Malware payload (DCRat)", "value": "4d289fd20cab52e8183578300b97e45cc4e9668a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439488, "uuid": "1a3a31da-9411-4a42-b1f1-5a4e781a592e", "comment": "Malware payload (DCRat)", "value": "60085c7f1a00e196ceaafc73dd692cf0d61b2efcf4e98f8708a114ddc1b7433123dbd852af5bbb2dbdc318fc0b635b0b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439488, "uuid": "2aa1930e-92bc-4403-b84c-60c3730e5cc8", "value": "T11955332A4DBC21D1E139ED7CA9C67CA05E035AA820470D257749036898FDBC61BBDF8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439488, "uuid": "a02f2e77-8159-4f9e-8be1-700e8b19256f", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439488, "uuid": "d9cac4c4-6b75-486c-8cb5-3b550c9dea78", "value": "24576:PM9BbRkaSQgSOJ0VtzFYCze6pFQC+D3Jfkomah2P1k2QZb/NJ9:cBlHOIBul06C+D5JQ1kNb/NJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636439488, "uuid": "f70e7ded-1753-4535-a439-a4e56c7f8659", "value": 1338880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636439488, "uuid": "cf8c77ec-70fb-4a59-9d1d-202faf565763", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439488, "uuid": "1c6713d0-67f6-4f36-8e1a-304b418f1a54", "value": "684a3b271324de6a9e6a8fa0a55709cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8587fdcb-415c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636462617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462617, "uuid": "f1e306ca-48ec-419f-bd3f-2517d3ea1bd5", "comment": "Malware payload", "value": "8ab7c5ba294d95e73daa06707f9cce21", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462617, "uuid": "e4b1f798-fcf1-4bee-9787-571e28398a1d", "comment": "Malware payload", "value": "b2cdcf185c0f0f8049e02f4b8c54c4dbdae4baa4dc4ddc6e1de5e76645cc17f3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462617, "uuid": "f5c5458d-d852-4edd-9153-aceb191b51c5", "comment": "Malware payload", "value": "30b31e70fb1c71f47f87ead43c78f5d5986ee254", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462617, "uuid": "f75f751e-0a6a-4b0e-8554-13a8688854e3", "comment": "Malware payload", "value": "7dd042a5531ec0c098544bdc449e02bea225070b11af732aaac427978e9026c701f5da84d25fd9d69c7585f20fe14e3f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462617, "uuid": "8fcb307c-d0e8-4d2b-a44f-c80b0f7067b0", "value": "T1BBE46C56BEC6AEA2EF7F51B7C360EA391156736D03A09ACF760305993915FD2403EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462617, "uuid": "c8b00a43-0c0d-4761-a44e-f29fd68e00fc", "value": "8c8bba54a9dc287053536e212411cdac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462617, "uuid": "7bbaee2f-c922-4190-8947-0f989a250207", "value": "12288:EHB8k2IlwP0iruRPlOF8bzbBSreqNlKVWf9Zam:S8mO2X16sgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462617, "uuid": "73e07081-b2b4-4b43-843d-455f38410560", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462617, "uuid": "0741bfc1-331f-4004-8d1b-13dcb2e1b828", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462617, "uuid": "95d8245e-ab7b-4f8c-b10d-3c2aa7b07365", "value": "Payment 1205_2.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a161b1a-414f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636456853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636456853, "uuid": "31b0eed5-6af3-4d4e-8759-4d5cfa4411f1", "comment": "Malware payload", "value": "9997974fcee8f8b4ad920ec1a75a2004", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636456853, "uuid": "0efb3302-b29a-47a7-87b6-8897b41bea35", "comment": "Malware payload", "value": "b2da2f63d450d9c0d695461147139ede56ad5baaa5f07da721383d07520541ec", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636456853, "uuid": "182a963b-b587-4435-af79-ba8f540ff2c4", "comment": "Malware payload", "value": "f61aecd149665461dbe23451c2a72371b830a0be", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636456853, "uuid": "3ba15e86-d59b-4992-b196-ecfba589c734", "comment": "Malware payload", "value": "1c81ac1c5b4c1fe844019b4951dc1433d5a530dd5a66c2f137edc89438acc0730901fee4f1e999338af06c72a08291ee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636456853, "uuid": "e6db1962-8108-4da0-88ff-313dd500babf", "value": "T12473E10E979C35E1C7B4FC3D024E08B57CB8A57255859AEB18B4AA4D12F67C3A30D52E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636456853, "uuid": "943bb967-8e23-44d8-a01d-836c0783cf29", "value": "1536:8CWAPZZKz/1eCzbqzLkh/OPvTFVfYqezo0X37lCH2DXHqGF0:834Ez/9qGWPvZVt27lCHAXqGF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636456853, "uuid": "a0b93d0d-d996-4044-8317-c596c530aae0", "value": 76382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636456853, "uuid": "80a2ca2e-86a7-443e-8241-03268c6b7bf0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636456853, "uuid": "326943ac-2790-4edc-81be-34b7f441c7a7", "value": "Bill-5812.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81aff2b6-4111-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636430398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636430398, "uuid": "9a24bf37-0986-4677-88d8-72b86db6b8e5", "comment": "Malware payload (Formbook)", "value": "b357b743450e971af2429d0635746362", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636430398, "uuid": "15def35a-518b-44fb-9b86-3298fedbe3f3", "comment": "Malware payload (Formbook)", "value": "b385f036efa9f03e13b28b88c5c8dd82db54888c7f98c4764d4c10f4b1d9b217", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636430398, "uuid": "6ee1d925-10f6-4977-8bef-f4b79f264729", "comment": "Malware payload (Formbook)", "value": "94ec905e679fd942228fd10401983a9290643359", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636430398, "uuid": "5c333222-1f09-4932-8f15-478c406caec5", "comment": "Malware payload (Formbook)", "value": "fd70d81ad2dbe04847df8260ef3f72cecc50ee03da1652eab6c469ab4502ea3a70d68439f32be9968556125e8e542adc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636430398, "uuid": "113c60d6-365b-4cfd-9741-8e38acff186a", "value": "T10274123A9794522FC89C277A3C137E42023911C7B81BF7AF3B9992617A333516993BD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636430398, "uuid": "5ae6c4fd-1992-48a0-bc7d-1e3c8743c4cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636430398, "uuid": "530080ba-12e7-4ad8-9bed-5cc6fc1ab062", "value": "6144:0hIewUeMKMX1GVlovNs5XkbtNZVJtnRuoH/x4SmV39ayeee7IvWQwqxFO:mwUePUGjINs5XwHz5zmD1e7PQw6FO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636430398, "uuid": "7055731e-3581-4915-a4fc-2e6aea8cb8ed", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636430398, "uuid": "4d3fa114-8516-4bfc-9e78-ebdd5c13ade1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636430398, "uuid": "96f6877b-1b80-437a-9838-3615d2c469b9", "value": "SHIPMENT ARRIVAL NOTICE - ORIGINAL DOCUMENTS__pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4965fe19-410f-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1636429445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636429445, "uuid": "adf87714-57f5-4d29-8445-1cb7a831f565", "comment": "Malware payload (ArkeiStealer)", "value": "3cdffe2e1fb3ecbaaeedabd931d69a4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636429445, "uuid": "deb55b35-9f63-46c5-8b7e-b0843c3609d5", "comment": "Malware payload (ArkeiStealer)", "value": "b3a638c3482b4d590c33df367460b437bc9faa628eb243264175265fc03dc3b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636429445, "uuid": "3cf7e796-a1f0-4ec2-bd28-39d3b0fe4a7e", "comment": "Malware payload (ArkeiStealer)", "value": "e7b9fab949e4299e6bf1e81b8cf0846a24158e9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636429445, "uuid": "97d14040-3e9d-4663-bc8a-b240e9674dbc", "comment": "Malware payload (ArkeiStealer)", "value": "1fcdafd805947f30d7d06f0165bc251f1f50b98863ff9a721e8ca8f9b7953815a421802e97d8443b978b5d3a77d1e036", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636429445, "uuid": "83b8c3e1-ddc9-47b1-829f-a4a63091b42e", "value": "T14FE40110BBE0C035F6F746F8097A9775B92F79626B6081CF62C816EA4635AE4EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636429445, "uuid": "9e65feb6-321b-4cc7-9f87-b3710be4d5c7", "value": "ef5891f13814421fd185279f57d98085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636429445, "uuid": "3bbfe3f1-41d7-4478-b570-f064b8d1d15e", "value": "12288:KiPdWJe/AAEiriGg/1X2qUs1t4wL6m55rtOTv50OKbZD8soMCCAdrERC4:Kwd//7rm/1mqbFLXJtOD5cbZD8sed7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636429445, "uuid": "201d05cb-028d-45bb-8eea-b1b4167fb595", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636429445, "uuid": "d8187cfe-350a-4082-aa44-e9d6649fd2ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636429445, "uuid": "ca770e13-7623-478f-92a2-d807b348892e", "value": "3cdffe2e1fb3ecbaaeedabd931d69a4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a884b002-415c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636462676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462676, "uuid": "2343b926-8f34-43b4-b011-3fa2fa2b2509", "comment": "Malware payload", "value": "6e5a16bcb17ee13ad0f3cfef446e2904", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462676, "uuid": "e5c00f32-0985-43e0-87ea-8df95f7294d8", "comment": "Malware payload", "value": "b615de9997243c8fbef6fbc8f9e3890c22faa2adc6b3b849540ecff25b7d806a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462676, "uuid": "02784159-da5d-4683-8c07-46de7d68e0ff", "comment": "Malware payload", "value": "be860a6fc0a27f2fb775ec6bf73b32c8551ac1b5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462676, "uuid": "b172d23a-4f0e-456a-bc76-529e75f6b843", "comment": "Malware payload", "value": "3b6a89c5826666f956b6e435f2d7d7516cbd66874a311d5456223cdb89f88081da04015972caa29337333b4d972931f3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462676, "uuid": "59f8af27-64a9-41da-947e-915130a7455a", "value": "T1AF5682B031182C5BE93FC019A54FB6C42569F62A97D282C8637EE178BD135D6DF0C72A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462676, "uuid": "d39843c6-5220-4aec-b8e5-6a25adc1d535", "value": "24576:kxT6UARXMDsSNrQ4oMEuWCAq22fNPtaXIE5movFyqYV79fFSkpeVgz+QaoCFifgK:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462676, "uuid": "91bbe9cd-35cf-43fc-8c07-25079b88ff41", "value": 5896558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462676, "uuid": "18c714d9-6d36-4620-8565-5c7a6cffce9f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462676, "uuid": "0fe8b4d1-ff35-4b21-aa88-92598815f433", "value": "PURCHASE ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55711a75-4158-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636460818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460818, "uuid": "53bbce6e-599c-4775-920a-27534c229bf7", "comment": "Malware payload", "value": "3782f601454de38b09c63a127e0997cd", "object_relation": "md5", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460818, "uuid": "a7f3bd09-a82a-4ec0-b9ab-a4b9e7b5b49e", "comment": "Malware payload", "value": "b65bf98e34df32db6c0373a510f327c0cf6f11dd486839a52a0963b90ac20068", "object_relation": "sha256", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460818, "uuid": "ec1b1f65-34da-456c-8773-5ed45ca61f97", "comment": "Malware payload", "value": "b29ee41d3ba9e7284e020319166290eb0a72bba0", "object_relation": "sha1", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460818, "uuid": "201ddc80-5786-4653-94db-5fa100222dbf", "comment": "Malware payload", "value": "5b48a88dd55ba05e4761f90545c2d9db8b6abb378744a100a5b4f3a59bfa6f8264fa12a154fd94d6a78fc6e6522294a1", "object_relation": "sha3-384", "Tag": [ { "name": "Agent Tesla", "colour": "#1DFEAD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636460818, "uuid": "779b4206-62ca-4469-94ef-7a8bea08f2e9", "value": "T15612AEF53F5705B140E4C067C6274A32110DED047EE35C07D63995ECAA8A47DA6BAD87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636460818, "uuid": "752d8d35-f210-43b4-9e67-288851b656e3", "value": "192:is3fj7LKPz5grtfCrhYatHk6Fzpb4TuRXeN3hpnNC+FGGgGg:5POPz5cW/1b46dwpnRGGgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636460818, "uuid": "283ac7d6-542f-4db1-974c-1c50d5a41482", "value": 9654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636460818, "uuid": "b884dc5f-45d1-4566-837c-5ddb14cb4c80", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636460818, "uuid": "47dc9571-2738-4d3b-867a-c0aa47156cf4", "value": "PO-20210029.ppam_868E8303250FA727E9CA7CC188FE4D16.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65a7ff7-4141-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636451156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451156, "uuid": "e93396f2-f707-4753-b5d2-2115f3ad76a4", "comment": "Malware payload (RaccoonStealer)", "value": "7dfa74fc58fc4dc09ad0af74083fe973", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451156, "uuid": "547eea42-07a0-4620-b749-7590cb5bdf73", "comment": "Malware payload (RaccoonStealer)", "value": "b91c2f43aabab59c3df28395ced9cb1a35bd914c053381ff2f9a9b48c56558a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451156, "uuid": "b5454f60-bc2b-4e71-ae25-5ea23e2b9154", "comment": "Malware payload (RaccoonStealer)", "value": "b574df15fe674e14c3a9c8975cf2092405e32f9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451156, "uuid": "ed4afc62-4db4-41e6-8e2a-175cc122e458", "comment": "Malware payload (RaccoonStealer)", "value": "9d35ef5f99092294259121b0f49a4fdc6f260433a5dc9a3ca70dfb660bc53d6315a771ff226545fde9a89132fd45a63e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451156, "uuid": "66aed397-421a-4e8f-862c-f747d0a5f9de", "value": "T1C0C4F114BBE0C034F5BB13F8497993A8B92F79B16B2894CF62D526DA56306E0EC70357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451156, "uuid": "332fdc41-9bbc-46c1-a944-8d7ad5136ae1", "value": "a24faa9f4919afc00d25c1c4d020aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451156, "uuid": "8f6d17e8-5a95-4b4e-b422-19f9c41f967b", "value": "12288:vbMApesyiryssHYqX0dohkzA8bOMNoWxEKm:jjaeHUKdoSz3b+gP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636451156, "uuid": "674c9f6f-00a9-459c-abbf-fd63e6ef4816", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636451156, "uuid": "54192f12-e866-4002-aa6a-9144c62d227d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451156, "uuid": "4f80a0e0-47bf-4820-8d80-8802bbee76a1", "value": "7dfa74fc58fc4dc09ad0af74083fe973.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22a74ae-4102-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636424145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424145, "uuid": "ed7044dc-5746-4447-ab9b-df6091990f22", "comment": "Malware payload (RaccoonStealer)", "value": "dafc3e697042656b6446efebd98a43d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424145, "uuid": "ab4c784b-475b-4c81-823f-bdea3d443e08", "comment": "Malware payload (RaccoonStealer)", "value": "b9a8beecc6ae77878cf4e4dadde0046abc8c823673e7231ead8707211da71990", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424145, "uuid": "72fd868e-f2c1-42ad-a141-f32c6c286b56", "comment": "Malware payload (RaccoonStealer)", "value": "861a131060e685f2271ce668fb4cabb193995ab8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424145, "uuid": "11f3a53c-2110-4991-a6a2-5c98bcc2241a", "comment": "Malware payload (RaccoonStealer)", "value": "c86328172d246436fe41444538e7aa206a6730cf6bbb7acd145a388b5b176134c9688c59b5effb8e6a456045e1ef62c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424145, "uuid": "5c1ec6b4-bf52-41f5-8a0c-f89c21b56d4a", "value": "T16AB4E131B6ACC835D0A32E309871C2A84A37F9525560700AF7646B9E2F73B9C95F635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424145, "uuid": "76a00773-f207-40d5-8e26-5b5c2199f57b", "value": "60ab4a93298436a0ea920c16b7e59caa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424145, "uuid": "cb9adea3-b862-4576-86df-9df3b10d2151", "value": "12288:q3n3ofuOUYs+S02ozqO+Bf6QC6u1p/SD+BPztQunn5:usl9SAVaZCUD+BPJ75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636424145, "uuid": "5cd9e92a-5629-41b4-9c28-bfc0ec643f7b", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636424145, "uuid": "20b86822-9dae-4c5f-b8a3-cf768bb8bc96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424145, "uuid": "3fce7879-e1f2-4f35-8ba8-13b06af4bef0", "value": "dafc3e697042656b6446efebd98a43d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea7303f-4148-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636453908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453908, "uuid": "13fa738e-1bae-4fd9-bb01-11091e454259", "comment": "Malware payload (RedLineStealer)", "value": "bb79dfc9edbb55d687042dccab1a857f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453908, "uuid": "c4c03161-a8e9-46e5-bb42-78634a9c2c20", "comment": "Malware payload (RedLineStealer)", "value": "bccc39cf570138a543dd2483cb89752caee2062f1dd84ed8fef8f29dd92bb059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453908, "uuid": "cabc64cf-e5d1-4851-99f2-7140b0ffafda", "comment": "Malware payload (RedLineStealer)", "value": "257b7c41808f79970ef320f92e91e6861eeb6c27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453908, "uuid": "a6d2bb11-9431-4e99-94e2-3fe89aa267bb", "comment": "Malware payload (RedLineStealer)", "value": "23f3a95586120760a8bab67e3944d99b63fffa79bff778883493be814684645ec51c932619e15cbcf868120ae85086ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453908, "uuid": "a0f0bbeb-5310-4efb-b5e0-85b3f85cc039", "value": "T17A84BE10ABE0C035F1B712F4597A83B9B93E79A2AB2491CF62D426DE57716E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453908, "uuid": "7c52d27d-1f99-4685-97e2-79f1209cdfd6", "value": "a24faa9f4919afc00d25c1c4d020aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453908, "uuid": "9307e54f-c909-4bdd-8178-a7ac9419c166", "value": "6144:FYCAE7UDHVQhYaYIMrEcNTFV2L8ex1FQbyABlJUaDtUZm2JbHS:jwDmKafMooz2hFQbyAzJUPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636453908, "uuid": "636c0a61-d7b9-4dd3-b5bf-c0eafc8b6946", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636453908, "uuid": "a9c5cdf1-a062-4bd8-a2c1-555c65ddd510", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453908, "uuid": "9df1a991-87f5-4ebb-92a2-63d9401910ea", "value": "bb79dfc9edbb55d687042dccab1a857f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0739f99-40fe-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636422343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636422343, "uuid": "9217a034-a2ff-4509-8d02-4904062d07f3", "comment": "Malware payload (RaccoonStealer)", "value": "96ad0aa5d9a104db32750e040626c3d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636422343, "uuid": "5e0e543a-4af5-417c-bf9d-7207badd9ee0", "comment": "Malware payload (RaccoonStealer)", "value": "bdbbe7d8cffb4b5a6a6fd2709b1dc606514e007369bbb5cdbf65cf70074cff15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636422343, "uuid": "ae33756f-33a5-4ac0-bf99-b782d0993ef5", "comment": "Malware payload (RaccoonStealer)", "value": "4b7bcd49db97953c53d7cfddfd2bfca8b79ae7b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636422343, "uuid": "9493a7d2-ad83-4c26-9f23-3dc13cb14031", "comment": "Malware payload (RaccoonStealer)", "value": "d11e18f56e367b7bba95b584bf2935e5b41cbc82db4c27f1d38108f7d0d4479c5b587a2b9a5b170b8160c7a2e0ece7dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636422343, "uuid": "df11c058-0c98-4eb6-be04-f9acff70b5d2", "value": "T155B4F13076B9D970E1731E384974D7A90A77FC62D820D14BF250E78A1A73B8C8AE535E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636422343, "uuid": "5e0ff791-9e4a-43f0-9f84-434137bc62c5", "value": "60ab4a93298436a0ea920c16b7e59caa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636422343, "uuid": "9e1e68fa-63d1-42b2-993c-6f1c02698750", "value": "12288:CYZrn8oGQXjwLCntJSTdMdi/Wb2lfunn5:HrXjwGtqIiWyu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636422343, "uuid": "2f53b1ff-854b-4a53-b723-092a28427c98", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636422343, "uuid": "c6b4c547-918a-4ec9-9403-77c094afd0c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636422343, "uuid": "82cae502-8493-40e2-87e6-1a33d6b92cef", "value": "96ad0aa5d9a104db32750e040626c3d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24b7cf6-4160-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636464437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636464437, "uuid": "b5597431-88c4-4918-86a4-651db717aa80", "comment": "Malware payload", "value": "4098ef762839010932f035a1a3737c42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636464437, "uuid": "54a01ced-db9c-47f9-ab8b-e1a2f87c9269", "comment": "Malware payload", "value": "bf28fead8ec14ec9e464574a4dd67fec82af54f203787632e55e7899293666df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636464437, "uuid": "497c42a7-1397-42dd-91ad-d22ef592f152", "comment": "Malware payload", "value": "d277550aacc1328807d3dcddaf9cdaa5c88296c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636464437, "uuid": "ea02dcf4-51c6-41c1-b450-09791e229d82", "comment": "Malware payload", "value": "815bb13f215dbacfb4ee46ee4da44872f872e071fa7bd71c52a61b9147589fde0d05b90acd76edb7d22738ceee29b143", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636464437, "uuid": "bfb41886-0834-4716-a143-65635a0b4a69", "value": "T1C184121F7346D92BEA66513AEDE76D8003BC79829993D72B39DD230D696239708037CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636464437, "uuid": "37ba4c06-b484-4c9e-b4f1-568ddd5eda8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636464437, "uuid": "586d59ad-56a9-4325-9f66-81aad173fbc2", "value": "6144:hI69iNLFtJMkMvr/iopMTgApLvxP+fLBq9gyFvUfd8zWv9aQJjw9hyzfgA3OuUAh:hl94htJTAraoppApLvxWfVq9gyNUl8zK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636464437, "uuid": "9a48b942-47c4-4767-8025-cfc5e890dd9c", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636464437, "uuid": "49127551-cb3f-49b9-878c-8b08eb88e20e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636464437, "uuid": "f7768c4c-261a-4017-ab44-ba71d0a04ee0", "value": "Hoja de orden de compra.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b270b1-4151-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636457780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457780, "uuid": "e8c6d447-e225-4d76-9e58-774761a6d90d", "comment": "Malware payload (RaccoonStealer)", "value": "7a00b1b13fbe378d79808a029f1b371e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457780, "uuid": "462a6e69-80e8-4e1e-a6b4-28fd75b7ef71", "comment": "Malware payload (RaccoonStealer)", "value": "c0177c9922a4b6a95aef096fc5f39bef8412e7ee2fec4a21fe91f7ea03dfa951", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457780, "uuid": "9a68676f-1a29-4d63-b630-a2fc1956c90a", "comment": "Malware payload (RaccoonStealer)", "value": "b3a4180916a3989a289097352dc8a485244357df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457780, "uuid": "afed1854-0698-4562-ac05-9c6b0e85400d", "comment": "Malware payload (RaccoonStealer)", "value": "da0124ac6f345d085a41759bf981e92b65af9e5a0c02fb2f71a94a86170bcc66b14cdfd297bbee2b299e446bd7988a2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457780, "uuid": "7fc1d9c2-2eac-422c-ae49-897175489b69", "value": "T148C4E014ABE0C035F1B762F4497A8368BA3F79A1572495CF62D126EA67347E0EC70317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457780, "uuid": "58e3aa73-9a15-4fbb-b3e3-7c9ce9411b0c", "value": "5f60c500db75f47142be06e755ed4aae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457780, "uuid": "aaec41dd-e551-479e-8b7c-299358dc3529", "value": "12288:MeUQV/va9LLvHjSSdPgksmYsP5RVACq0bjB1:M+VqVr2y/rPWjKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636457780, "uuid": "5c0390f3-c3b7-4c3a-a838-d8bebeaa41a6", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636457780, "uuid": "7f9106a8-22e2-4754-b1d9-573907d074c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457780, "uuid": "fbf7ed1e-071e-4567-98fb-8a1c8b3f0a73", "value": "7a00b1b13fbe378d79808a029f1b371e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92e4fbb-4155-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1636459670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459670, "uuid": "e14924de-0a1e-4eee-9c8f-707a9b11c1e7", "comment": "Malware payload (AZORult)", "value": "5f898b25da675799f9d17ddf988e95e1", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459670, "uuid": "faf00abb-efb2-4942-bd98-34d0634bb0e0", "comment": "Malware payload (AZORult)", "value": "c0de21d15f1dad36f96956a301c4db992fd6c2964e3f4855590da5fa2d7665eb", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459670, "uuid": "490a478d-66a4-4e6e-bb14-f263f06725ff", "comment": "Malware payload (AZORult)", "value": "8ad35ef0e47f0d0fe970e0ee3b50ab26fba36989", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459670, "uuid": "62ee6e2f-4437-4e82-b764-80b9215088a3", "comment": "Malware payload (AZORult)", "value": "ca3cae33fa73fa5012036c4018ea2f6a0bfd93719716fd21835af90c0290d09cbbd138ca73c83a516c6d9cf056fcf390", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459670, "uuid": "a12a75eb-e3cc-480a-ab9b-279a89d4087c", "value": "T108549E2467E0C434F5B722F849BA9369B93EB9E16B2490CF22D516EE47346E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459670, "uuid": "6d1df3f1-8cd2-4cd9-8aec-cf3434be3b3e", "value": "a24faa9f4919afc00d25c1c4d020aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459670, "uuid": "c56d68b8-2520-4af7-8d29-e975d10a2a67", "value": "6144:d6dBld8iYpH8EXF/b9rMhhWdWxfU7Qjk:kBsckF/b9rMhhXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636459670, "uuid": "0efab07b-2f77-4aef-924c-982cdd16b775", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636459670, "uuid": "d505fe04-13d0-4a54-ab94-a1f2c9da1d1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459670, "uuid": "089907ca-20c4-4da0-8c45-bff026e17dd2", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ba46c9-40fd-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636421733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636421733, "uuid": "d1226cf6-dada-49f0-9c85-f46c905b484c", "comment": "Malware payload (RaccoonStealer)", "value": "734195ebd5316ab44e7f8f75b9f2bcf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636421733, "uuid": "f2e155bb-6192-4f86-b773-e3158bcd857f", "comment": "Malware payload (RaccoonStealer)", "value": "c0fd99ab6898145593395343dfbd1b5afea781d37cbbccd72e6c9dd408cb36f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636421733, "uuid": "48c35fd1-e526-4e0b-958b-aa29cda17e08", "comment": "Malware payload (RaccoonStealer)", "value": "94a6c84abcf0add03c7be610729fc8fe746808b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636421733, "uuid": "2ad106e2-500f-489b-a471-e5001d2f25dd", "comment": "Malware payload (RaccoonStealer)", "value": "6b770d0d861f955eca3d3c09d4fe919779c6e0efd93fdab88a3df3116177567871a14d44e9fcd03076a01ee2c34dd182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636421733, "uuid": "ef04cb05-b8bc-4044-9f33-51e7ac195ef9", "value": "T1A5B4F130AAA8D539E4A3FD304974D6A1562BF9125970000BE7746F5E0E73F8C9AE931F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636421733, "uuid": "d02cdc11-9123-49aa-951d-545239960d2f", "value": "c8725b7ab8753c936cc4c98a181b2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636421733, "uuid": "fca6a3c9-15f4-4b8f-ab82-f32b6f78d8dc", "value": "12288:wASNOdIwSUwdeUNbg9NblAJqGkgf8YqJ50DuWT6unn5:SNOdk92bacIfLD9B5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636421733, "uuid": "a8ae1269-b859-4c7d-9be7-64517794f70a", "value": 515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636421733, "uuid": "4968cc21-9de3-465b-a1e7-c5415d36e6bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636421733, "uuid": "41dfd55a-84ff-48ce-860f-30a62b8b7ff0", "value": "734195ebd5316ab44e7f8f75b9f2bcf6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a7f25a-413a-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636447857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447857, "uuid": "9fbeb40f-4a7b-4408-854a-0bfe73e40918", "comment": "Malware payload (RaccoonStealer)", "value": "244fbb45c183e5a5caab0c6ff56f035f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447857, "uuid": "a358beab-9b5a-448e-a22d-a75ce877fb21", "comment": "Malware payload (RaccoonStealer)", "value": "c25538e04bbb9084922f2bb39e5da7764716cd902ebead0052397fbe4912ee3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447857, "uuid": "45651e72-7202-46cd-a2f0-dacf79baabaf", "comment": "Malware payload (RaccoonStealer)", "value": "b45f009bf9efda2579b3c9d2f10c78791c169479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447857, "uuid": "09adf6f4-414f-4d0c-b1a1-3cb2717467a8", "comment": "Malware payload (RaccoonStealer)", "value": "b5e895ea0a7a0fab90ecbb6dd2b9113bbf0f0f68e24b39f5c261ec6b9b1f5977cfcbc10f1b0c16dba5ead15043f2b822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447857, "uuid": "a359ca45-744d-46d2-819e-aef53117109b", "value": "T1B8B4E010A7E0C034F1B726F85EB992A9B93F79916B6490CF62C116FE5675AE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447857, "uuid": "21a6b567-9ed1-43d5-9b68-b572fd0d4356", "value": "ef5891f13814421fd185279f57d98085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447857, "uuid": "76870326-7bd6-4545-aec6-c8ff5d44dcf4", "value": "12288:uLRy5Fl7ujdsZ8Zkedqjxuw9JVHN1GDcdYwkp1:uIrl0sZ8ZkaqjMw9JVCcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636447857, "uuid": "792dd572-e45b-466f-a697-3a5972b76ff8", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636447857, "uuid": "cb704cde-ea3a-4ba3-a738-e38a4be975ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447857, "uuid": "b3745f66-51e8-4e98-aef9-1023a80948a3", "value": "244fbb45c183e5a5caab0c6ff56f035f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c381af8e-414d-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636456278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636456278, "uuid": "ebd0baa4-a485-4937-a290-9e21cf50307e", "comment": "Malware payload (RaccoonStealer)", "value": "eb39a5072bb1abfc389ce70b8530c79d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636456278, "uuid": "22282d64-8b13-49d1-a170-c5ea9379889e", "comment": "Malware payload (RaccoonStealer)", "value": "c288cd772d64fde2421fff6faac53e75a179ddb17029f5d4c5944fa7fb44cd63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636456278, "uuid": "cbafe96c-7043-43a1-8665-95807fa8c3fc", "comment": "Malware payload (RaccoonStealer)", "value": "0511fdb6d82f1772c3cb5ca8358386efaf0a4447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636456278, "uuid": "5b1ca758-6215-4e90-8ecc-7a9dff97c959", "comment": "Malware payload (RaccoonStealer)", "value": "6f9ae515240309ed8cf8031fbdd0c7861e2e91a913c6ea66f0306f354ce811cfc52a662f0d6260e3424f42a46bb8320c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636456278, "uuid": "c474b00d-251e-4793-86ae-90bf5fc09192", "value": "T1B9C4E120A7E0C035F5BB12F44DBA9368B93FB9A15B2494CF62C516EA66347E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636456278, "uuid": "62f08cf1-70cf-456f-ad24-f0391b2de0fe", "value": "a24faa9f4919afc00d25c1c4d020aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636456278, "uuid": "29a0c3c1-c2e4-431e-b672-47828f86f094", "value": "12288:ZfCw8f5AD9uz69KPmq9TOd/O80bKIe2jrs:D1xGgPq9TyOjbtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636456278, "uuid": "cd879a46-b960-40d1-9946-f779cac85759", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636456278, "uuid": "8cf06128-7f14-4894-a54d-69e680857eae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636456278, "uuid": "57f62dab-dc18-4efd-80ba-8619ddf652c2", "value": "eb39a5072bb1abfc389ce70b8530c79d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31a1496-411e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636436172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636436172, "uuid": "dfd0b279-0c19-4aa6-b5b9-68bcdf08a042", "comment": "Malware payload (RedLineStealer)", "value": "1b05f16a518697d3aaa7882261e697b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636436172, "uuid": "0cdac734-577a-462c-9dce-9d3cb7b02456", "comment": "Malware payload (RedLineStealer)", "value": "c3438b6c83e9fa1c955ea2501ac27c34ffecb795909cca03409deb018558f3c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636436172, "uuid": "8591d09c-1a17-4466-b773-9e768acbd0b4", "comment": "Malware payload (RedLineStealer)", "value": "a0f91f49530d49de7a1596044c44d26b27ca6571", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636436172, "uuid": "1f8ebdd3-ea3f-42ee-b793-3738519637ad", "comment": "Malware payload (RedLineStealer)", "value": "c746881d9e3f7ddbacf3494cbd30f9876efa3afc9399db3cbf8a49bfcab090e171691e63e55c5876d605b24550290b06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636436172, "uuid": "4a9ed17d-336c-4bd8-8b84-ce46f5b50b7a", "value": "T185249E3176E9C865E1A31D7048A596A01B3FF8215970608BF7906B9E1F73F4C89E239F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636436172, "uuid": "c104bc80-c8e8-4ef8-bb37-9def406099c1", "value": "c8725b7ab8753c936cc4c98a181b2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636436172, "uuid": "efdddca3-6b26-4371-b92c-368aaa1f5773", "value": "6144:XesFbRAM/5r2lHbdI48uzbgwu6QigabwVf:OsAM/5rS8unn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636436172, "uuid": "b6fcf171-bb70-4498-bd33-05cfb1aa3ca9", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636436172, "uuid": "0b82cac5-9be6-4003-8a39-a3281f7fde57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636436172, "uuid": "50044fdb-ee44-4508-88ad-4147f283a11e", "value": "1b05f16a518697d3aaa7882261e697b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68c4930-418d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636483852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636483852, "uuid": "7b71671b-759c-4951-aed1-8ed51a3745f5", "comment": "Malware payload (RedLineStealer)", "value": "ed0f0f55748457d49fef18a9ab4ae825", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636483852, "uuid": "f82c6ce7-7161-49ca-9279-c9c72016b789", "comment": "Malware payload (RedLineStealer)", "value": "c467b23bf87c691ee2e68f4970d2bcb9af5e2523e960111671a2cdf61e203485", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636483852, "uuid": "bcfc0865-0db3-46d6-ac94-068d837e68b8", "comment": "Malware payload (RedLineStealer)", "value": "6e906f137db61ce65b877e13050a778fc5679f61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636483852, "uuid": "66d5b920-727c-4461-b0f5-d0855681f647", "comment": "Malware payload (RedLineStealer)", "value": "8d21e5204a78dc69b6c28726b5da2e1d99e736dc08f43f26c4c55fbb6d997824969cde215f671d2a579259b24afd1411", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636483852, "uuid": "e23f25c8-643f-4934-a180-17bdf0d89aef", "value": "T1D9E4AE823288DD96E0672EF2587FD42012787D9F8425C60D3B83BA6B55F770224AB75F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636483852, "uuid": "2d8bdb6f-7bc9-4e4a-bcb3-f896ff917983", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636483852, "uuid": "38267939-4fda-49d9-8310-fc7ffa767813", "value": "12288:FpPjDGuXMIrKOf5o4R/qeJD6YNrAGmSiyyjK:FBjDGtC9o4dJD6wrKd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636483852, "uuid": "5bbbb8e7-d6dd-4492-b6a2-f887748530b7", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636483852, "uuid": "08260517-cffa-4d84-8601-ab8d6060a466", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636483852, "uuid": "187f8a17-e67d-4db4-b270-2c5ae53d8284", "value": "AMAZONORDER3774848588433PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a98ea43-4155-11ec-843c-42010a9c0014", "comment": "Malware payload (GCleaner)", "timestamp": 1636459592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459592, "uuid": "fe98f4ff-a78b-48d7-847f-0a885d03b811", "comment": "Malware payload (GCleaner)", "value": "7cdd8a8e0fab1b1661cac6b8a442bc6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459592, "uuid": "b44848c5-4aad-4e51-a40e-c038bcd3aaa1", "comment": "Malware payload (GCleaner)", "value": "c67037c258ab3294e4d8a13e83d4256845b48dbf9568483c58a2b9e3c17db1b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459592, "uuid": "0403955f-3fd0-468e-aa08-63431ace0133", "comment": "Malware payload (GCleaner)", "value": "bc69db46d8d9bb4dea16789d47ce8cc0d81451e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459592, "uuid": "ba1e2133-f886-4918-89e6-af09c22a0288", "comment": "Malware payload (GCleaner)", "value": "f9219d66a5b77a15fde3b0a1f6a27a7a4fcb99df03f41383d93d89b2121c4c7f0a33981a9f448049d8e11f0a70892b7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459592, "uuid": "eb950522-9764-449c-8805-f55b329490b3", "value": "T19FF522C3B78D87ECD1B1DD3414F496618C386D205E2389DA5398FDFC2DB04A1AA66A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459592, "uuid": "0243a662-8c57-492d-973c-d9b3bce41515", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459592, "uuid": "f5c108f7-f16e-4eea-baff-69ac126d559a", "value": "98304:SKqyVpUv6IelYLRSljOwuKQXl8LSZ8Z56Nj6qDI6AHZQTgJ:S6pUv6IFLgljOGQXl8LSk5W6BfQsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636459592, "uuid": "8b1d077c-7075-4dc7-b700-3ec8a4306f5f", "value": 3516573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636459592, "uuid": "187080a7-9f9b-4db9-a46a-a45bb57c8ddc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459592, "uuid": "f9eaa98a-c4ef-49e9-a6d2-c9e29f5b6a24", "value": "C67037C258AB3294E4D8A13E83D4256845B48DBF95684.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32381eac-4138-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636447015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447015, "uuid": "53fd0d1c-dc0e-4e78-a615-c119da19dd72", "comment": "Malware payload (Mirai)", "value": "83a6d0ffbc818d0f6dea94b747099858", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447015, "uuid": "008ec4ea-8b0c-450c-8c15-e8b38605770f", "comment": "Malware payload (Mirai)", "value": "c88e79eb00854ab4e3a5c0129d7624239c10cf008d814e48709d0c6a909e42bc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447015, "uuid": "95e0db82-8f85-41ae-8e26-c3eacdc081c4", "comment": "Malware payload (Mirai)", "value": "36336e121527d41b62f5756e4d370e81c9929de7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447015, "uuid": "42e68535-e894-4b22-ae03-72213fb07f8f", "comment": "Malware payload (Mirai)", "value": "0a2b18e5141492b06f53cffb0749d4814d8ca1b76510af74e32944472c8ad435b6dc79175bd3ab744340c21ae7a989e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447015, "uuid": "adec5459-7bcc-4342-9627-b63ec9cd7a8a", "value": "T17F735B13258088FCC449D1705FBF922AF522F07E4274F5AD2794BF27AD8BE215E4E4A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447015, "uuid": "82e44419-7365-44cd-8eb5-946d1f81d3fa", "value": "1536:/Utetar7qxEp57+it0R2EmV/jYTLxRtoh0so4AcmQVeTBncL:/Uhr7LpV7uR2E6jYTrtoh0soKmQVeTBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636447015, "uuid": "94219075-94cb-4b74-97dd-5e720fd90f21", "value": 74944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636447015, "uuid": "122a260b-ed7e-4eae-9572-6e351d9b8cc0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447015, "uuid": "bbc970e9-e358-4bef-a3fa-0395c9736988", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00efc36-4131-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636444274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636444274, "uuid": "9c322460-3a02-4a10-ab54-07bad6383988", "comment": "Malware payload (Formbook)", "value": "d1f0a2f7fad1b0cbe34ad4f9a88d1323", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636444274, "uuid": "f6daa15d-9889-450e-808c-5074e22928f3", "comment": "Malware payload (Formbook)", "value": "c8d54eac34afd28839ae109f0813ed54f21ee9d17a8ae54e5b12a11ec9250999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636444274, "uuid": "575300ad-2c8e-4c67-bd67-5bf125ee2223", "comment": "Malware payload (Formbook)", "value": "24a38b98a3b72dd202d39d349b8853403e76e271", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636444274, "uuid": "10944845-6295-4029-bdbe-b148efec047b", "comment": "Malware payload (Formbook)", "value": "a2c432a2287889472fc4ebe9e3ea4e66844f61657afcd4cc2fc0c474a01100be4c8d177b6e9fb3fac8620c138eaaa7ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636444274, "uuid": "9015424d-ca6e-4b44-b836-b41662aaa282", "value": "T119056C41E2C86CB1D06326300C6B97356534AFA1297A591A6EFF3D5B6EF33C22531E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636444274, "uuid": "56c29ff2-50ee-42f5-8574-b92d3ed36bd4", "value": "7b484975ebc1a121d346391a74418697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636444274, "uuid": "42721913-61ac-4156-943e-b7a563c2df8d", "value": "6144:6ty9J2eb9Vmcc03Dl2QEE12/ggyHISePm7lDW/Bl5Wn7DYKbQAJR3l68hTnUE:R9J2ebzmccYDJ2tMIMS/n56Dj6mTnUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636444274, "uuid": "3436c204-56ac-4dde-9469-d37daabdd67d", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636444274, "uuid": "2dd0280d-78fd-4bee-afe5-2a8119dc05b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636444274, "uuid": "12245a8b-ee37-4fe6-ac78-4c4c99dd04a1", "value": "Urgent quote request,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2777bf-416c-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1636469664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469664, "uuid": "26ae6146-6a30-47e2-85d5-9a2aec29ce0b", "comment": "Malware payload (SilentBuilder)", "value": "9336f4bbc0e3cc8c13a1232a94f131ad", "object_relation": "md5", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469664, "uuid": "e60d5600-a5e8-49a1-8572-13c1f9839042", "comment": "Malware payload (SilentBuilder)", "value": "c9d9905a183a3cd19f9adf19a8dfdb902a58fae5a6a82cb1e0cf4a4816dff1b9", "object_relation": "sha256", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469664, "uuid": "73ef0bd1-127e-4849-bb56-2c566797e0a7", "comment": "Malware payload (SilentBuilder)", "value": "25d8596788d72e6c1b9b7b9bfc523e42c0a9d33c", "object_relation": "sha1", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636469664, "uuid": "879f22f3-ccb0-4008-9e0b-371336b1aeda", "comment": "Malware payload (SilentBuilder)", "value": "17c1ddff9f846e3718b0442c74a0ab309ee54695fbfb72042368db3e027686bc7ea848ac72a3572c382bd476cebded34", "object_relation": "sha3-384", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469664, "uuid": "c649fce7-ad8e-45a8-8b3d-43b222d66f36", "value": "T1C0C34953B655844EF616833814E743B1A2B2ED21CB5E0AC729D7BB227FBCDE05933852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469664, "uuid": "4b02544c-d2be-407a-ab75-84c6a4ec02ca", "value": "3072:YKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgL5yVceeiE/RD/oU2/zLWQdt:YKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636469664, "uuid": "a1a983af-356b-41e9-b862-9acd61d9dd99", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636469664, "uuid": "db045bee-a52c-40be-b684-9160aaa50c83", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636469664, "uuid": "06cbad3c-2ca7-4ade-b629-081b628fae5a", "value": "grand-154831261.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c87da2f-4154-11ec-843c-42010a9c0014", "comment": "Malware payload (GCleaner)", "timestamp": 1636459032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459032, "uuid": "657bd2bc-273e-4a4c-9b36-6ce39d510724", "comment": "Malware payload (GCleaner)", "value": "7d4ed604a4f010d09afd1b2c396d396f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459032, "uuid": "bbc62b7d-6560-400c-adf4-0a4275d91e83", "comment": "Malware payload (GCleaner)", "value": "c9de02209482359466292be7bc0464fc65037698b38c1566cd331720e65f8ea0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459032, "uuid": "ad58add2-b336-4058-8465-4bd39e5b149b", "comment": "Malware payload (GCleaner)", "value": "5576b3328390498bd9706c1e3b1e9e48dd478906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459032, "uuid": "b4b30876-707a-41ae-a6e9-acd309c4f8f8", "comment": "Malware payload (GCleaner)", "value": "a60c49a1d43b85778ee0d7d2778d53604d9c8bc3acb83ed298af65960350944cd58a10e5904ed46bab8c0b93555ddfee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459032, "uuid": "e8464a7d-afde-4db4-8bf5-e24cc7cc129b", "value": "T1CA36330BCF7841E6C6B4BB7009BE9C68A1F929ED610146039B21E77556B09AEED3CD70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459032, "uuid": "02684525-b2c2-4d2e-9286-3f9cdc103cbc", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459032, "uuid": "22541a3a-b5d3-4c83-8ee3-42c8e54b5bf5", "value": "98304:yaweFJEwamljlXog5veRcqBaYLJ1M4kc2f5ujNBC7S7ymAvuTeKabZdujw:yawvkX1vYl17kcGQNc7S7/ArFdqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636459032, "uuid": "27f3a1ad-7250-49c7-8a4e-e1c0ef77bf3b", "value": 5332875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636459032, "uuid": "945c5934-f0c0-4035-b544-8831d489d22f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459032, "uuid": "b654d260-fddb-498b-baf1-21e6f0eab9d5", "value": "C9DE02209482359466292BE7BC0464FC65037698B38C1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cdf7335-4142-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636451462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451462, "uuid": "523c9390-5397-463c-8f58-95cd348cc7d0", "comment": "Malware payload (RaccoonStealer)", "value": "833b3ec3d707dadf9a80c781de0b245d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451462, "uuid": "1ef5a009-bc60-4bb5-a67c-b5ded056efdd", "comment": "Malware payload (RaccoonStealer)", "value": "cb2b0593dd5917cd2c733aec233994622c4eefc4876f5f3e4c90a241714766d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451462, "uuid": "ca7ddaa8-f4e0-4780-a3aa-22fd9bd0ec0a", "comment": "Malware payload (RaccoonStealer)", "value": "8245272e4d60a03b4ab2fc38ce61e16391df1f54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451462, "uuid": "2672b8ca-0161-47b9-a362-083570a62878", "comment": "Malware payload (RaccoonStealer)", "value": "de0a403e9cf361e36d385fcdd57dc9550450fe0e33c25aac3998069d29739c4deba425c1f6865f5743bf0f79c82fc6b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451462, "uuid": "7ff00136-9ed8-4d92-88d3-ab16de63e6e1", "value": "T138B4E110ABE0C035F1FB56F80AB593A8B52E79A17B2590CF22D516EE67756E0DC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451462, "uuid": "c92ce02c-d063-4786-bee6-7f4b1e16ccbd", "value": "ef5891f13814421fd185279f57d98085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451462, "uuid": "c53a4eb0-df95-47df-a7e6-03c21b7e4041", "value": "12288:0lohTwSkTZ7wmpLMfZP6wqah71egcLHe1GIsZ5e:2ofoZ7rYBiwq271egcL+sS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636451462, "uuid": "0ace7fc9-9190-45f6-9db1-72332635f780", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636451462, "uuid": "889a826e-1a97-4382-8d28-a25a2cce6cf6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451462, "uuid": "297dc6c2-a22d-4052-807f-b6e61b87c95a", "value": "833b3ec3d707dadf9a80c781de0b245d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3d47f3-4125-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636438848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438848, "uuid": "376b87eb-fa7a-4b35-a230-c71a1b8bf118", "comment": "Malware payload (RedLineStealer)", "value": "5918f9797058d07d2c34cccc2e3fe161", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438848, "uuid": "ecbb952a-92e9-43d9-a1d9-e5107fbc2e9a", "comment": "Malware payload (RedLineStealer)", "value": "cb7d321954760de22ccbf59ece43d94e503350b18203df4e3fffd3833fda1c2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438848, "uuid": "bd8ea6dd-1d41-4242-9102-dc1343d594a9", "comment": "Malware payload (RedLineStealer)", "value": "2241076986bde4949b7afdaf0e6e8b9fe325cb64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636438848, "uuid": "8764fe00-8823-4f0e-9773-4287bdbfbab3", "comment": "Malware payload (RedLineStealer)", "value": "11ab7aa8481724d65e1c67241d6d983487f983f55214034e91ba7bac33f72ea1a664991fa555a076e512ed06bc26063a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438848, "uuid": "d185815d-15aa-4713-9232-177bdab93c7f", "value": "T18356334CEA918DD7FE02083AD86E961583E223E81464BB927D7814DBD335E34F059EB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438848, "uuid": "c868b273-163b-4d81-a6b6-79280a691e70", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438848, "uuid": "3d7a67d6-755f-41e7-bc1c-b4c7ec3fb5d7", "value": "196608:ycHNuZtCApDAO99aQ3r2Y/7Tr/ci39bBR:yccrCAdAM3P4gv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636438848, "uuid": "bde030d7-c4e4-4a89-9a5d-fd10f6468851", "value": 6364087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636438848, "uuid": "d73d3e7a-b6e1-4ae3-9f4a-d3ad8e5a380b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636438848, "uuid": "54637890-53de-494a-8578-b487b3b46868", "value": "CB7D321954760DE22CCBF59ECE43D94E503350B18203D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669a31cf-41a0-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636491771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636491771, "uuid": "04642006-b4d9-47cc-8ba9-790945715032", "comment": "Malware payload (Formbook)", "value": "db1b8514a93cd56a2021f7033ce81143", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636491771, "uuid": "3da7d575-c2b4-4520-ac1e-5f50a8fdc624", "comment": "Malware payload (Formbook)", "value": "cbb7ab17e9d5003b6a58eccf882624f2914ed14e0b093806fe83d3e2b7ba6422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636491771, "uuid": "24dac241-08ca-4c43-8f07-d36d68c348df", "comment": "Malware payload (Formbook)", "value": "9437b7a71a547e65f880a0699788b4530eafb638", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636491771, "uuid": "236860ff-bf74-46ea-8483-a252a20c0a93", "comment": "Malware payload (Formbook)", "value": "22af3092c5049da6765dac6931c2d8ee18cac0f4964c450fd81038d907789b2ef5c647e2ba4e839fa32a934dbd585ada", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636491771, "uuid": "8d08d8fe-6a83-4226-bfa1-9632fb80f911", "value": "T185641291B630CC73E562AB701826172786FFE23174E59E6B07810D9E7E622D1963FB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636491771, "uuid": "0a7bdf19-4716-4163-950f-92d86afd88a0", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636491771, "uuid": "95f6d0c5-9535-495c-a111-b3e4c98949f2", "value": "6144:mbE/HUbXgNqh5/K381L7miAY3vIdf53yJMN73stUNXmivoeGzfmG94Ih/EK:mb/XgmZNLyOQtdN7kUuI4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636491771, "uuid": "c8cd074f-5c89-44bb-a183-1b118d52075a", "value": 315212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636491771, "uuid": "04cc82e0-4f9f-4352-804f-7e9a83df79d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636491771, "uuid": "9d60eeed-2610-46e8-ac33-58bed4dfec72", "value": "ITEMLIST#00987655.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34419038-4107-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636425973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636425973, "uuid": "dc87c699-ce90-4a64-85b4-effd3bd21ac6", "comment": "Malware payload (RedLineStealer)", "value": "1620322a65dd6d5e613a6490ef31845c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636425973, "uuid": "f2396a4f-769f-4830-a2e1-5e080373db98", "comment": "Malware payload (RedLineStealer)", "value": "cdae1e13138d083cdf0faad62e2d975669087900c05171953c0f087befca62eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636425973, "uuid": "c693b56d-8f04-4f41-a16b-ed538923477c", "comment": "Malware payload (RedLineStealer)", "value": "3fc00c0b93a00fadd1d295de63395d5b13ea83e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636425973, "uuid": "81523f92-1ec5-490d-b162-a98587ee03b9", "comment": "Malware payload (RedLineStealer)", "value": "6d7e04fe99b70c2f7a1d0ca26a46bcef7d5864dbeae42d086a05eabc99357c5335262680aea0bb4c727c4d80cf44de75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636425973, "uuid": "a73c39ea-aa68-4b7d-b118-cc6ec8c41b06", "value": "T19074D03176E9D835E0531E3CC561DBE90E3BBC519960510AE620678E2F73F8C86EA71E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636425973, "uuid": "bb85a1e2-9546-4355-a820-17e673f00b8d", "value": "c8725b7ab8753c936cc4c98a181b2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636425973, "uuid": "50d67a6b-f569-41c0-a6fc-1b9ee21e8cc1", "value": "6144:JmH9a2JGZGa+OyI1QQB2b3DlDfhzmWuzbgwu6QigabwVf:Ada2JGZGK6QMb35EWunn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636425973, "uuid": "97bfebd3-9c72-4de9-8f5b-9255c2dc9873", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636425973, "uuid": "28e30381-227d-4cb7-86f8-6987fb1a4235", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636425973, "uuid": "d6e8bbfd-890d-43e5-b356-89f2d89928b5", "value": "1620322a65dd6d5e613a6490ef31845c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9994c217-4144-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636452343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452343, "uuid": "47427a18-1c16-4040-986e-c37627d59580", "comment": "Malware payload (RaccoonStealer)", "value": "9f9c7f4206ab49da803b3ad512ed58f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452343, "uuid": "e94843c8-61bc-4dc7-9ae9-233e8abeee6d", "comment": "Malware payload (RaccoonStealer)", "value": "ce31df7deda51491cc2d64be217c1cfc82046f58b93e5a5ce4f087fa6b741d67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452343, "uuid": "2f123215-168a-43cb-8f93-2537b3bf7e93", "comment": "Malware payload (RaccoonStealer)", "value": "fc019b2ea7bf6239fbf3c5c59a711a68d0faf397", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452343, "uuid": "590402b8-cea4-4983-aaa8-faad6f844525", "comment": "Malware payload (RaccoonStealer)", "value": "be4c6b6add74f671a278f8107b9754029239ef2322152db6e8c62ac89037e27016a6188f4294e3a595144eaee79f9183", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452343, "uuid": "554e0d5e-b6af-46cb-995e-a8e4aa40fb37", "value": "T131348D1077F0C035F5B712F859BA97B8B92FB9A16B2490CF62C516EA4675AE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452343, "uuid": "1dcaee90-4bf9-4687-bde1-f797de36609a", "value": "ef5891f13814421fd185279f57d98085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452343, "uuid": "adfdd930-0d6c-4483-9208-ab3dbbb23e37", "value": "6144:sxDSZ1GZTwMM8z12cru+2xuVtFevxjb2r:GDSZIZTb/12cru+WIFkxjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636452343, "uuid": "c5397445-6500-45ff-b2d3-17c7a50268cd", "value": 248320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636452343, "uuid": "f6ba5ed4-7829-40dd-87d6-c64b3f066dda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452343, "uuid": "62882fd0-a143-49b9-8d01-bceb715ac07d", "value": "9f9c7f4206ab49da803b3ad512ed58f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508e6649-4184-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636479708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636479708, "uuid": "4eb37b49-8094-4049-8db5-7db1353d8b53", "comment": "Malware payload", "value": "c2effb8447a4d13f97ef95c2018612fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636479708, "uuid": "381caf1c-3f74-44f0-abfb-d7604ae6b24c", "comment": "Malware payload", "value": "cf85da620332f1efdc06a6df46fdc219974a7b4d63afed900a47592ac31f1519", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636479708, "uuid": "c03c4688-8605-46d9-8c36-c5eae6fb9061", "comment": "Malware payload", "value": "7631b06b93d2ff2f73bbb5f094585cb9704de99b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636479708, "uuid": "b77522a0-3d6f-4d38-982e-dd400e59fa83", "comment": "Malware payload", "value": "a9e6936553d1f18f22e384d026343078d40affff4a47c96cec53be5eb73d8d6635d0249a60e1bc9b17e56bfa6f2e9f0f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636479708, "uuid": "afe2f855-d747-4e37-af8a-f2a57357b905", "value": "T1549422725359062BCE7653BF68733B441439A1DADAC2F7AE071A94E83F333D1A460792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636479708, "uuid": "215eb550-9d12-4178-9877-6a5f252931c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636479708, "uuid": "a30b05c1-0cfc-4219-b1ed-37f973a7d557", "value": "6144:3fuwYM0MIvfx9M3iO8n/xU/g64Vt/f0fZjvHjFzCaxdfuRYr/jN12:mwYZb3k3+qjiCZj/t7dmYr/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636479708, "uuid": "e0a2ecbb-fa0e-4f25-be02-150b96f5433e", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636479708, "uuid": "2e56cacd-9d72-44fe-a97d-47269bc0d729", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636479708, "uuid": "06e47b72-7802-4b5d-a642-04396d29a904", "value": "Account Details differs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0caf6f-4140-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636450733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450733, "uuid": "0bb439a0-d45c-430b-b379-a394fac7b210", "comment": "Malware payload", "value": "30b887d4042759867a28b8b549dc0c41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450733, "uuid": "627e3030-c1cc-4da3-bc8d-7b01cd5a3b67", "comment": "Malware payload", "value": "d00e1615ba855e6a7a1797095819dc6f8831434ca7d2fd0d077f95ef52405e53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450733, "uuid": "eb4cafcd-bd60-42c2-8660-906ffd4a1e89", "comment": "Malware payload", "value": "7764e3ec20032884fb389de7862fa6de46e9ce51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450733, "uuid": "5f89f179-7f64-47b4-b9e9-f7c129391d87", "comment": "Malware payload", "value": "71a640e5272270fe727b0fda464fc4b381196ef11faf2cc817abc4fab37b77b50ea0d427b84b3762d3e7af642f79bde3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450733, "uuid": "cacba39a-a64d-41a4-8bfc-1753dc04897a", "value": "T14B02D80497F84236F97A0A71E573A6D0427DF392BC92CBAE25D4021F6D33B5056A2F64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450733, "uuid": "2f619566-4251-47cc-ab6e-d12870a9d6fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450733, "uuid": "acfcd29a-ab16-4301-a14e-cf9dff16aa27", "value": "96:397usM5mBwYyDlJHIlGGiWgiIGYWPgJHjo5971OnJE9Vcqwvo2Q6DDjUzNt:3JusM5U+lJ1QIGTujo5h1OnglwvQgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636450733, "uuid": "615b94af-2e6f-43ae-9b19-c0198e9adcdf", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636450733, "uuid": "5c66c8e2-27f8-42b6-a735-797fec135c67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450733, "uuid": "54ad421a-6cd2-471e-bdf8-3d1b60941838", "value": "decrease.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df123cf2-414b-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1636455466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455466, "uuid": "5faa149c-f7f8-4026-a325-68b53528cfbc", "comment": "Malware payload (NanoCore)", "value": "4c83cf8c21d079740d7e5ac5c7475736", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455466, "uuid": "8bd1747f-bf69-458b-a7b2-24c49f28af0e", "comment": "Malware payload (NanoCore)", "value": "d1b83385ce5e7f2b6cbffb4c06641d7dfece3287b7cded2037529d7076b35448", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455466, "uuid": "0c705ed3-baac-4578-9901-583550b93ff2", "comment": "Malware payload (NanoCore)", "value": "7ed521e5e134f9adad0ca77f1d5d511f625f9e59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455466, "uuid": "fd2a34de-cf7b-413d-bef1-db7d2b7e04c4", "comment": "Malware payload (NanoCore)", "value": "461fe66fc191f584bd7903e7803233abaa07f9050506256d2705650f2abc0e796da2e99b6d4d8d0f621ddaec50fd3ffa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455466, "uuid": "82b8b82d-84b3-4619-9b2d-55b87ab5f2c0", "value": "T153D401393F96CC2BC10A2D7A1E91F9784174BDC06C5BE36A3B75662F6EB27423C52181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455466, "uuid": "4907f80c-3d18-4844-9b3e-27894e667eda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455466, "uuid": "2910ab5a-f6df-4ae9-ab65-a71e1ae9b577", "value": "12288:jw1ePzjIMfAGSfuGvVXOBONh+Ukv1UCYJXOaXJmrno+:jwUPfIMf3SGGvJOqh+UrJXOaUo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455466, "uuid": "4faf0b48-f6f4-43f2-9f73-58c2e9b326f5", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455466, "uuid": "0f357c59-a15f-49f7-ae6a-c7842e5c4c06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455466, "uuid": "a4adb0b8-88c1-433b-bcde-f9bd14ade00c", "value": "Rqm~093873536733-0873654356783993gh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619c05e0-4119-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636433780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636433780, "uuid": "7301ff4e-c244-47e6-b6da-2e1171e54eb0", "comment": "Malware payload (Formbook)", "value": "3c1bcfc5e5d1327746d9e8d3fdb5b49f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636433780, "uuid": "d3cd73a3-8641-408a-803e-d202ecf1d632", "comment": "Malware payload (Formbook)", "value": "d1f610af3c46fff6c857be0136c696604eb8e7466b4a7e40f6b459cfa8339422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636433780, "uuid": "0f97104f-6c99-4ab1-9546-4f83ef03e996", "comment": "Malware payload (Formbook)", "value": "58af3de1e2e55241141f05a3a82163ed2ef62339", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636433780, "uuid": "e6e0018b-57a8-40ad-8094-6e8fd16fb658", "comment": "Malware payload (Formbook)", "value": "aa73ab37130ea63eb393300f57478a071e2c6476cc436e69448f1ae49d31a11e6acf0c8f07a28562e8dc15e6e26dc063", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636433780, "uuid": "e7ce5d22-400d-470c-84ec-742d1123fd0d", "value": "T1350633DC2510D493FA2ECF7267464FA1260FDD9D54B1EA1BA3CA534DFC12A0CE3196A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636433780, "uuid": "03ea8946-b501-41c0-9c8b-a8d6f005acfd", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636433780, "uuid": "56c98378-8668-4673-8428-3f3eb25cafb8", "value": "98304:yG5CSRr8iMqvDG/gvVs86oR52IZUwZL+fjZPjifkqO2:yWv8Ix1UnfjZP2e2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636433780, "uuid": "1d9e78b8-a9f8-42dc-b120-89bc778f6120", "value": 3972145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636433780, "uuid": "4de2b661-45ce-4b1a-b012-db644420244c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636433780, "uuid": "a9115bd6-4be1-488a-b302-9c67e8ec786c", "value": "D1F610AF3C46FFF6C857BE0136C696604EB8E7466B4A7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd519b51-4140-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636450792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450792, "uuid": "ee9780fb-ba3e-4d33-b104-12ef407f5a7e", "comment": "Malware payload (AgentTesla)", "value": "ca25628c908282c7daede2cbc74520e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450792, "uuid": "f8521e99-6b1f-42e3-9a70-ad1d042b1efa", "comment": "Malware payload (AgentTesla)", "value": "d2b97a72173eb2aa363d9b5763d71f5c8b5d6324dc7f3a75b2d60916f64d4c2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450792, "uuid": "99b86591-a2a1-4612-836b-7b233d4ab170", "comment": "Malware payload (AgentTesla)", "value": "e9f6974a2e2aea11cd8ea1183e982cb6b52edcd1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636450792, "uuid": "f5f8f408-d2a5-45d6-b165-e6f89ddc99b5", "comment": "Malware payload (AgentTesla)", "value": "c99af845247bc8fff84f3d5f94a998b5ae7a1551e61e15d281b152875e8506085c00cb0608df5f8927f644492cc3dddc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450792, "uuid": "4baa4688-598d-418e-b240-a4d84061ce4c", "value": "T14D02A700ABF46236E63A4D3198B3535157B4F353CC668F6E19C4035F7D22BA0C6A2F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450792, "uuid": "8d062b2c-ba89-4c98-b488-ac0257f45d23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450792, "uuid": "60ec750b-7296-4966-a5e1-5a696fa0aadf", "value": "96:DesM5gwk4/YdwUkGi4SieGYWPgLHjgpUPhEQVcqTwWQ6DDjUzNt:6sM5gK/XieGTgjgpUPjlzQgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636450792, "uuid": "ca0f8cd3-fde5-4032-9648-adeef47f5fb4", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636450792, "uuid": "415f0e85-b153-4bc7-8cc9-152c154c33f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636450792, "uuid": "0faa1500-e9ab-4a83-acd8-aeed15fb73b1", "value": "Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4a2579-4136-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636446145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636446145, "uuid": "f05bfa73-7a3e-419a-9c44-412bb606cf9b", "comment": "Malware payload", "value": "2ee66c95ad3c8c5b3ee311dd26c12172", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636446145, "uuid": "6f9b3c70-48af-4523-bc55-c745d3a3b2b1", "comment": "Malware payload", "value": "d548d7408f8aa868bf670e0cbc5b2ffce8996bc6c6df44c5a84633518d23db69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636446145, "uuid": "741d5351-b031-446c-a775-944472aad2a5", "comment": "Malware payload", "value": "7ae97b978dad660a5f0031661cd9fe44818b46c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636446145, "uuid": "bc21b70d-286b-4617-a451-e8aeeb7c4f62", "comment": "Malware payload", "value": "a5d8f4e606a22b1f3711e29d82a70f3f3c53e3bc792f673da4e576b5886e7068610d7c54c0f28c3bb1b5c4fffd46333a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636446145, "uuid": "badef03b-40b5-4db8-80ac-7cfb1f0a93e6", "value": "T1BEF4C46C3AD51A32EF0DDE3B695109D4BBBB0F032244AA8167DB31FB433F9965D45888", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636446145, "uuid": "9caeed57-9b47-40e2-a91d-6a45e07f5b6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636446145, "uuid": "ff9d77ae-79a9-47fb-8d2b-4c779dc7ecf9", "value": "12288:8L6/Pa+8JquU6fWdFw8CQ8O829QEzXHEBS:kk8BudFw8eO82+EzXHEBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636446145, "uuid": "1e757383-c168-4ad7-98cc-43b48e1cfe9c", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636446145, "uuid": "8d25cbf1-e852-4b4d-bb0c-d289157aec03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636446145, "uuid": "83033b72-2383-4dd0-9228-9427c6faf392", "value": "Instruction From Bank Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed0ff48-4126-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636439332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439332, "uuid": "d09c93b8-e0b2-41aa-9a85-174d0eeffb19", "comment": "Malware payload (AgentTesla)", "value": "faa02c8afd5052e0d1b317ca85050a48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439332, "uuid": "20d6d15f-d909-4ff9-b1f4-c45cbf7186a2", "comment": "Malware payload (AgentTesla)", "value": "d64456dd4c2a9d2f7aefbcf76bd296669bdda3bd93537c961375868902c73c87", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439332, "uuid": "1ce362b8-2a5b-479c-ba68-f2b6cc4d5b1e", "comment": "Malware payload (AgentTesla)", "value": "5cbdf2c5bebe5b337f9b218648360797923b6930", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439332, "uuid": "df22dda1-187f-409b-8dbf-21b37cde251a", "comment": "Malware payload (AgentTesla)", "value": "51afd7629a2df5c6610a59e5bd5cf2d91086a3f819cfb09befcf8ee588f8d0d7a3838e93a319f2ad1dd0afb91c9cf334", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439332, "uuid": "df69094f-996e-4f61-b4a1-3c23d8fc212d", "value": "T1E3C4DFE50194C549EE56DF3C9439AF04193A3EF7293DEA8D5D68B8433E7328B04F2986", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439332, "uuid": "ff732117-ba9b-4bce-8f03-f1315f769006", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439332, "uuid": "16fcbb65-14d0-4769-a0e0-c9c2e05607d9", "value": "12288:RwrePS5GGmDoEA2rpGpuc2MBKohlHRr9fXVUnt:Rw6PS57YoOrgIc2c7hJkt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636439332, "uuid": "04e8b30c-dd3d-47e2-85a2-d9df21b0f29f", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636439332, "uuid": "da3fa3cc-8832-4d22-b499-433e369b2834", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439332, "uuid": "4a727efa-00bc-4c9c-9f69-cd0d9953f299", "value": "mPvMbrmaEnutMsi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42aa191b-415a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636461646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461646, "uuid": "38009bec-f55d-47e5-8d60-1039e5ee6dfc", "comment": "Malware payload (RedLineStealer)", "value": "14eca5277b9f34afdf6445137f536d00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461646, "uuid": "5f837643-e9d1-4775-842f-d6278654fc3b", "comment": "Malware payload (RedLineStealer)", "value": "d68549067554697569e1566c1e4c993a7e84dae92fb30e39ac9f4fc184e48cd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461646, "uuid": "a19603f2-ff5c-4e97-949a-e9d20e221a6c", "comment": "Malware payload (RedLineStealer)", "value": "dec70a64a1107aaa4737add0a3516c0dfe07353e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461646, "uuid": "6ecf32f5-fa5b-410b-8307-94c4eeafbce8", "comment": "Malware payload (RedLineStealer)", "value": "6b6f1ec43c627b0fb3446828541abba91b75a80f00218e20a841a08b8dd9c106c355d7671057a66ea93bef89de97d0b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461646, "uuid": "19c08dcb-334e-4d97-af8a-72c14c10481f", "value": "T11F84C010BBE0C035F1B716F4457A83A9B92F7DA1A72594CF62D526EE66346E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461646, "uuid": "bd3934fb-f2f4-4482-9a5d-abced0c2922e", "value": "5f60c500db75f47142be06e755ed4aae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461646, "uuid": "271b4636-02f1-44ae-81cb-7be968b54deb", "value": "12288:1R9X670s+xlvJ82x0AQPqF6CNgODzx2W:1Lc0P7W3PK9Xx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636461646, "uuid": "f97d395e-5f3a-4cb2-971f-96876f32e15a", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636461646, "uuid": "39787a88-0029-4bb3-a7f5-6ceecce7f569", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461646, "uuid": "8120e979-071f-44e0-9638-0eea8ab40360", "value": "d68549067554697569e1566c1e4c993a7e84dae92fb30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e6a30c-4142-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1636451320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451320, "uuid": "72238eb2-9cdf-4d55-ba6b-eddd9b1b15ff", "comment": "Malware payload (AveMariaRAT)", "value": "9899df18a9ba76d40fe965de829d0c06", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451320, "uuid": "4197081c-9f83-47ad-a291-45eee72a407b", "comment": "Malware payload (AveMariaRAT)", "value": "d758edb6fa48c621458fd03dfbf78c5ac5df1dc26e749341dbdd588f3bd1ed30", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451320, "uuid": "1793b43a-684e-478e-bcbf-411439347980", "comment": "Malware payload (AveMariaRAT)", "value": "a8850030e69d03f78c171c63045e209bbff9c1dc", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636451320, "uuid": "bc8e0549-0e00-47d6-8860-370d58930ff5", "comment": "Malware payload (AveMariaRAT)", "value": "c4ea1eb511be5d925d20817f3f60a7f7bae13ff7387e95032816533ad546bd571c5cee7c87565548343c196bd6118057", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451320, "uuid": "4aef9130-9ad7-429c-b74b-e351a750b7b2", "value": "T139056C12E288A9F5D49726344CB7632662793EA029159906ADFF3D032DF33C33675E4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451320, "uuid": "0fad0382-63a3-43ad-9ffd-ba25155c831a", "value": "7b484975ebc1a121d346391a74418697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451320, "uuid": "3e50da29-102d-416d-a437-74e0b32e65c6", "value": "6144:6ty9J2eb9Vmcc03Dl2QEE12/ggyHISePm7lDW/Bl5Wn7DYKbQAJRGl68hTnUE:R9J2ebzmccYDJ2tMIMS/n56D26mTnUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636451320, "uuid": "6ab86579-6f74-4ed4-b7da-d91204216b5b", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636451320, "uuid": "af37a328-3004-4ba1-b59c-6fda0e631ba3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636451320, "uuid": "813bd846-1323-4eb5-926e-4b85c896abaa", "value": "Complete Set Document #YHNGBMD EndUser Proc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c148c9-4125-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636439190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439190, "uuid": "12a834d8-adcc-40db-97c6-8fc43d69cecf", "comment": "Malware payload", "value": "ea1a74f2b093e3aca5137f2399b08fe1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439190, "uuid": "6d5de53a-629d-4248-b914-b49dda1582ab", "comment": "Malware payload", "value": "d9043481ac860270c7b3884fd58107184ab08605da067ed42daff1ab1ac5eba7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439190, "uuid": "5590e14b-80de-42c0-ac49-fc4803ae9798", "comment": "Malware payload", "value": "5c1b5844a2cb4ae365438da10fef6e85a79fc232", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439190, "uuid": "267e78a8-2042-4b84-87be-9abef8ced20f", "comment": "Malware payload", "value": "469a614268e72acb231979f5915c27ad2f4b0d8a925d7c38456b190f82d118aee8c621f9f592ef8c27855700b4dfb2fa", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439190, "uuid": "0398e6b5-dbcb-416d-acc5-27fe31d2249e", "value": "T18C24AB7DF1870A88CF8693B8170B2F81164CB50DF3D995B636B8DB3866C0D7A961293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439190, "uuid": "518890b8-3cc5-4264-9798-52186fe840b8", "value": "3072:YWYayRX6/eeix1ZOlAmRoFAzLp/Ds6VLr/:YZRCix1slPWA/p/DLVL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636439190, "uuid": "1b7038a0-1961-4cad-b7fd-20dbc95d5a4f", "value": 228493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636439190, "uuid": "6cc1e2c6-9b31-44a7-9ce8-075f988d88f1", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439190, "uuid": "17b02e5e-bb97-4719-9ad5-f70d49dddf2e", "value": "ExportUSA Corp RFQ 6000567507.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec95826e-4158-11ec-843c-42010a9c0014", "comment": "Malware payload (Pony)", "timestamp": 1636461072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461072, "uuid": "9656d36e-9fdd-434d-8085-13f26bca3e6d", "comment": "Malware payload (Pony)", "value": "8b998aaa2064a24bcd8122d956c59c66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461072, "uuid": "9db7cd36-bd39-4cdd-a602-87b8cecad6c7", "comment": "Malware payload (Pony)", "value": "d9a5b131c7a3323ae280684b70ca4892d7b82ca6c599e2290915bab798c34600", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461072, "uuid": "c5ace7de-2029-44b5-9675-1011112b01df", "comment": "Malware payload (Pony)", "value": "a5e54d054e59114c4552efc46348c404f3493ded", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461072, "uuid": "0f140792-bca4-44bb-b5ba-4ad29e429c3f", "comment": "Malware payload (Pony)", "value": "bee0379cf10a11ed252be04b1157aa392db448858d07dcee43e388e44433cb0efde81fd56b6ff162a8b7f82b88a94f47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461072, "uuid": "ba2b76d9-8ca5-4786-9bc4-4feff5e826bb", "value": "T193B41291AADBE6F9CBA6893A47716B0B07CCFC271C75C0A6DA1DF3C830B20E57921515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461072, "uuid": "ce5c1f37-532d-4ada-8a6e-59b7e97a3c4d", "value": "2f3102f07e26b726eba70d83959b07e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461072, "uuid": "28838820-d9d7-45e8-b380-5ac21c4732f5", "value": "12288:wbBXXg52RKby7Fp8Bt7h4E/N43GD/+esTCmY:w1Q5UKe7Hkt4ElTDW2mY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636461072, "uuid": "6c01945e-e304-4f99-af55-1a24b26e953a", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636461072, "uuid": "16ee8a6b-3e7d-4a5c-9a60-52ef70c57e90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461072, "uuid": "f327422e-e0ab-4756-8f4f-ce99f8e6741b", "value": "D9A5B131C7A3323AE280684B70CA4892D7B82CA6C599E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe685fb3-4102-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636424165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424165, "uuid": "867fcf4e-0474-4f2c-8410-78b060fdda12", "comment": "Malware payload (RedLineStealer)", "value": "e43c42e54c94e8de167ab91aefa54ff3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424165, "uuid": "f178279b-c19e-46f8-81ae-6b64c1aad3f3", "comment": "Malware payload (RedLineStealer)", "value": "d9e1198e36826ed2c6071d8efbb922e1c15714f0fa939366939c63cfa8bf511a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424165, "uuid": "f5e17035-18db-42b1-a043-8819a2dbc51e", "comment": "Malware payload (RedLineStealer)", "value": "18497eda8f5b08e4b311aa2a4534520b0e5c0e3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424165, "uuid": "868fea53-a9e6-4763-a2c6-d2b627105860", "comment": "Malware payload (RedLineStealer)", "value": "60aacf7a16125ddaae8283d420b237186e2809804055f8c96b8d8e8b5201f9428faf936a514fa98e2880fb15a29cd87a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424165, "uuid": "2f89aece-e4a5-46a4-901f-d04bebfc5884", "value": "T16084DF3167E8D824E5A71E304871FAA41B37BC12B520D10AE650679F1EB3A8D96F13DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424165, "uuid": "da8dd76c-121a-4ef2-b42a-c1408362e9b4", "value": "d258636f72d347eaf01f17dafac75115", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424165, "uuid": "3545a292-e509-45f5-a203-07731bc3e911", "value": "6144:oIj9G/IEDHpVCUNvyjjIAv+PGOYkJZPDFuzbgwu6QigabwVf:bj9G5CUdywE+P9YuZPRunn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636424165, "uuid": "dd7560ae-b8b9-4091-9578-f4515c1837d4", "value": 376320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636424165, "uuid": "534df642-3d0d-4ab0-9164-5b800b46444b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424165, "uuid": "b9ddccf4-b2df-4637-a942-1653df6c3df0", "value": "e43c42e54c94e8de167ab91aefa54ff3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dede541-414b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636455356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455356, "uuid": "0984ec71-7932-4834-bed4-7553dddb6492", "comment": "Malware payload", "value": "e85bd453cd3f2b0fd5801146181b7b3b", "object_relation": "md5", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455356, "uuid": "49490164-b676-47f7-ba2f-7ba5406411f4", "comment": "Malware payload", "value": "da8a66dc14ec51b11b18d5c71be69a60e40f233003ef90eb7e77dd0f504351d5", "object_relation": "sha256", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455356, "uuid": "dc95f2df-4d35-4428-bc7d-4207cf7403c0", "comment": "Malware payload", "value": "b5f51efbb196c1d63001a2483c64c418a0f455ac", "object_relation": "sha1", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455356, "uuid": "2a8b6dae-20ac-4ba7-a533-4764677b36ab", "comment": "Malware payload", "value": "b46df854eb9ca7c4b9aeeae22539ceda29a9a365ef32379c7de5e1d3a206d7f2f68b1a8c8a461e93c0209b62e8cacd3d", "object_relation": "sha3-384", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455356, "uuid": "4c51ffda-d5c9-4e56-81b4-d42539e6c840", "value": "T103B423CC1BBBC4C52E0AE704E10B8453D91BE8C547D4B68355BAB6662D778CDE20CBB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455356, "uuid": "3af16a3c-47c1-449c-9023-0b42bd4a7dd9", "value": "12288:XTMgy075KlypWH7AKKmSsv23/jmc8fDzHeV3zg4atf:DV7SKfRm/m+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455356, "uuid": "8be11b46-0354-4484-855a-4c343c024018", "value": 499976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455356, "uuid": "46c46ac9-db78-40a9-bf69-bef8207e4a46", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455356, "uuid": "436e7a22-10b4-433d-a54c-798d37ba19c8", "value": "WDC~039837653356-30983637.Doc.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aeba9ea-415c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636462653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462653, "uuid": "e6418228-e7c4-4e9f-b106-aba0de742a34", "comment": "Malware payload (Formbook)", "value": "7dd83d33a8462eff9f65ddb4d326b3d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462653, "uuid": "9745a030-8d61-4405-81ea-ef4cc9f9798c", "comment": "Malware payload (Formbook)", "value": "dbf442323e19a477370d316dbbd389f48ce8c93ebd119fdb319be4f3f82d4b7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462653, "uuid": "38294a4c-9319-49e4-9c97-de9e40b40df1", "comment": "Malware payload (Formbook)", "value": "48ec85c314157d9a3d5416c2e7c71cac920762a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462653, "uuid": "04ae297a-d0e2-4dd8-8cb9-d9514f816be0", "comment": "Malware payload (Formbook)", "value": "801f26f41ec90be5be14870ea56f73b921583a33a8260bfa1d03ff7e2bdd1d13e7aa8af15962f7eff2b32abdadcc0cb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462653, "uuid": "db18d9d6-8dd7-4651-b08b-a1e14ab2c583", "value": "T188D4AD7A3111BDDFDD378EF58950AC70AEA43867532EC24398B7059AFACE492CE144E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462653, "uuid": "aeebf3c2-1da1-4ceb-8e35-751386be917d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462653, "uuid": "96c384e9-9db8-4fe0-a212-1cf67c266315", "value": "12288:7zEPGlqJFTPvd2382+I9I7TEV0u/VJDvUCyau7QrmStqdPVVr1F:PqP2L1V0uthvUC/uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462653, "uuid": "d2aba0a4-b199-4d6f-a6a6-15949b8e06bf", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462653, "uuid": "44e26781-54f5-4592-b874-4667e699c874", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462653, "uuid": "13678e73-151c-487e-bfce-0139d921878d", "value": "PO#101581.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c55fa96-4157-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636460266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460266, "uuid": "eebe37a1-82da-4d54-b203-24ab5241c9b5", "comment": "Malware payload", "value": "b28a1f90af3d0b09cd760585b272061e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460266, "uuid": "52cd8ba0-9515-40c0-b3eb-ee8249eb8f02", "comment": "Malware payload", "value": "dc729b2a9afc414456859ada9ac7931565ae0789c2cd9c35186458c3987f1639", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460266, "uuid": "1a253ec9-0a21-4df2-bf4c-425a084320ff", "comment": "Malware payload", "value": "548bbf863bda9a83ee6c069a61e489ff8273e551", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636460266, "uuid": "4dbe8b4b-c7cc-4de0-bf84-eead157ab09a", "comment": "Malware payload", "value": "98ca83ea3de038771266736fe044a9e1aa6bce27c543f24c8a6129736806b8f8c4c8a132c8633d7de967bc132907393a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636460266, "uuid": "2566ac73-9582-44c7-8ce4-95e4e6f4e400", "value": "T149741261A3688A3FC99E473F881729410771539AA617FF7D0B88B4763F173522582BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636460266, "uuid": "318ad87b-d28a-4c7d-8b6b-cdd44d91f696", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636460266, "uuid": "d76603e3-44ce-4c0a-83b1-4ebea9b439f3", "value": "6144:aJLUwFeMKM5lx9akz5yNJ1xmUQqRGgBc6+GVuC6ZxMrwTuKHqsbAp0+eb6+MQ7:hwFePEl75yNJ1x1pbVF6ZxMcTZLqYLM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636460266, "uuid": "25cb14b5-c145-49ce-bb09-3ac414b52bfb", "value": 360960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636460266, "uuid": "024a6a14-6eb7-47e4-b621-27bb1ef2e777", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636460266, "uuid": "4504d3c8-3dba-4d0d-8583-878090b43d8d", "value": "Order confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f208008c-40fb-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636421138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636421138, "uuid": "f9a7e058-eaaa-45ce-915d-88d4f155b019", "comment": "Malware payload (RaccoonStealer)", "value": "5ee7c01873bedbb1312815353e6957bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636421138, "uuid": "b2b36710-f6ac-46d0-8fce-9d1338523867", "comment": "Malware payload (RaccoonStealer)", "value": "dcff5dfaace324b1c7a88575b563f7e6fafdab55df9fb9a8f096332c0adc1926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636421138, "uuid": "8eb43441-3700-409f-9bf6-a655b6133271", "comment": "Malware payload (RaccoonStealer)", "value": "2b79ce31011098646cc3f7c1418ac9938485de91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636421138, "uuid": "1bf978d5-d877-4d0a-bd77-d3a4b439ad5a", "comment": "Malware payload (RaccoonStealer)", "value": "6190701f5cbe38dfc262eb57cf2dbb5cff14c6a3967de3cbd3c3b6f9240d0b2d6f67c426396763a26183de7c8976f9b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636421138, "uuid": "22805b78-103e-4b22-950b-84ec5703493f", "value": "T169B4F031B798D424E3A31E308966D6A16AFBFC011970110BF754679A2EB3B9C46F731E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636421138, "uuid": "691cd00e-3bcc-47f3-bb4e-4cabcb65ac94", "value": "d258636f72d347eaf01f17dafac75115", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636421138, "uuid": "abbdc6be-6bc0-4672-a857-3a7daeb5979f", "value": "6144:jW/2etuHDFGTexh0a1yRz7uW+9o6wqFRHhZLtl82iuzbgwu6QigabwVf:a/2etujUCWb89o63zPDiunn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636421138, "uuid": "5965afb0-63ef-4141-a891-459f9473f217", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636421138, "uuid": "2ac33e9e-04ce-43a7-b546-c65f56c355f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636421138, "uuid": "b2e59298-efaa-4ee6-9b7a-e5b8118f6b55", "value": "5ee7c01873bedbb1312815353e6957bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9216474a-414b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636455337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455337, "uuid": "b555b948-e2f1-4e77-a7f9-bb3dd8334041", "comment": "Malware payload", "value": "f841711144cbc11c648e6c78fc748f0a", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455337, "uuid": "948d9b84-98cf-447a-a417-615fd19cd59c", "comment": "Malware payload", "value": "dd89be163195aed2b72ae6098c0916728cfb58c2eba2d3f67cc48420a99b1176", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455337, "uuid": "94afba0e-6308-48d6-8935-4877d05f22ba", "comment": "Malware payload", "value": "1deba11ea1bf69de2cff1114a52ecd9092eba345", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455337, "uuid": "f910e226-ce47-4e81-be13-0e883a315275", "comment": "Malware payload", "value": "9ea68be2e8a93981f330808d5e2355b347a543ca0f11b5665481b11042f7af8d4cff9cd5304e350407d513df24cbb0de", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455337, "uuid": "7406147c-c4d9-41dc-8955-eaee1225a00a", "value": "T11DA423A534C5CF96315FAA10215BEA9FC734B28DCEBAD23479A2101CAD5CB35D6848FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455337, "uuid": "a6e19aa2-28c3-47da-8b0e-c02548e603b3", "value": "6144:YSnLnc07+Tx4Oqr5kJnCcENpF2nzCuvKLPB47Tli5P9J2MJVQGoKzDQeAwc4yeqX:YSnw4N5SCcEuuFjB4HAnJ2yE8ZyeBoLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455337, "uuid": "b7540390-dbc0-4e15-b02a-b00402011449", "value": 469218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455337, "uuid": "8b54cc45-e10f-4d15-9d70-5b288c51b5ea", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455337, "uuid": "25270f45-0266-4c19-8cb9-6d89c32691c8", "value": "PURCHASE ORDER EXPORT1024 SCANNED DOC_pdf(1).ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886f6ac1-4150-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636457468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457468, "uuid": "bd59431b-f119-4c89-bb11-c0b94558e151", "comment": "Malware payload", "value": "8a1a3caa1e0f138dc0d8016671682438", "object_relation": "md5", "Tag": [ { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457468, "uuid": "57c99c0e-8cf6-4e17-9ccb-0e03bd301fb6", "comment": "Malware payload", "value": "dfd507a747aa49b13351f35e97dde23519e56fb017dc2c5c0b60c1923511763e", "object_relation": "sha256", "Tag": [ { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457468, "uuid": "91a6797d-0940-4421-90a9-1d32caef29a5", "comment": "Malware payload", "value": "6c2c4358fda4e243ee53d26311bdcf6898db8624", "object_relation": "sha1", "Tag": [ { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457468, "uuid": "7b85830a-c18a-49cf-b307-ff5c4319f29f", "comment": "Malware payload", "value": "37b737702e72f2457597a8fab51d2d227cacf55579ddc3793babc8d1da4f3f1c7e1151f1f0f88699710f7f8479d24a76", "object_relation": "sha3-384", "Tag": [ { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457468, "uuid": "a643ac6d-ec90-43e4-9c3f-fd5150c70b33", "value": "T176A2FC7EF58B0E88DF47966D160A7B65064DF41C73C844B22AB8CB38795D91B8B23D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457468, "uuid": "abe50377-7b50-4861-9894-4f9d824a8da9", "value": "384:pZc9Bxc7z4ArxxzXL36U6evkLndqi6kEPcRIJMQTXu6acKmll6:k/0z4A1xzXL36U6cilRIJLTnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636457468, "uuid": "74bec8cc-5148-4b22-b54a-c1ff426cb13d", "value": 23102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636457468, "uuid": "1a844331-cda8-4822-9ac8-45e861da7cbf", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457468, "uuid": "6b2874a3-286e-4e10-9fed-3bb3d08eafe5", "value": "invoice_34567445556.wbk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec72eaf4-416a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636468803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468803, "uuid": "cf0c180e-747c-4b4f-b1c8-894b79bbb958", "comment": "Malware payload (AgentTesla)", "value": "62524df5de24fd01d349d4183dcc073a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468803, "uuid": "5610c23b-0661-41c4-86d7-e7dfe9108a13", "comment": "Malware payload (AgentTesla)", "value": "e01e30c5ced9fab9d880d669693b6ed9ed43eea97b3a2ae9f5bd217b936331a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468803, "uuid": "ce3ce40f-700b-4c0a-8036-1905a95d6393", "comment": "Malware payload (AgentTesla)", "value": "6f62f914cac1344e450aee04cc714b285f3a8a53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468803, "uuid": "5b543029-b7a9-42a8-adf5-751acb1754fd", "comment": "Malware payload (AgentTesla)", "value": "c8e5fa94c1637f7f12c95fa649b53eb273813e895cc05287272b945737e4d08dd550b4ee235355e4a87a7259f97a9458", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468803, "uuid": "f4da6cb6-9add-4e15-9c12-16b783516131", "value": "T1E164128BF4C0D673E95409B81176AE3953F683C1E24F1E539728FEA81C714829B59DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468803, "uuid": "8fa10862-932a-4c7e-9b56-7526c4d74339", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468803, "uuid": "9436c68e-2db8-40a9-88c3-8d5a63a1d362", "value": "6144:BGipd9c8sdfZU8C1kl5MV8zrVn83HF0GafLDbXKeOlIEigL9mY:3c9dfZURGMV8nVn83H6GMLDpWIowY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636468803, "uuid": "cf669e3a-3999-4597-8dc6-f64adbb4c680", "value": 324864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636468803, "uuid": "fa150885-2cff-4259-9f14-3ee2005507ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468803, "uuid": "8d966893-8619-4242-9c4b-ecbcd32a63e1", "value": "NEW PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e8a3f5-4146-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636453251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453251, "uuid": "cc73a921-a98a-4ec5-af1a-b4c0e15f4482", "comment": "Malware payload (RaccoonStealer)", "value": "b3fe60a32c6274acd39f189c93c2e0bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453251, "uuid": "4af867ae-b10d-43b9-ae66-028990869631", "comment": "Malware payload (RaccoonStealer)", "value": "e04f6d6b73cbeb3b5ed8834cd2c8a386daeab02e94937b54f6579802c2433e31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453251, "uuid": "f5f37664-b38e-418f-88a9-656025d5787b", "comment": "Malware payload (RaccoonStealer)", "value": "3b18e8c5c79b404ad7553be9e30270396bc69de5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636453251, "uuid": "c4aaeb90-add1-4bdb-b8a1-bb251475a050", "comment": "Malware payload (RaccoonStealer)", "value": "4c59b22081bc87af609639438f2ed6151f830134973493b2811a5a915ac863dedeafa0ca15395a0f3b040387b63ececd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453251, "uuid": "eaae643b-2b55-4fa2-bba1-2f9aff875f7d", "value": "T151B4F130A6E8E439D5D31E30896192B04E3BB852D960504BE7D1679F1FB3F9C8AE531E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453251, "uuid": "7560c507-990b-4055-9983-7774c1e77407", "value": "c8725b7ab8753c936cc4c98a181b2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453251, "uuid": "1402ea1a-8345-4f23-9bac-04661ecea8a7", "value": "12288:lASUCL0bW4x2H0OFkMD2MKZBJ9BdcnOaoLunn5:bDLEgH0xMinB6vP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636453251, "uuid": "faae2c1a-2ef2-4a4e-ad3b-7b87a35a40de", "value": 515584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636453251, "uuid": "e4bc600b-8a92-4084-b79d-6161f13fd1fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636453251, "uuid": "dfe82e3c-7209-4151-b590-1f3ffc0e25a8", "value": "b3fe60a32c6274acd39f189c93c2e0bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2781e30-414b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636455364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455364, "uuid": "5341dba6-93d0-458b-a3fb-b83f979ea71c", "comment": "Malware payload", "value": "40cd8ef9e211de12bf57d6582c22dba8", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455364, "uuid": "5a7bf4ea-ff4c-466a-a23d-391f83f5a9c2", "comment": "Malware payload", "value": "e0a22a36afa47e08a8ca6a0c5dfb1be80f546877986c164da8b042a0132ce46a", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455364, "uuid": "33c2ae1f-9b01-4894-80a9-18018ce9017b", "comment": "Malware payload", "value": "588a9d7aa1ec63253089544aa05a23b9a29e98c3", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455364, "uuid": "4b4d4288-5e60-43bb-959a-e88fff8218f2", "comment": "Malware payload", "value": "fe58f9121daddf665ddd87352e9b73c7bf5ced54f5feb6f3d8d8400789308b4fae83a8be3c781d5378f15552b521dbeb", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455364, "uuid": "775dc386-46d4-4708-9b0d-24586a5d4f3b", "value": "T1FEB423A9D9406C3FE2B33D34928461D941CCE183BFED6B7854574CBF74B8E961D8A822", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455364, "uuid": "2a411cf4-1af5-46e1-a6c7-e0b4b6df95b1", "value": "12288:7Q7W2z5wtA/hTKxmbnepcrkyhvWYd/lGDQB3gw1bmUMmu:78CtApKxmbepgBtW6lGcB3gsWmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455364, "uuid": "32d7bd66-932f-4cb9-b15f-f01706de1c3f", "value": 514848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455364, "uuid": "f4ba8754-0062-4197-9d9b-f01adcae69eb", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455364, "uuid": "3d5a485b-6851-4c29-bcbe-3345435de423", "value": "PAYMENT COPY EXPORT1024 SCANNED DOCUMENT_pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c682e1fa-419b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636489784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636489784, "uuid": "792c47f7-df70-4111-8fdd-d712131991cd", "comment": "Malware payload (AgentTesla)", "value": "3251c84354776a0eb6ce50ae27858cb2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636489784, "uuid": "56bbf566-a8ed-4ab8-b1c9-715bd3b5bfc8", "comment": "Malware payload (AgentTesla)", "value": "e153c6a3683fe634a3d45ddeb79bff8ac28ec894c9690fe8fff026c40a1900e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636489784, "uuid": "e69a8486-82e7-4227-aef5-1f79cff0d780", "comment": "Malware payload (AgentTesla)", "value": "b7c66d2671f63d8cdf843ed9f25c1eb1688e857b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636489784, "uuid": "28e81da4-d3ba-49d4-849c-449d9258eddb", "comment": "Malware payload (AgentTesla)", "value": "0bebea082b4c08264246c4f214e6cf2e8f20885bef6ae57e4c14809cedeeb3eb75be55def57395d01930ddff486c32b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636489784, "uuid": "4ca8e202-153d-40f1-ba39-278e670c4065", "value": "T1CF9422AA839988ABC285563E2C63F590133867CBE847F7FD8F5991943F1334294927D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636489784, "uuid": "0a38ad6b-6ed8-4aef-a82d-21593fa481a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636489784, "uuid": "ca19091e-de62-4ceb-9615-c6761563e08e", "value": "6144:SuEnwSeMKMCBALFNZaR1HBwMfBsi25xh0rmS4N/CihLIjTo5avoq:2wSePrB2slBsDj0rD08Cav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636489784, "uuid": "484ded77-01cb-4979-97b9-cd1f5256b4a4", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636489784, "uuid": "6d34e30b-0593-40a9-9470-f6710d59b639", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636489784, "uuid": "622760ef-9e19-4ca6-8af7-28b9293ae8f0", "value": "Order#749121301548.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a067b9da-4103-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636424437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424437, "uuid": "15ef23d2-3e2a-43f3-b6b9-80056f8272bd", "comment": "Malware payload (AgentTesla)", "value": "df707ca42ecdccd6b30737504f90f4af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424437, "uuid": "1564ee63-605f-486f-a5d0-3de674ea1731", "comment": "Malware payload (AgentTesla)", "value": "e1fdc02e35b9b02816530dcf8c068abbd76d2b4f3f145baeb8fc908b2f0fc8dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424437, "uuid": "3f80331f-cb32-49d8-b726-d781ffd55849", "comment": "Malware payload (AgentTesla)", "value": "0e7dd05ddc0cb04bd203d9dff279d0cbcd2301bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636424437, "uuid": "5ce6446d-e5dc-4435-88a1-c8ba6cfebad0", "comment": "Malware payload (AgentTesla)", "value": "87f9fddebf37daff40ba0646cb32c5fb801619ed9257eef214060d0135d917ad0e0c522cb1bc695b83d897af6d4f8bad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424437, "uuid": "ea7876e0-e433-4df1-89c8-00420f72af27", "value": "T127A30802B3924323C58C05B5D0D3166307F7A64FAAB3D6867E8861DA0E573D89D4AFCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424437, "uuid": "9d6e7109-5a55-4dce-b866-06e3ff543a32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424437, "uuid": "9df49afe-f06f-4242-8a0d-d3a3cbcdb41f", "value": "3072:Nmtwh1Eowu2+Z/zwpga/eHUTQQQQQQkdBft/2YWLr2:HhWbYzQoJ8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636424437, "uuid": "ec9ef9c8-f71b-4c12-a705-3bfa13dbc08e", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636424437, "uuid": "7b5a12df-3a49-46e0-8a4f-ce0eb3d559c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636424437, "uuid": "2fa8636a-40bf-4496-aff7-04cf4c19c181", "value": "Document_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab55bec-411f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636436507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636436507, "uuid": "3b65446c-75e4-4d0f-9817-54329903178e", "comment": "Malware payload (AgentTesla)", "value": "52cc39a88039fadc477da1a88356126b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636436507, "uuid": "fcf30c6f-8abf-485d-8fee-5b70b222ce92", "comment": "Malware payload (AgentTesla)", "value": "e2badfcc36befdf56574d8ae20968d941c0de9988da0ae2f949b10a28f5096fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636436507, "uuid": "9568979a-7b73-4e6b-82d9-86e3ee527469", "comment": "Malware payload (AgentTesla)", "value": "342a27990939c50cbe47cfaa82bf64db1ce2c6b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636436507, "uuid": "63c0f310-72ce-41ab-a356-3b8e7b81e28e", "comment": "Malware payload (AgentTesla)", "value": "0b250ae5aa86928a63bfbe695671d6315bdf8e4c2e60c32c01dee9fe32bc1bd471e8028865d9dc798a3553bdc5597878", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636436507, "uuid": "a77c6689-857d-4528-962e-e7b34ec9d5a1", "value": "T1E715170536D8AA6CF03DA731507901858FF4A811E362EA5EF6D95CE99E21FC24B0F35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636436507, "uuid": "d579b8d8-3e2e-46ca-b1db-4c512e3f0b87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636436507, "uuid": "858f3100-5ee1-4625-834c-48ad0e49a71e", "value": "12288:Ozcp/wQqJTm4rT13HLTLSd5ix7txMlpO5tl/qAPc3sVXmTrnuQpvMUnElvJEs+YG:vp/wQqJ7Ihx4qLvKFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636436507, "uuid": "987e100e-7052-4141-8140-d76adb4ce93f", "value": 927744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636436507, "uuid": "2cf807ba-4dc8-4b95-8cec-f0d96201065d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636436507, "uuid": "cd264058-863b-43a0-8ddc-f7403ec4c893", "value": "52cc39a88039fadc477da1a88356126b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654d0dc5-414b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636455261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455261, "uuid": "e2155c59-1e9f-4b30-86e2-76e8da16d5d8", "comment": "Malware payload", "value": "f64b60b00491677abad05dfb69551354", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455261, "uuid": "86a3d28a-d0e4-4d5f-89d9-83406ec2ed39", "comment": "Malware payload", "value": "e2f27e1f3611140da538f1d6954ea231a38bd4b4aa29deff567c9b39db6835bf", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455261, "uuid": "a41aa866-e1f9-459b-8e42-8c338d9149da", "comment": "Malware payload", "value": "debd4969ed95fee41c94168b7f81651e79c8d05e", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455261, "uuid": "57f705e7-f407-4026-9a8b-13fe989c97d4", "comment": "Malware payload", "value": "6c75b937442af45d369ef9b313fb95bb082ffc109299b9d6e5c274e9c44f4738628221f7f086ed73c2279dcfa0692596", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455261, "uuid": "141a2557-f140-499f-96a3-c9b226ffc7dc", "value": "T10E84236FA09952FEEBF1BC6BD30D0886F73518397567FCAB14F3098B996A004A1D406D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455261, "uuid": "7796aa28-aa5e-4577-aeeb-20c2a07a0934", "value": "12288:onBoMJBAFYyWOWB+1bZVfQU2p2qnuI8J1rjz8eIyGN:oBd6FzABIwp29frPY/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455261, "uuid": "e9e0d5bc-d882-4772-8e4d-f4ea3635544d", "value": 396098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455261, "uuid": "fe4633d0-5b33-4e80-9614-ea7078e24b3c", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455261, "uuid": "eeb48f3d-4ccf-4c7d-9661-405207254fdd", "value": "REVISED PURCHASE ORDER(1).ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68495277-4151-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636457843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457843, "uuid": "20a7c8c4-eccf-44a6-9781-846feb4d818c", "comment": "Malware payload", "value": "d9c8319abdbf4c7712d180e30c04afb6", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457843, "uuid": "4d91e98e-8b9c-4d86-a986-faf2dfc6c45b", "comment": "Malware payload", "value": "e48e4e8424294d3d8ed14741b8d52730db273a1b33e9e6ad2a0f23cec65d9352", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457843, "uuid": "8bd598b9-a1ee-4df9-9227-e9ed2f8f7d82", "comment": "Malware payload", "value": "115ccb13c988e395c13e8ff06ec6e4965805fb38", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457843, "uuid": "abacc723-1743-4d76-ad79-11227a6b80bb", "comment": "Malware payload", "value": "2ee25b9217d880994edb2e1332f79193d4a29a3f7955922a572d1ea85f1e83e9b1daffbad3ce8071201097b7953a9ffb", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457843, "uuid": "89b3497f-ba27-4151-946b-2c47b956cec2", "value": "T15F73F12F8AA968E3C299F83D424D08B6ED72D7503D80526E9A59F60D00F6697E34F02D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457843, "uuid": "eacb230c-8907-4eda-93e9-bc8e26dc6fb9", "value": "1536:8CW/PZZKz/1eCzbqzLkh/OPvTFVY3SIxcEbwJvg9WvXu8SW7:83ZEz/9qGWPvZVYBJbw9g9Wve8SW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636457843, "uuid": "51933a6f-ba0f-420a-9c5f-1c7992b3173e", "value": 77590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636457843, "uuid": "27e4626f-ac12-4907-9304-cc32f56dbd71", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457843, "uuid": "103ced88-0c40-4cae-bae5-1f48b335ed8a", "value": "Bill_5773.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b635732-414c-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1636455647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455647, "uuid": "f069cf6c-4fb2-4a59-8fbc-572eb741f24b", "comment": "Malware payload (NanoCore)", "value": "e3849d23cb4dbe83d6d3a59ae1f5d4fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455647, "uuid": "9e690242-d69b-4139-ad9d-2fff63898de3", "comment": "Malware payload (NanoCore)", "value": "e5fdb950c549cd8a761c4612cc91c1d661b5e9a59ecaecd65ecaadc840023a9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455647, "uuid": "c2b5cf2e-d32e-4d6e-b3bc-8c22cdc7b1ec", "comment": "Malware payload (NanoCore)", "value": "ad10e50352eff2a4d7fcd974a2e77a799a3b4bb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455647, "uuid": "7056ba0c-0ff4-4042-a19a-019890da883d", "comment": "Malware payload (NanoCore)", "value": "f0b20cc166c588a0049cc117755273eee1c67bfa6fec5d521dacd2396db37b0c786e990c971809032e920d1269eed126", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455647, "uuid": "86812b2b-ca3e-4e2c-b9f7-477b9dfdced9", "value": "T1F6156D127AD49C05C37A0732495B912CDAA86D67653E8218BEAE337B2F7B710065733F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455647, "uuid": "5d241750-49ea-4650-b63c-82fa018023e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455647, "uuid": "e59441f5-552a-471e-9145-43e1e208350a", "value": "24576:kIzUy+lh5BhvnYjp5wylGCswxw7HgCTvl:X+wssw7ACh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455647, "uuid": "4824bd9c-a7ab-43e3-afaf-50e0c675d9e4", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455647, "uuid": "edfae2a3-8cbc-48d1-989f-f3d106ac7c14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455647, "uuid": "19e80ff1-c975-4492-942b-8a414796a88e", "value": "PAYMENT COPY EXPORT1024 SCANNED DOCUMENT_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b0d197-414b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636455317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455317, "uuid": "a291be83-34ad-43da-bb7a-3e7de51b24f6", "comment": "Malware payload", "value": "0b573722d86b6855c8605293dd4c4141", "object_relation": "md5", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455317, "uuid": "9fc24164-f584-4185-82ee-7b92d3050a41", "comment": "Malware payload", "value": "e8c99adaa1d16389b0fddf01f3208416d0bd1669cefb2500df57753012c18a71", "object_relation": "sha256", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455317, "uuid": "6400c6c9-be89-4eca-8f7f-2ccae986a132", "comment": "Malware payload", "value": "798c911b086891c41e37233eebc6dd8d1b946976", "object_relation": "sha1", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636455317, "uuid": "3102b9b5-ed3e-4faa-ba8e-652723d5941d", "comment": "Malware payload", "value": "20a7439f39bc562b57ddac57474af028efff28af7397cb00b67831db55269394e82819ffe3117d80833cae98dcb74325", "object_relation": "sha3-384", "Tag": [ { "name": "onedrive", "colour": "#BD9ADB", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455317, "uuid": "a8fb521b-8c35-4112-8d53-3fe53b6516e3", "value": "T1999423DA9BCD4CED90B22A1581DB6D9F625AB104D23752C1FD09A347CBA903344B72BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455317, "uuid": "4735fab5-9da1-46c2-9b2a-118ae2644322", "value": "6144:UidnW2mpEU7EPCsz+fVNd5058AXDKt0keBm2peqkM/+xRUa5dQIbKgGh4vm8fl4d:vnOov+fVNd5A8seMBmEkMMRP59y4ll4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636455317, "uuid": "5ca8b8dc-3bee-44e3-8f67-cd82ac30f85e", "value": 409430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636455317, "uuid": "64d8a316-6089-4bb4-ae17-2233f50344ba", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636455317, "uuid": "8b39426d-bbe4-44e9-9960-5179e2225957", "value": "0X-498746467849-0498765456784.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246b53b2-415d-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1636462884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462884, "uuid": "9f0f9489-fe6a-476f-b67c-d7a5c66a65f7", "comment": "Malware payload (Loki)", "value": "810a87a834383747888de033cd76b084", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462884, "uuid": "f5b9fa86-6569-4213-99bc-824b927362f3", "comment": "Malware payload (Loki)", "value": "e96d8183e8148a3a3c601057cf63fe8d703be1158ecb07697f7fb0773d86555b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462884, "uuid": "36851bc3-06de-4147-ac28-0b895f151f05", "comment": "Malware payload (Loki)", "value": "3d4b1289697048283252a39162c839f624c6128a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462884, "uuid": "9aed70cf-7c9d-4693-a7e6-301fb3072ca3", "comment": "Malware payload (Loki)", "value": "027068da68190e124b6966e80d3789b3bfc4dd6e5e03a79f5c8f6d941963bc426e077841c662e2e068acb3bc4fccb07c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462884, "uuid": "cddaa9a2-fe71-4c9b-9438-2857a6a2c5e9", "value": "T12FB38C0173975716C4681BB480FB9B7003F3E38BA1B3D65A3E8492F99F517D98A847CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462884, "uuid": "62bbeb64-2572-4d30-be43-cb38aca66f03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462884, "uuid": "98b26071-be51-442e-b603-1b7419ec6c98", "value": "1536:hSpC06ADbz0Kvc6TkS0Cy74CT3TrYz6vDpMQ43+41xPNfadh:hS806AP09S0h0CTXYmvFMQ4b1Lfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462884, "uuid": "0b05986e-11cf-43ed-bab0-c16a70bf843a", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462884, "uuid": "e1d89f75-017e-43ac-b66f-7ef970aeaaa1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462884, "uuid": "16e9f18c-4cfd-4c6a-80a1-5be9da4be206", "value": "ORDINE131509-11-21-ENGALDINIS.R.L (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c56e78-41ab-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636496687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636496687, "uuid": "2c306ac9-601d-496c-9e41-6efa9f60b4d5", "comment": "Malware payload (RedLineStealer)", "value": "53d261cb3f1ec4e8462a021979e4f2b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636496687, "uuid": "c308bce9-b981-4aaf-b13b-3bc740629017", "comment": "Malware payload (RedLineStealer)", "value": "e9d3473f5093679f5cfd91de7bec0b7388fb7986ba0c3d7cdd5e8bca14236516", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636496687, "uuid": "ec984a6f-69d1-4dd3-9a98-e92b69fc6fc0", "comment": "Malware payload (RedLineStealer)", "value": "c9270d36a94ca875b489813e37383c68d9855cda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636496687, "uuid": "bb013265-40d7-4ee3-a3a6-50dc37b0f88e", "comment": "Malware payload (RedLineStealer)", "value": "c7a61027a106850b7e4a0be941ec25097c29368516f3657834daf339e3ae90f551c634774e6a1d939f0a2d448362db97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636496687, "uuid": "d8c5479a-b400-41cf-8217-979bf75113b6", "value": "T1D5462373A7740189D4D7C83A8537FDE131F21B779A82A87556CABAC22B325D0E217B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636496687, "uuid": "60755f34-8212-46c7-be85-68b69f5bf852", "value": "172750858dcc0719eed08c952858023c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636496687, "uuid": "305f1fc6-e69e-4308-82c7-9b324ec301be", "value": "98304:dB5iZlwoGdP+ZBkBih1qSZ2p57nJB1ZR1jnmE2xxf6YHKOtpQf:8ZlJGQuihPZ27J1vmE2xxdXQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636496687, "uuid": "a669390f-4633-4926-9585-503b62425aa5", "value": 5700912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636496687, "uuid": "754a83d2-bb56-43f1-a993-a1e771606313", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636496687, "uuid": "888c4c6f-401d-4db6-a8a7-88c62ef559ce", "value": "53d261cb3f1ec4e8462a021979e4f2b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc1825b-4159-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636461312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461312, "uuid": "737f06ba-4de9-4666-886b-5697ca3c78a0", "comment": "Malware payload", "value": "6a905ef035a06da47615cad33ac77722", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461312, "uuid": "ad56a66e-3cb9-42a9-9260-c9ac7c4cd455", "comment": "Malware payload", "value": "eb74de4c86697b6164a4b7e5267070a54524d7b8c4a73c3a378f21f991c952aa", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461312, "uuid": "15b086d2-1327-4388-88cb-3450d49c0a45", "comment": "Malware payload", "value": "6c23b96235c5cf3d009c6b71e2a005209c5e942b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461312, "uuid": "0981949f-924f-4db4-96d1-6cf2144aeaf9", "comment": "Malware payload", "value": "d80dd935686af26413ac68a75048fa56441c8587eef91aa7b7beb43a5e0f800c01dc2d051f8412d6edc5ba2b0c1da6a3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461312, "uuid": "f5a5be94-2675-4fb7-b6dd-555cfea01c67", "value": "T16C6423AEA0EC66E1970C49C3F0CF436E3D95421E4C3AC9C78309751D55A9EE81752E77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461312, "uuid": "d57531bc-0822-487c-ae81-32b22959a2d1", "value": "6144:3Rh3U91EOhgIgixKE3civ2mWSW8W2Uf6LmwtKgyAfxd3EmOT:3/U91EOhguxKJiv2mWSW8W2k66wJyYxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636461312, "uuid": "b039bada-5010-41e2-b593-0f21f590cde5", "value": 330651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636461312, "uuid": "96796fcb-d800-47fb-a373-15eebd743348", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461312, "uuid": "21d8fb29-1900-4dfa-a528-13386e4c2c82", "value": "PO0221BichamProducts.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485b14bd-4113-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636431161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636431161, "uuid": "69a2625b-7671-4849-b636-425faab92943", "comment": "Malware payload (AgentTesla)", "value": "f99ea083c3d95a5eeee43bc2ecb9031e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636431161, "uuid": "36781597-3fd0-4d10-9da5-70feb139b2fb", "comment": "Malware payload (AgentTesla)", "value": "eba90678e94c80f1f1995c4d3c66f97bedab5d215955af4d04cca38dae9c5222", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636431161, "uuid": "9ff3056d-2254-47cc-b031-70f143da167b", "comment": "Malware payload (AgentTesla)", "value": "1252d901c3c9b49e661869ae5b3f04561f1e2115", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636431161, "uuid": "d07cb711-80da-49ad-8277-0fcbf4041089", "comment": "Malware payload (AgentTesla)", "value": "4b12a95e867b7078eb5b3c1e0cd6c5ec7e8df07f03ed0bab29e8d7ff1c122592048fb379bf418328407e1834e431de1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636431161, "uuid": "b32c009d-6256-49f6-9ce6-ba2d77860a8d", "value": "T1F9941371A771893FC99717BE286339410172A1C2A867FB7E0F5CA4713B537A2A481FC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636431161, "uuid": "97f0c43f-30a9-4f87-8cc5-f4978134ff29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636431161, "uuid": "b9ac19d4-9053-4a2b-b61f-017c3fb3664f", "value": "6144:6TMSK1wbeMKMUd1IXmhPvZOnLZUPMzn2hVqTB8lHlO2JivG:NwbePLvx3wnCU72cB8lHlxYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636431161, "uuid": "4b89541b-6b82-4034-8b0b-49426f3e4b7c", "value": 409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636431161, "uuid": "7b46af7d-d1f1-457b-a68c-2af1ce4e4db1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636431161, "uuid": "0203b8c7-050b-4d9d-90f1-7651ec866eb2", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50d1a3f-4148-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636454160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454160, "uuid": "72a667c6-6e38-459b-8f35-5bbea5fc9d93", "comment": "Malware payload (RaccoonStealer)", "value": "3591815c23c89a04854a1a4426a8d825", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454160, "uuid": "7c23439d-fe3b-4e05-83c8-27fefbacc32a", "comment": "Malware payload (RaccoonStealer)", "value": "ec2d8819fe0ecf31eac909a6f44e91b1ce662a965f67405ab21da63ab51cd1f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454160, "uuid": "b2adb669-b1d0-448c-9dc5-f76c20c35341", "comment": "Malware payload (RaccoonStealer)", "value": "4e05fecd7d4c3c8bfbfc38af90890a9e632835b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454160, "uuid": "f136f7dd-b249-4be8-a4fe-e4c885ab3a80", "comment": "Malware payload (RaccoonStealer)", "value": "62defe9d9953f6c1e40c9b37ac8e08350b60550bb6214ada52366720dafc9e2ba827ff556de1ff8708c5a83c87e3f052", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454160, "uuid": "c2f606bf-5f1b-48f3-af1d-23159a4e1e5b", "value": "T1DCC4E110ABE0C034F5BB56F889799268B92F7DA15B3494CF62D026DA6B347E0EC71317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454160, "uuid": "2ac9f26d-ac12-4e0e-97f5-d44d2a7a0a98", "value": "5f60c500db75f47142be06e755ed4aae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454160, "uuid": "989383d6-e922-452e-9cc7-e1ad4be31262", "value": "12288:pwyPWuL8GI6/a7vASpuicrvVpNrR7qaPY3TcVyWx:r07IScicjVpN9DPl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636454160, "uuid": "b46f7efd-87e8-4c2c-8cfa-4aaed718cc43", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636454160, "uuid": "7eb25e9b-aaa2-49bf-bf19-cb4a1ecf3dd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454160, "uuid": "54c8ee74-85df-4426-8a3e-efff3f9ca026", "value": "3591815c23c89a04854a1a4426a8d825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddab5d1-4164-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1636465906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465906, "uuid": "2fef5755-14fc-4f40-be39-671c4db0bf07", "comment": "Malware payload (Loki)", "value": "e20bb5f85b0b0b4893be0befdc9af462", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465906, "uuid": "5cbbf7e9-debd-4eda-b3c3-404906794aad", "comment": "Malware payload (Loki)", "value": "ec782dd6f1c9f856f031b4d3f8023f1c1620e2b3666308560f71646231dd495e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465906, "uuid": "fa249ea0-0ff9-4e2b-a865-0d556097eb57", "comment": "Malware payload (Loki)", "value": "96b10e8bdd03a38ceb1556315e42bb83079a72a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636465906, "uuid": "ed03788f-d27d-4d60-bf0a-76224a2a9c8b", "comment": "Malware payload (Loki)", "value": "97781c8b9736d551e8db98323f7ec18c6d1f8154cd40a13424dcebf0d012e2314e938b3c2be4d956bdcbbd8f9f1716ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636465906, "uuid": "f3893ac6-282b-4661-a8ba-7298581e5db4", "value": "T17554121B75B450BBE942A7B25772E276F3B845D9021690C74738EF1F2EB044B0E1A3D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636465906, "uuid": "22b026bf-c797-47e8-9bfb-fe943df99807", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636465906, "uuid": "b02dd24a-550e-469e-a9c6-32fed2b145e9", "value": "6144:F8LxBs0JrFd/mmSNfQ8dEdEcWvQEGppKudSbLFTGKpoo0EIxUPkA27:/0pT/mma9NoEGubLwKp4EIB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636465906, "uuid": "469709c7-8ed0-4a87-aa9c-9eea9c742d0e", "value": 301243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636465906, "uuid": "30ad93a4-bc6a-471a-887f-9d0819b82cc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636465906, "uuid": "1dd45fb9-c02c-4914-904d-e9f4e9ff04e2", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c8ef39-4138-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636447016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447016, "uuid": "255fbb13-dd92-4dee-959c-98792e5da00e", "comment": "Malware payload (Mirai)", "value": "9603b8f5c2459625718ac0c60f5f7142", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447016, "uuid": "50b80048-7c3c-43ae-aa08-30a15a97553a", "comment": "Malware payload (Mirai)", "value": "ec871284f65911a8646d2da1890fd2d9824ada03787577753d33c946c1c9831a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447016, "uuid": "7d4cc5c3-50e9-4d9c-8c3c-9ed8659f7869", "comment": "Malware payload (Mirai)", "value": "c0193d4998510fb3062763e374f4f0495f87dd70", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636447016, "uuid": "17328d70-ee72-49dc-84c3-41cd02c3d112", "comment": "Malware payload (Mirai)", "value": "340e55455ab301e5e90dc8d4eec96a361e2d03027e9115fdb8bf1358a0936a9ac5ba7087981786ebe31d70adb3cd4b8f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447016, "uuid": "1d6c328e-1ed0-4f78-a54c-273732e3343f", "value": "T1C2831845BD829E16C6C543BBFA0E438D332263DCE2EE7213DD156F1177CA92B0A6B161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447016, "uuid": "a547a534-d691-4490-86ce-4f5184bf23f0", "value": "1536:itTBfGWI0v6MdyCfysp4mh5VrmKTNeWP+Ii9qAhAynJYQ6Hv/wbZnt:itpLNd1fr4mhmKTnPbi9qAHJ0/wbZnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636447016, "uuid": "2bd0868d-e902-4c70-9452-42ea066b99ac", "value": 83716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636447016, "uuid": "0c058239-5770-4090-ab1c-3c19f9dea08c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636447016, "uuid": "2a264845-3495-4157-9db5-6367cb36f7a8", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d69de2f-4126-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636439384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439384, "uuid": "650e665a-bc82-4ba9-a5df-daa054d15b09", "comment": "Malware payload", "value": "f2e9ba061c7b952aeced10ab1fb64722", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439384, "uuid": "816b52c4-9cdf-49b1-a3a5-ca94f46252c2", "comment": "Malware payload", "value": "ed57c970b88275173c50215c3228d7e238dca4c923995b25f8d9559c4adeee65", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439384, "uuid": "abcc0e07-236b-48c9-a3c4-f50a7552f6bb", "comment": "Malware payload", "value": "9bc95cfa5ae08331d2b70c0e9330d14b5ab91f92", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636439384, "uuid": "46dc3665-6a33-4ed5-a5fc-a451f5d7ccb5", "comment": "Malware payload", "value": "01c93d3dd93e9704a2b6583832304fcbf0f1f2a8a43234dd611973aca66d151fc7b0c70d5e94b3eed6f8c02dbc1fb52d", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439384, "uuid": "64f0d500-678a-4633-a89f-3d8804dd57ed", "value": "T18E742336EE06D1075315F3DA3DC8E94078FCA99446504B37419D56A8AAC3E8EE648D3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439384, "uuid": "f164f5b8-3f30-49ea-b37f-5d1ff0c54552", "value": "6144:5q/W3OL8mv/RT8FdLYwNCbb0WWTM/NjyHz0ycRn6iejkbt5BFYDboFeMsTAcd:0W3OomvJ4LYwIAYjV6OBF2bIeMsTAcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636439384, "uuid": "3b898c9b-9a9c-4036-a666-001b7b5b8038", "value": 366126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636439384, "uuid": "ff3b39d5-556a-4a18-a119-44a60127fbec", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636439384, "uuid": "dff19405-5408-4404-a82a-a34fb00ec38f", "value": "TNT Receipt_AWB87993766478.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "738bf045-4170-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636471177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636471177, "uuid": "7ce25213-f50e-416b-a24b-f112ea112f2f", "comment": "Malware payload", "value": "0896bad725e1bdd978b13af4ef495496", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636471177, "uuid": "95c02e32-10db-4e00-ad5c-0541c0a32f62", "comment": "Malware payload", "value": "ed7f7d3820d7f43a78ac09f20ffa099468529846da18b6da1801e244f42b348c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636471177, "uuid": "1f206891-e43b-4ddf-8deb-146ceb194271", "comment": "Malware payload", "value": "882eacada0621b31bfd9eff98be4e28a38eb89e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636471177, "uuid": "3fb44b40-43c0-4a1b-a859-faa96306a207", "comment": "Malware payload", "value": "f142027c3a52eea275a680a539e8575b1b804568e6b11b146b25ac52abefe2105af5f4d1b877bae638d1d3636ed12f81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636471177, "uuid": "ef4120ed-f9a1-4c0a-bcf0-446035a4d829", "value": "T17794E13413A9AB6ED6BE0B392810510017F6358EF733EA797DE100D96A75F015AB2B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636471177, "uuid": "1ec25586-1a70-42af-943b-255fdd04c837", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636471177, "uuid": "b4e983dd-0d11-4106-8a28-38ed47a950bb", "value": "12288:2gSN/xhiXi2RouRvUytfSgolH2YFpvQCLKn:2nZUi2RoKMytfNmJFRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636471177, "uuid": "46294e99-7b75-47d5-bf89-ca75e247fb14", "value": 427008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636471177, "uuid": "430e326c-f2fe-4a97-9a76-fea05e97fec7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636471177, "uuid": "a16560a6-74f4-469e-b29c-5f99e7bc93b3", "value": "New_PO#29560186349070140.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6537bf-4174-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636472993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636472993, "uuid": "53aee2f0-965b-4933-98a6-e6ee87a42e13", "comment": "Malware payload (AgentTesla)", "value": "ec9d16b332f7d1493495bc1a581a1f53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636472993, "uuid": "a86b3de9-9594-4e97-9cde-144c9f4dfc0b", "comment": "Malware payload (AgentTesla)", "value": "edacb4d0aa24b845d1a4b1470cfc0d4f2e034c8e76269026be399706d7d78311", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636472993, "uuid": "54abd8ef-b329-4f0a-9f03-41e134c4e356", "comment": "Malware payload (AgentTesla)", "value": "da768200df92de54832ab586964a464fc825a5fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636472993, "uuid": "0ec8cce6-851b-4919-a7ab-f1ea46505a74", "comment": "Malware payload (AgentTesla)", "value": "e4dce5e3015b67e372ae5b2f779cf263b423d30ff35c1e13a30603c0c2108f33b9706eed2b3d5cc153984efc50982219", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636472993, "uuid": "211c6a84-b239-49fe-8ab1-bdbdc4496e55", "value": "T14A9412123A49C91ECA261137DC5B6B4023B864C2F897E31975DE63E8A8633E74D873DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636472993, "uuid": "57fa0553-d391-4039-a831-befac6d1ee1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636472993, "uuid": "db386474-478d-4c76-b5b4-816efdf98079", "value": "12288:TkbuVT7px2L9VS3pS8VawOHBmZGQcVqYY:gb0TrS43pS8w/BmZRnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636472993, "uuid": "8617d235-4aec-4584-a85b-e11da9253551", "value": 419328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636472993, "uuid": "409ac204-b67b-4756-8311-2de5f41183a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636472993, "uuid": "5a9d2e02-0a80-4541-933c-e4d7b7fe177b", "value": "New Quotation_678657745865895.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1df0fb-4150-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1636457506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457506, "uuid": "38a801ec-f8e6-43ab-bc37-1684782abc39", "comment": "Malware payload (Loki)", "value": "118d52ed431c7aaaab60fc9ba28cdb37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457506, "uuid": "5268288b-b371-464c-9d65-0b3703a546fb", "comment": "Malware payload (Loki)", "value": "ee01efe5bc64a5e50dc0c495edea7d102d8f851bbe4f37f3ed91279c2e1fd2a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457506, "uuid": "dd52ba72-0a30-49f8-b006-3afddd60b44f", "comment": "Malware payload (Loki)", "value": "1b6280791e3c36735f0187b0736337ab8f70e0b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457506, "uuid": "836c801c-bb79-4233-bad0-73e5fc896075", "comment": "Malware payload (Loki)", "value": "31581785d1ac4412fa4d5f0fcae49cf7a95e5c35bbfbb070e46909941b60086f008d5ce78c2ff8457d4a3695601f0ce2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457506, "uuid": "93c3ecef-8605-4ec8-80a3-06fcf058fbf4", "value": "T103548E1067E0C438F5B712F849B993B9B93FBAA16B3490CF62D516EA56346E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457506, "uuid": "81e815c3-c82d-4827-b783-f0bb8517081c", "value": "a24faa9f4919afc00d25c1c4d020aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457506, "uuid": "0dd07e14-c314-4685-8248-29812448ab44", "value": "3072:BMVyYf0kx9NBk5TuinCK2shZkWMbfVzwDqOecJqQpBjj3ffDeoFb+CXopSmjoeON:BoPBkR3C5WMbfpLccGB/3nKoFXaKzp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636457506, "uuid": "a8ff3ad0-0bf9-4a10-bdde-9ec775b56a92", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636457506, "uuid": "751d8628-9fe2-41b9-a7fd-dabab20b2834", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457506, "uuid": "8e2eecbf-c9e6-405a-b496-b2ad385a1639", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20518c3b-4115-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636431953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636431953, "uuid": "b889c3cb-1132-4233-9927-01b085aa6f24", "comment": "Malware payload (AgentTesla)", "value": "c64ce2de69fb1e283b1cbcecdb912d0f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636431953, "uuid": "c8d4c6e5-1d4a-4474-a74c-5d6e62768424", "comment": "Malware payload (AgentTesla)", "value": "ef1af1b64bc218c2f816530fcc86e8a04d15a7bad81ccaae49d250d5772ef3ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636431953, "uuid": "761313cf-05d6-4a35-89c7-76ada0a7460a", "comment": "Malware payload (AgentTesla)", "value": "8d3bfc13f9c75729a4b606f2e76ff531ce53e4f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636431953, "uuid": "4dff72c9-d096-4e6c-b171-5f26a8cd538d", "comment": "Malware payload (AgentTesla)", "value": "e9d4b8eb6fb63bfb0c5e2ce91e37241b5454159f19ea7c1cc14be9c77141342f0d167eb12a63a81a49724fcea1229a94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636431953, "uuid": "933385e1-f0f1-4378-91d7-9963aed32f7a", "value": "T16784122B6354483FC89E877A25A319921F6811C3B80AEFBF9354E0BA2F1335155E27D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636431953, "uuid": "cd9dd62c-aedf-4693-8713-263f27eb5c38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636431953, "uuid": "508161df-4c1c-4712-b9f8-9ba82bfb249a", "value": "12288:UwxeP+YiZFj2xsD86SoBBIRiYddt8IH9:Uw4PPpdrmWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636431953, "uuid": "d6374474-146d-49ed-9595-18ee577b6f0e", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636431953, "uuid": "915bcc86-7007-4f2b-b9ef-60810f4aba5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636431953, "uuid": "c28b0b15-720d-460b-a112-abad3b7460b8", "value": "Unpaid invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba18aaed-4152-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636458410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458410, "uuid": "1bd8550b-8b88-420e-9a2c-322ac0bac357", "comment": "Malware payload (AgentTesla)", "value": "973c5244a1ea397da4e80628fca6ec52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458410, "uuid": "9fcb7cff-d9f2-46b1-9ea1-6fda52502708", "comment": "Malware payload (AgentTesla)", "value": "ef996e29d0abd63d0172d2ac258045c236b5653b45486f1919b24aeeecd15380", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458410, "uuid": "11fedcb3-afa2-42fc-b951-9b24082228a4", "comment": "Malware payload (AgentTesla)", "value": "d5c0c9e98b6017391841a924af700305cb2f0498", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458410, "uuid": "f47333b3-a758-4d2e-b60e-48a0d6162baf", "comment": "Malware payload (AgentTesla)", "value": "6c8b47e42affdd5789309c3e3b1ca77fc39031b874a1f7c451a91d685811e7e0c84d2ad5de05eef49a82c2bc0ba5b470", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458410, "uuid": "d1ddf21a-06b5-4dc9-b69a-9ccaa29102ce", "value": "T1539412297359A46ED97CA133DCEB7E8443FC3181B8D6E71E6B99335C15A13A20A036CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458410, "uuid": "fa6b3b19-979b-490d-9002-3c444e133029", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458410, "uuid": "92e4100e-1911-42f5-a33e-25f78d1de4dc", "value": "12288:ChwRl4TmPMnM70ggcT5aFoUoUxxsC2Xuvns:0wR+Td1bfFeUkufs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636458410, "uuid": "32489a71-8310-4f66-a078-4919dae6c557", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636458410, "uuid": "1625fd21-5de1-4c6e-bc8f-41f1f3d29c7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458410, "uuid": "6b4fff70-3300-4ef0-9675-0957c1ec35a9", "value": "6ZDSSLB8G8YklJ3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af08cf5-4144-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636452345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452345, "uuid": "b6612db1-5b44-414b-b1f5-1e25cf0af023", "comment": "Malware payload (RaccoonStealer)", "value": "9f35c700528223366adfc5e4fe4a33f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452345, "uuid": "27307fbc-63e1-4407-bdc4-f19e59d0fbdf", "comment": "Malware payload (RaccoonStealer)", "value": "eff8d7d565c86cb1360f7a1cdecbb003913943d5733ab6ba79003193d19669cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452345, "uuid": "81f983c2-5f88-4848-9ebd-650f67230d7a", "comment": "Malware payload (RaccoonStealer)", "value": "abe8fdda5bade69e034fc2ee3d388c1ba97d2aef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636452345, "uuid": "bdf51832-fcff-4244-9201-345b950e245e", "comment": "Malware payload (RaccoonStealer)", "value": "36d91d784560d4f92a1aecee0d499067a1f74ffcb7273b275d7e5ffcdf899c16af680bed59a74602ad4d498af4aff8f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452345, "uuid": "59331b69-0791-448f-9e30-9beca46c376f", "value": "T1B2B4F131B6ECB424E5671E304831C7A42A3BB992D9389146EF54578E1FB3F9C89E431E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452345, "uuid": "045240af-cf45-44a1-8005-5c412c9ab574", "value": "c8725b7ab8753c936cc4c98a181b2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452345, "uuid": "eaf3918b-4ca4-4217-a2ef-f6e508bf02e0", "value": "12288:MASJMoUgn6Hf1NoxALo0O3iC85NzY3IUNAZE1JfgHunn5:2JM5g6foxZ0d4NAZEjp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636452345, "uuid": "d33c4099-1414-4bcf-9ad5-9f17b8647e22", "value": 515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636452345, "uuid": "b9c6dfa2-a860-41ff-997f-713ae450a27e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636452345, "uuid": "e5cea2db-153b-40c3-ad7d-010cc554284e", "value": "9f35c700528223366adfc5e4fe4a33f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bce3a0-415b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636461993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461993, "uuid": "3cf4240d-17a3-42a3-ae50-829587200636", "comment": "Malware payload (RedLineStealer)", "value": "b1a0bc55343edb874ec4c54cbb5a21b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461993, "uuid": "a055f40b-114d-44f2-a203-6a52f5e0482e", "comment": "Malware payload (RedLineStealer)", "value": "f063a271d8a2da357559a32adcec6083529158168bf340c2b3c393778898da66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461993, "uuid": "41951750-7818-4d69-a92f-db6137d908b1", "comment": "Malware payload (RedLineStealer)", "value": "c96b7a2067ee13cb84b7e89e4a455ebc19f2b13b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636461993, "uuid": "3e7fb808-5aac-42ea-aacd-52ee02c785b4", "comment": "Malware payload (RedLineStealer)", "value": "f965118b4672ade18bb6ae157cdab97d7e03f9d0c38b42511184eee5822b1d707f3d4b4302bf5f20aa028e261c476e87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461993, "uuid": "403f2912-23c7-4ede-9a1a-cf8ad7c9e379", "value": "T18484D031FEA89834E1931E3459B086E05A3FBC51E870914AE350EB9A1FB3F9C55E131E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461993, "uuid": "c903789f-07bc-4206-a2a8-138f9caf62e1", "value": "d258636f72d347eaf01f17dafac75115", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461993, "uuid": "6cf39d58-dd9a-4aaf-b7e8-cdfa3f86033c", "value": "6144:YHWuK6isfynD/VQ5Nie31XXP1klVjdbnmuzbgwu6QigabwVf:kWunfLtRXP1Qdjmunn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636461993, "uuid": "2e4893da-8f82-4c70-a3de-f32059202648", "value": 391680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636461993, "uuid": "affa8df2-b344-47f2-b8bf-5cb190c27e17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636461993, "uuid": "f77bed3e-71bd-4c61-9e4c-bc8ac5b3d40b", "value": "f063a271d8a2da357559a32adcec6083529158168bf34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5c2704-415c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636462412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462412, "uuid": "9d0dc5e4-dac9-46ba-b485-5090ec7ef003", "comment": "Malware payload", "value": "a568ff1e6ab88fdc18d1646d1ead3637", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462412, "uuid": "c1b59881-56f6-4bee-8542-9accb1ec1efe", "comment": "Malware payload", "value": "f0748cd86f2648c4ff23611f87661ba89045039966eb9595c2fb4d046249e1f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462412, "uuid": "4580121e-4462-40dd-aa16-f7da3567b098", "comment": "Malware payload", "value": "e080a3e5076dee10d325c90d861883b408d0e2e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462412, "uuid": "a6560da4-dae1-41a5-ab2f-bfccf16838df", "comment": "Malware payload", "value": "1f0622e2ec7abf81a0968091780d3f4998555df3288d9135db66e78e86d574ab0200c071e5638a1041d8b21d3f7a5898", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462412, "uuid": "2e225634-55a4-44b6-bf36-9ba9014f7bd8", "value": "T16284127E731DC52BC5A69633DC9B264047ACBE87A9A3D72E3ACD738814523E185036CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462412, "uuid": "44dfc316-3746-467a-a3b8-afe37f3c2066", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462412, "uuid": "12ecf647-76cb-493e-8d82-34b9d71d8e95", "value": "6144:MI517lA1MkMax5mnngFuW5HWXjQgTVvYupF8/SfnWFjrDeGQ70J1IYya4PAdI:Ms17lA1TRx5mnnTtjDN8nyGQsuY4Pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462412, "uuid": "99e93d43-6567-4601-8cf2-a9b6928cec95", "value": 374272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462412, "uuid": "61557d7b-121e-40f5-b982-ce18492d295b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462412, "uuid": "1885d31f-7d9d-4d55-8d68-36b05eaf1cf5", "value": "SHIPMENT ARRIVAL NOTICE - ORIGINAL DOCUMENTS__pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f3b9e8-40fb-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636421151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636421151, "uuid": "03b6f5c6-6bb5-4fbd-8901-3793935fbcbc", "comment": "Malware payload (RedLineStealer)", "value": "63f86987c266389c0e6b254b250b6fd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636421151, "uuid": "b4518372-0e6e-4e6b-9c58-6d8c81801d91", "comment": "Malware payload (RedLineStealer)", "value": "f08f4fbf18a1542ce4f6a3d11c54da70a2808d5ae54bb653d32ce83608af01f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636421151, "uuid": "bbbbcb74-8bcb-4442-b882-10803da92c20", "comment": "Malware payload (RedLineStealer)", "value": "cdd07cf639698f72103b84447c7a5ede1d37deee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636421151, "uuid": "474e3496-7207-41e3-b3c7-ac3e7c93be3f", "comment": "Malware payload (RedLineStealer)", "value": "deac3293a00053ed6cf722b62724f5bb19daf3bffc96d51255f1b0028009570813105a356ecf205f1e09372b689a8df8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636421151, "uuid": "1b5352e8-81c5-4446-abe0-f0abf172df53", "value": "T19684D03176A8D825E0A35E30CC6186E55B3BBC915870A14AF7606F5E1BB3F8C46F235E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636421151, "uuid": "6b4f58d8-5e4f-4f83-acfe-5454a48c398a", "value": "c8725b7ab8753c936cc4c98a181b2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636421151, "uuid": "b2f0fe8e-6099-481c-9c1e-4ed123807799", "value": "6144:imH9a2a6+o1iMZwStuuQRT19lcdq3rXdRe1hD9ouzbgwu6QigabwVf:3da2CMZnuzNlY2BRGh5ounn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636421151, "uuid": "2d135995-a407-4ea6-9259-2f65c73d9591", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636421151, "uuid": "b35845c7-4bea-453f-8bf9-0a5fba277611", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636421151, "uuid": "e15cdd0b-ee30-4c38-a845-e65f75123f8d", "value": "63f86987c266389c0e6b254b250b6fd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff10bfd-4192-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636485908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485908, "uuid": "11c8c1ef-3bb2-4489-a19d-c48f2a73af2b", "comment": "Malware payload", "value": "3b66a2095a59fc06f8e22eb18ce7624e", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485908, "uuid": "44716b22-4085-45bd-919f-9d66f3874cf8", "comment": "Malware payload", "value": "f0afe792177b3dddaf461a670525f1aa03f1c18d1ec466dcdf3a13b4c2f7b3d9", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485908, "uuid": "80a3b12e-c5a3-4c6b-be77-b08801e9d321", "comment": "Malware payload", "value": "0b68aaf2ca916aa733dfefe9f4c1dcc467a1c828", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636485908, "uuid": "96d80b8a-1394-4281-bbe3-9bb8fa63c7d2", "comment": "Malware payload", "value": "91259f2f8f62a32ab400e939217e05b1ccf30a7024a52f1384d7eddb76dd72d3c0f88ca118ac579385acc465ce4532c1", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636485908, "uuid": "15c95710-fc93-4a7c-8969-b534633901b2", "value": "T1587312F22C3FCF8E7DA152084122C9E4A5079E6A2EBED55C41AC53EDD977AC2470E48D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636485908, "uuid": "8baf04cf-fd36-4063-9e5f-ee2b79205ae0", "value": "1536:kKzzCtpxUUHhFb9EOZ7mJGdRPweBPuwxUXJwbdhU6Hzs+eQ:kszCvxNBCq7RuwxUJwbdhUOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636485908, "uuid": "1aaacd83-c28a-47ba-bf08-93e38f6d26a0", "value": 75988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636485908, "uuid": "dda74aa5-6d8e-44fa-a296-d39cad4da99f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636485908, "uuid": "76de14a9-750a-4199-902f-e145dcb8dcb6", "value": "AWB 2101.ARJ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d437444d-414f-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636457166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457166, "uuid": "c1a49d95-2d28-446d-9dd6-1265765eadca", "comment": "Malware payload (RaccoonStealer)", "value": "fd32325a1642cf31a85ee29360183a67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457166, "uuid": "130c23d0-b88d-4fc6-adc8-aeb927ee60d1", "comment": "Malware payload (RaccoonStealer)", "value": "f0c6c81477938fcae74fe57391235d9128ef6b155052c78dcd18904ff702da80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457166, "uuid": "72a2fc70-cee4-41fb-8141-c55d3552a83f", "comment": "Malware payload (RaccoonStealer)", "value": "95ca19ce8141a4fb44e45f746feaa965b65af32a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636457166, "uuid": "05a551e1-3966-4911-abc5-731b42ac9be7", "comment": "Malware payload (RaccoonStealer)", "value": "15d15d2b5b3ed6aca6ed356372cecdb7ba2e881b624ad91757d77b463badc7ffb85fcdf370792ab500f0934e20578f0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457166, "uuid": "7aa5862b-647c-4bc3-9940-792f09678b98", "value": "T143B4E100B7B0C034F1FB56F81A7993A8B92E79A16B74C4CF62C516EA5671AE0EC70357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457166, "uuid": "712864d1-5aec-4bbe-aa29-92fa4e184513", "value": "ef5891f13814421fd185279f57d98085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457166, "uuid": "4a4be44f-7a5c-42fd-9007-94639d69aad2", "value": "12288:XzBozI496oP4s5WvHqka1xbTlOHbjGcrrF9/g:FoUxoAvHuxPlONr3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636457166, "uuid": "df43c991-8695-466e-a189-8a7d531e88b0", "value": 506368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636457166, "uuid": "7464679a-4896-4d9b-90da-28db2d7f3e29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636457166, "uuid": "ec8ce68e-4d89-4f17-8b7e-bcb7850ef2c7", "value": "fd32325a1642cf31a85ee29360183a67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc3fd7c-4153-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636458656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458656, "uuid": "8296b32f-a4c5-4e00-a52a-8ae0f6cf019d", "comment": "Malware payload", "value": "efcd2208a9a709f51066e7f5ecdfa4c4", "object_relation": "md5", "Tag": [ { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458656, "uuid": "b816470e-2d38-4fa6-8b67-5e079c7835f9", "comment": "Malware payload", "value": "f0dfd0d89f01e192500226d4d470a3e91d3bcdb168024e0dfb0c0ad8532fa1d6", "object_relation": "sha256", "Tag": [ { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458656, "uuid": "80e09390-0f81-49fa-b0a3-93919299735d", "comment": "Malware payload", "value": "a5b00fcdf7f733ed823a2d87b4f1aa80ceeb4fc2", "object_relation": "sha1", "Tag": [ { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636458656, "uuid": "f17e8875-1fe3-46ed-96cd-067bc7b5c7ba", "comment": "Malware payload", "value": "eb7768336e9ba38be91ec1462a400ab859478d391b0c2a1413162b05afbab61f18558893507280a7ab77f0e96ef512cf", "object_relation": "sha3-384", "Tag": [ { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458656, "uuid": "8b43cd43-c682-4961-9f34-0e609ac766ec", "value": "T11764120877747336F0E28D766C1002654FE6DC6B648891AD93913BEB70FA79A4273877", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458656, "uuid": "b784982c-3914-4aa2-a926-5345e9a5591c", "value": "6144:FVycndBh9q/qjjtmwjS3f0ugAn6/WBztb+GEEp7Jxll0urKu4M1cvuCZltiO5:/Hh9fQxgA6/yxb+0p7JxllhrKHM1cW8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636458656, "uuid": "e38be5d0-6dde-4689-b5ed-433c94e9bbbc", "value": 318664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636458656, "uuid": "bd21c97d-972c-493b-a263-d054cad81473", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636458656, "uuid": "a0b9941f-03ec-492f-825e-6ca78e8d0bb9", "value": "Purchase Contract.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549a00ae-40f2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636417008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636417008, "uuid": "00741e67-17c6-4dd4-9b8a-59ceeba3cb45", "comment": "Malware payload (AgentTesla)", "value": "dba8c348f622139b06167090fee04e88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636417008, "uuid": "b38854dc-e239-4105-ad4e-5fa7fce22c31", "comment": "Malware payload (AgentTesla)", "value": "f19e5c846b81b76212d796dae29d8573d457e467d9810b77b9f4131afb5e3c49", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636417008, "uuid": "2b8dee55-5233-4b47-a94c-900b554aeb39", "comment": "Malware payload (AgentTesla)", "value": "b5149b2da5e663f1336ecc972ef4b3518a1cb1e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636417008, "uuid": "eb960898-482f-4f38-a699-b1b6538b07ca", "comment": "Malware payload (AgentTesla)", "value": "daec919df8a9aa10a78a1017407440e01e691fd2ba03120ee8e758a40a8238d50336b1e43af304a05238069efd46235d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636417008, "uuid": "e71f895e-88bf-4172-8ede-ae3150cfaf63", "value": "T12D94E03513E9A75AE6BD07356420510017F3348BE73BD63A7EE510D92BA2F019AB2773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636417008, "uuid": "a55de709-9dc5-4740-b657-716c90ca2a7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636417008, "uuid": "0482d678-5b00-4680-a0a0-f3917fe57f2e", "value": "12288:Acn+9wWa77pLe5WrlR7A4HtyxO/TZIgCxlu:AHhIcslhJHtyxO/dOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636417008, "uuid": "d1a590b2-62d9-4181-a73d-275fca040128", "value": 440320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636417008, "uuid": "f3933e24-604a-4d2e-bfe9-3fdb2cb550b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636417008, "uuid": "21496663-ab96-4cfa-9b62-ec2bc4c9e115", "value": "YWvqk1OliVWNoau.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c73f76-4113-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636431351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636431351, "uuid": "2511ced1-4702-459d-a7c3-189828a03589", "comment": "Malware payload (RedLineStealer)", "value": "21dd531727259fb0085f2407598c7db0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636431351, "uuid": "2d2d8cad-dbcc-4d84-ac15-ac2064c8be32", "comment": "Malware payload (RedLineStealer)", "value": "f1f6aeee9a42004e68765a83e9cbd51bc878a0afd7c80a88432ab14c84f8541b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636431351, "uuid": "2e4fb9e6-6f83-40dd-b775-ab6a0ab6cbd8", "comment": "Malware payload (RedLineStealer)", "value": "a4f1861d6862b9b31ac8f56b7b307c3e192c0e87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636431351, "uuid": "10658a12-4d75-46dc-9bda-47713a770bd4", "comment": "Malware payload (RedLineStealer)", "value": "0b910aa1cd95a6a5a56a3c53ac7e1ca0c6e9cc97973746465ea22ee6842a5815fdd648b63d1cdd98bb12ad278edb9eaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636431351, "uuid": "d4e32984-74a3-4db2-a27d-333c21133b16", "value": "T1C66633C55AFBC508FAD454BF8DB5BCCB6C60661C814ECB1E9993B42819829E27F4CB0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636431351, "uuid": "9f1ccc91-7628-41b1-a186-31b5690f14e8", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636431351, "uuid": "b10ab780-a1fa-4806-a2ad-464a3e16f0d7", "value": "98304:y1DeOU7F8IKCgML6/jRsDaH95LnyUm/0Qeid6ID0vzpQS+smBZcs1G5pR/COj+34:yq/KNeed5rnm/EiRD09aSqo+3wRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636431351, "uuid": "97622e99-d523-4d70-beb7-da331647bdd1", "value": 6667779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636431351, "uuid": "0b6cbce1-ffd4-406b-ba44-a648cf460988", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636431351, "uuid": "6aa00493-734f-4eaa-b27f-432fc655dddd", "value": "F1F6AEEE9A42004E68765A83E9CBD51BC878A0AFD7C80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22226be3-4149-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636454290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454290, "uuid": "33f13aae-000f-435b-abc1-39be7caf5456", "comment": "Malware payload", "value": "ba434014832a66f1d49c0273e24a1e33", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454290, "uuid": "35becba4-7bd5-48b2-9101-1a3a35fc6790", "comment": "Malware payload", "value": "f2a9b2adc29ce84617353be80d9b6c97a4cbc1da8c2a83561782dbf87d09e161", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454290, "uuid": "3f92d3c2-0e72-4dcc-9eed-03415581a27a", "comment": "Malware payload", "value": "ca894e2b49e35ecb469aea7e8d81073b49590524", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636454290, "uuid": "9de9af6c-73fe-4716-b136-09bc71ac173c", "comment": "Malware payload", "value": "2884db0817e72ae09ccf79103e05aaa662aa4daa95c2ca8bea6780c2031a029d5941d1efb60c7e4ea0aa6fef5c4cbe77", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454290, "uuid": "d42520a5-f044-48ca-93d1-91fc5f64a03e", "value": "T17AB23A06C910C3B1E6F746767271393E799E8F20034A11E3D6D72E689A5E8E33B71553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454290, "uuid": "dcf1057d-3486-4126-ae8c-6eff784f752a", "value": "e2869a3c2183d0da54941ea937a11417", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454290, "uuid": "14f90c39-2501-4dca-8ef2-8de8e79b9948", "value": "384:S2acgBsHkvcc/w3+wTbEY1CvI/+q2lezFA1RsAivbEXrv3xYayV:2dsEvUZb3CDle0sAeIXrPOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636454290, "uuid": "c49d1d0b-2388-43d8-b453-aab64e64ff2c", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636454290, "uuid": "618493c2-9f3f-4aed-a0f5-0cd33f2b7d15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636454290, "uuid": "b5e1a2ca-3c93-4dd8-a341-2ce7770cedd8", "value": "SecuriteInfo.com.Trojan.Inject4.17406.12884.18976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e0e2d6-40f3-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1636417604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636417604, "uuid": "0ad1e5d1-9a29-4e3b-bee9-117e3134ffeb", "comment": "Malware payload (DCRat)", "value": "236489500c3dcf2408a29105621172bb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636417604, "uuid": "4dd147dc-93dc-4a8a-b2f5-328fa8b03f1a", "comment": "Malware payload (DCRat)", "value": "f36a462f08397c5fb6586af8f1bd3bf1c8403724003902dfdede3a22cefd8998", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636417604, "uuid": "f577a917-6f8a-411b-94b7-d7e94214fcae", "comment": "Malware payload (DCRat)", "value": "c7e17e5a7b1b76c6b914900ecf7203d2b9bd5145", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636417604, "uuid": "033662f0-e703-473c-bc3b-7f9ff786b447", "comment": "Malware payload (DCRat)", "value": "45e75b5e75044d2e76e26d611e679af3ece16d6a68691550bc7a56e7866233bd16327b864d3d58bc5b36bd5742291d7d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636417604, "uuid": "0d04b210-e3c0-45db-ad49-22daea5b2d59", "value": "T1D402D700A7E8823AFA7E0A729C6372154375FB159D1397AF28D8021F6C333D4D2A2F61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636417604, "uuid": "29a52c90-ab67-429d-850c-ae4c77a01f9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636417604, "uuid": "24a9c3c9-ce80-4196-bb14-39ca763b15ce", "value": "192:+xsM5j48qm/r188/ZIuZny1jbHMMabqCKWr:+xz5k4/r18juZujbH4bJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636417604, "uuid": "c6fa9a3f-661e-4681-9254-610c9eab3233", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636417604, "uuid": "1f3b9d22-5379-4b49-99ed-ecca2ff7c170", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636417604, "uuid": "3442376b-7b4b-48bb-bc9f-831aa57c8eab", "value": "Halkbank_Ekstre_20210913_074002_566345_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb7ce6a-40fa-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636420543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420543, "uuid": "39ffa98b-6f14-45d3-8e45-f94e9b160162", "comment": "Malware payload (RaccoonStealer)", "value": "4492256fcbdf17bd4931b59ed7363408", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420543, "uuid": "fe170db1-05c1-4c97-8a76-34a4ff8a2652", "comment": "Malware payload (RaccoonStealer)", "value": "f57b5ada8a44a9778b96620193572ee4282a61f5d9063532eb0e5b8db5086357", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420543, "uuid": "ae57bf87-7776-459e-acf9-89c848d0555e", "comment": "Malware payload (RaccoonStealer)", "value": "d9e4ece6b6ad84799fc7a80afec38076638ab4a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420543, "uuid": "885d8d39-b23f-4d1a-bf0d-902584bb0b16", "comment": "Malware payload (RaccoonStealer)", "value": "36bf0b29a4942097117226a28a3d54433c90842b05badaa17c9322d137df7296a372a847d96f8e3cb86c5f387db656d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420543, "uuid": "5f0035bb-f9c7-4513-90e1-44262e7bb347", "value": "T1B7B4F030B698C835E8A31E3049B1E6E50A37BC115A70504BFB947B9E1EB3B9C46F535E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420543, "uuid": "70b2d396-1cc6-44d0-bcbc-531091b7f900", "value": "60ab4a93298436a0ea920c16b7e59caa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420543, "uuid": "878f0cbe-8630-4369-8a51-f7be644f784a", "value": "12288:O3nvIq7hkFzNNXorVnIgbTpf9M1WXcDounn5:Sv5h8zu/pf9M1WX85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636420543, "uuid": "3b3eb3c3-378c-46f7-9f12-29cb387fa2bf", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636420543, "uuid": "be6afcdc-eb44-49eb-83d8-04f7de991664", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420543, "uuid": "8f613729-62e9-47a6-a064-75832c43bd3f", "value": "4492256fcbdf17bd4931b59ed7363408.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627c6bb8-4169-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636468142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468142, "uuid": "412b83ef-9170-4e65-962a-15a0e9cf2e10", "comment": "Malware payload", "value": "57a3703ed33a5727850eccc5679b284b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468142, "uuid": "7f23b6fe-3f2b-40ca-ab4d-1ad4a6cb9959", "comment": "Malware payload", "value": "f7c663f45b324acbf0332f464ef56e3757b3c0713af448150af44e5f2cc55165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468142, "uuid": "9e477aa4-d46a-4f38-b2e8-1922fe2403d2", "comment": "Malware payload", "value": "dcbb150c0931454569bb29dd0dc701b101ce92e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636468142, "uuid": "f28f5681-32aa-430f-9fdc-ec0b0a90503a", "comment": "Malware payload", "value": "b3efdafc371ea7e35daaded932eea6a8337ab3a245531fd63b5e62b06857cc87009595c9653a571d1f284929163991ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468142, "uuid": "312373a1-5786-42d2-ace5-11e3c605f4d6", "value": "T17CF32972ADC1E4A8E25E5871B804A45627D06FC3B626C95FBCE8F3946C307832D94FE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468142, "uuid": "876fbd99-98a7-4d4f-bd9e-66783e7066b4", "value": "0045789c6cef3bfcd6f0b95ad82c908f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468142, "uuid": "0bfd193d-f2eb-4cb7-bf75-1748c167d1b9", "value": "1536:9WgdcZ/hdhfgkehNCYGljZutxiAWFLO/RGBWYKfDVh5e8G30u:MbhExo+txiTF2fwN0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636468142, "uuid": "d75722fb-171d-4d88-93bc-058bb9ccc278", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636468142, "uuid": "bb5965a3-d066-47a3-af90-ce454f0f57e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636468142, "uuid": "d3ede71f-8736-47fa-9585-c947e6c9838a", "value": "SWIFT-18627182.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59ae88b-40fa-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1636420634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420634, "uuid": "ca06df08-fa8b-4435-859f-2337a8bae32c", "comment": "Malware payload (GuLoader)", "value": "24d7511f582c94224f04bdfe99103f6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420634, "uuid": "267e5846-99c8-42e9-a1d8-629d72b7908d", "comment": "Malware payload (GuLoader)", "value": "f84419204aa65ddb23ca5366cbefaba41c360454fb042a9c9bd103d02603f770", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420634, "uuid": "72b74049-d695-4312-8361-40b7d9140194", "comment": "Malware payload (GuLoader)", "value": "7360e96f9bfeb1323558922a3fd6c3df6eda8a21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636420634, "uuid": "73bad154-1c29-42ca-b11c-023586370128", "comment": "Malware payload (GuLoader)", "value": "2d2848bc14459b470976feceeb1c0ca97120c3b660b06796f71767d45bc9014643e46861fc2b079f1eb3443f91211085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420634, "uuid": "eceee1ba-24b9-4ec2-affc-563e7e8b8351", "value": "T155F307366DD6A898E26E68707415446252C06FE37725E96F7CA1F3A03C30B832DE4FD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420634, "uuid": "48400cc7-18f6-4346-b196-58a12e30c4bf", "value": "0045789c6cef3bfcd6f0b95ad82c908f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420634, "uuid": "648e6a02-de41-42fc-9e82-7f1a2f9ff4d2", "value": "1536:6bm9AHtDa6gTwuVrjXbE8JSIrVVMHlM9qzHlVhiDYMoLpG30u:H9ANDabvX1SSDMFM8FVhiwU0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636420634, "uuid": "71e7b68c-1487-4c8a-8583-394deea47b6f", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636420634, "uuid": "59729e49-c4b2-42a9-b2e9-6ce0de30d0b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636420634, "uuid": "4130b86a-42c3-4584-93ae-40d8671835ef", "value": "Purchase Order 10,000MT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae9bcf1-4167-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636467512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467512, "uuid": "4d4b8ae5-7a04-4947-864c-31912759b227", "comment": "Malware payload (RedLineStealer)", "value": "2cf73866e155ae916b8c5e23f509b357", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467512, "uuid": "a187b26f-e30d-415e-8cc1-5f1f886e1cd5", "comment": "Malware payload (RedLineStealer)", "value": "f89908f8594a0dccfb5e52b295075ff63be86c0f5584f990d39dfe2b2c2f9c08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467512, "uuid": "433f6011-75af-4b46-93a4-adaf09507258", "comment": "Malware payload (RedLineStealer)", "value": "794f4671809e0821dd1785fc6d63ab2f8405b788", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636467512, "uuid": "76452ae0-473a-491d-9ace-5de012520354", "comment": "Malware payload (RedLineStealer)", "value": "35d3693b1bfd5dae15a4f2ccf746b53a3aaee51d675573e07a912229c1a6678758eda98025639a931470544823957ca1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467512, "uuid": "5e69d760-c2ef-4666-b433-3f8945179214", "value": "T14274F00279ECF65CC161BE7387EB46191FA2FDB54A72498E1E08DF429651D022F23B39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467512, "uuid": "d3d0180e-197a-430f-aa25-1fd986029459", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467512, "uuid": "aac26d72-3f10-401f-b60b-aaa3dbb5745f", "value": "6144:MUAUneWPUB8rcIC6VqiKXq0lOF2fL4MPqXdsGKZ6ZJe7hK:VAyZy6cIC6VqiKXq0lOF+vPH/62tK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636467512, "uuid": "6129d684-3c99-43aa-97d1-a64b629425b8", "value": 348568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636467512, "uuid": "fbe63ecf-49ad-47d9-8515-36de8c3f6b6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636467512, "uuid": "fcdad50f-5289-422d-b150-e2d8c75f5c50", "value": "FOXHACK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8c6b2a-4156-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636459861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459861, "uuid": "8c9fc00e-3f47-4bf9-a088-626fe0e3197a", "comment": "Malware payload", "value": "b46f683e5efd214e59fe26e7fab5e892", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459861, "uuid": "e0c8823f-70ea-4048-84fa-e4b1538849f1", "comment": "Malware payload", "value": "f8dc8c2b8cdfce553a6a3c8067aa4d54efd0c8c95b2e37b87c792484af383134", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459861, "uuid": "139295f4-d844-45f3-9275-0e02098b16b1", "comment": "Malware payload", "value": "01af37ef2d3b5a5f7d2fd8dae4922f55f2f567a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459861, "uuid": "9b7fe9e4-bb4c-444f-ae1a-9a5139b7913c", "comment": "Malware payload", "value": "95feed6b0691363bf716a22fed98a2e2ee4ada6ca4c34eee54a8b462fe3575ece03f10401c9c85ba44ee04afd901de87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459861, "uuid": "34b1fea1-3e1d-4258-a55d-2d5246628745", "value": "T1BFB4E09D7220B99FC95BCE768D642C60EA51B0BB530BD347A41312EDAD0D69BCF112F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459861, "uuid": "c87d4b96-ba2f-4900-a781-b24856c8e525", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459861, "uuid": "f0761ce7-a690-48c5-87cd-294fbe25c8f0", "value": "12288:HXrPOycNZQcknooi2jSHiuQHZUpmjfhs1b7j979IEXY4CJVsqDGGMw:HXrPqQcHT2EHOZg8QjzqN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636459861, "uuid": "ba23f92b-e076-45bd-b393-aa30fc9258d9", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636459861, "uuid": "d39ed5c8-fbe1-4c78-a3d5-95e9318b20b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459861, "uuid": "2c151d78-d855-4b6d-bce0-1600e7c76acf", "value": "ORDER-ENS003 - QC6318427850 GEM-R9B-035E Elgate Products Limited.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926e2d52-415c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636462639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462639, "uuid": "e3670c94-8dd6-42da-8586-aadfc19d9f4e", "comment": "Malware payload", "value": "143a404280f2e9c41a04cbb27d9246c5", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462639, "uuid": "6d4f4014-ff72-4bf8-8255-b7ab5b667ebd", "comment": "Malware payload", "value": "f94380f600899a30f325f87a138ed39739a748366afd27cf46f10756ab88c5ed", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462639, "uuid": "c79943a6-6cd3-494f-b21e-5f14753c37b7", "comment": "Malware payload", "value": "7086890036592b62344e6bac8381aa0abecb8324", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636462639, "uuid": "cb060703-e928-4e15-8357-3bdf5fc58cba", "comment": "Malware payload", "value": "de00b68f9ba01c801eb23355c4622eec8c6ea88e14c700e979564b413bf8e46249f8d9738c855caedade45dc9c5711fd", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462639, "uuid": "af9fbb11-8341-4f34-a748-119f56e8eef5", "value": "T143642364AFE4F01B3EA3E42D5D4FA91E28049A7F4CEA57E21C183714F6D8EC45BA416C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462639, "uuid": "a5d69887-2c6f-438a-9990-8eef06384c1f", "value": "6144:Dkj4pZ2u3vktc0c2ROUZwoNl0tMsY04qfdMKY3kmNbUcmTal10OPzwk1953:Dk+fU4UioN4tYQSVPb7mGl109k19Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636462639, "uuid": "6145be1f-8a17-4ed7-8cc5-1a674557c2af", "value": 326033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636462639, "uuid": "efbbd079-0323-440d-bdc9-67da5145b48f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636462639, "uuid": "9a7339ee-019e-4c74-b84c-9534b065b686", "value": "uCkIzRN4ZzUIzCY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf234dd7-41a2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636492778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636492778, "uuid": "197c6669-6c5c-4814-b011-8efd2688cbcb", "comment": "Malware payload (AgentTesla)", "value": "5a52b65b8eeb4663d9d0f6ca15ed3371", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636492778, "uuid": "98a5accb-8b19-434c-bab4-72f1e104af36", "comment": "Malware payload (AgentTesla)", "value": "faa9609a17cd425f8899fcb7e5df7829d9fdb535f1637820f16e2927da4760dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636492778, "uuid": "9bfea040-91f9-4c21-b5c5-74e40c3c0ad9", "comment": "Malware payload (AgentTesla)", "value": "69d378b7cb883ba142e202a47da8a6fe1a0ef94b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636492778, "uuid": "181197fb-825f-4bef-b29e-0cc23c39e928", "comment": "Malware payload (AgentTesla)", "value": "d19ed3dd89f1d358fc86346e270622927d0f54558301cb84c23dee118f40ce65c3201e5303d1da916d747400d1852077", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636492778, "uuid": "1e2109c6-6761-4811-bb40-3de34198b92f", "value": "T1BA438E81962C0BB1DD6E8B37D53348501379AF2BA46ADA297DC9B1180CF33571332B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636492778, "uuid": "04e7e474-a3d4-4933-beb3-31db77e02a27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636492778, "uuid": "d60ae648-a366-42c7-b4d1-653a79c3d5e0", "value": "1536:AxDcSsCkSdcA/tAwEwKNNNkE1+EncJk+yfipnLx0:qDcW5cA/tAppdL+En3Jfix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636492778, "uuid": "7057f75a-44d2-4714-94e0-782111819e51", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636492778, "uuid": "594fd73f-a3b8-4ab2-83e9-56955fff94d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636492778, "uuid": "d4a3bc75-067f-4950-a449-670482eb48a1", "value": "Payment Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb41305e-41b3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636500100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636500100, "uuid": "6c1021d3-e5fb-43b2-8c9a-d1d150b7d1f9", "comment": "Malware payload", "value": "ec7d7c82f82d23396e1aa55d69010d91", "object_relation": "md5", "Tag": [ { "name": "DEV-0322", "colour": "#95A03E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636500100, "uuid": "9fe02e7d-07d4-41a5-86db-8e52edbe330f", "comment": "Malware payload", "value": "fb101d9980ba2e22dceac7367c670b4894eaae9a8cef9de98ed85499a3b014ea", "object_relation": "sha256", "Tag": [ { "name": "DEV-0322", "colour": "#95A03E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636500100, "uuid": "1ecf69da-f037-41f7-a9ca-e32ed60ac9c0", "comment": "Malware payload", "value": "ce390e72af6d92c5745505c503709eb2a3a12e2e", "object_relation": "sha1", "Tag": [ { "name": "DEV-0322", "colour": "#95A03E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636500100, "uuid": "55f8c7aa-e256-4961-883a-82f84f19ab44", "comment": "Malware payload", "value": "6f39a4e715c97fdc66043471f3f8e65c7e0cac0c30cf392963ffed981c5737ab80b4423b5506db36de6761785c3ed77a", "object_relation": "sha3-384", "Tag": [ { "name": "DEV-0322", "colour": "#95A03E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636500100, "uuid": "2349ec85-9f8c-4c1b-ab3f-aa5603146799", "value": "T1C4911984E409B4F7C61B90AC968D2B431999754220A7A8303AEF7D4DFF33ADD0275DB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636500100, "uuid": "ed9b98c3-53e9-417d-9c70-2a8d2a8a0fec", "value": "96:KlQkbvtMHNZvvvvvvvvvvvvvvvvvvvvvvvq/PDFrGtf+MVIOG9hGwdP2BCtb:KlVjtIbvvvvvvvvvvvvvvvvvvvvvvvqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636500100, "uuid": "40e96826-a9aa-48ed-8012-2a026148de5b", "value": 4394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636500100, "uuid": "bcc9964f-cfdd-4c76-ae50-338176324d21", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636500100, "uuid": "2d1c4d0d-b771-4108-8662-453392711460", "value": "fb101d9980ba2e22dceac7367c670b4894eaae9a8cef9de98ed85499a3b014ea.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6845c2b7-4109-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1636426920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636426920, "uuid": "9fdbbb5a-ed28-43ab-941b-623419e597af", "comment": "Malware payload (GuLoader)", "value": "5626841b6b8291d4b5caad5e7fb2baa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636426920, "uuid": "9e6ac556-8caa-4c9e-8737-fe8d5659a6c1", "comment": "Malware payload (GuLoader)", "value": "fd4b278b5de34460d2a92bdb6673b36d85e98f7010e1b74331cfdb60af6a49f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636426920, "uuid": "380d15d3-e7e6-4f10-b0e1-b314b92e7d87", "comment": "Malware payload (GuLoader)", "value": "c87763683baea7fc80d1e4d93506be542c677b2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636426920, "uuid": "516c8ef4-ef00-4a88-9eba-9cdcc06cfbf4", "comment": "Malware payload (GuLoader)", "value": "777c12891790c21c8efce3c3e175aaca72ef405c6e03e9030a581ba8152d50b91c317986964be50e746f6283544d7e85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636426920, "uuid": "181521a9-1a12-4d52-9544-351bb7783e05", "value": "T137E3F9A026C4D89EE459C9FD3BD0D0A484BC7D744C9362173AEC730A6E7795CE6A03A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636426920, "uuid": "d8d7c924-e5bc-4e75-9794-4c9d25cfdfaa", "value": "64cd91d7715dfd0ff843d86f1e670c6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636426920, "uuid": "d20b1262-da82-4677-bfe5-f520bd797b23", "value": "3072:tg+atksy/556UV9dE3XD/ilCFI72w9tdBKRr/tNw8:tkE5jvdIwFKhFa8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636426920, "uuid": "7b6032de-6c72-4b99-b876-d77135130794", "value": 148616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636426920, "uuid": "6ce0d873-19f5-4811-9147-1c8e21212c65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636426920, "uuid": "ad022aad-2588-4914-9372-289d1a5c7f5a", "value": "Quote request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1a61b8-4155-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636459591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459591, "uuid": "c38a9127-4b91-4040-8e6c-ce4e4a81b5d3", "comment": "Malware payload (AgentTesla)", "value": "22d2f1a889200dfcd02c9e621c7e3d2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459591, "uuid": "65635794-8b41-451d-8abe-8d045957170d", "comment": "Malware payload (AgentTesla)", "value": "fe3c092673ac4261ac0052b5c39686916f604d2d50ceac8987253cffc4d9ab94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459591, "uuid": "b42f1983-a7c5-45e1-9468-cc4f76183689", "comment": "Malware payload (AgentTesla)", "value": "439dc8f03d6ac7f762e05b5dec5b8b3fdcc5223d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636459591, "uuid": "7fc23895-1208-4660-8191-aed282f7979f", "comment": "Malware payload (AgentTesla)", "value": "a539de24597441e7a4f74b64ee331c22609fc8e535dfa1e106497af7ea0089a10954f4ab357b208ef7c72d1c926e1a16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459591, "uuid": "40eb55ab-6026-4825-8924-cfbc4a4aacb9", "value": "T1F3536C82D7B50243E59A4AB1F1D3C6E31F74614F18F08D6A49CEB09E8D9F3856522ECE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459591, "uuid": "8c56294c-b12f-4dfe-807a-22ebcc6a2736", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459591, "uuid": "483e8566-346e-4bef-9502-75a23fdb98f1", "value": "1536:twXpga/eHUTQQQQQQQBdBgN6b5/2kWSC6WLrMF/I0:twXpga/eHUTQQQQQQkdBft/2YWLrMm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636459591, "uuid": "32330e8a-33f2-42f4-ad28-021221a7248d", "value": 62448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636459591, "uuid": "f87a548a-85a8-4f03-8921-e3fb6675a545", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636459591, "uuid": "efdc8e8c-a25b-445c-9386-9c6d58e2ead3", "value": "Documet_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }