{ "Event": { "published": true, "date": "2023-07-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-07-25", "timestamp": 1690329782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e87960c9-fa9b-4cbb-b5b3-f37a571da868", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a385bea-2b45-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690328736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328736, "uuid": "014ae8c7-affb-4e0a-8654-569f276f6e9b", "comment": "Malware payload (RedLineStealer)", "value": "ab41a5753f99d5e1531556e8da947696", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328736, "uuid": "acda6123-f618-45c1-bf43-0b79cdc9c59a", "comment": "Malware payload (RedLineStealer)", "value": "001f714c0e847f73aa1b5d3b0667e304bdb3b6f37731169e4b9fee65bec83f07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328736, "uuid": "bb340706-9252-4504-b935-21e70b9dd456", "comment": "Malware payload (RedLineStealer)", "value": "5ac8a2160df33b74f7d52d3640ae46b1e770622d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328736, "uuid": "587a6c19-7d8b-40ac-9c9f-82b7f205c08d", "comment": "Malware payload (RedLineStealer)", "value": "919c46f9bed9445724c27b4fdc98a4d6d2de4a1d89d543c1c52f1e02dc69c6b706f617007a9dcf40a436e1593f9bb836", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328736, "uuid": "d251afbb-6b13-4995-b05f-75b6bddedea1", "value": "T105B41213ABD84432D8F11BB05DFB02C30B397DE59AB8876B2395984F2C72695967133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328736, "uuid": "955aaaa4-5178-4b3f-9bea-e8f43ea72e69", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328736, "uuid": "7c5d3b3e-d594-4e97-8488-3356172f1a8c", "value": "12288:6Mrry90lkGIJa37t33MYFXrqWKvyWPL5Rv8BVl:xylKt33MYBrOL5JW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690328736, "uuid": "b6f28a2f-de19-4ae3-bdd6-9b178a6a5d4d", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690328736, "uuid": "735153ac-1960-4b46-8112-b82af00fcc9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328736, "uuid": "6d136262-9259-42e1-8ec1-45307e036f5c", "value": "ab41a5753f99d5e1531556e8da947696.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac66e96-2a9d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690256769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690256769, "uuid": "6d35fb5e-5581-4ab6-af43-5fbaea12db63", "comment": "Malware payload (RedLineStealer)", "value": "a37f97d5778f05862b34df1d9583090e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690256769, "uuid": "f3e21d6c-b7cc-4683-af06-2877b8d327e9", "comment": "Malware payload (RedLineStealer)", "value": "003fb028b1957462e30e031f2fae39d689a244b0b611bc295c97ca4763049428", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690256769, "uuid": "73a02af3-12bb-4a83-a82d-d5f78deb7c24", "comment": "Malware payload (RedLineStealer)", "value": "10fc7107b09a6f8f240a182af30005ff7b571e1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690256769, "uuid": "5f993a3b-ae84-4ef8-9321-9ae755d690f1", "comment": "Malware payload (RedLineStealer)", "value": "3bf273004ecd9ac047f1b72afbfdf4c06c4de46862b217165153691d68f274d413546d77ad51146e93b8ea5e89c82c2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690256769, "uuid": "a96d802b-fb39-42b4-a029-74a78a7d6725", "value": "T1D0E2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690256769, "uuid": "f51ff6bb-be7d-400d-9c61-03e35bf1568e", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690256769, "uuid": "521cee79-12fd-4067-a60c-ebb9ccff051b", "value": 33877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690256769, "uuid": "7609d0b8-a545-4cbe-acfc-4255b430dbb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690256769, "uuid": "f8b470f1-a790-44e0-9854-a066cc7087d3", "value": "a37f97d5778f05862b34df1d9583090e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49974f48-2b02-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690299931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690299931, "uuid": "c42eb2cc-c528-47bf-bc7c-a1992794f561", "comment": "Malware payload (Amadey)", "value": "458c0ef12f0a7275e8d165f2fd50717d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690299931, "uuid": "c1342e4c-d430-423c-bbd5-6de33f7a130a", "comment": "Malware payload (Amadey)", "value": "004c372be221e7659d3864d01dfa19db3c59c623e9a44f74479b00fbbcc7305d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690299931, "uuid": "84b498fc-06f4-4159-856c-251679cd12eb", "comment": "Malware payload (Amadey)", "value": "749681ed5d4130f6f9808d5fe3f2031c8e134028", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690299931, "uuid": "a3055b0a-a578-48a2-9af8-fa81a93f9a99", "comment": "Malware payload (Amadey)", "value": "e54c1ba9d5ae82cff8c4611bf047a7cbad5e449e8ee4145b43b7cf6077b8eae014f45fa45886da810cba0b7683994c8d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690299931, "uuid": "77e0a67f-8527-4a50-a5d9-218b38939887", "value": "T1DD840103F7E89036EAB5177058FB06D30B35BDA29878436B2786A81F1CB3684A571777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690299931, "uuid": "d6b21c58-1183-41e2-a12b-ac9476ef58d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690299931, "uuid": "d368b77a-4e3a-465f-8b6d-74cda26ee0b4", "value": "12288:VMrFy90CpgzQy/KsalkhhM7467brZ3IbAg:gyl+kGKu0XbrZk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690299931, "uuid": "e719910e-0570-46bb-a3fc-55ac4d055e1e", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690299931, "uuid": "8092634d-62f3-4c0d-8db4-921da649742a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690299931, "uuid": "c3856e2f-2007-45fd-b39b-b78494546e76", "value": "458c0ef12f0a7275e8d165f2fd50717d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a872f923-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690308681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308681, "uuid": "1a78e1f7-e63e-44fa-a684-75a70a417f66", "comment": "Malware payload (AgentTesla)", "value": "26f802d560ddf42f6bdcec5060f17197", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308681, "uuid": "7990d669-a942-4fb8-b935-9483a3bdac68", "comment": "Malware payload (AgentTesla)", "value": "00658c9b2e43b8e0d4ea0069608b76b664e8ebb1275c02abfe6db07cc4c6da0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308681, "uuid": "0bf02205-2cb4-4deb-98e7-b03adb40c730", "comment": "Malware payload (AgentTesla)", "value": "f3fe93d32bc6b066d6547f40698676412cd23327", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308681, "uuid": "ab8d101b-1c2d-448e-9685-2586f4f205f9", "comment": "Malware payload (AgentTesla)", "value": "87f0f3e053b48b767f393f56ddb63c57f84b6b1aa04223440f11a229bb1f7a51307ab5d61ca8474731caf9404a0f1056", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308681, "uuid": "24ca89a2-5048-4049-96dc-53aec2d6535e", "value": "T1794412247794C057F5A64A320B3617676AAEF526142CC71F5300ABEA3C33982EC3E767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308681, "uuid": "7c16cced-7f7d-4a59-92a8-e53c89be51bf", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308681, "uuid": "8afb114e-495f-40e5-baf6-27684324217d", "value": "6144:vYa682b8eLkQvO5nDHcvazMSePdltORRDiZETY8l:vYa2b8eYQeIvgWd7OLkETLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308681, "uuid": "c96c09be-c4ae-4d95-88ae-383299838a03", "value": 275802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308681, "uuid": "8f28ea40-250b-40c9-a4f4-f8c1f661571c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308681, "uuid": "7f4efa81-56e8-4cec-acf4-d15391b40452", "value": "PO21905.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263a9e48-2b19-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690309751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309751, "uuid": "c18140cd-e24d-4e39-be39-fd8a0e312829", "comment": "Malware payload", "value": "5b7d123ba00a3fd916da42a08e61f243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309751, "uuid": "56ddc2f4-f099-4aee-ad94-71a957a16893", "comment": "Malware payload", "value": "00d709407bc5863c8b0dacd89ce0172e57fabf3293ea0bcf56ea96da22660b72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309751, "uuid": "3d149ea6-d787-432f-9775-ccf9ab405b09", "comment": "Malware payload", "value": "4b2a0a6d7d7358d7424b1d66186d3a2d925975df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309751, "uuid": "e76150b4-052c-41c8-8f15-81c1fd485a08", "comment": "Malware payload", "value": "ea2eee8668988b9102423c4719d3f8600e21fb14f158ea92681f5e6b269171d30d5f0654fa5bb142ed8b48a4078708e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309751, "uuid": "456bdf36-16d2-4dc6-855b-b9a446c84871", "value": "T1D9C5CF03B666C6F2E28967B6DDAB8C04C361DA83731FD70B788E23A555433B79C46607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309751, "uuid": "2fbc2977-26d9-4ab4-8d5b-0997b272454e", "value": "49152:irjqkI9wbOEyCbdaveg5Q7FHo+sbC40fDWJmmZ2kVk:d+OKJo+shoWJZZ2kVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309751, "uuid": "2803682a-d932-4f85-9379-865390f066ea", "value": 2577771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309751, "uuid": "38f2e551-591d-4b1e-8858-219c108d8742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309751, "uuid": "df6d1b92-7e90-44a6-8a4e-735a06d69b65", "value": "5b7d123ba00a3fd916da42a08e61f243.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2f146f-2aeb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690290215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290215, "uuid": "177cfb51-65e5-4267-a3d7-1d8f6da7c56f", "comment": "Malware payload (RedLineStealer)", "value": "b98729272c6d4df3a64402281ace8eb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290215, "uuid": "fa6e2e63-e8f5-49ef-a3c4-6a2056e6ec86", "comment": "Malware payload (RedLineStealer)", "value": "00dc3a43dda255a61bd370ebbf0fc0431112da3c176a205489b4a2113c396878", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290215, "uuid": "927014f7-0280-4a2d-b842-c4a133eed25f", "comment": "Malware payload (RedLineStealer)", "value": "e7085276b6444b67bafa946b8dc7d97cb9724481", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290215, "uuid": "80b90e20-8ac9-4f74-a9a6-9aa955187b3a", "comment": "Malware payload (RedLineStealer)", "value": "ad1cc3153e1c177e3a0fe058a48cde698348e1a45e395857396df70d6b1d63cff2237c0c7ba9cdd1df1f485100a4db87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290215, "uuid": "25c61fe2-35f1-4bf9-a088-e79ac3099aac", "value": "T12A840217E2D89032E4F527706CF703830B367DB2597483A7279A69AA4CB26D0E572377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290215, "uuid": "caad4f1e-b60a-4de0-922a-4fffc9b8467c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290215, "uuid": "0c108b39-c1ea-4849-859e-864e8cb1df65", "value": "6144:Kiy+bnr+4p0yN90QEgIDkih24KNWnnVOYvWUo/+K1DEn0q9qkzlM4uM:SMrIy90+IJKNcOb/+K2nzokzlMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290215, "uuid": "213da2d0-ba7d-475f-89c4-5ce17a37f9ed", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290215, "uuid": "394fbeb9-171c-4238-b890-0bf17daeb54e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290215, "uuid": "b300f0dd-0ecf-4ba9-92b4-038d253e7c3e", "value": "b98729272c6d4df3a64402281ace8eb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2cbc42-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690280258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280258, "uuid": "2d6810ab-71d8-4f2f-a1d0-10bb45beff28", "comment": "Malware payload (Amadey)", "value": "a076ae6cb1b18ae3f0157f02f17ad575", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280258, "uuid": "25a78439-fe61-4504-b799-702736dd62ca", "comment": "Malware payload (Amadey)", "value": "01aa1629bce01d1d882c10d835fa7765f2a247f51bcbf0d46b77b87362877916", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280258, "uuid": "ae53cbe9-1fa1-4f63-8b31-26dcb381abc7", "comment": "Malware payload (Amadey)", "value": "a51acdd2e42beb97ca8de21d3a07e62f2fbfbfe4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280258, "uuid": "f22b7fd5-bb8e-4377-987b-5d20f9383cf1", "comment": "Malware payload (Amadey)", "value": "46dc604e8566c4934a5cbec1f8ef573411c917f3e0b0bd1445435e4fa41f50d92186320f70bf4e6ef6c813235aa518c3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280258, "uuid": "c1e0f88d-c4cd-424b-8bdb-e03a853c4a40", "value": "T11B840152ABD85132CDBA5B7058F903D30B36BCA19DB9976B1749985E1CB32C4E03077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280258, "uuid": "71245967-3fcb-4120-8b3a-12effd412c6f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280258, "uuid": "53674275-9ea8-4e83-b6d4-de81fb0e905a", "value": "6144:Kyy+bnr+Ip0yN90QEkX3vNbKMTy4HDtPdpS5eJ9cIkiGBmzC9AozEIsGE:uMrQy90KX3RKM2YtPjSKG8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280258, "uuid": "17fc4b9b-f8d2-4542-a2fe-b833914c8abd", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280258, "uuid": "e4cd4e8d-08ba-460a-a50c-7cdbce8f8a5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280258, "uuid": "ac5d73ae-6268-4325-8e3c-6f852b1fc9cc", "value": "a076ae6cb1b18ae3f0157f02f17ad575.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93497efd-2aee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690291465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291465, "uuid": "1f3cf98c-5bdd-4176-9fab-b0b2d209e8a3", "comment": "Malware payload (Formbook)", "value": "352a5bb6e73a242ed41bb988cdc7ae34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291465, "uuid": "c22782a5-cb1d-434a-9097-b63acf0af2fb", "comment": "Malware payload (Formbook)", "value": "01d6b9289dbb3ade96c798d49f7ba8bd9522deef12840f5178187197357366ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291465, "uuid": "52a03f0e-0bb3-4368-bca9-eca06376e340", "comment": "Malware payload (Formbook)", "value": "57ef517cdc0db31c51768e5849c4c1317aa6be69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291465, "uuid": "5dc6e5ce-ee2a-49e6-a3d0-83f921f4d7b3", "comment": "Malware payload (Formbook)", "value": "9c373b9b45af658b25d0140ef154d97ff4c8dbacf797172a2ecaf7f3af78811a4c29bc44151dd1a3404ab08cb594aa7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291465, "uuid": "e717a4ca-780c-4e5d-98e2-7800d9db3991", "value": "T12BC4228936BC9B30EDAFABB814F10D4507F2ED6A7725EB0A1D9476CA07A7304534163B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291465, "uuid": "2a218884-f470-4781-9d51-fb0dba4c34a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291465, "uuid": "79ea6749-c6d4-4e8e-b153-04f8c28aca53", "value": "12288:8hNd6IN7NDGuZN2id+8KuKaZOr7ELyGIQqOf6/zrkBH6R:INdZxNiuZN2i1/KFrICMOzgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690291465, "uuid": "0f5183e3-de35-43d1-a165-3e3a2aace757", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690291465, "uuid": "ac2ba0db-a356-4849-88a0-a7118b771a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291465, "uuid": "37348724-16a3-4031-bbb1-5c5c089b002f", "value": "RFQ 6000066536 - PR 10023150.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7413cf-2af0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Andromeda)", "timestamp": 1690292288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292288, "uuid": "6ed81efe-1e74-49f8-9609-09dba1bf9f2d", "comment": "Malware payload (Andromeda)", "value": "aaebda505d994099804174744c48ffe1", "object_relation": "md5", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292288, "uuid": "e3f541b2-06c0-4957-83dd-006fd848f321", "comment": "Malware payload (Andromeda)", "value": "01e774d22097b6a9ff12aafa62fb9833f9082522e346dbdd2459c1920a831657", "object_relation": "sha256", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292288, "uuid": "2c0e6669-27e2-41af-9b20-61f8bb5250d4", "comment": "Malware payload (Andromeda)", "value": "b38e13318e923349f2be720dae16841b748bdf28", "object_relation": "sha1", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292288, "uuid": "7027d0df-72ef-444e-985e-b72024e620a5", "comment": "Malware payload (Andromeda)", "value": "0244cdc01bf135b75264a7ce87d94b4715403955a557cbd604c5083c4951f666610da79a2714702d0614c62633432e4d", "object_relation": "sha3-384", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292288, "uuid": "a7226dee-a91c-43e7-ad0a-939a6380a87a", "value": "T1D053C02323C0EB57E02D827911A76BFA1A6BAE114C15C80FADF71DDD67627D49023E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292288, "uuid": "8bb2d530-ad27-41af-90f4-beb5c54b6088", "value": "540cba6657a101cb43bb9f60920f4768", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292288, "uuid": "7db87483-9b9a-4c87-ba91-1976cfcd3ed1", "value": "768:8ZYOGJ8z39m6odrD2ydQtaCGvRDvqguFjI3LOLisuIPcH9e3FEx8EFK4AVSi0WCi:83t2dGanvsh2ki4PQeVEKE38TCNMBMpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690292288, "uuid": "243610a5-4fc8-46a7-abb7-26e10cd043a5", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690292288, "uuid": "cbebc0f6-6b76-4efc-b2f4-eb6a8db15621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292288, "uuid": "4053ad9f-33ea-40ce-a1c1-93ca6149fcb6", "value": "01e774d22097b6a9ff12aafa62fb9833f9082522e346dbdd2459c1920a831657", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc02aa5-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268261, "uuid": "8d330a62-20e5-4e21-91d5-0ade36c468b0", "comment": "Malware payload (RedLineStealer)", "value": "96a485e578b54f2cde0c37c6f512e0c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268261, "uuid": "d79bd093-2649-46c2-95f8-90ca98653e18", "comment": "Malware payload (RedLineStealer)", "value": "02fa9e870a9e9a0cc531855a78099113495ff912e04f39b601de63c2b4853d3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268261, "uuid": "7e19e531-7c75-41c5-bd87-f3905467d7ba", "comment": "Malware payload (RedLineStealer)", "value": "0a5740973b41ae78b864ded4bc40ea2d697c118f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268261, "uuid": "d8f75afe-9bef-45d0-81d7-9958b19afc7d", "comment": "Malware payload (RedLineStealer)", "value": "be514bc7eb20abbe56c8c25db90d63a1c8e96c904f75fb1db30bff6f3b0f2aaeb16591a4d1ad6af30ee13ac9e757de1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268261, "uuid": "d40bc18d-4859-4ca3-9a59-327b090d5a43", "value": "T1AD84F112A6E44433E8F66BB028F703C30B36BC925978836B2755A96E1C726C4B57177F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268261, "uuid": "1f3338e5-6a7e-42e7-ab49-a64f40efb3a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268261, "uuid": "e2c6df95-2994-4e90-8355-46290778a11f", "value": "6144:Kay+bnr+Xp0yN90QEw2RqEJ7YkWnjBNsnDwA16Ngl+U+YQqNwk2eAsOXmE5JCzHZ:WMrXy90OEl162l+UAkAZ26CApO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268261, "uuid": "c2f1f2f6-a9f8-4217-b97e-4cff6980ac95", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268261, "uuid": "30e877ba-e9b6-423e-9656-7a30f16c639a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268261, "uuid": "88c55783-565d-4a0f-a2af-ac90a7167bb2", "value": "96a485e578b54f2cde0c37c6f512e0c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea2d7f5-2b39-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690323562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690323562, "uuid": "a801ec4c-7cf1-45ee-b2f6-7efca6056446", "comment": "Malware payload", "value": "47914f0ceb488a63c63c68c5b2cf9703", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690323562, "uuid": "924129a0-e550-4395-be24-80b8bf73012c", "comment": "Malware payload", "value": "038c37cbf6050e8371b9e4ea76498b6297ef4645262fbf14cb25198f0f42b51e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690323562, "uuid": "d88a79d6-5a68-472b-b6f6-a1d3d0f7e097", "comment": "Malware payload", "value": "3735a542952b294d6b4d6bacffd21db154aa468d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690323562, "uuid": "a38105e5-4bc6-4b51-9ad8-5ef9f1810b27", "comment": "Malware payload", "value": "b58475af820b9abb3d4226ce93495c4ebe3c4fe54652e97f1335ae0314baa7410b4a377145871b1b6fa1f5887de02670", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690323562, "uuid": "1c66bb17-fd45-412f-9dbe-9c51e8041d07", "value": "T123749D13B3D4E93BD1FD1B3AE43206155FB0D987B616E38B5A5846B86D133868E903B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690323562, "uuid": "1886de91-4e4e-4952-9cf5-6284b2752734", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690323562, "uuid": "232e8026-0b3c-4f43-b4ba-17dff1b85042", "value": "6144:h2NHXf500MtXtOfcNSJbeudBmC9qvUYjB1fEW:Qd50Pt5Qf9hYj4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690323562, "uuid": "b3c742f1-cc77-436c-8962-a9872a35ae6e", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690323562, "uuid": "62d22101-41a3-4b10-a018-2cbbb8f6ebb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690323562, "uuid": "9c0f6aac-8245-42ca-83de-bc639335635b", "value": "x4ccHUL9jDse.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62685aaa-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268190, "uuid": "c610d23e-7ba3-4d1c-8d83-9330561f04ee", "comment": "Malware payload (RedLineStealer)", "value": "21d5e26d80e17d90723eafe2e81f0380", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268190, "uuid": "7e017c02-5b90-4339-b84b-0ba2368e1f77", "comment": "Malware payload (RedLineStealer)", "value": "03cef1108b01e5304207d3fb3a53f024ec18e0178c6dc16454723a9c7852ab25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268190, "uuid": "ea9c9778-9b05-41ed-ab10-79bc3f4d2fae", "comment": "Malware payload (RedLineStealer)", "value": "8cf32bcc5746e7097e8457cb8072e6af5c3cc078", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268190, "uuid": "ea06bb0c-4ecc-49f6-b51f-3dbd0affc08e", "comment": "Malware payload (RedLineStealer)", "value": "bc945e139e062baf24d107ffa7aff608d76246d525885fca0554f0798806957e36e540503fb627bce9ce2210f6b891ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268190, "uuid": "81cb8c3c-a5cb-416a-8aa3-a05b982740af", "value": "T10BB41206B7ED4037D9B52B7098F602C31A397CA15E74936B3785D91A0CB2680A57673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268190, "uuid": "5d074797-0d14-442e-96d1-6d007cbf985b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268190, "uuid": "c6b3f820-cf2a-4d06-95f6-7a529dcf092a", "value": "12288:UMrvy90+M2xY8uiV4qLx52eJe9d/Z3Of0c:TysoVp3zov/Z3Of3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268190, "uuid": "c3c2a943-fa3f-4ea4-9af3-edd8b63eb742", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268190, "uuid": "73efae36-8f19-41a0-a334-10859d7615f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268190, "uuid": "9ff11fed-9781-4b68-bd6a-eff264dbdb00", "value": "21d5e26d80e17d90723eafe2e81f0380.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c62a58-2abc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1690269996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269996, "uuid": "c127f010-a58c-490b-89b0-194ce322c9c0", "comment": "Malware payload (IcedID)", "value": "1286c9e72729a728f15a88f2e8184b49", "object_relation": "md5", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-724", "colour": "#D0EF82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269996, "uuid": "dc644911-e808-4749-b61c-54223e1876ff", "comment": "Malware payload (IcedID)", "value": "04004194bf11dd8a494cf150e7607c8a5626a7bb32fa0731ea14a95b1ae8d2e0", "object_relation": "sha256", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-724", "colour": "#D0EF82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269996, "uuid": "d432d0cb-4931-4139-b33d-c826a2953f4d", "comment": "Malware payload (IcedID)", "value": "8ce859618640eba10d9af59127192d14991753c2", "object_relation": "sha1", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-724", "colour": "#D0EF82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269996, "uuid": "48b24e42-b3d7-4138-aef9-3220c018461c", "comment": "Malware payload (IcedID)", "value": "008113648b4156eff102dc84e287bda1cd2fa31c3316b4b09404b903eb01467d20253153b6808f1ecefa2d527dda67b7", "object_relation": "sha3-384", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-724", "colour": "#D0EF82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269996, "uuid": "f7cc62bf-c126-4eae-ad34-90813fa5bed4", "value": "T1720412C9CF5E123F5692625C81DDF4B660E17E446D423089DBDC24E2CDB6D80BE2EB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269996, "uuid": "76ea64c9-3bee-456f-9224-d638ff83f5ce", "value": "3072:V9OV/pFLV1CzB/dnj5TZQPvO6Cjusoza8cdljYJxBgfEgUxb20Hu8FD82PF:TOVDLPIlj5tQPvO6CyvzavfgB4EJ3PF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690269996, "uuid": "920444fb-c305-4248-bc41-0342e59a91ed", "value": 185991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690269996, "uuid": "bfa0357f-86ed-4e49-b5fa-01fa01529ab3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269996, "uuid": "88aa03c9-f942-42be-9221-e44282a100c8", "value": "INV-Details-JUL2023(124).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503f85ed-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268589, "uuid": "77013804-db13-4618-b6b1-e00a3c5cf7d1", "comment": "Malware payload (RedLineStealer)", "value": "a1cd17ce99605bed7e51f332ef48e9ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268589, "uuid": "cbb18178-b46a-4b2c-9b5e-7345651a6f2f", "comment": "Malware payload (RedLineStealer)", "value": "056757ceed066519eb34910115fe06f7bd89fbef869850b495f01707c956ca1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268589, "uuid": "50de5139-0dc7-4ba1-87d6-b42bae8ed8d9", "comment": "Malware payload (RedLineStealer)", "value": "e9c707a4174f6181419324f1a7bfda014cc90c53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268589, "uuid": "8f344a3d-f282-488d-88ba-f485d5b1c203", "comment": "Malware payload (RedLineStealer)", "value": "6c51312343c471c4f9f1fe4b10d95d9c542f4fe2ba30345a0b34c19a1c823adfa2cdfa0fea347c8c9274212681063e5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268589, "uuid": "761363b4-fd5d-40d0-a941-219063dffdad", "value": "T1BE840113F6D98032D9B52BB068FA02971E367DA65D78836B37096A4E1C73AC0D436377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268589, "uuid": "893857eb-5b68-487d-a385-5f5eaa09df7d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268589, "uuid": "13795307-1d40-4cf2-8a29-7cec15a0dcac", "value": "6144:Kyy+bnr+Fp0yN90QEi4IqYcxfE/EKzVW3e5zdqEQmMDgwVAmE+jfsN4u2lLY60L:+MrVy90E2VEMhLnmV0W+jfsN4u2lLYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268589, "uuid": "1aa06226-66f2-4014-aaac-95c6c16373f7", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268589, "uuid": "cb569bd1-f88b-419e-acab-2b7abc3b1765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268589, "uuid": "b244e29d-206c-4c7e-a157-ea6005674814", "value": "a1cd17ce99605bed7e51f332ef48e9ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be04b9f-2ad6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690281145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281145, "uuid": "640f6b01-ab0f-44eb-9bf2-2073d573abc9", "comment": "Malware payload (Amadey)", "value": "f74e3b9d201ad57a91151c074dce2f18", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281145, "uuid": "6e887ada-0186-490b-aefe-125120c12e3e", "comment": "Malware payload (Amadey)", "value": "056f44561dd59f1c4d2bedaad82bbcff8a01743f8fcb97a03fb9fec8b3d29562", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281145, "uuid": "f4e9dd89-6ba6-47c4-a328-e9f7041bcd35", "comment": "Malware payload (Amadey)", "value": "6b2cb0a24296746da8f5607b6a841ccabc58bc5d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281145, "uuid": "5a469776-0b46-4f66-bc3c-1266ab5648f6", "comment": "Malware payload (Amadey)", "value": "fa98caebea9de0cf5e478b8dfb845abf48c1a99741bb941c21fdace8b3cfe45e27aeb60d58dd8b799dd9c793af792abe", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281145, "uuid": "d40454ba-81de-48d7-b507-28a23f8b717d", "value": "T1DF2408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281145, "uuid": "e56b4eeb-40dc-4e20-bb7e-7185acd7145e", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281145, "uuid": "51801c7c-5c91-472b-b259-50cf69d69371", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690281145, "uuid": "d9e10824-e479-44fe-af74-18beda807b54", "value": 229440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690281145, "uuid": "f2ac067d-14d9-4304-b4d3-cbb173421da9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281145, "uuid": "e2c5073c-83eb-45c5-b849-2c0e84e3aa7c", "value": "f74e3b9d201ad57a91151c074dce2f18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c7ddcf-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690282131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282131, "uuid": "954461c7-2975-46be-9822-34d1609b1e4d", "comment": "Malware payload (Formbook)", "value": "5b7f594a4b8bfc07eb5221d602590452", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282131, "uuid": "c8a99006-9fe0-4a1e-83c9-6be540c028ab", "comment": "Malware payload (Formbook)", "value": "06c8aa9110e9c50c51464d31ef28f3cab2efdb1ca756455f99f49daada571dba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282131, "uuid": "caccfa4a-dc34-4fe9-93b1-e714815a50e3", "comment": "Malware payload (Formbook)", "value": "087a7b5db73d6030a25318a5c1ab901dfb0cbbdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282131, "uuid": "dfa0d0fa-92e6-443a-a86b-ea0336ff24fb", "comment": "Malware payload (Formbook)", "value": "0aaee93cb40cb3f170350813091964c23f20bbcdd78d71dab419dae91094cb66c919541cd2e36f5441a036ba6235067d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282131, "uuid": "dc330113-c45c-48e3-9d8a-764b2ac0bc83", "value": "T1464412213FB8D46FE4560E71AD3BA3A9FE63A51110B45B8B175437CA7D38392C91E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282131, "uuid": "120b858c-659f-4e11-8dce-3e425c168082", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282131, "uuid": "b7d01b47-cf48-4cce-8e41-31a20833e461", "value": "6144:vYa6ip1WAK/RTQ56Hj5o8Xp24/jzf8G8z2DcJ7serItT:vYcfWn/FMc9152QKSZEItT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282131, "uuid": "3deaa8ee-98d9-4fc0-9625-fdd10a389a70", "value": 262399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282131, "uuid": "319366ca-d549-4491-a427-201bf9cd0c60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282131, "uuid": "e4e49b70-0f2b-4b51-b709-136888e40141", "value": "rock9976.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad436ee-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690308685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308685, "uuid": "aab1833e-ef6f-4b28-b62c-2bad60fc79f2", "comment": "Malware payload (AgentTesla)", "value": "6137f5bba73cd527a7ceef3446df4f68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308685, "uuid": "5dbaa488-0afd-486b-aba6-9767f574138d", "comment": "Malware payload (AgentTesla)", "value": "06daf26a2dbd59adbf752e34239b082116eb03dd49bcfd56f10a408ea4864f82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308685, "uuid": "c9489b11-ee59-4e02-8fd0-d86b0ac019e9", "comment": "Malware payload (AgentTesla)", "value": "91cd522b9b3a28292d40e1a92ec38d82653d72ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308685, "uuid": "427c2964-99ca-4a5a-96b2-43fd4491e9b3", "comment": "Malware payload (AgentTesla)", "value": "d5b815b8be978a821391bad2de274fbfbf71f35250e5bb6c6ea255523e9fe8086f3008d6d83e676735586f76ded12f06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308685, "uuid": "b2db86ef-dcd8-4240-8f05-9b6ed5a736e0", "value": "T1F915387239DEF8C6E28CD33D212EED146B6AF4119212A0DF84056EC9974BA49F447D3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308685, "uuid": "2992c83a-0b10-497e-8ec8-2c19e860d5e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308685, "uuid": "457e8346-0f13-4349-9359-6916ab95744e", "value": "12288:u6zq96r1Vmjp5ELq7SjKNUtv1ervl5MpN2geya33SW4bS35v:Pq612xS1eToezIbSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308685, "uuid": "6e879a8d-3e1f-49c0-9676-cb12a64ea7d3", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308685, "uuid": "a5155bb9-67f8-4f4d-a97e-02ba40beefef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308685, "uuid": "eb32732a-e031-4474-95dc-ae11892698ef", "value": "SHIPPING DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aea06cc-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690296954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296954, "uuid": "74423ee3-2c27-4f03-a030-9aa51fd3054b", "comment": "Malware payload (RedLineStealer)", "value": "dc78d9d24185e778461a2075f537ea02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296954, "uuid": "eeaafd34-53e5-434f-82ed-72678fd41168", "comment": "Malware payload (RedLineStealer)", "value": "07abf7f0289b1d67ed37ac47ad89d4348ea386c4098cdd015b5827156a63a3d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296954, "uuid": "de116c50-dd93-4230-82f0-0c406b540bd5", "comment": "Malware payload (RedLineStealer)", "value": "20d37e90221dcb879a31f4b03dcbcd2a367ba460", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296954, "uuid": "4f670d11-d1ec-465d-9376-4410365f7d70", "comment": "Malware payload (RedLineStealer)", "value": "7220ad5242dc78b95f3df669ba1385f75942d900176923f1cc42f549f993ceab874af7999a3a76a36a1ec4e050ef2bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296954, "uuid": "33c339be-8000-47dc-b656-de07704fb5dd", "value": "T1E3844B0792B17C54EB27CB728E1EC3E876DEF5508F4977A72219AE2B18711B2D273610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296954, "uuid": "3501f24b-5460-4585-9b5a-5f5f39321ba2", "value": "6dd6b46f56344bac3e06d5c8db854c3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296954, "uuid": "8d1eb0d6-e255-4c03-90f4-422cc44a77c0", "value": "6144:Ud2r0PLuz28NiyOmAVnVqR7+LZ3oyixslX7621pT2:02r0Piqiiy6BL3oyYG62P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296954, "uuid": "13d1a688-1d1a-4ec4-acf8-341ba126b2da", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296954, "uuid": "078bdd31-d952-428f-8f9b-f81bdf8f1a10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296954, "uuid": "4d124fe4-d87a-49cc-bc37-8cc6e208db1c", "value": "dc78d9d24185e778461a2075f537ea02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e450aadc-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268838, "uuid": "5b1fd7df-ca58-487d-8ea0-e852e8097030", "comment": "Malware payload (RedLineStealer)", "value": "a012410949759e4457ca0bd450207d70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268838, "uuid": "ea9d60ad-ed7b-4364-8717-e5c528747306", "comment": "Malware payload (RedLineStealer)", "value": "0807e330ce25d8615d3f69f10c2c3f9eaafd2a16a368168526b90fc95c759e04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268838, "uuid": "d73a2b0e-fec9-4587-a75d-546ff96b98c5", "comment": "Malware payload (RedLineStealer)", "value": "00c4307de5541a15ba911f6e2cad72527bb82fef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268838, "uuid": "b12acfbe-f7a8-486c-a38a-791951945153", "comment": "Malware payload (RedLineStealer)", "value": "5d4494a2c5150d9a212a599165f9cc9096f88e22ea574ce150fbf211eacebb924484734ee1ecef5342604c35ee4096be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268838, "uuid": "bbbafa1f-b2a5-4ba2-a5c0-b4413d4dac46", "value": "T11D840243B6D89133D9F42BB158FA02830E357CA26D7C936B2795A85B1CB32D4A57133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268838, "uuid": "e7fbd03f-d731-451a-b4ae-59b5085f7c6e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268838, "uuid": "67174c4e-7665-4844-a2bd-ca8176cf227e", "value": "12288:PMrky901St1YP1aa1WqNRRdgBYCwSLvP2l:nyV1YN91WqNRszFL3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268838, "uuid": "a6a79d54-23ec-43a9-8392-2749cd82168f", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268838, "uuid": "2d71d604-1265-46f8-bf0a-b6faba74ac80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268838, "uuid": "4e5928d1-d438-44ca-8b63-40d41c98e6d3", "value": "a012410949759e4457ca0bd450207d70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbc719c-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268213, "uuid": "e9fea93a-812c-4e32-b016-09f320379639", "comment": "Malware payload (Amadey)", "value": "6ed16fc0196c499604696dc292b249aa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268213, "uuid": "55b9b37d-1a3f-48d2-97dc-2e5dbb968e4b", "comment": "Malware payload (Amadey)", "value": "084bfe8726010da1db5606bf963d5fe3a9b0e92fdf3f0a64a48d3d9ac6fc9e21", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268213, "uuid": "bd5bf3a4-6670-48ad-9196-cf70718c0b6c", "comment": "Malware payload (Amadey)", "value": "5632f7e7d738a662cff1089182201f48d69508af", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268213, "uuid": "c7d883e6-1975-457c-95a2-9277a8fe01d9", "comment": "Malware payload (Amadey)", "value": "fdeb864152521ba76e72b97b1f2eddcfa8fbefd8c56f39b0a443eb1f57a0082820dcae3c6618f900c3aafb009b8bb39f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268213, "uuid": "1465c2db-7c41-43e5-b6b1-5f92b21176fd", "value": "T1042408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268213, "uuid": "ec97bcfe-326d-4cb9-be46-3731899b3c46", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268213, "uuid": "ddeaa2d6-7134-4564-8937-26e8ffae6844", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268213, "uuid": "2bfa802c-9447-44dd-b0ee-d10b2154889c", "value": 229382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268213, "uuid": "f9c242ef-5b93-4bd9-bb23-ae508e13c06e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268213, "uuid": "b1c771e7-72d0-4cb4-b5d9-1efc3e958c55", "value": "6ed16fc0196c499604696dc292b249aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7650d59a-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690280250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280250, "uuid": "f3d69041-23e3-40c4-8568-b5463fe1b3a7", "comment": "Malware payload (Amadey)", "value": "dfaf991419b4bcd9be26de5811dab6d0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280250, "uuid": "5bb90de1-0be7-4222-8fa6-affe591a0fb6", "comment": "Malware payload (Amadey)", "value": "089ff6d60829c62833435f066f6247d7ad839a61e4c18614d1b847ef3bb7aead", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280250, "uuid": "3c8fa2e1-c646-4656-8ab0-a4870b02f3fe", "comment": "Malware payload (Amadey)", "value": "18ec6b25da91280361e091c0ddddf4aca4bd9e13", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280250, "uuid": "8aa71346-6914-4d70-be56-b06f2cf3f87e", "comment": "Malware payload (Amadey)", "value": "79d7e75b1e5f15bb780dd257f097de649706bf56647b1255870d944e4f3cf661644be307eb1c11e68c6c92ba8324363e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280250, "uuid": "188678cc-36d8-4164-a60d-28025303bb7a", "value": "T1522408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280250, "uuid": "51e9348f-6d3a-45cd-89a7-524d496f8ee7", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280250, "uuid": "80480732-6f59-45bd-a145-8c2d460f80e2", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280250, "uuid": "aa0e0530-7455-4dc5-a8c3-cb56ad75a3b2", "value": 229483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280250, "uuid": "7e72c7cb-b4ab-43c6-ac95-fd8d9a42c3af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280250, "uuid": "e19f7409-1f45-4552-892b-0db6ea845ba0", "value": "dfaf991419b4bcd9be26de5811dab6d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a876b02-2b14-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690307745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307745, "uuid": "0eae34d0-e09a-409f-a5ea-755bb240f0b7", "comment": "Malware payload", "value": "d1a65e69c7394a1da2425f15d1e1ca18", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307745, "uuid": "8b9babb0-adae-4a43-a5c7-e121a7075d85", "comment": "Malware payload", "value": "0930e25d03cac8c0135165a3c27dba9a56c28bbaae2198a853f63558ded57746", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307745, "uuid": "73d455b2-c9e8-4ab0-bf2d-b152a2e2c2b5", "comment": "Malware payload", "value": "3074d635302177a517cf4793ffde0006fb00ef44", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307745, "uuid": "b8baedd8-65a3-4e01-a43f-e2348efd8103", "comment": "Malware payload", "value": "a78aa71e52d5f3ec155a58ed6cb84f35c45c989f72a6254c0ecf7cf037b5fd5c627a0db23a81aca0d0fd5bdd47c136ed", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307745, "uuid": "90b3e204-681e-4f1c-895e-55cddd8193fd", "value": "T17FB50217FAD6EA26CAA922709CF1EF3A0D59FDA29D50A04771DD3E6F37319006C4A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307745, "uuid": "7a81402e-56e0-4a83-946a-aa778ff3bba1", "value": "49152:yvt6p9SfZC1dxSes5y7xfM44aVo2kb7QwIN9AYSuX:edZC1rSXy7kaVRkb71IgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307745, "uuid": "7d2c7748-e8bf-4c10-a306-9d5179d130c0", "value": 2417152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307745, "uuid": "6d95998d-7503-4ef5-820b-ac7e294fddd6", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307745, "uuid": "8c18efc1-45ac-40e7-990e-364dff22a967", "value": "2023 2024 Dossier Administratif Inscription POLE PRO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73cafbf8-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690308592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308592, "uuid": "744b2b04-e96e-458c-88c0-368f21229304", "comment": "Malware payload (Formbook)", "value": "55f9e129e6c13bcdf5c25f7b37103077", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308592, "uuid": "c027ebd0-4990-4405-8b84-9a1f1bc038ff", "comment": "Malware payload (Formbook)", "value": "0958d840bb001dab5c73ea644bb8a32a3c28e41f80b93833d54f2ac1e4e11472", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308592, "uuid": "1fcfa2f8-2e2b-4d91-aae5-be5529f0c2ef", "comment": "Malware payload (Formbook)", "value": "4ad57d1acebacbe0a6827530b32f07625d3aed75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308592, "uuid": "6c8f5d9e-f87c-4d06-8f78-b29fd3bd3561", "comment": "Malware payload (Formbook)", "value": "2699e0ed6ba6f30d08422a50c56a78f384832bb48fd573794c12fd66a69f30a103c2a1e23ffca07d0a0f5e3d522c10b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308592, "uuid": "8fa5084a-5f26-4ef4-b55c-baada31c561e", "value": "T18D15E0523669BBD7C57AC3F45020323053FEAEAE6237E3286DC270D61572B408A76E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308592, "uuid": "081c4504-01b6-495f-b2d0-00aecc0cf7af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308592, "uuid": "5fc1fb1d-b776-4749-bbe5-6410e3b6225c", "value": "24576:QxUuHIcTrGCSVqfQkdS/tXPj+PgT+mZOj:IfHIkrzSEa1XqIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308592, "uuid": "92ce430d-71d9-4fff-b359-88f2e5b465f3", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308592, "uuid": "d963e4d3-c1d7-4122-9b6c-4e6ce2e624e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308592, "uuid": "70c614f9-0425-439c-88f6-eaf79f83e5a7", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69058962-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690280227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280227, "uuid": "1602a505-9caa-4caa-81b8-2ce832d86897", "comment": "Malware payload (Amadey)", "value": "6002e4602a1405b85b72c94d98b92155", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280227, "uuid": "3f1ddcf5-1e50-4d1d-b7bd-80569a498522", "comment": "Malware payload (Amadey)", "value": "097f1c29280093840e1f6dc3c3db5b61ad51b586aa10bcdc7588a3ad7940a6b1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280227, "uuid": "14308f7f-3872-420b-a351-5edc4a5e93ee", "comment": "Malware payload (Amadey)", "value": "02ecaa5e9c7d4cbf0686a6d526bfe90ac489cf9f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280227, "uuid": "8e9123d1-8b10-4d52-8274-47c597607cce", "comment": "Malware payload (Amadey)", "value": "99052ee73078fc87ba5657ccd447279dc9d71a08f510515eda8364c764747ddfa8ee9f99c06d40dfed32ec6c119f37bd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280227, "uuid": "b665d545-361d-4dd6-aa5c-5a31e988ef3f", "value": "T184B41227BBD91533CCB51BB098FA03871F317CA29D78875B2785C9991C72AC4A93136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280227, "uuid": "50084795-9729-4160-b976-f77c4098a18a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280227, "uuid": "de5fc177-b3fe-4c1d-8a12-cb97e1dfa058", "value": "12288:FMrty90OzmltJAz9mMl0yUbigfwWFZXV6LFs:YytyazIU0PbNfwo3uFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280227, "uuid": "58595aa3-3332-422d-8b85-659898bbd34f", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280227, "uuid": "e2c911a6-919d-45b8-96cc-012719c108cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280227, "uuid": "09042029-f303-480c-b959-5b5fd0193e1a", "value": "6002e4602a1405b85b72c94d98b92155.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c632d8-2aeb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690290318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290318, "uuid": "2ae5943f-d5e8-480b-ab26-e5aebf823702", "comment": "Malware payload", "value": "851bdfe9ea52b59d50b8d2de086921c9", "object_relation": "md5", "Tag": [ { "name": "80-66-88-145", "colour": "#AD4147", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290318, "uuid": "9af9f77e-986f-4ec3-9755-b3120e9932e5", "comment": "Malware payload", "value": "09bf1b88716c49a62cb4ff708f7ff4f09cb7c3ff42e58661802cd66f1a2a0311", "object_relation": "sha256", "Tag": [ { "name": "80-66-88-145", "colour": "#AD4147", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290318, "uuid": "0f1e99f4-1399-49a4-961f-0225c8f28b66", "comment": "Malware payload", "value": "5a1585479349ab9a64134ce4a3063b513aabb9ce", "object_relation": "sha1", "Tag": [ { "name": "80-66-88-145", "colour": "#AD4147", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290318, "uuid": "d4814367-677b-4b83-b18a-fccae48bbaa3", "comment": "Malware payload", "value": "519a9e29a9c8f297069e793b7ee569ba7b66bf296d3375bad29b80dff0e09eaff7e91b4ff72e57e7db3100af982ac9c9", "object_relation": "sha3-384", "Tag": [ { "name": "80-66-88-145", "colour": "#AD4147", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290318, "uuid": "5aac8bf9-dbea-4917-9361-d60eb84f2335", "value": "T149F4AD4A1F6D4D2A4F8EA05D22787A7F1FA078D1D2E4F47D68479F55A09EF200CB8E09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290318, "uuid": "9037d73a-ef8b-42a6-becb-d053aca515d7", "value": "12288:S7k7ag2ZA0BSemCiZUYeaFCjWuweGqJ/4QDHrii6OoM:SeD2SHeWuwItWiloM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290318, "uuid": "72dbe21e-4a7c-4cd6-8a82-488fab499855", "value": 769468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290318, "uuid": "f9b49207-25d4-482e-a893-d9cffa7bd328", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290318, "uuid": "2a437fbf-c231-4435-a589-186fa8af20e3", "value": "dgYoooUm.au3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440dfc5f-2ade-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690284460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690284460, "uuid": "d59a57d2-9400-4b6d-9cc0-94f15bd53838", "comment": "Malware payload (AgentTesla)", "value": "011fd2a174d3154e14f1065629540e3d", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690284460, "uuid": "c8da4f07-07cb-4dcf-99f2-6681524db5a5", "comment": "Malware payload (AgentTesla)", "value": "09cddf3877530861d730868bcd1d1563c2b631976c2cb6f456a4e6b00171aff5", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690284460, "uuid": "ccd9a556-3b08-4dec-b32f-89b6d914004b", "comment": "Malware payload (AgentTesla)", "value": "c2cbd3b98b46ecf7e23167e5e1516e0824ff0d96", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690284460, "uuid": "3fbd2f28-7d1d-4021-a126-485c8fdd1b5a", "comment": "Malware payload (AgentTesla)", "value": "628a6abe6631a3a4760f86682dd03cea07f7cd3e3c5a166daa83f44933bd62bb537e359f93c8f314c00ac4238c9b13fd", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690284460, "uuid": "42558afd-ce65-4bac-b467-e464997d73d7", "value": "T199442307595BC3B56CD652FB0614AC3BF0AACC2E4143E23584786EE15E4BFED61A720E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690284460, "uuid": "6f0d90ff-0a8e-449e-9a76-4c1316065be3", "value": "6144:R5n5JdQqLm62x0uOVbdzMkrYZcBnOVANLrBiE+Qcj:DnjdRBuOeZCMacj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690284460, "uuid": "cf4816e9-33eb-4c9f-b8cc-775c9a5bc1ba", "value": 258172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690284460, "uuid": "1b6858c2-8dd0-403b-969e-7bf18c3d2612", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690284460, "uuid": "02be6eb1-3ca0-4680-9c0a-50d3132e0e0d", "value": "Qoutation.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e4b528-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690282108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282108, "uuid": "f5e94057-4a55-4a12-b77d-fa63f3da8907", "comment": "Malware payload (AgentTesla)", "value": "db9bce375b2b1f6ed8958d7c1c906336", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282108, "uuid": "72ef485f-7b63-41ad-8901-ca89bfc5c47f", "comment": "Malware payload (AgentTesla)", "value": "09e97801ff1517862bbba24506555cb7d06e6b90c6ec794f3ccb07b4776782b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282108, "uuid": "b702600e-a0ac-4275-8257-ffc97670f7d5", "comment": "Malware payload (AgentTesla)", "value": "c800fa02a11bedf8ddc4950cb5ab23b3ac31554e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282108, "uuid": "d3d4b0c3-b8da-47f7-b598-ba916b5d1e8d", "comment": "Malware payload (AgentTesla)", "value": "963ad1ecccf836038cf381560f10fb743f5409b8460109dde616a1610529391cae3d16d31a9830687bc2d1d92b00d636", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282108, "uuid": "e93a7763-fc3e-409b-8bb7-4ff4b800ce9c", "value": "T1B3D423945ECADF17D76B2FB9000136B4838A49D93A1AD6970C0DF0BAEB19E4F8D60753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282108, "uuid": "d771b4e0-3cd8-4843-bca6-94a4adbde45e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282108, "uuid": "3ac8bf7d-dca4-4b5f-b97d-9aa58c18f798", "value": "12288:dmAY2kcdbL4Ef1kXJhsbffaO/BFXtauZakx+bHI0r94YHc:oN6GEf1kZhsbfiMrbZf+bHIkSY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282108, "uuid": "499cfa5d-30df-45ad-92a0-5a4288a0a227", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282108, "uuid": "cb8774c0-e67b-48fb-aff2-10b5ef2385f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282108, "uuid": "ae2d3251-4218-41c6-9a7b-99e6c0693cc4", "value": "Estimated Invoice 287468-8565648.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a262f2-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690282121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282121, "uuid": "b413ac90-6be1-4523-b5c0-f96ae36f2be1", "comment": "Malware payload (Formbook)", "value": "5e143a29a1cc95052e0a0d5e1b25f07f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282121, "uuid": "ec73d8be-53a3-47b5-9dda-ff07b57855c9", "comment": "Malware payload (Formbook)", "value": "0a66f915bdd8a4fb6a5ccd21d56c97a0fbf75a5cf534e1bb927c594e0643cb2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282121, "uuid": "b9010c06-e1c9-4f7c-908e-402faae37ab7", "comment": "Malware payload (Formbook)", "value": "cfed5dd8253b0aae4f833401039489d528ebbc21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282121, "uuid": "aa618e43-67e2-47ca-8a39-b648f5936fc3", "comment": "Malware payload (Formbook)", "value": "c333d07f6983ff6cc18bada5b727562ab41fc2145773353a9c912e9726091bba016e2d3536fca6c6da37ad5d023f8e41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282121, "uuid": "7523b341-24ab-4ee7-93f9-e890fd6e30c3", "value": "T150C4DF3D503C87AFEB47D7B7E434225622F403A62AF293DC8C7A145F7EBA524A1149B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282121, "uuid": "8478e3ea-fedc-4066-b202-ea8c7e3a9dff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282121, "uuid": "361467c7-f331-419a-b63f-e3154aaedab3", "value": "12288:RqTrQaSejL8ZDSGkv9Ne7x/nNQZ1PqbPodlYPZiOU1spom2t:RqTrQaSejL8ZDSGkv2xVkModAZiOU1sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282121, "uuid": "2752a1a2-e017-4656-9383-88a4d91f98cd", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282121, "uuid": "fd7af941-2cd3-4179-a7bc-933654102178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282121, "uuid": "c32ebb7f-0d51-41bb-8960-4fe6d8b6e55a", "value": "Please Quote #070017023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f741133-2b14-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690307753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307753, "uuid": "81755d47-7f3c-4dbc-b2f5-a3de868d911a", "comment": "Malware payload", "value": "63deda3630274e1c47cfbcafa19c50b9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307753, "uuid": "72ddf64f-b730-4dff-908f-6daf4e7a3863", "comment": "Malware payload", "value": "0aa3cce5b1fe80d3de9b29892972b22dbeb61880162d3680516d515770f32b57", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307753, "uuid": "10b77c4e-6a8d-40ca-b372-412c7b9c5a87", "comment": "Malware payload", "value": "74008ce36ddb0788637afa7708627f9ed6fe7a1e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307753, "uuid": "0922eb02-f0d0-473e-a838-fa064fe9bc5d", "comment": "Malware payload", "value": "a81eca174e913737ce4dca9c1ca00526452b67c5fab69349f7c2e8b5542b2ddb08ff36585100a47f43c2192ff4d61b9b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307753, "uuid": "c16c62bf-cb90-4645-8340-abfbc03e335a", "value": "T102D3AE3072D5CA1BD292153008E3D287FE31BDD7DE3581173AAD3F6E6F752A14A4A219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307753, "uuid": "ea12f690-6114-439b-b62f-00dc2a806a00", "value": "1536:jQRjVkrYSBt/iFkm+tfaxK844c47N8vA1ORi0uYKCa0Kqce7U/ReoHnlQly:wGrYChvtfA4x9Em37QReoHnlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307753, "uuid": "19b8bbaa-6761-4b0c-aa46-6d71de9f5923", "value": 140288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307753, "uuid": "532fb8fc-9089-4453-b017-f93abaff9979", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307753, "uuid": "61be9f2a-8baf-4f62-ac59-b6ca95de057d", "value": "delegaci\u00f3n_de_representante_t\u00e9cnico.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fa52d0-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268225, "uuid": "779eb7b1-7407-4f12-ae7b-379fd86ec5f6", "comment": "Malware payload (Amadey)", "value": "77b9fb0f6b8cffbbd74a48c88d728042", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268225, "uuid": "9ce533d3-0b9d-48e0-991e-1ecf4fe48ddc", "comment": "Malware payload (Amadey)", "value": "0b77ecaa1b47f7bc168f30b00531ca8aab8e8a58ed0985de288fe126c3d0fdbd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268225, "uuid": "63fb8b56-42ac-4807-a7b2-d4ac3f669142", "comment": "Malware payload (Amadey)", "value": "7e1942225b08e76d77124f885843bdf679d3c4fa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268225, "uuid": "a71b2b03-cca8-4639-b6d7-6804d4c55094", "comment": "Malware payload (Amadey)", "value": "ec6a218cd3c1894a3a184fdf75db77b65bfee152b59bcb1d06270af0e9a95bd946894cb87ea9c3decb0f619c3b75db52", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268225, "uuid": "864ff368-628e-47ba-a171-e90f09820a3a", "value": "T1A9840203F6D99073DEF52B7058F202830A397DA26D78C32A2742995E1DB26D4E87177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268225, "uuid": "13d4c89e-513a-456f-ae16-d9e429b7a157", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268225, "uuid": "d7500593-7311-4c12-91a3-438cd67114e5", "value": "6144:KXy+bnr+Yp0yN90QEuiMZl8gP007RHr6ppFAwxw9C28zC8FgBZ+t4FDEXo26mWd0:RMroy904HZixtAwxCC3tFgBYCFY01u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268225, "uuid": "3aeb7528-25e7-4709-8016-a472d0dc9d25", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268225, "uuid": "8f657851-dd6e-465e-b0f9-14ed2028c646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268225, "uuid": "dc97a19f-7a00-4412-ae46-0ba626a31dba", "value": "77b9fb0f6b8cffbbd74a48c88d728042.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3b0cd9-2b14-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690307828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307828, "uuid": "f48be6b4-229a-45b5-aeef-bd04f549f41e", "comment": "Malware payload", "value": "235eb4870f740b57392be4c052fb5788", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307828, "uuid": "f51640ca-3d7c-4ef4-8c62-6c46c8a6960b", "comment": "Malware payload", "value": "0c172073c1c65ca9f55b4a5b4286d6a0194e16c496d4696e1333a61b12484264", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307828, "uuid": "2f635aaa-a75e-42a8-b953-eaa58ec5e81f", "comment": "Malware payload", "value": "77f83f11b7de103f0d79e5fadffe3af168e714df", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307828, "uuid": "87849e31-171c-4524-a752-f4426dc8602b", "comment": "Malware payload", "value": "6b058fa54ef3a54900ea4b116ea5211a1cb6dbb46c103b5b8e68d247926859c750a93341e0046f1c2edeb8010111acf4", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307828, "uuid": "f36c2a02-6751-40d2-b42b-c524ddbe7e95", "value": "T111A4AF02BAC1C072D57651300D2AF775DAF9BD20183A457BB3DA1D9BFD70190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307828, "uuid": "7b1d507b-28a8-4ac8-aab5-7d7ed7cb404f", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307828, "uuid": "24ea23b0-83f8-4a69-b1d0-bd194203b990", "value": "12288:dRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/ZO2FDU:dx7cyF2eSsewS8W47eZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307828, "uuid": "729cc6a9-7983-4ca9-812e-334e7ccd99db", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307828, "uuid": "710f70b7-cc7f-4908-90b1-4bb14df3f2ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307828, "uuid": "b8aea02e-985d-42c8-9357-3db57331cf4b", "value": "169030782657027f2fdbdbb9d5afbd7e7028688f1f9fd66253d444eee01252c38102b84546125.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda53ba3-2abc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690270142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270142, "uuid": "44fe88e2-dcad-486d-a1e4-3ba715d3c14a", "comment": "Malware payload (AveMariaRAT)", "value": "7fb7b656772e052782a15149d1ec1a01", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270142, "uuid": "189d242e-d966-4d25-8695-48aadeceb240", "comment": "Malware payload (AveMariaRAT)", "value": "0c477981081bcfab201b14dc0a7529cf9825e13b0957cabbc4b7b2ab6bef7c8d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270142, "uuid": "69830aff-afcc-46c4-9c7d-6790ef2a515a", "comment": "Malware payload (AveMariaRAT)", "value": "6407d4881ca8410ddbd48d12992c862193487875", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270142, "uuid": "ffb544de-b382-43d5-a5d8-43bf65e2de96", "comment": "Malware payload (AveMariaRAT)", "value": "8d99899cb2157cc1fe6d13dc862a2765c160108d98a2e37568951726d8f9797a74d4d28d80d423b82021b95c3280b76f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270142, "uuid": "463cc7d4-f06d-4f9c-aaf5-3fcac19713e7", "value": "T1800523D70188FD7AEBB1273928A0937096131E391F7D864FF28F422A53B774492257B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270142, "uuid": "b01a5850-710e-4b25-ab80-33ba10aabfa4", "value": "12288:I9t5HrOzVIlj2YxrrHYStsKwgdYY0pfQemu5mxEBGDORK79YF1B5IIKi4w:snrOKXr/tjwgd0rmQmAGKt+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270142, "uuid": "6d63534a-e5c0-45e7-94ce-c3134d4c1d18", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270142, "uuid": "4f100423-caf1-4a92-8f3c-1750c7e1d252", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270142, "uuid": "927e4725-cc9f-4bc9-bccf-99e38c34855e", "value": "New Enquiry for Supply..img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698fff65-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690296979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296979, "uuid": "a1de2509-e359-4436-b450-536a29f6d9b0", "comment": "Malware payload (AgentTesla)", "value": "9b659ab9e37c7869688c9b92ec8bfa62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296979, "uuid": "1e6d3364-bcac-4388-8498-631a5b77350f", "comment": "Malware payload (AgentTesla)", "value": "0d2f7e49186d74f6e8a320d41283d88fcd785f4b1e06abd18553ebc14b8c9f17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296979, "uuid": "97b54b3b-e4de-44cb-b2eb-6b5af3bf56f3", "comment": "Malware payload (AgentTesla)", "value": "56af8b5fcbfe1695714c27de8f80a6989b70a286", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296979, "uuid": "faa7a350-6200-4473-9d29-4ad21b6c26f7", "comment": "Malware payload (AgentTesla)", "value": "25e86b33fc593dce619b0b2eb94f4dcd20fff01895cf72086083877e79d5acd7b8007e58bab996d733b8b673f2c09a63", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296979, "uuid": "8734e40e-6cbf-4eba-ac9e-9d663bc90684", "value": "T18475E11972D0953BE163193CEC0B439AD869FD757B34EC866AF42C9C6E28B513C291CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296979, "uuid": "a1852c1e-e0e6-4600-8b8f-84a0480d864b", "value": "ea8d56a6b9f4ce307f716636038657d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296979, "uuid": "10778320-0d29-4639-b0ca-5301e572d4cc", "value": "24576:rbGHGrOrQ9gnMC6LO3cQoikKgti8PM2MCUrTDLwVIf2IOXkDtZ3Npts4bJZ:rbGWAJeDingti8P+TwSNO0n9vJbJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296979, "uuid": "e7ccea33-b707-4ab4-ab7c-93eef9394608", "value": 1595392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296979, "uuid": "493554b7-88aa-4714-9f43-a8666ccac823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296979, "uuid": "634fbfb3-a288-4907-9232-5adaa2d19804", "value": "PURCHASE ORDER 20230117,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3b7a88-2b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690307130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307130, "uuid": "68c8a787-8560-45e7-8cef-0fa0af0393bc", "comment": "Malware payload", "value": "087bde31e4da9c2c22b128bc100922e3", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307130, "uuid": "c3e41ac6-e3fb-4c22-913a-295c202bb4a6", "comment": "Malware payload", "value": "0d4a17711752aa245d338d3615b03711d45ae7cb25933b15e3e69de198731358", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307130, "uuid": "996aa719-d633-4572-996e-3ca1e9318903", "comment": "Malware payload", "value": "4e131c042d96934a1667db3db49d8631e2229017", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307130, "uuid": "462630f1-c378-4443-bd32-b10c4c0fb1aa", "comment": "Malware payload", "value": "086f2cd63e4d92a66dec2d2e26d71fb37a5c9614b3acca69e23a8472c75d6d647dd5899d8468ec2e22927c10d7a89f6f", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307130, "uuid": "cebc70a7-6fa7-448a-b98b-ec34567c4c70", "value": "T18C752210FAD44471E93B1D3906E1AB71AA79BD300B768EDB97185E6E8F304C09F357A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307130, "uuid": "a6ae6902-7aa0-45ea-819d-5c0206c462ab", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307130, "uuid": "b5f193e1-237c-4b3b-bc60-dcd6e19b8a21", "value": "49152:qDkUjjdkimPanic+s2RwKCctWywtGS5RaRW:q4UVkZMTpIntWj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307130, "uuid": "b60e1e45-e625-433c-b085-69ea28005711", "value": 1643011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307130, "uuid": "9b2590a3-c06c-436d-8b98-0ad75dfb762a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307130, "uuid": "44d6b1e0-d7af-49ce-81ca-11521ab8074d", "value": "087bde31e4da9c2c22b128bc100922e3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c02c43-2aeb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290209, "uuid": "906597d7-025f-4527-8994-20a7c49313d3", "comment": "Malware payload (Amadey)", "value": "0bc13a358fd41f038299ed9e54b33a6e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290209, "uuid": "9854a291-b5a6-4594-801f-afa23d4e5c00", "comment": "Malware payload (Amadey)", "value": "0d7fff64497956be537fce8110e2260b6d5e843800d9a95e293933aca5daae59", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290209, "uuid": "29c02fe1-8ac0-4a88-8179-c07cf0dbf3d5", "comment": "Malware payload (Amadey)", "value": "e7fc2a7d365a3bc61b447b0c7ae6cdd5a86b0ccb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290209, "uuid": "c2a12712-e67b-4ace-af9d-c178043cd1c7", "comment": "Malware payload (Amadey)", "value": "469c945e83d7b0f8c80ce22483d38ed519e12412ee47f14d67b8e602d8b90040f2b26c53bb9678186762f69fe46838f8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290209, "uuid": "df90b8dc-7b52-4123-aee0-839ad8cdf405", "value": "T17B840107B7D84076DDF567B008F603930A3ABCE19D68836B2745AC9E1CB22D5A57273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290209, "uuid": "f805a96f-0d92-4f77-b441-e7b370b702b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290209, "uuid": "fe4e7ef7-c9e7-497f-948e-a847e3b4f000", "value": "6144:KHy+bnr+pp0yN90QEUHYKpt2bYNnPQtqHbwHjRrtKE36SfDA3G5NE:xMr9y90uHYU2cN4tqEDRrUEjfJNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290209, "uuid": "f50170bf-6619-485f-a3ef-8193b3bcfbbb", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290209, "uuid": "df50bde0-bc36-4e67-9bc4-617251f438da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290209, "uuid": "5cc7aa28-2bae-4a71-8ebc-9b3f15e7e342", "value": "0bc13a358fd41f038299ed9e54b33a6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9342bab5-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690280298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280298, "uuid": "4d2aaa23-61b8-4fbf-9347-2fa1584f299b", "comment": "Malware payload (Amadey)", "value": "c38e12a56c8660a54003bd3ce5b1fd56", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280298, "uuid": "0479fd6a-387a-477a-b874-b65a7a486c68", "comment": "Malware payload (Amadey)", "value": "0dbb2554653f49d9cf2b3d4b005fd967067e6de7acc721001be3ebd316c20195", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280298, "uuid": "bfba53ec-a840-4274-a9c7-9720eb703958", "comment": "Malware payload (Amadey)", "value": "1b3e536df129386761f3eac64847120aa7676b08", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280298, "uuid": "ef65a67b-1726-4a18-82fd-7e6736ea5b94", "comment": "Malware payload (Amadey)", "value": "887e22f367f577891fb9a85407a594b1e6e7299da53e427bc4ef58d64a61d1be3e3db351698a60dc5783b6f1f2f49dfb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280298, "uuid": "ec577d77-736a-4123-abcc-2308059a9cb6", "value": "T1D744CF2273E0D032D5A759305430C6952BBBB8325BB995CB33A82B7E9E707C1AF75346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280298, "uuid": "957a0145-a2d3-480c-9a1c-cf47f66c8ca9", "value": "41f54a8bceede5b7d9a3e6f46d43695b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280298, "uuid": "3954ba76-9033-4b19-92b8-0c2c8ed6a596", "value": "3072:gjhLcH2Bb0iWvmS8PyhM24cuMAHHkdp579+DVnzZp5XTDqAGBceTIXxrP:NuQbvz8ahscEkdpCzxXT2ZOXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280298, "uuid": "8776a260-441c-4b82-b59e-c5bf5e00c635", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280298, "uuid": "dc8a887f-29fb-465e-ba92-e79e2a8df0d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280298, "uuid": "5ee12009-5aaf-4519-b94b-4270216467cd", "value": "c38e12a56c8660a54003bd3ce5b1fd56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a85bb3-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690282133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282133, "uuid": "993272cb-02d8-4cdd-8ef3-a460b995dcf8", "comment": "Malware payload (AgentTesla)", "value": "c937a0bce7d0be5a457e366d94d0d003", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282133, "uuid": "3289e928-57aa-4946-83ba-578853f2d778", "comment": "Malware payload (AgentTesla)", "value": "0ddf3c3d48b974744fc636fcfe64371467cdcf806a2834376f266020807f5cd9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282133, "uuid": "f6536d2f-73fc-4ecb-b497-1bdd420ebf1a", "comment": "Malware payload (AgentTesla)", "value": "db3cc6e1a308a5c5e1bad75dad4bfbe7c8b1b410", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282133, "uuid": "184a9336-9cb8-41d7-bed1-fe331735d4e6", "comment": "Malware payload (AgentTesla)", "value": "512d08af6ca0462525f693c7aa0eccc8c0278cfc394bd57800b957c681b8fe1c2e449facc6573cd7659a47830b43bd7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282133, "uuid": "e4f58791-ca0e-4c11-ab0b-bb774f6ef80a", "value": "T1E54533766513CC47DC212EB15B21838FAE94F77C7474DB6AAF5027782D12210AEBEB09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282133, "uuid": "b8878332-fb8f-4817-98e3-44915b146a8f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282133, "uuid": "8299e42f-3238-4c26-8e1d-7341f62d4a5d", "value": "24576:PYap7pRLyK7PU8HdK0NvPaO8IuBoagIw9FAUE9Ojep0qheWuzt:wONRLy0g0NXaO8JBoaWAkT/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282133, "uuid": "f5cc5e77-a414-433b-910e-475e761dc066", "value": 1205507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282133, "uuid": "808e8c78-aa4d-43a0-b2e1-2b57e1e21758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282133, "uuid": "3c4abd82-b7b2-4be7-b1e6-56710d9281f1", "value": "Shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18ec450-2aee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1690291543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291543, "uuid": "4be7a4de-d571-41c4-978e-92256ad72aea", "comment": "Malware payload (NetSupport)", "value": "bfd7a68a151e81eb6f7fac7356bf5320", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291543, "uuid": "c42deb66-5a12-4c03-b632-25f9dbcbf1fe", "comment": "Malware payload (NetSupport)", "value": "0e74d799e5486979f7cafb3c6bbd8fab224f882b82197eb8975818bd61cbb667", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291543, "uuid": "88bc9398-ca39-4eba-82ff-3e1356cd83a7", "comment": "Malware payload (NetSupport)", "value": "11aeee07c2022179290fef689da9a1c196fc0548", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291543, "uuid": "79f63370-e404-4d7b-92b6-d070f66c7cc5", "comment": "Malware payload (NetSupport)", "value": "b0781442a1f3fbf52c74a97ff486efaf3a753b1738dcaa8649b2ef4ee828bd2aeafde3f3a0850b46c1a12f9ca90fd268", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291543, "uuid": "16f01465-6493-47e5-abeb-bcad0f11b9a2", "value": "T19145C934397A7C2443DBDA1334F14A961CED564FD5703A3B1A9AD8239A342C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291543, "uuid": "5be15238-6dea-45af-97f6-ece64846757b", "value": "3072:/IZaUwEhgIiwnBoK8nLZH3FxXHXyQJw14kb:/IZa17IiwBoTnd3XZJw14kb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690291543, "uuid": "7ec33b40-45c1-4013-a546-4a6303be45a9", "value": 1259881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690291543, "uuid": "78bc1150-0e4a-4417-bf92-e21791700d4b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291543, "uuid": "dca43a6d-7fda-44cd-909d-22655651b0d3", "value": "XVXCSASD.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d4f91f-2abd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690270241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270241, "uuid": "5dbd66e8-8ed7-419e-9067-ca609ebb5170", "comment": "Malware payload (AgentTesla)", "value": "fbe5a2f3ea2e2cdf2af388564c4f33cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270241, "uuid": "f739b595-1e69-4392-957a-70d69554da23", "comment": "Malware payload (AgentTesla)", "value": "0ef8f46933f6388ca0374cda300f534802a54343ecade5f00d9cf2f9a6485638", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270241, "uuid": "1d716f6a-8086-440f-97c6-76ca5b4b6590", "comment": "Malware payload (AgentTesla)", "value": "638fe2c8aa837e20966e2fb1166caa38ec85c387", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270241, "uuid": "bc8fc099-7dcb-493f-8f29-e57d7894133e", "comment": "Malware payload (AgentTesla)", "value": "f437a4d4b30554f393baca77148631f19ba625c9eb53c7dc71e98846c9263961adee63b24f44f569da679e61ac2879ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270241, "uuid": "e60d422d-9fc0-4692-8390-d7e6fdf36415", "value": "T114D4AE2663946F4FE1BE77F891A1181483F6E65B2620EADE3FD711CD04E9F04C794A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270241, "uuid": "98c4e86f-3779-445a-a8ee-b4efa06847d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270241, "uuid": "ca658fe3-3522-4cf2-a07f-63f143d66d03", "value": "12288:SyPrGwKTAYc/A9SD0Lh3zAkUBnoZmYGrKatri9IMW5EL3:Pk4AVV0OZArjtrTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270241, "uuid": "b711f382-50b3-4918-9afd-080bce00564d", "value": 636416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270241, "uuid": "8c7a93e9-0b25-4626-b640-d6d68f9ea84c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270241, "uuid": "f835d2e6-1059-4024-b2d6-a91a73c4854c", "value": "payment slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5adb59d-2aeb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690290208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290208, "uuid": "11912d85-a49c-4e47-ae96-a9bed424e82c", "comment": "Malware payload (RedLineStealer)", "value": "06f297d5ab72577e710d83ca33856c0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290208, "uuid": "9931b0a6-29c7-43d4-bbc8-6eb103231cb9", "comment": "Malware payload (RedLineStealer)", "value": "0f59602b9c30561c8409f0d4ae9d5e9f6398ff2ce894561b7e3b40aa49cd2a0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290208, "uuid": "e4177648-a9a8-44c2-854a-1d2568d340fc", "comment": "Malware payload (RedLineStealer)", "value": "12103c0f8381b4ef71553d6dd2c4c3594884c530", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290208, "uuid": "e6134bcc-9b7f-4dd0-84df-df8b46e3bd3f", "comment": "Malware payload (RedLineStealer)", "value": "6d1020ce3cf5d5346d5121cd137eb7cd442f5a47944924dae362c8a787f7e4230d1365398a9913905ddd540d68a60c9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290208, "uuid": "11b51574-e7d6-4794-bb4a-375089d7fa2e", "value": "T154840203BBE89433D9B92BB048F602D30B36BDA55C74476B2749A94F4CB25D4A43177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290208, "uuid": "3b3e2d18-8a29-45b7-9ed4-42d6c2392cd8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290208, "uuid": "e30c9f22-dec8-4808-b78d-351b04f5fe31", "value": "6144:Kzy+bnr+5p0yN90QE/T7pEQkWGjZNJ5p794GSY2ctdkpC1NU8t2fM4S:hMrdy90t7S3rH2ctACzF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290208, "uuid": "d93d6a6d-d536-4c82-883c-a4ffc4a88d81", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290208, "uuid": "964352a5-424d-47aa-bee8-606cb6e7e484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290208, "uuid": "667403d7-e148-4b85-8d24-14c9520fac65", "value": "06f297d5ab72577e710d83ca33856c0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a9b9ae-2b05-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690301425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690301425, "uuid": "cecd75db-3208-4f43-a652-dd1ae0ca980e", "comment": "Malware payload (RedLineStealer)", "value": "8696bb34fddaf1d338147db72e37588f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690301425, "uuid": "a445b6b4-dcab-4b7d-adb2-4dd6f94b708c", "comment": "Malware payload (RedLineStealer)", "value": "0f74da845911ba45f1443411cf346c15a9b3910fe9b65943439e8cdc4c2f0fc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690301425, "uuid": "25c0709a-1604-46be-850c-fa2c15c24ed8", "comment": "Malware payload (RedLineStealer)", "value": "9e6b36391fd14e78787b79a0ba7932d77f7042f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690301425, "uuid": "f4a1f808-5779-4381-b1c1-1efea020ae22", "comment": "Malware payload (RedLineStealer)", "value": "9e98c4cb004babf02fa0b2ac9041ddd52ac0295d5f426d6b4405103ec93afc6684e88b535df7e52bc2d694e93b85a19c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690301425, "uuid": "75c2206b-4435-419d-955a-9919952acefe", "value": "T19774E0117590C072D067AA311870C6A21A6BBCE39B3486CB73983E3F7E726D05B757A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690301425, "uuid": "d890548a-5d8e-4b40-beb8-ba1f09071cc8", "value": "21f576cdd9781dd6a4a8eb3639210862", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690301425, "uuid": "91663398-da6e-49b4-adf3-ad8ac22e6d21", "value": "6144:4P+GUgZyu41gX5iZxd7C3lU+xJTo32VTucs2S:4GG7YuKgI7C3O0To3IjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690301425, "uuid": "91e4e61b-1906-4b70-a4e3-1b15122dcafc", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690301425, "uuid": "8ff9b040-a9e2-4a00-8aef-91e2519e396d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690301425, "uuid": "005013ab-3f00-4a5a-a556-63fbb8840b9e", "value": "8696bb34fddaf1d338147db72e37588f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4198805e-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290469, "uuid": "99b6b67a-a4ec-49f7-a3d2-72d5b364b3a4", "comment": "Malware payload (Amadey)", "value": "61851f50c158cd9fcc18c48feffee95c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290469, "uuid": "2b5be952-1027-486c-a93c-b0953f2eec1e", "comment": "Malware payload (Amadey)", "value": "0ffce302b861da891640dc77cd56a5dc8949895381a445dab72f14f76999784a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290469, "uuid": "c6359694-4602-42f8-8eac-71184606bc56", "comment": "Malware payload (Amadey)", "value": "f9926f92e902278822d4e8cc96ea0ad60df70fea", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290469, "uuid": "c0f86aca-895a-47e9-8f0c-8fa5cbd47d38", "comment": "Malware payload (Amadey)", "value": "0e4892bf5e3edfd3a2c45eab64a830b1b88a137d1966fe5f4f7e9415156acd49db9311c700a6342889edbe8b5083d66e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290469, "uuid": "5b9c343c-2b49-4e84-95d3-80e9f0d40532", "value": "T185B41202FBD85072EDB117B068F702831A367DA21D7447577785999A0CB3B84A871B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290469, "uuid": "885323e1-cdbb-4ad5-afb6-f0f096d55260", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290469, "uuid": "6dc4cbeb-5e05-4ce6-a6f4-3d158678030d", "value": "12288:AMrry90FXrxLoTcDl8UEJOwXdRVr3qmVRhSNF4+1uRte1:by2b9ccZ8UEJ1NvdA8+sRte1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290469, "uuid": "f15c0783-8b3a-4305-83d5-4fc23f74b89d", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290469, "uuid": "9c428c49-4d70-4c61-b122-4b424e4f8b2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290469, "uuid": "f471f720-c869-4124-9a04-b1bb87865a1e", "value": "61851f50c158cd9fcc18c48feffee95c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a972fc7e-2abe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690270887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270887, "uuid": "eac688ae-10d2-490c-869f-cb10ab24a3ff", "comment": "Malware payload (DarkCloud)", "value": "abfb9a130697d72c080b9611d6ea9353", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270887, "uuid": "c235018b-6070-4d9d-bdf4-babab4aa89c9", "comment": "Malware payload (DarkCloud)", "value": "1011a1f84416383bfa9241516964b0d06ef81709b95677334fc65ff7b0323cf5", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270887, "uuid": "ff7d8614-3817-4d70-978e-cb0cd44b977b", "comment": "Malware payload (DarkCloud)", "value": "55eb6679cc759ec4c56e2049a63873a261f1ee99", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270887, "uuid": "2447298d-c987-4520-86a9-72ec3f00b7c5", "comment": "Malware payload (DarkCloud)", "value": "01f9ef0fb5ed022d3a11612f6457a45a1c9bd4896f33b17014d3fb625c79cfb5b8bd1678521d16db7b1bf9bf46bf5da9", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270887, "uuid": "5227eeb6-a091-40de-9097-2f0d11e766d5", "value": "T1986423143FE1D9B7D9F246722E39A793EDA6933A1074570F8B901D58B1622C2D90F3E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270887, "uuid": "a3e7090a-9b02-4e17-b6d1-acfb46d6d3ee", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270887, "uuid": "ab1647ed-70c1-43f7-b5e8-401cfaf9f9ae", "value": "6144:/Ya6CHF1HCJfL7UrQlxEXTdCte4+Tt3/mENe2VkHMOJ:/YEl1Hkj7U8XEJCteJx3e4iHMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270887, "uuid": "2cad282c-5464-4d61-8470-bd19d92048db", "value": 331652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270887, "uuid": "f2035c91-3f47-4537-8c98-195707535685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270887, "uuid": "ee4431ea-af8e-4d57-a517-6f7e8e89f9b6", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a438e0c1-2aed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690291064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291064, "uuid": "519e820d-68f0-469e-a571-acabaffb9d2f", "comment": "Malware payload (AgentTesla)", "value": "bf784a95640e931e1cc1827fa972275f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291064, "uuid": "6bbe2c5f-b6fe-4c69-8bff-2116715c099f", "comment": "Malware payload (AgentTesla)", "value": "113633cb4d3b7411d428d5a0dc9c10a9d2d6492e3578101488d5f3b3091a9f77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291064, "uuid": "23a166af-3061-4893-8ac9-56a0ef339ef0", "comment": "Malware payload (AgentTesla)", "value": "54e54c0004da2630e3c2fb77c14d20f42e5b9677", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291064, "uuid": "ae99233e-85e8-4dff-8e22-278081404aca", "comment": "Malware payload (AgentTesla)", "value": "3ed2dad951afa1a40ded74d00f5ea83cd0cddd0ef3fc15aea8b2f6a3014d508fe1bedd878e3c05bbc57399e34224d125", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291064, "uuid": "a7417f7f-f2b7-4384-b9e1-ba641ee92af2", "value": "T16B833902BB995134D95C873BC8EBE5002633A94178F7CB0F796E13895B733D9CA4678A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291064, "uuid": "d755ebf2-2055-466e-acfe-06e444af9ca7", "value": "384:S4gUdmYFG/Gj0MOHpJIzcg2g9Hxx/cCK/FhM8TaiWimL/qgH7FdB77aRd:Skdml+jMJCzj2gzxkCKthhgSg9ar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690291064, "uuid": "e49e2ccf-8734-4ca9-b7b5-755d0d2ab21e", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690291064, "uuid": "33f04f93-9289-41ef-ab27-34cbab21bf4a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291064, "uuid": "0caa05c0-ad95-4be7-9e35-d4e17a5e352f", "value": "Kopia pliku Aptiv Supplier Basic Information Form 2023.xlsb.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d540ec-2aef-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690291651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291651, "uuid": "a02a7a70-f51c-4fe0-b9a6-5e7f689633a4", "comment": "Malware payload (DarkCloud)", "value": "9b281abd93f1ea0b1d246ebc7aad1169", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291651, "uuid": "3dbfa7ac-2e83-4257-b4f2-f502dd662c5f", "comment": "Malware payload (DarkCloud)", "value": "11592500f755d82318d47eca784ea07ae649253a8655687d1c61f852f9e9eac9", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291651, "uuid": "c7882f86-8c8e-40ee-b4f0-fb085ddd8671", "comment": "Malware payload (DarkCloud)", "value": "fbb53ae0a3e756d71bde5875a9d354f5b97848f7", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291651, "uuid": "48ac7cd8-f768-438b-853f-380cc7de5e3d", "comment": "Malware payload (DarkCloud)", "value": "328e3eded7683a5b9a916235e35dd1354d71127314e2d90dcca20af5b516ad5c98c3b90650baf01de5c66f15eddc13d7", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291651, "uuid": "63a7f54c-3563-4c89-9292-a35079055718", "value": "T18C35022036B99F57C5BA8BF98420327013FEAD9E6439D3196DC370DA1976F848A11F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291651, "uuid": "43c19277-807e-43c8-9a97-df2833695a74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291651, "uuid": "157fb2bd-f25f-42b1-b45f-2c1ca7490224", "value": "24576:dxqFHIcTrGCSPiCADt2cwO7hPpaLMkgzWY5cjdvFU3la+C1+nV8jDH7:7qHIkrzSqCAZosBpaxPvGla+C1+nV8jH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690291651, "uuid": "5cb3a241-dd4a-42c4-8540-69ccfdb5f404", "value": 1107968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690291651, "uuid": "23c2c270-237c-4d17-a5cc-ab66aa723946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291651, "uuid": "e0e74776-97b3-438e-9bf7-fbf3641dba08", "value": "Costco Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fb56cf-2b14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690307742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307742, "uuid": "c0319c3a-bd67-40d9-a6b9-265782a9a7fb", "comment": "Malware payload (Formbook)", "value": "6f42aebfe381bc4ddb80eaec97dbbe2c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307742, "uuid": "a5446e7f-da7a-4d33-a080-d306cf5da022", "comment": "Malware payload (Formbook)", "value": "11e7ffa53cdb57a6d71399a74efd26bc674d03d67a8b6dc75464d2576c687564", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307742, "uuid": "410d3ac9-2a9c-45cf-87a7-9fb310a367d8", "comment": "Malware payload (Formbook)", "value": "d345a079bb897c235559e679fdd8e1388a43a8a4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307742, "uuid": "488d40fc-9aa8-467c-883d-07c1cdf6d0bb", "comment": "Malware payload (Formbook)", "value": "0621713e6ecb679609b853150dfe375fe70e50f6053281b302cfd9f9b75183fbe6f9c31bbf50d4912c8123afd6ebfaad", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307742, "uuid": "0e339df3-dcea-4417-8b5e-de36b518ebad", "value": "T14F13D35AE79F1268CB410373271A5E889ABDB23DB35150B2785C833433ED87D46A66BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307742, "uuid": "f7ef6c9a-ad90-4b1d-bc98-c70870c78281", "value": "768:TFx0XaIsnPRIa4fwJMB7Gq1sykUv0lyt6yQM92/BEQoqacBmU:Tf0Xvx3EMB7L1sy1v8yQMk/PTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307742, "uuid": "5e948142-54d2-4eea-a01b-acdb11ef6366", "value": 42269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307742, "uuid": "788cb30c-5cc4-4b12-adcc-05749679640d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307742, "uuid": "576808ea-aadd-4a41-922d-3661d1dbabc3", "value": "6f42aebfe381bc4ddb80eaec97dbbe2c.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1895f80a-2b1a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690310157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690310157, "uuid": "d3c47ba9-e105-4084-b4df-c798846f5f6a", "comment": "Malware payload", "value": "455f0aa8494246196c4831d75ef43f77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690310157, "uuid": "d227761c-a301-4175-b379-1de04de7bbf8", "comment": "Malware payload", "value": "1257726baaeca6e8c000406ceaba2ec70fa53371d331f8e6b39bfff8bb0a3a02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690310157, "uuid": "2bf3b61d-c89a-4346-9fd9-246fa915cb4d", "comment": "Malware payload", "value": "995a5470e23ff05abb858bb8835bbfc3c4893386", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690310157, "uuid": "845c7abb-1266-4073-a935-fb6f3698e313", "comment": "Malware payload", "value": "b36719b42deb9b661717e7c32497cc448a70b25f5d2bf055b832337af687e1654a46c9d60cc07f151c0762f627fc24cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690310157, "uuid": "2004a44d-21af-4c87-9028-b428435743e2", "value": "T18BE4F01372EC46C7D0AD1EB52C55F30C0AB6AE665521DE096E89FACA5C3170215F3A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690310157, "uuid": "9302b1d4-e035-4054-bee0-51a4b5dc7f58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690310157, "uuid": "e703f77b-ac71-4f62-ae7d-7370741db402", "value": "12288:gXPZwn1kTm1zuBZWgODGW8gJWdTk+1XkDIjG96MdF59tJCf0xDvdKHAEQ:7d1zuKGWoRkDkU6ellt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690310157, "uuid": "79e8c302-8876-47da-b3c6-f83c877ba2aa", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690310157, "uuid": "26851c97-7e5c-48f1-9037-d804b4f377a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690310157, "uuid": "65379489-0faa-46f2-98a5-9eaa841b691a", "value": "DEL-25-7-23 COS-HWB NO 65534423333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8651a7-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268830, "uuid": "d1333bb4-406b-47b2-9eda-8864b9069652", "comment": "Malware payload (RedLineStealer)", "value": "ec2d0294e4a433e7e403294ce1c957ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268830, "uuid": "d376045f-7425-4faa-83b7-a1f816d11c42", "comment": "Malware payload (RedLineStealer)", "value": "131037a8fa91c68f31437c0f40ecb3568bbe8a4c089e80493cd699a6ce37dd4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268830, "uuid": "379c47d9-e27d-482f-9ec0-9408a3f8e491", "comment": "Malware payload (RedLineStealer)", "value": "bbb32ad10357264e059bbcc2bc0e91f84cd571f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268830, "uuid": "333b804b-0d00-44fe-a0c7-baa5bd44904b", "comment": "Malware payload (RedLineStealer)", "value": "82489d23d8b74c4507e2f96cd7f6c35c304a2771b4cc90d68b5d3342de0b0bd20fbabc9812e8e9fc543eee43242bdda3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268830, "uuid": "a29d0d9e-172b-427a-89d4-0a7561917cce", "value": "T11FB41267EBC49072CDB91B7098F602D70B327EE19D7882673389685A0C71694F572B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268830, "uuid": "410463bb-6607-4eb4-8a48-19d338c56719", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268830, "uuid": "cf82c7bf-458b-497f-8aac-04a388617cb8", "value": "12288:tMr7y909oRAal+25SbOZvCNoLGxvoZdldeo812VN7Z:Kyt+d6MNomoZdGo812T7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268830, "uuid": "e9d3dc56-093e-47ef-9ea0-7e6be19e4abc", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268830, "uuid": "80c0f146-b58b-4995-b112-c51dc859b086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268830, "uuid": "931f96e5-613a-40eb-aa2e-9f9b21c121dd", "value": "ec2d0294e4a433e7e403294ce1c957ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5088eb5a-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690296937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296937, "uuid": "ea71769d-974d-4ea8-bcf0-7cda0ccf6644", "comment": "Malware payload (Amadey)", "value": "a8814c642cced37e42fd90a44252d3a1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296937, "uuid": "7a865301-df89-4200-9a27-94dfb817da04", "comment": "Malware payload (Amadey)", "value": "13812881f297280ea08b6d7f86663c9a3b6f672a06fe8282eecc92d220dc206a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296937, "uuid": "0381161c-4a23-491c-997b-9df737f8c9fd", "comment": "Malware payload (Amadey)", "value": "c30919046e929581ba3ac594d748199dae843c8a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296937, "uuid": "2eee9c7d-0fce-474e-b685-31ddbad855c8", "comment": "Malware payload (Amadey)", "value": "6c0066257e405b03acc9943b7941cd8ba953cfbf019e62441c57461aebe7c898b129f641e609f01e6cfd1f869addd89b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296937, "uuid": "abb3976a-2857-4a36-b647-9f08ee6cd8f6", "value": "T1A844DF1233E0C072D4A395305970DAA15E7B7C726B7485CB37682A7E2F71BC05B7A3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296937, "uuid": "82ea68bc-a95c-4be3-96ca-d7d62a6a3b17", "value": "325ed12d4ca9489275d8c828d6bdf65e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296937, "uuid": "370a064a-1bf7-496d-a371-e26c863a6ebf", "value": "3072:Rr0dzc/UtsFjQ59bT2QXwPRLapKKPDLXGIuQKsyoIIl/8td2bm:udzHtSjA9bTBwpLiv7GQuT2/kgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296937, "uuid": "3cdb1db7-929b-42cc-8ef4-99de28a1e9c5", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296937, "uuid": "81ee80ff-e3fd-4003-b91b-a16bbf766185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296937, "uuid": "7a89c08c-67b1-4b0e-99cb-7fca4b2968b0", "value": "A8814C642CCED37E42FD90A44252D3A1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475e8e72-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290479, "uuid": "8bcee700-20cc-483e-8856-ff48e025b7d7", "comment": "Malware payload (Amadey)", "value": "7f3043691912e030e6d1891e42d32202", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290479, "uuid": "a809f254-2935-480f-8364-840f6785b2db", "comment": "Malware payload (Amadey)", "value": "13cad833006158f4aba033ea75b6d95d03e640f1f0aa401651db5f7b370c2258", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290479, "uuid": "02363ffd-5677-4dd5-97bd-3337953bfbef", "comment": "Malware payload (Amadey)", "value": "8b3be13102aff5a4ccfba68148fa63370790e36a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290479, "uuid": "0664468a-8aec-4be7-8473-d10ad7f278e0", "comment": "Malware payload (Amadey)", "value": "732fb6fbe4c22c7d31993cf879dd1e807d681a8257284f973de64809e0be2ba167017eb1feb183376dfa2991c72e9501", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290479, "uuid": "bf0d8cae-225f-494e-9e21-c82a3e922ec1", "value": "T1802408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290479, "uuid": "8313ca34-a6da-49c3-a802-2a3090632bf7", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290479, "uuid": "33001dc4-4090-4d89-9401-77542a6c5fa7", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290479, "uuid": "13c2e9f8-58a4-4075-9f57-4d7f83f17a9b", "value": 229562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290479, "uuid": "d050722d-d9fc-4766-b7d9-25a08dba73f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290479, "uuid": "a6afbb37-e609-4c89-88da-7fa7baa5b743", "value": "7f3043691912e030e6d1891e42d32202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec7600b-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690296907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296907, "uuid": "ad8dca02-9a85-4e32-8687-0bcc9d6345df", "comment": "Malware payload (njrat)", "value": "15c8d0e49014bc1736943425850cd78b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296907, "uuid": "e8a50f34-419b-45f4-986c-95ae23dc4647", "comment": "Malware payload (njrat)", "value": "13df7c5cca78d63aedfe61f3b18a99da2767d731818d918f2c4d9f52b6187bf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296907, "uuid": "8f98862c-5496-436c-a2a8-022eeaabd014", "comment": "Malware payload (njrat)", "value": "9e4cb5c1aaeae437b843e65d6fc98df424396db1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296907, "uuid": "9bc2caef-3bb7-4f5c-9d5e-b55726495191", "comment": "Malware payload (njrat)", "value": "cc874741ebe840cd9960af697508dd5c8ccfde4cb31d8281bb65665b272a9ce7e4db5c53090071bcb8a05fdadb9dacb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296907, "uuid": "bbb9fe88-9ade-403d-b510-3671f4b2b351", "value": "T139032A4D7FE18168C5FD067B05B2D41207BAE04F6D23D90E8EE568AA37636C58F50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296907, "uuid": "fd4ed5ec-b8ca-4579-96bc-7b03da885312", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296907, "uuid": "659760be-af77-431f-bc5a-b800ee4d1fae", "value": "384:8S70qi0TJZtbH9KyM+2Xzmk/Lus28rprAF+rMRTyN/0L+EcoinblneHQM3epzX75:xXJ95M+2X6ka189rM+rMRa8Nuxrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296907, "uuid": "b9451ba1-c163-4dd2-af97-23d329d6e2a0", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296907, "uuid": "23916820-e2e3-415b-be4a-1651e67dc1a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296907, "uuid": "ac4f7e98-9bda-4b17-84bc-fa2d3e275fe2", "value": "15c8d0e49014bc1736943425850cd78b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d076a5a8-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690282119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282119, "uuid": "47eaea03-f96f-4d4b-82c6-e8fa916da897", "comment": "Malware payload (Formbook)", "value": "505aa91404265a867d9ff47652ab03bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282119, "uuid": "e7414b23-8f3f-48b6-a249-1598bf57d1fd", "comment": "Malware payload (Formbook)", "value": "1434b391d1b8e5369395173e021878dee61f4269e7e758102c430bb047cb336b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282119, "uuid": "7c1e44f0-1139-48ed-be28-b9fc7e624e27", "comment": "Malware payload (Formbook)", "value": "04f102bf9b37c75925b813a0a76298165b40c616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282119, "uuid": "aa475827-d2e5-4e19-840f-4ed2eaacf27d", "comment": "Malware payload (Formbook)", "value": "a6d9feb9b7f2bcb5913b891cf051d5202e5216caf397f9596804201ba337659d6a49173eb8a206ca0b20750878b6e030", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282119, "uuid": "4db26562-8b72-4439-87a6-e90b7b6342b8", "value": "T108F42261337E9D23F2ACFDB54BA065481372A6946427D3CDDEB2408A0DE67C0BE509DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282119, "uuid": "6f7b4711-b444-435a-bb84-8385c1b738a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282119, "uuid": "f2178967-3455-477c-b429-4b519e52240a", "value": "12288:pQvJRBusy9QoSaSMCh0THY49ha7AKwVZUwSeAuJaFweb/:AFu2aSRy/Q7A/ZUaAeaFLb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282119, "uuid": "8e675c83-1b8d-4afc-b6ff-3d4830bb0458", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282119, "uuid": "4581cc30-4caf-4e07-b521-a13212b89b24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282119, "uuid": "831374bf-8aef-4035-95ca-0c38569fac5d", "value": "Our Purchase Order(Quotation No Q0000043527).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67b8756-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690267875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267875, "uuid": "19a1cc41-e7b2-4cd3-a95a-a36cb5c752c4", "comment": "Malware payload (RedLineStealer)", "value": "302c8027c8728a76aebbdaa358bcf27f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267875, "uuid": "be6583de-ca8f-4da5-a00b-fe43e24da223", "comment": "Malware payload (RedLineStealer)", "value": "143e14de3ab20f2359132907b991db6a76d0d521ba132b83a736d149619409c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267875, "uuid": "f0f19460-655b-49a0-ad7f-38beedca1bb0", "comment": "Malware payload (RedLineStealer)", "value": "b377bb11e4b31fac3779736dafd77d3930e68349", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267875, "uuid": "c75b6596-3811-4c7d-b42e-9a3510ddf9a3", "comment": "Malware payload (RedLineStealer)", "value": "205a7a43e50291fcb7bb564020e1915b10207a616857c510a80131f3b677beb3cf8bd0ee50fbf4ebd6021729952dc76c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267875, "uuid": "9cf06f1b-0bad-445d-b590-048b5071ae61", "value": "T1F6840253B7E88536D9B92B7018F702C30F36BCA0A97943AB2355995F0DB36C4A47173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267875, "uuid": "6cae04ab-12bb-4fa3-9dab-744709afb215", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267875, "uuid": "489ffae7-78bd-4985-9565-af2d5dfe3c6b", "value": "6144:KBy+bnr+6p0yN90QE7f11dRzGQkV6oNImWSzVGBmIqS8a0lCG:rMrey90lf1zcQkHNwSzAd0YG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267875, "uuid": "bc6e6a84-5997-4cf6-88f4-b469d9d4c386", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267875, "uuid": "f72c5990-ace7-443f-a3d1-3b01fbefb5a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267875, "uuid": "77279850-f291-428d-bdb8-97e8f3102db8", "value": "302c8027c8728a76aebbdaa358bcf27f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45607ad8-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1690296918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296918, "uuid": "f1158439-48d1-40d4-bdf2-4b1e8aaa4eb4", "comment": "Malware payload (DCRat)", "value": "03dfb82798b51c1b9acbaea8e7ebe8b9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296918, "uuid": "34d35a65-a59e-4a17-95f7-f95c89f36fac", "comment": "Malware payload (DCRat)", "value": "1459c0d3b21302701c9ca344942daaaf1f3f4b8d03037d8e7571f599e11b0148", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296918, "uuid": "f69b2a2e-d924-4e13-b7c0-eb17e253dee1", "comment": "Malware payload (DCRat)", "value": "a9528056f95681f3bcf6864686ecbf15477f0cc7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296918, "uuid": "4f4faf1a-ef00-4773-8bf3-a49229dba550", "comment": "Malware payload (DCRat)", "value": "b76666e56e41b561f73ef699a3cd4b902700c4528549640cb6c989e320e8e9f2e297eb721be9ef89cbbeaa21a1156ee7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296918, "uuid": "057920be-9900-47da-8bbd-b13b983834bf", "value": "T14B5633077ABE6A1DE4CB8934148D0B0ACCB608DDEDEF146F935E319D8BC205A5E918DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296918, "uuid": "748f8f27-13c4-438b-9a07-7e9ea42524ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296918, "uuid": "353de31f-109f-4f52-88b5-f67fe1187192", "value": "196608:s3W0SsgDGOUQw+p1/1W3F4tLkEcswfe/cQ1:vIOUQw+pVc3F4pKswfb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296918, "uuid": "92a96cf6-2745-4db2-867f-5f0ac68ca272", "value": 6436352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296918, "uuid": "eec12c28-edfe-40a0-b662-f15d6f35960b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296918, "uuid": "56427af7-92b7-4172-8cff-afacf23993d4", "value": "03dfb82798b51c1b9acbaea8e7ebe8b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65afc4d-2abb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690269673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269673, "uuid": "4dbaeb4f-93e1-40bd-9a18-e3389174cdaf", "comment": "Malware payload", "value": "35c88f680467ece743c97d4881b1ee0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269673, "uuid": "82882c68-c3b3-4cd1-8066-09bd7f0b987d", "comment": "Malware payload", "value": "1486569f25d01a055597e00b03356fa65456d260eec1533600b7d6d6ad494733", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269673, "uuid": "e6c92c4c-94c6-4030-b354-6f1f5067b249", "comment": "Malware payload", "value": "7fb0d9069b25e4d6964e0f0a1c2e5cc149d4d1dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269673, "uuid": "ce24a8eb-5e95-48d3-a5f9-addf7fea58e2", "comment": "Malware payload", "value": "6405b1a16d52f32c987a33a92ce6be87924cdd0906ae1a29e04ef7d1b4298bbbdfa32bfb2df1b5684f476bed59e9ea21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269673, "uuid": "6c99e6d0-a6eb-4295-9087-e0adc5612a69", "value": "T1A185F12B7FF5548CF9F18BBE199A5706CB1AF1631803B75AB343A2270C17648EE890D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269673, "uuid": "86655fce-7629-4f1c-9ee6-5ae0452d8b34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269673, "uuid": "03be8b4c-6549-4ea7-b2d6-ef3fc204bce8", "value": "49152:17vU4RPv5Png3q5JbDFaDJxZar3eEWD8Hj:TxPg69cJ3mj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690269673, "uuid": "3b78d1cc-9c26-49c4-a981-e86274a67a47", "value": 1838721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690269673, "uuid": "355b2ba8-c01f-41b2-98e9-65a85cd91784", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269673, "uuid": "07d8f0fd-1204-4f50-8e4c-e851fcee9794", "value": "Chalenge (Chalenge RUSS AUDIO 2023) russkie film (2023) FULL HD VIDEO 1080p Free torrent RU AUDIO full HD.mp4.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a282c5-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690267877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267877, "uuid": "ad43ada4-7ffb-4560-a6a1-960b4c937b97", "comment": "Malware payload (Amadey)", "value": "0d434e854b2eba6963bfb7046dc55424", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267877, "uuid": "68c753d1-8cb4-49ff-ab1b-34496e617414", "comment": "Malware payload (Amadey)", "value": "14a110b7b69927a416ef2dccd8a6dccfe99de4f84b63029e016ac5d3358a6d4d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267877, "uuid": "6c02de5e-53ef-48bf-ba94-2c73b8162802", "comment": "Malware payload (Amadey)", "value": "3bf24cb9f004529d27ef22e3518a73ce57e7af38", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267877, "uuid": "fc91ec5a-de11-4b8d-8b7f-8cc30bf6a343", "comment": "Malware payload (Amadey)", "value": "f485903bb45e0c8c1699a6a1be97f3e809fafeb3ad093b9f9f71daeee57d6ecefe738785e475ab7184676919ed7861d3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267877, "uuid": "9e1458f5-5479-4e9f-b8a0-41ff1ba91648", "value": "T1B62408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267877, "uuid": "7500b1b5-170b-4d72-94a5-45453aeb91e2", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267877, "uuid": "a867dc38-1625-4ead-9c89-82750c930f22", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267877, "uuid": "2cf5d470-8b8e-43b8-972b-9415c5bde80d", "value": 229290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267877, "uuid": "99bb3a0f-e2d6-42e8-9b2a-50b69cc195a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267877, "uuid": "30e0022e-c5ac-4468-9013-e46c741e38b3", "value": "0d434e854b2eba6963bfb7046dc55424.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aaf8b96-2ae2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690286163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690286163, "uuid": "ceaba340-eefb-4465-89ef-3a255becafec", "comment": "Malware payload (RedLineStealer)", "value": "a6134b25ed19ccc3b9aa0f517aa71480", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690286163, "uuid": "c2162414-843d-498b-b607-c694728c3c43", "comment": "Malware payload (RedLineStealer)", "value": "14b35e6e0894fbfbfc265b48fc6d8f9c63dd4a382f73447b8f7b0b7ef19e18b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690286163, "uuid": "0cad5f47-af41-42a7-8ed1-787b15fae546", "comment": "Malware payload (RedLineStealer)", "value": "1489086e22ef3b247914e99193403615db6dbe7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690286163, "uuid": "d966afbd-7d39-48f8-9863-7899addd7c73", "comment": "Malware payload (RedLineStealer)", "value": "4a6235854072a89087ae8652ec78b121454886a40baf0d32b6e5a511a6e8a19d75117b7ea2d134332c5bdf46aa45140b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690286163, "uuid": "6159d04f-7371-42ff-a282-a76dd9afd600", "value": "T1C174E02236E0D072D1B786346930C6A55F7BB8725B3095CB33A8373A6E706D29B75327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690286163, "uuid": "09a87ace-59ef-4461-9a59-383b9fcb2804", "value": "bb615941a9791bad98127d7fa679f59b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690286163, "uuid": "d610d079-7e5e-464c-8c05-e1282324dc55", "value": "6144:+ql9guRWM6pUywndBbg1kxz8qAMAKTxzPWoGoK:TlKmWtpavgTY9PWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690286163, "uuid": "9b933819-3cb2-473c-8dc7-91bea1f10a20", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690286163, "uuid": "6caf1310-5792-4153-8f93-f93b16ae6bb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690286163, "uuid": "b1298cbf-5bb4-4fd1-856a-8137ceff75d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ab7791-2b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1690307191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307191, "uuid": "8d9eb67e-71c2-4041-b90b-116a4d84fe98", "comment": "Malware payload (LummaStealer)", "value": "16c3824bb332631b6f2c4095cd605c8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307191, "uuid": "c3b382cb-a09e-4a17-bcf1-266757d2af7c", "comment": "Malware payload (LummaStealer)", "value": "14e5d0b7662ca8a97c90592f6ff7a012e769704e662651ae68e190252b54cb4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307191, "uuid": "2d87b4e3-6ffc-40b9-af5c-4cc3c7d0305e", "comment": "Malware payload (LummaStealer)", "value": "5b7d5213c61f631d3bbfcb0bd3fc2b3886b1214e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307191, "uuid": "db4a8253-0df8-4311-8f8d-7661d673106d", "comment": "Malware payload (LummaStealer)", "value": "93a046c26658e9d9c932f65620dffd102b29db7d1b1e1e7d9d818a88d0d2e8fb61fd7d524fff72b3976cc6cd970c6f51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307191, "uuid": "9c5457ee-a7ac-4c0d-af03-21ff184183f5", "value": "T126556D307E54D44AFBF999F8C8D7E08E477C75191D288099A6A086E51FE3DEF2E23520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307191, "uuid": "ad35958e-dbff-4614-a628-f59daa637dfb", "value": "e2a1496c94d52a035fe47259ee6587b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307191, "uuid": "f3b288ae-f4e5-4abf-8437-242f06b07c47", "value": "24576:OR+cl7X1BRnI6hmebbe1ZfZ0dRbH4Xy8PHZ42Xc+fTv7hs2uMBHm:q+clb1BRntmeXK5HZ9M+fTvfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307191, "uuid": "e2ef98b8-645c-49c1-bce4-f881d54ec610", "value": 1358376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307191, "uuid": "e233fb20-cb2d-4586-aa3a-0c1e9166237e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307191, "uuid": "aa47b081-acd8-4583-a52d-ad2d3209d5db", "value": "16c3824bb332631b6f2c4095cd605c8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e7f692-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690268708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268708, "uuid": "68b6d055-50db-4b96-83f7-4d75f97fad9f", "comment": "Malware payload", "value": "af1aca89b31a7f12473b086793fe0011", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268708, "uuid": "aae2daa2-e57e-46ae-a509-637b2178eeac", "comment": "Malware payload", "value": "15511e49ab99c949174ce77cdfa36e8b56ba06c165c653a96f0ad643eb59e134", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268708, "uuid": "d6b66fed-e085-4d8c-8a09-d8a95187211a", "comment": "Malware payload", "value": "757f437b57dffc637a0f00cbb59e0c6e2e4b4208", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268708, "uuid": "32135e80-0b3a-4352-afd7-4582ca149ebf", "comment": "Malware payload", "value": "d28b1cc64cc4ecd8e943b995681b6e504d25e5426ea0f18a04e360821cc620addb5af9b32509abae4306280e9ed08fb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268708, "uuid": "52cd307f-1a49-46cd-8c67-0eed6470dce8", "value": "T113A68C87B8814657C5E4263BACBE80D433675EB9A78B67566D04FE3C3ABE19C0E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268708, "uuid": "c32f9cd8-2f15-4f48-b152-8802473ffd90", "value": "98304:dQkUstEYrzyhN/75ehftlzNTORdDhgTMToGcdeU:dQkuY87+TpTodDh2gcdeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268708, "uuid": "f8b2f743-dbe8-469d-b3a8-737b5cc7f5ea", "value": 9530829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268708, "uuid": "c80eb8b6-42e7-438c-b14d-bc5188ffd067", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268708, "uuid": "96a8a24e-6563-4abb-8c78-bd95d1820400", "value": "af1aca89b31a7f12473b086793fe0011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd15e2a8-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268826, "uuid": "5c2d733c-5852-4854-9a0e-7bee55ebe3fb", "comment": "Malware payload (Amadey)", "value": "f4dcdf3754b1d8854b5bfe68616d6142", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268826, "uuid": "f6c53d0a-740b-4f9f-86b1-ff9e5b02921e", "comment": "Malware payload (Amadey)", "value": "159592515cba7323e9150051de5089a1f23ba058a41be7e77921705459421623", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268826, "uuid": "4af2d0e8-a103-4fb3-a793-9959bbd22064", "comment": "Malware payload (Amadey)", "value": "69ccd9a74c7208cc42a1106aba5ccc1cb7595d9c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268826, "uuid": "08d593d6-7c30-4842-b3bb-5a516c38eee8", "comment": "Malware payload (Amadey)", "value": "77be741b15479a7c200131daddb8b7f9ef35b8cd2d159a720f5236d5872197d8aa1694a9521d507d059729c69caa95c7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268826, "uuid": "a6c0c4ee-5819-4675-bce7-e0cc29e7b24b", "value": "T10A840153A7D88033D8B6177058FB02D31E39BC669C78836F2785991E0CB25D5A872B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268826, "uuid": "3f9f389e-bd0f-4ff5-b653-9ed32dc397b5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268826, "uuid": "dc5c96d5-0e0b-411f-bc3d-5a80f88f3a7b", "value": "12288:tMrIy90bX/nFQB3F1v+6kigpBjFFgBYCv15QjA5:5y2qF1X+zez95h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268826, "uuid": "74e9267c-88f8-4207-b2bc-ddb31a97e921", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268826, "uuid": "7f9b179f-28d0-4e37-bf37-a00a3a86c1cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268826, "uuid": "40eceaef-2f8c-41a9-b528-cd06d7ce0dfe", "value": "f4dcdf3754b1d8854b5bfe68616d6142.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ba544f-2aa0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690257868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257868, "uuid": "1179fb7d-ae71-42d1-8533-306e430e4213", "comment": "Malware payload (AgentTesla)", "value": "0f853625fbfedb9bdd3760252644c8fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257868, "uuid": "8e94663e-11d4-40f8-b09f-e8a3c752c3c6", "comment": "Malware payload (AgentTesla)", "value": "15ffb6933880d5e366fc53bd225eb5264c78c32272acafeedfa5b3a025714e06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257868, "uuid": "127cf82a-883a-43fe-9a0b-e29c8b458f52", "comment": "Malware payload (AgentTesla)", "value": "12720076f2e435b0174a0dbb0a6145c25c0a9694", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257868, "uuid": "3d87f60c-13c6-416d-bc78-798f271d1207", "comment": "Malware payload (AgentTesla)", "value": "8b2aeb5152b00b73573db651535edd3531fbbb69b9cdc806992e998cf26db81c680b891cf64962ef06053009c2831e41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257868, "uuid": "3df8fa0b-9e00-4c44-a4b7-d6f887e5a5aa", "value": "T1E8D4D0663A24C9D7C519633C48F5E6254A18FFA63DA1D70FB11477BFBB33B091806A88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257868, "uuid": "f9fe1647-7892-4b76-bc30-12d98e0faab5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257868, "uuid": "9a4183fc-4150-4482-b788-6d2563b053aa", "value": "6144:hbWJZHyMPXmHmVzgfSH9U9FPSNzxEpoSU6ygAwn/AtWYJy3UBXGBMOYF:4JZHyYKqkfSHWz4VoAly+BO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690257868, "uuid": "225643d1-ad5f-4d78-970d-1fdc52a8871a", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690257868, "uuid": "b187ca6f-2e7f-4979-86ee-4f1be896569f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257868, "uuid": "c4837e66-b00c-4f35-abaf-5744553650c6", "value": "0f853625fbfedb9bdd3760252644c8fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96c8210-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690282080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282080, "uuid": "7927b99e-e68e-428d-8180-914cfd1194ba", "comment": "Malware payload (DarkCloud)", "value": "7c01d43519bdd57cb2bb46aea14078c2", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282080, "uuid": "6bd4d9ce-246e-4da1-80f7-239964867f91", "comment": "Malware payload (DarkCloud)", "value": "16329a763d15e6e2a873bf3c0ca87f5cbce617912ba840b2a375a65225f43b50", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282080, "uuid": "08669497-a68e-4e8c-93c8-f841f2b18782", "comment": "Malware payload (DarkCloud)", "value": "5479220527b747dbac35e550fe9794739706a225", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282080, "uuid": "3a1fdabb-e002-4835-963b-c1ce9f75fdee", "comment": "Malware payload (DarkCloud)", "value": "94e92f2f9dd217ab98029541176d39279bc5711e5ca127a3639708147f8f48265a34f514b765f13dbccd0a7ce496c0cd", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282080, "uuid": "778e3bca-adc3-4069-a78c-f1a07fe71f10", "value": "T1A4B40626E721702EE1EAC8F1E6E8526768146D761198EC27F7815F4D32352D3A8F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282080, "uuid": "c3e51a62-c7ca-4dea-b3aa-16d54f0b71d2", "value": "e54239e86b9cff7ce74afec114ce6400", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282080, "uuid": "399c7a55-b6b8-411d-a123-36937487d4eb", "value": "12288:R96BEnIHYA+2t3xny0I4d2Nqnp4vRqMr/jYKkJj6GmZU:aB0ZAcTInp4vcEYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282080, "uuid": "2537dad1-ae50-4f4c-95e8-e95ba5bd69e6", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282080, "uuid": "582a40d6-8b63-45b2-a821-dd03cbcb6a39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282080, "uuid": "953667d8-dbc0-42f4-bd70-0d9b6002000b", "value": "16329a763d15e6e2a873bf3c0ca87f5cbce617912ba840b2a375a65225f43b50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29376a77-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268524, "uuid": "c3ab2a7b-fec0-4d96-a2e7-3bab5e01ec97", "comment": "Malware payload (RedLineStealer)", "value": "9e257c8c4fb50727b6ea293939cfdee6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268524, "uuid": "729ae5c6-f7f8-4b79-af5f-ca1b3942d831", "comment": "Malware payload (RedLineStealer)", "value": "1663f89d765658b400bb154e25c2261af07c651585eef48e5069b333502a8aec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268524, "uuid": "dbeef2c0-7c4f-417b-81bb-a0fdc45c0319", "comment": "Malware payload (RedLineStealer)", "value": "c4d8f7a22d95cda723ebf0097f43c3387b7d63c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268524, "uuid": "c497a03d-0cff-4da2-b637-550c5747c5a1", "comment": "Malware payload (RedLineStealer)", "value": "25206615e9c5e81f5d7cc9857384b1a108496ef5d9a2e2f7a8bb386f2a4f476f19062592defb0cac5f9b046ec983226d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268524, "uuid": "0b76e707-34b1-48d7-8881-14763cfe80e1", "value": "T1588402527BE95072DDB51BB058F712C31A3ABCA36D34932B2302985E48723D4B532B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268524, "uuid": "a8de103d-f9c0-45cf-bcb6-10a390340747", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268524, "uuid": "3043033d-364a-4bfd-8525-2bc411231fcc", "value": "6144:Kxy+bnr+9p0yN90QEO5o5dXMa0Doob+QPTcR15AdWRgBZ+t4ZDp6I9yg9g3:rMr5y90gKXMaQYzWwRgBYCZVz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268524, "uuid": "d6f883ec-cf5a-4496-826a-7ab8be9db2f0", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268524, "uuid": "7b384d1a-9024-4205-8504-8cf4883f5399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268524, "uuid": "06d44d4f-3746-4187-b0a5-20785b6b66cc", "value": "9e257c8c4fb50727b6ea293939cfdee6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a193ac-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690280302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280302, "uuid": "0c60feb2-0a28-4814-92f9-1a2054b027f9", "comment": "Malware payload (RedLineStealer)", "value": "eed3ccc2225c50c2f5ca19845a17978d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280302, "uuid": "980cc146-4161-4451-b38f-ddd694655bd6", "comment": "Malware payload (RedLineStealer)", "value": "16861167bb7402b8719412150289d07ec9908b3532dcd909877ed2d52bb6a34c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280302, "uuid": "74e7d996-0ee6-4f61-b04d-81a19f84dd88", "comment": "Malware payload (RedLineStealer)", "value": "26da7e8fe430be13c9f8ff29de7e26491aaa9429", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280302, "uuid": "01fd8e81-88ac-4df3-a638-366ae014bf3a", "comment": "Malware payload (RedLineStealer)", "value": "572c3d133eb030d369bf4f5cf7763dded7250793e6c5ead4f8c68217648f7cd082acce69fd931db4bbb90b052ee040d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280302, "uuid": "6ec25346-b907-4737-9045-f41823e1461b", "value": "T139840143E6D88033D9F91B7058F702931A36BDA25874832B6B899C9E5DF25C0B87573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280302, "uuid": "fc161f49-3787-4137-ab71-b97da9aa3a7c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280302, "uuid": "d486ba21-3f89-4301-82ba-7f20c5a1da8f", "value": "6144:K3y+bnr+Jp0yN90QEUO3bLJKXHGFLWZCglM3ZrbnNI5HyjuDgCCqRbpew:1Mrty90+6cXsjYM3RbDqcCFbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280302, "uuid": "0f709a2b-bee7-40a5-ac88-340536906e48", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280302, "uuid": "43dc06ce-05d3-4bae-909a-a90b3db4df43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280302, "uuid": "2ca9ae45-9d7e-46a8-8300-7825da33982f", "value": "eed3ccc2225c50c2f5ca19845a17978d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9cafe3a-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690308683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308683, "uuid": "e77d1301-079e-4668-acab-b3e7ddb47718", "comment": "Malware payload (AgentTesla)", "value": "00b8318c3b6dbb208d7293ed7cd89b40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308683, "uuid": "510f2475-bf9c-4208-8413-2e9f04b27669", "comment": "Malware payload (AgentTesla)", "value": "169ce1ec70101dedd2c7f14ccc89d13635feef28b1a680d04c740c82aef31864", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308683, "uuid": "0974e55d-27f2-4387-999c-6cc5cc5853e9", "comment": "Malware payload (AgentTesla)", "value": "c82cf97d9141d4f789dda7faab0711c191e6815b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308683, "uuid": "66242413-7f96-42fc-9cd2-e35240b3daab", "comment": "Malware payload (AgentTesla)", "value": "a018050c75e95fcaabdba5a01be5ab083816e132f8c550a4f105ed870c978e36f22468d23d06e5b093b6b1f62906e46a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308683, "uuid": "0c07081f-f46f-4f15-9f5a-2843d19deb74", "value": "T1D515387239DEF886E28CD37D212EED046B6AF4129213A0DF84056EC9574BA49F447D3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308683, "uuid": "806d018d-ea96-4d26-89f0-2c26f217f469", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308683, "uuid": "35759a4b-3acd-452b-ab29-6da9a7aca297", "value": "12288:M6zq9eFjp5ELc7SjdAIh4I3gvSRCDzXV2ELBj3DYy/4DbM0fD/:hqQ1TXIhrRCn3J3Dh/iM0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308683, "uuid": "40e4095f-c21d-481f-a306-fca00593a98e", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308683, "uuid": "b42431e4-3948-4fe8-bae4-090008423277", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308683, "uuid": "6cdc0e1c-9482-4ff8-be94-0931c1f64430", "value": "SHIPPING DOCUMENT & PL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6533375b-2aa0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690257887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257887, "uuid": "d7e0a10b-fdd2-4b70-9366-8cb081acc8e7", "comment": "Malware payload (AgentTesla)", "value": "66bb82ee05fc13737b1d72237c5a82b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257887, "uuid": "1ebdbee6-f54b-48bc-85a2-d16da95529d6", "comment": "Malware payload (AgentTesla)", "value": "16a614d7c92a7a8be3153b7e42805d6f85d35b7fd213961b42387ed5251ece8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257887, "uuid": "dc13b667-7450-4e95-aebb-ebe2870aa43f", "comment": "Malware payload (AgentTesla)", "value": "2e6325da3d3f8e819ec0040c333a8a0e352565ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257887, "uuid": "10adcc92-5eb0-4ee3-b131-1a0234b9c221", "comment": "Malware payload (AgentTesla)", "value": "224c5f7c7e30b75d33b0797430594f96e8f339fbfb69e90e19678556c80467cd5a93cbab4bc516a13b9c336632592dd8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257887, "uuid": "e04e3303-1811-42cb-b6fe-df85b9e78403", "value": "T15EE5268C4E40D11FD89A1F3DA4707988E3DDED142CA2E60E99D6B16D6F3EDE23009D69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257887, "uuid": "55f9da16-54c4-4b7d-af34-21eb40ddfb3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257887, "uuid": "e74dc1a5-4cce-4888-830c-21d41c31bbf8", "value": "6144:YgbskQbZeDYksz/KOhw+0Wad+zXtBQF2Z:jQ2YlSjWm+71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690257887, "uuid": "ea83703b-a615-4591-8c3f-66f1d141d12e", "value": 3145728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690257887, "uuid": "d875f301-295b-4b91-b5fa-cf2a12ecd4be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257887, "uuid": "06a58f85-f288-4997-b21c-5f35eaa95ee8", "value": "66bb82ee05fc13737b1d72237c5a82b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ab4113-2b15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690308329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308329, "uuid": "e34ba64e-d837-4211-90eb-c834ccc55a1d", "comment": "Malware payload (AgentTesla)", "value": "8632bb68cafd8827004b6faae91b0c03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308329, "uuid": "cec89e1d-8e6d-47c1-8460-b533f92235d0", "comment": "Malware payload (AgentTesla)", "value": "179a633927c413097f2c4d175b195db998d64d4f2fe10a0a84b6fcdf5a583150", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308329, "uuid": "e6214705-d6d8-438f-b6d0-38144100196b", "comment": "Malware payload (AgentTesla)", "value": "ae0ac6c3ab1e59ffc4ac7db651c2dfe5925d8838", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308329, "uuid": "546cd11c-fa61-4f94-838a-0f824152556b", "comment": "Malware payload (AgentTesla)", "value": "1d1d2ad5577216b5275ee5eb1714a0dabefd3d8a2963f6561ccc79213a03f9e7b82fbeeeab02e1dc497cb9ca71f8e482", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308329, "uuid": "a773f4aa-49a2-48e0-8e7d-1108d72eaebd", "value": "T1C6A32FCE30388275DA37CFB0DD99C5F2A2911E86078CDDFE46812F6730D0D5A5A29A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308329, "uuid": "d62bc08b-3faf-4819-b8c4-84149f122e0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308329, "uuid": "4dfd0db9-6320-4960-bb02-5563e0090f05", "value": "768:QXiuZvkCZ7E04OzW+oNwp0icm9cgh/NW1KkKXCA2tu5OEfHn:yia7Z7E04g73K6/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308329, "uuid": "2d75140d-6da8-4fa9-afa8-0323bf7af300", "value": 99840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308329, "uuid": "55f68b4b-3a43-46e8-92f9-b9b13816f897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308329, "uuid": "2d52b08f-bfec-4da3-942e-3d27e5b37aa7", "value": "povpra\u0161evanje 24072023_0217_PDF AM Monta\u017ea doo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcdda42a-2af5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690294595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690294595, "uuid": "35ca3513-ec5f-4a36-9015-26e33ae64efd", "comment": "Malware payload (AgentTesla)", "value": "f5f8d20cad6ae529b6867436ce50883c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690294595, "uuid": "e2ef1f95-01ee-4a6d-beab-b6ce4e2e0b24", "comment": "Malware payload (AgentTesla)", "value": "17c6110bd8068dd9732c15b383c006b3ae70785cc6f0ce5d4d61c070404a0e86", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690294595, "uuid": "2befae20-5537-4f96-8d42-86b852ad26f9", "comment": "Malware payload (AgentTesla)", "value": "1d01e4cc420df4533481c8232bf610ce254bef63", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690294595, "uuid": "00499adc-2616-4524-8a58-26eca54ed7ad", "comment": "Malware payload (AgentTesla)", "value": "8d3c72197ef5aada603147a1145677d83e116a2a85c63b8c9b2cb47978c02f37b1ff9abfb171c416b9044d9594c301fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690294595, "uuid": "29d749eb-3610-43cf-b7a1-2ecbd48279ae", "value": "T168F404F21234EF1AFC695BFCC0D554110BE79A31D661D58D3FB1238D2DA3F81A28AA19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690294595, "uuid": "a12ce301-4355-4776-af89-712a47fd5a56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690294595, "uuid": "bee4f3c3-fae3-4fdc-9dd5-394aaab380f4", "value": "12288:LDMsLe07gnJU4JNanmiR0vr9ZuwZwAz9u3+s5ELFMtntGGzGtGGGlGtGGGGFGGtV:L77gWwNimG0vr9EwBu3+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690294595, "uuid": "5f874abe-b87e-4e2d-ab09-73f9febc0e69", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690294595, "uuid": "dcb4d1ec-9a80-4a15-9219-ea441e54e5bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690294595, "uuid": "cff5a8a1-f17c-425f-bf47-eab505311183", "value": "Swift_coft.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a786fa3c-2b18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LaplasClipper)", "timestamp": 1690309538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309538, "uuid": "b941506f-8c26-47ad-8268-fcc7fbfe04e9", "comment": "Malware payload (LaplasClipper)", "value": "18658dec7775fa53f081b892d6a2b027", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309538, "uuid": "6cc4659e-94d3-4765-81f7-f08f457d6a50", "comment": "Malware payload (LaplasClipper)", "value": "17ca2de661fa07dd83a55a5005c61eb8aee1e9cab56e9a13bc36a27f4b785554", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309538, "uuid": "566f2e3a-7cb3-4ac3-bc3f-a8f449b35a32", "comment": "Malware payload (LaplasClipper)", "value": "fa8d901c7aac70e2c37544883ce087e48c6302d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309538, "uuid": "9e2cc3c8-94ae-48a7-a6b2-3fc8f57d848a", "comment": "Malware payload (LaplasClipper)", "value": "f96687dac6f3c0239ce07e881a6688e3eb339a4516f97a6f5b61964a92ef03491c8c885da8c18fced02c1910f3627aab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309538, "uuid": "c369a5f6-3dad-4f9a-8234-615d98d18155", "value": "T17CE53382199C4595C90586F438C9F523FED9CFAA5E057E25005EA1BCEBD9B8331873AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309538, "uuid": "5c0dd659-bbde-4029-96ff-2a5ea0bafb89", "value": "79b3362178937bf9559741c46bb9e035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309538, "uuid": "841bc923-7a59-426c-a214-9e95b0f800fe", "value": "98304:F28fuEzm1Q1n5oIVb0cCU/8j+okSprZHm87mv2B9:swm1o5pF4U/UhkSprZHJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309538, "uuid": "ed7be236-6d3c-4a0f-adaf-dd474e107e06", "value": 3267744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309538, "uuid": "c29d9f49-e4a0-49fd-9d27-01377dc69153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309538, "uuid": "591c0422-a9fb-461b-90a1-978e22e5db95", "value": "18658dec7775fa53f081b892d6a2b027.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad1284d-2abd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690270298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270298, "uuid": "e32fb616-e45b-4916-9dfe-8e99045257c5", "comment": "Malware payload (Loki)", "value": "95d894f31c6475c92763333bc6de21d3", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270298, "uuid": "493c0690-8a7b-4fca-836e-fba030cc3839", "comment": "Malware payload (Loki)", "value": "17cd2137240c5d6540543a675947a2c63a6d2f788a75829e7f50201c2cb4d6c9", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270298, "uuid": "8550176c-2232-4319-8769-e17e8b3fbe85", "comment": "Malware payload (Loki)", "value": "207e67b4696b79248326c3189c8e0bb693eb34b6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270298, "uuid": "73acaca3-2c64-4150-8042-520dd45744e4", "comment": "Malware payload (Loki)", "value": "27ae157142728e522239ec8ed3abbbc00eb5f101f16423d6e3720a79247e7193f2f60fb1a95a07ea3d06edf88f397eed", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270298, "uuid": "4a393ca6-e810-44c1-b4df-91eda5e0e8e9", "value": "T1EE94230AAB62000BFC69F48DF28ABB144914F7A11B0FBB96504873CD359753FDCA9AD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270298, "uuid": "b05ac853-a797-4c0b-885a-1cde8d04d8f0", "value": "12288:xqCW1y9r206dwYtG2uJxz7NAieAEHlBpCwFDj:xq311bw3BxzxYHjTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270298, "uuid": "6c1d27c9-2322-463c-9e34-c524ab09c5e1", "value": 443063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270298, "uuid": "9023461d-567f-4a9e-8438-10e033824fe5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270298, "uuid": "e2abefcd-99d5-4603-a621-fb5f0b2415c4", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a2957e-2aa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690258260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258260, "uuid": "9151da8c-97dd-43da-ad56-d26159af95d6", "comment": "Malware payload (AgentTesla)", "value": "1fc93b3b72c9b4716d427342eaae4724", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258260, "uuid": "0323cde1-736e-4b2a-964f-83ca5b6e702a", "comment": "Malware payload (AgentTesla)", "value": "17dc8d6c4b9e8a27479e3de340925a3f766cc815eafbaafbc59ee5f14ae41fd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258260, "uuid": "f0ff6e77-c228-4cf9-a72d-0edf6053f131", "comment": "Malware payload (AgentTesla)", "value": "6ee3427beb53b6b957f4655716f7bf2e453f2fec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258260, "uuid": "ba107fc3-c942-4820-8e08-2a10e94e88d0", "comment": "Malware payload (AgentTesla)", "value": "3f2850f9ec9225209d35fbce7cc9f740c8f21c770e217d221ea86f60e929943aa528978b4457fe04633af081e0f69f52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258260, "uuid": "26b96620-5efa-4ed7-9aee-d230782879b3", "value": "T11D94FB381D034770E03F56B8E64B7D0B3614EBAB6460DA1176B63E1B7B5A217B4F2329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258260, "uuid": "112e3c35-befa-4224-b8bf-f177e39aba66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258260, "uuid": "ae9772e2-8195-4a99-b93f-8f6b0dc9e23a", "value": "6144:ubEM6xyJO8+7SdnyJ6nltV/BFp3+8+I3Dfv+mdQzHAb:HIOLeIJa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258260, "uuid": "c5e057fd-53c2-45fd-a5a2-360dadf64083", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258260, "uuid": "7242b762-315b-416c-b526-512df06ee5cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258260, "uuid": "e082e351-6bff-4ef3-8cef-6ac409e40db5", "value": "1fc93b3b72c9b4716d427342eaae4724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd41305e-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268880, "uuid": "ee497917-4857-459d-b8bf-9b676c6c1c03", "comment": "Malware payload (RedLineStealer)", "value": "f8cfb1df4bcb4f9f8b7b9d0708e16d69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268880, "uuid": "38b97402-93db-48cf-bea3-9295c0d2af80", "comment": "Malware payload (RedLineStealer)", "value": "188abd944862b0218c2c1eb1ca15b896c802801a2127e4abb847bc5ba1a2eb8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268880, "uuid": "ffbb872f-8098-47cb-a078-d2eef7c0cb49", "comment": "Malware payload (RedLineStealer)", "value": "93755a42eacd228ef291a3136a1394593c678faa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268880, "uuid": "55babb15-3e80-459a-a132-a12fe6d58377", "comment": "Malware payload (RedLineStealer)", "value": "9e8b818c3a312d2a6286ab1fe0d54fb0486e995f66d564220e85a173350bd7a59fdeb0ab2d8e036e98a3153b3b30c9ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268880, "uuid": "1c80be70-8def-476d-a10f-a8b901799501", "value": "T17D84F143A2E95032D9B52BB018F612C30F36BDA18D7843AB3745E91A1DB36C4E57277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268880, "uuid": "b0eb7f79-7130-4da7-b95c-4e9f22a3eeab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268880, "uuid": "c6a6af2d-8272-463c-802b-457d40481318", "value": "6144:KQy+bnr+lp0yN90QE4JX36Yol3tvc630ZEnOOZ38ow6db8IEw2+ogF1AmoTMJrTH:0MrFy9003obIE3dwooI+c1AlTM0Mq8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268880, "uuid": "3c4b74c8-1eae-4bde-96c2-4eb5373655e6", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268880, "uuid": "ca271fca-5468-4c04-9087-68c19b73618f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268880, "uuid": "a4fbec21-078e-417f-ac80-e9d911f4f5c6", "value": "f8cfb1df4bcb4f9f8b7b9d0708e16d69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb50c7e-2ae7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690288285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288285, "uuid": "7a1bd765-eb0c-4a58-a2cb-847fc3c5517b", "comment": "Malware payload (GuLoader)", "value": "2acc0a0c05a86074ab00f0daaf259b6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288285, "uuid": "1616bdb1-e613-4767-a1cd-b376342968a7", "comment": "Malware payload (GuLoader)", "value": "1936e5d20a050f3377455c0a1dae242cae84641d9e66be25eaee2b2a707ed5f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288285, "uuid": "748a6f49-4532-4ebf-93c7-d02f5f12cf7f", "comment": "Malware payload (GuLoader)", "value": "e2e17e905419c38dec6805b4dada021fbe65c311", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288285, "uuid": "05eec918-e807-4952-b9fb-7ba33ead281e", "comment": "Malware payload (GuLoader)", "value": "b5b025fe140483a9ce73c8c2e0e0a2dc43b52a87666b0d61d21010b2f57747ad9d4e7d5f787647b17e4275566ee99898", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288285, "uuid": "81d3cd02-32d1-4777-9d90-17854538a72e", "value": "T1CE64120576E9D153E1128F316C3A1F3967E6B9223859520FB7006AFD7A21782D83E3F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288285, "uuid": "40fb1fee-4113-40d7-a455-46a1b63b99fd", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288285, "uuid": "d8f0f832-d63b-494a-82e6-20a0f53a1772", "value": "6144:Hp+gguE8f8k1rt8YzI7c6e+py/G/yf5vEvNzAEqRA5FaQmrclB++xe8Ugcxm:J7E80kFjzwc6ZpF/yhvEvmLRSl6gZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690288285, "uuid": "c6b0c617-c88e-4509-a16f-9c51ef6f16a5", "value": 308168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690288285, "uuid": "af8cf5b7-a9df-4319-8e02-aafba699a983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288285, "uuid": "1e56148f-0064-467c-9075-e19a0ffca0a5", "value": "shetlnderne subarmors.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34cae12b-2aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690268973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268973, "uuid": "a8dd9eb8-cbb3-4592-aeb4-d042347d1b3c", "comment": "Malware payload", "value": "6ee7e7ac431a7e6cb86ef312e6946b30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268973, "uuid": "240fbc31-db78-4aad-8320-885d06947f73", "comment": "Malware payload", "value": "193bd53692f6da62186cd69acba04ba1f1c610a2ab69ae146564b3c8f00acbd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268973, "uuid": "c11a2289-1dbd-4c05-8974-fac2ade0c0f0", "comment": "Malware payload", "value": "4d61bca1e1a45b37b86c84715a2ffc2a8be8c7ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268973, "uuid": "d129759d-b473-4609-abf2-6db90f5b2e35", "comment": "Malware payload", "value": "aa4bcef96f99873503eebedc24b3f3b019402e644fc555771a465fa373e1e8352830f99c7be29f3e5d9490048518ff1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268973, "uuid": "df77bc87-31f6-40c7-88cd-beb1c9b61076", "value": "T100A67B137A18DB1EC758123448B1CA94673E9C4585C6A913B394F329F9F60AC9EAFDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268973, "uuid": "63f2b915-3092-484d-a26c-c2da85ee32ae", "value": "98304:dCjK3hbUWkwbpakcYQpqfJWKOfnLy2jbm+uEwi:4j4bUMkJJpqfJWKOTy2jYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268973, "uuid": "1d256adb-82c0-4270-9b32-203eeadd2e7d", "value": 10319830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268973, "uuid": "6684847f-d2ad-42af-ba1c-1f25b05475d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268973, "uuid": "fcb4bd44-fc73-401e-b66c-8ce021c3db4a", "value": "6ee7e7ac431a7e6cb86ef312e6946b30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbcf1126-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690273951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273951, "uuid": "346f96bd-0503-48c0-9684-f8323f1c4218", "comment": "Malware payload", "value": "e2b1ef1c7e166f9b20b9c881ef8412bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273951, "uuid": "6a3b3645-58e9-4437-b885-7481b29f6d08", "comment": "Malware payload", "value": "1a5b21b9f7b4694d257be43746d60b64afa92a34e8c0ad4b515d03fc69ed2b0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273951, "uuid": "0802d29f-d70d-4524-92a2-470e997f0319", "comment": "Malware payload", "value": "b91b0d84b086faf42f1bb0388d66f3dda2400db4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273951, "uuid": "bf36c8f1-4d55-4f81-9f5a-95cc32b32229", "comment": "Malware payload", "value": "af05b06189670c6919183e8720f35096d48c9a6d6413d3212322fe54772a472d8ff42ea77a40869cb1c112d8984287ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273951, "uuid": "29fa95e1-86b3-41ad-852e-12779c0ee97b", "value": "T187735CC1AA8610F0D7CA67B521ABE7374F385387018FFB47DA74EA205923A11FE561E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273951, "uuid": "29bca4fa-78bf-493c-b8c3-73f052d6bc22", "value": "1536:hi/XeQmBQrU3WKXAjjxrsN8DSxmKHbJ/4HMwcc1/fJ4YVQKbRCvv:wPBU3WaC5WQKHbJ/4swcc1/iKbWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273951, "uuid": "d0b31b3b-9fe1-4669-adc1-fdfd9d650280", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273951, "uuid": "4e407742-adac-4546-a7bd-608bce920f5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273951, "uuid": "bb4693fe-cd59-4b08-a32d-475923589326", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen8.6021.16311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518e5cc1-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690308535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308535, "uuid": "49664313-d1a1-4dca-a920-aed6119ec69f", "comment": "Malware payload", "value": "fe9a7f9e0e66dcf2d92479a29bbc6180", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308535, "uuid": "6e387d7b-9328-4a23-9ffb-e0fba495a4db", "comment": "Malware payload", "value": "1aacb2a3674cd60dabf63b6c4039358cf9cd57069be2730cd8abd94ebbbce6af", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308535, "uuid": "da653307-a617-488f-80a1-7dca70a16b50", "comment": "Malware payload", "value": "f8f26bfc03b214fc42731a0acf4288b39431f8c9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308535, "uuid": "f22eca0e-ff84-4c49-89e5-87c5c51aac82", "comment": "Malware payload", "value": "5ab21736fa7cca5bc0784b3cc8821722e21086e5c93cfe1feccc1303d1ff6fc62e4fa47ef0666640361ab0e9d3441cd0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308535, "uuid": "b664e32f-bb60-4cd1-b855-f3b31fa431b4", "value": "T1BB64990166EE114CB2F33B565BBA65A84F2BBE956A39C15D208C170E4FE3E40CD51BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308535, "uuid": "092b07e0-3971-43d4-b78e-8e6da48e4a09", "value": "3072:/SAN6cfiGxfaXDEevCjcrobc4/Mwa31DG1go1nD12t1hs/Ua/VgVBaHvRY6j5Ii1:uVMxzakJhoBvdxCZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308535, "uuid": "08263be2-bd09-49e2-9a89-2e8e9710b779", "value": 334008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308535, "uuid": "5d252653-e0c0-4620-828f-67955620c961", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308535, "uuid": "33b59af2-1804-4dcb-8820-c59ddb248301", "value": "COTIZACION ARTICULOS DE OFICINA PARA PRODUCCION.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b3352a-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690282126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282126, "uuid": "7b80f0bf-3522-43b9-bfff-262797e03c01", "comment": "Malware payload (AgentTesla)", "value": "b0b37f153b0e49780f34bdb8c8691869", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282126, "uuid": "8b57498f-89a8-4b82-a34f-b7d987433977", "comment": "Malware payload (AgentTesla)", "value": "1b29fb3263d4305fa8dc267616a040739f8121b24d27506f3764e2f1088c43f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282126, "uuid": "44fc3207-b974-437f-937f-8017b9323510", "comment": "Malware payload (AgentTesla)", "value": "df5e6f0e7f09d01a00f7dd1d79ac193f3f89b91a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282126, "uuid": "6d96b73e-3b74-4043-a7af-21c230473023", "comment": "Malware payload (AgentTesla)", "value": "5694780121fdcd3f6f0d0e3c99665b1589bb701cce5b1d04071d98434afd608ee4972644f0d9a31f1e6b0bcf08a0bb92", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282126, "uuid": "ffcb5f12-afde-4b05-adfc-941e265619ce", "value": "T1D0E422197ADA8647D22E8BFD1160B3B457BEEFC22511E3CB2DAB70CDEC62D488354605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282126, "uuid": "65bdf44a-d633-47c9-a614-f5d0b8828a8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282126, "uuid": "a717cd66-fc88-4498-a5f8-7e8a3b027ba1", "value": "12288:HYiIoFwIrG3XCCaaHBWn6cZNLXaBb2qXO/TbkKR4lMm1d:HHIcTrGC6Hgnigw4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282126, "uuid": "37256338-908f-4939-9244-9de491ccd192", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282126, "uuid": "89519e19-3d90-4c31-8c2f-f394182d0910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282126, "uuid": "271578ec-2561-4766-961f-ecdcad3e1170", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1b8ad1-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690282083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282083, "uuid": "87f174af-b1d4-4c01-9660-f9f2049cf675", "comment": "Malware payload (DarkCloud)", "value": "490592c4046e6cfbad6103fcca949806", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282083, "uuid": "0e25201b-4f73-49c4-abab-819e9b7928a8", "comment": "Malware payload (DarkCloud)", "value": "1b3d189b2b4a80fff20df8d2ab6f4a7161b81312612cb1eddcd45a57f402fa3d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282083, "uuid": "6c6abdca-4dd1-48f0-bdf0-3bc85cd56b0f", "comment": "Malware payload (DarkCloud)", "value": "985dbfec2eff09efe654d37e448f39014543cf50", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282083, "uuid": "1ef168f2-8dbf-4067-9462-91142c84bbb8", "comment": "Malware payload (DarkCloud)", "value": "62f24314095f8b86e9a76926509db6e2238801e830431f628b5577b01d2de74d6beb6dbe286431d2bc5122a553feea16", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282083, "uuid": "5e0a0b7c-213d-4320-b0ae-761e40f7d6de", "value": "T12FA43A26EB60612EF063C8F1E6E452576894AD7712A8AD1BF3815F0936351D3E8F072F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282083, "uuid": "af1a2bdb-2a1f-4e23-9599-0c8c8e7e3a9a", "value": "de17b8441a9e3905b88bfe7909089a80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282083, "uuid": "b190251f-aa6b-4061-a923-17694d237ec4", "value": "12288:Gnq9ahuwlWR7Gl9vzZ1dl/LxMrKCq5jYKkJj6GmZU:4hVvl1dl/lMrK3hYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282083, "uuid": "261d8cc1-8cb9-462f-a09d-e90d5df1c046", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282083, "uuid": "cdcc4727-14da-429e-8c40-ee11d9035e69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282083, "uuid": "0ae2d95d-a457-4ce5-84ee-9b046c16169a", "value": "1b3d189b2b4a80fff20df8d2ab6f4a7161b81312612cb1eddcd45a57f402fa3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf4a4a3-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690282084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282084, "uuid": "bb9b0142-34c5-4390-b5fa-4a62f45899e4", "comment": "Malware payload (DarkCloud)", "value": "0147262f089c392ace640e82488fb02c", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282084, "uuid": "4066ef97-4463-42c0-85ec-b11e52a37500", "comment": "Malware payload (DarkCloud)", "value": "1b443e1f94062abcf6ccda22f6c41b7a3c25ab5b2766ebb1f98d4a186a30e50e", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282084, "uuid": "f6a66633-0cf3-4c3d-8df1-caee6a50bc9f", "comment": "Malware payload (DarkCloud)", "value": "a61e609511a5ee4b426751af07fa1ffdff588abf", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282084, "uuid": "b49303e2-2728-419c-a2e8-0923da71bf1f", "comment": "Malware payload (DarkCloud)", "value": "a727b0cb81bbb22e6a409cb6db26faa1926039fc339af1fe80772dbabc3e8cf9756a658214799415a68e1a1d0c34946a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282084, "uuid": "7097ced7-3355-474c-9805-ef650324182e", "value": "T194A46C16EB61602EF053C8F1E6E5921768996D7A12A8EC27F7819F0935351D3E8F032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282084, "uuid": "36026073-c321-457c-a7c3-43c98f4885aa", "value": "2f4cc3406c48d1d30d3166cb5741eff5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282084, "uuid": "670e1c15-148b-413f-a062-1f28569cca2b", "value": "12288:REUH1n27bHqiAtweKISY2GFerjYKkJj6GmZU:Rp1vfKISY2GEXYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282084, "uuid": "fbac255a-96eb-45eb-a242-1b40632ce033", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282084, "uuid": "1a7e9224-ff9f-4dd9-baec-1689e2df9c16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282084, "uuid": "5a8ed15b-c05e-456c-9724-030473c9ac4b", "value": "1b443e1f94062abcf6ccda22f6c41b7a3c25ab5b2766ebb1f98d4a186a30e50e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd300584-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690282113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282113, "uuid": "57865971-8b40-4869-83ae-98e84c71039c", "comment": "Malware payload (Formbook)", "value": "d79253df5e5913e84f6694bd1d822e27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282113, "uuid": "54a7284b-329c-4e77-85be-41ba6ba2ecc2", "comment": "Malware payload (Formbook)", "value": "1c0810c9351e73650066ce431603eb2b586f28ef39cedbe53103e2b3e727840b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282113, "uuid": "6506348a-ae9e-4aee-9f9a-41b2e147998f", "comment": "Malware payload (Formbook)", "value": "927cdabaf8368ebf6535ae01367ac412c9191d61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282113, "uuid": "4978a11d-7319-46e1-8ed2-76e91b49d155", "comment": "Malware payload (Formbook)", "value": "5037234ff4de9471398db3ab8e1a61f92b4b0d691e46979e124907225346f292f76b6bc4ba5e522dc840dd060b2d038c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282113, "uuid": "a0c995e6-2505-4959-a83a-bc81ff04b1c2", "value": "T13E35AE33B2D18437D1321A3C9C6BA3A4983ABE512E34794E7BF42E4C5F3E68168552D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282113, "uuid": "4bcb7121-5e02-4d3d-8431-831fe894a8f2", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282113, "uuid": "ee0b49bd-c8ff-4be8-854b-ec60db62ad1c", "value": "24576:tnsJ39LyjbJkQFMhmC+6GD9x7i2vDsD4APvxd:tnsHyjtk2MYC5GDzzDmLxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282113, "uuid": "beee2531-3fca-4666-aa51-e8154ffacd7c", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282113, "uuid": "ca71a51f-346b-4370-b37e-bdc9eb7ba237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282113, "uuid": "f3e78366-24f5-4cc0-a6ef-bef9d731c980", "value": "may&june settlement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765f259d-2ac6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690274237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690274237, "uuid": "709ffb39-b251-49d2-91cc-acc3c8313ba7", "comment": "Malware payload (Amadey)", "value": "2983d487675b8e857be5cc87ecf3a3f9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690274237, "uuid": "8ac7023f-da6a-43db-aa36-94bfae80a77c", "comment": "Malware payload (Amadey)", "value": "1d059ca891566e0006cb4534dc4ff845fedd1d3d468c12366e12f98a815ed7d4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690274237, "uuid": "3b5e92cf-6492-4d24-9d3b-b3f6aad11cfb", "comment": "Malware payload (Amadey)", "value": "5dee58d99ebb08bee6f7210ab933e0adeed7930c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690274237, "uuid": "fc75a634-1063-48aa-a2d9-54400e1ac1b3", "comment": "Malware payload (Amadey)", "value": "d95f6a6dfdaf84e453ceb2dff51025da489797d5ed84dfbfe8e0e5c0a512793bb977041677ce3a5eca2ac28ee8329362", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690274237, "uuid": "3b25c0f5-f4b3-4b03-9af6-c147be2ffce4", "value": "T1BE840247EAE89472DCB41BB014F607930F31BC9698B8836A2749A55A1CB37D0B57237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690274237, "uuid": "c7d19b03-a9d5-4c6c-aed5-c27a80d96597", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690274237, "uuid": "aec095ad-4869-47ff-86eb-a9255dd2a9a2", "value": "6144:KOy+bnr+ep0yN90QE+d2iPWnGyF4ts9EO6GGvo5o8egBZ+t4nDSKWWE3k33GMC:iMruy904d2om56j6RegBYCnprKk3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690274237, "uuid": "970464c2-13ef-47b3-a4a0-56cae26bd3b9", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690274237, "uuid": "57e0e8d3-1d03-4077-903d-86f211f6ed5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690274237, "uuid": "e2ace654-6985-433f-8086-bed0c1514985", "value": "1d059ca891566e0006cb4534dc4ff845fedd1d3d468c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04411dc1-2af2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690292943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292943, "uuid": "39984b0c-26bf-45d1-ae93-511bfaefc52c", "comment": "Malware payload (AgentTesla)", "value": "4124be242fe54b7beeaff533fb26beb5", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292943, "uuid": "73b096b3-3d78-4b60-963b-50f40ce609da", "comment": "Malware payload (AgentTesla)", "value": "1d468a0850dc047793fc8f54cd4f91aba5f80bf60d568d3ce45b0c37182b8295", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292943, "uuid": "334b0e14-88f7-4e96-b839-699c97bf60c6", "comment": "Malware payload (AgentTesla)", "value": "96ba521dd2b978efc5f9c9e18c19d12d9b6db943", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292943, "uuid": "ababf516-f590-4ed9-bfd1-df1e9b33b101", "comment": "Malware payload (AgentTesla)", "value": "f8fa302c4ad09780a248a221ac85dcf50cd33ca2058f0a90f2ffcee42df7564759b0d62399f26e1500453992145b32cb", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292943, "uuid": "48259604-f591-4ec1-80f1-b97415b12e95", "value": "T118F43327A326EA16A8289F0644DEC43F830418ED94F1A9CD387C7D2D7717136DB99CD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292943, "uuid": "166610a9-6687-43b7-8331-294a83124f54", "value": "12288:n6vFPVYaer+IP61nWb2SAM8OMtMu2JIzs9bQIO7AilNPxHCeH1Erza2EB:n6vFmkIKe2SEtfLspQIgPRLEr2RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690292943, "uuid": "a596077f-6e72-404a-9782-e059f4d7268e", "value": 760384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690292943, "uuid": "7d7eb445-4614-4275-b7a5-6570b2f8b0b2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292943, "uuid": "980ee3e9-7663-4977-8ccf-a658db06cd58", "value": "Documents.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46b975b-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690267898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267898, "uuid": "65d31dcc-3473-41f4-9f7b-a56fa0b8dc11", "comment": "Malware payload (Amadey)", "value": "333434a867de0b1a2ecb5ac0fffef431", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267898, "uuid": "7045657b-0384-455b-9d39-081484a2fe09", "comment": "Malware payload (Amadey)", "value": "1d7872b1e1c45136e0c8ef9d269c0bd54c8e1e83ab3242618b94580cbfce79f0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267898, "uuid": "ecb52790-6f4c-4790-a3ce-350eb8839065", "comment": "Malware payload (Amadey)", "value": "2e70cacb6467cd21e322d1edd078bfbe1bf3a79e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267898, "uuid": "f461ac90-f3ae-4a18-9c41-6f2777b517a0", "comment": "Malware payload (Amadey)", "value": "75ea3dc375e7ee402da63d8b4fad8042bc32b444ead17e17d2aabe8ee53ec06e9ae222ad78e04f5fda7b5e2b3cd1cda8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267898, "uuid": "cfd7fe02-8aef-498c-ad70-b3b6beff4daa", "value": "T15D840213B7DC5072D9B527B018FB13C30B3ABDB199B9936B2342A56A0CB27949871737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267898, "uuid": "9d53852a-93b5-4695-99e0-f6728460c5cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267898, "uuid": "9ba63a9d-5dd7-4713-ba40-d097411de871", "value": "6144:KTy+bnr+Ep0yN90QEIG/9LlvbZriMufcYjxnNmK63WSeFmuMh/M03B4oizp1daZy:ZMr0y90Ww9Lzm04ng93eMk03Bad6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267898, "uuid": "3232f6c3-d09d-4a00-8938-d316660a57b8", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267898, "uuid": "3a7f848b-4269-4bcb-9993-f656f051f6e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267898, "uuid": "4bb96d82-989b-420b-b3a2-2241fc8decd6", "value": "333434a867de0b1a2ecb5ac0fffef431.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356f0baa-2a9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690255659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690255659, "uuid": "877c7063-6fae-4f64-9290-7a7ee80b0413", "comment": "Malware payload (AgentTesla)", "value": "6c61afbf188ee10e0fcf3fa837a303d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690255659, "uuid": "2616beb7-355b-4848-be32-31ea16f09ab7", "comment": "Malware payload (AgentTesla)", "value": "1df31e1f77cb6e4a128c2eea27424948b7b8db593a958bf573ab95180f230eca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690255659, "uuid": "cc66a302-fad8-4b10-95de-8f32f31e506f", "comment": "Malware payload (AgentTesla)", "value": "59f7e49575fa38cdc1f31dce9b269eb276ab9782", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690255659, "uuid": "3cf7af22-d204-48cd-b48d-16ac52a3ef73", "comment": "Malware payload (AgentTesla)", "value": "ef450bd9d41187729e038b9c3b6dc9fa01a0a12434d37aaccc970f3ee045404c88fd31580165b9f8835dadce6f7a8d9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690255659, "uuid": "825aaba3-0eb5-49c4-8704-d81999b4563c", "value": "T1BEF423197A854647C5775FBC0465B3FA27BCEED23420E68B6CC7F18EE9A6F5C8A60001", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690255659, "uuid": "443d37e2-7e79-43d2-a05a-6dbe6c6c4304", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690255659, "uuid": "154e8cf1-2e95-4891-b3fa-221cad9b32a0", "value": "12288:pYiIoFwIrG3XCCa6nt7BwJxN7hu7NrcMyXsu0zoliJEWgPHI+ABj2fmuVfeuxG6M:pHIcTrGCeqJf9u7NrDxjUWX++SX2uuS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690255659, "uuid": "0c6c7711-65b4-4e64-9625-b260f1ecd402", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690255659, "uuid": "39583d98-d33e-476f-9ec8-74d98706468f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690255659, "uuid": "07ef4a7e-005e-47a0-9328-887676fd01b7", "value": "SecuriteInfo.com.Win32.PWSX-gen.9716.10137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d514afc6-2aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690269242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269242, "uuid": "6cf8b654-879b-4c8a-9df0-36ca486b4d89", "comment": "Malware payload", "value": "de9f77b37b8f7d332b1c9d8af245045c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269242, "uuid": "d0c28090-a6e3-4d84-b382-117d631ce3f6", "comment": "Malware payload", "value": "1e4270a86c472493d864df72712006d7640555983fa62808bb781fe7973b2555", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269242, "uuid": "2d55c718-5dd1-4be3-a6d0-c79d37360e8c", "comment": "Malware payload", "value": "418ea707d83a9acc7887e5d4c278d84e60c6f11a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269242, "uuid": "b21ae269-5b66-4ef1-a91f-82755f8e40fc", "comment": "Malware payload", "value": "3755c8df0433905ea0c29d966486df893cc058adfe6b127b3c736098e8388f539a13ea071400cfdfba5cce0c086b0992", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269242, "uuid": "49c9a993-a722-4d60-9c02-361ff1b48acc", "value": "T1E8A68C83F85511A8C2EDD131C96681527B717C454F24B3D37B20F7B92E72BD8AAB9390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269242, "uuid": "08a1ec8d-742e-43d1-bd8d-d8989dc069ed", "value": "98304:yBeqtDSa86d5XEKtEVDQsyOHFwf0kyQZbaAhJcuEC4o8:o58dyOHFwMZQZbaw3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690269242, "uuid": "a15b2754-b691-44fc-99a7-1a5fd0264e47", "value": 9980371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690269242, "uuid": "3f2a2803-9d06-4f53-b32a-4552d6bcdc7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269242, "uuid": "dfa8714a-6ec5-4404-a073-5acff8f2a43b", "value": "de9f77b37b8f7d332b1c9d8af245045c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c433bd1f-2ab2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690265777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690265777, "uuid": "a316b445-314f-485f-a551-2864611c086d", "comment": "Malware payload (RedLineStealer)", "value": "1b39c696c7ebdec56e5bd5e819ff51c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690265777, "uuid": "35b7ebf0-b105-49ab-b008-953491a89186", "comment": "Malware payload (RedLineStealer)", "value": "1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690265777, "uuid": "44076de9-edd9-4630-9103-943e1a5fdbbd", "comment": "Malware payload (RedLineStealer)", "value": "13499e2a975747bbc7dfa629b93c79143980cb5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690265777, "uuid": "a9585ffd-c7bc-425b-a26a-9d2f34aa3175", "comment": "Malware payload (RedLineStealer)", "value": "c84c2b702067aa8ff1f967d33be89bb9e61957d84c0c480e07430f9b427eb9c9c8c38319093ef24d1e1cea8fad4166f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690265777, "uuid": "0d6435fb-4a30-462e-94e2-1b6e76be83cf", "value": "T144840202E7E94032D9751BB058F603831B3ABDB19A38876F3246AC5A0DB36C5E47577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690265777, "uuid": "39c43565-d6fc-4511-8ee8-1c341474042a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690265777, "uuid": "c3000fcf-9486-455d-88a6-19439cb59759", "value": "6144:KKy+bnr+vp0yN90QEITqYImmruIrRHY6y0ZJJqB5bu9CVCyXyNRK2h7nSXO/:uMrry90mTImmiazSBJlwuXO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690265777, "uuid": "32d8aba7-2a97-48c5-a444-2860a8933a3e", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690265777, "uuid": "0566a3e6-2dfe-43b4-a8b4-f98a63f3d0a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690265777, "uuid": "50469818-4648-4ddb-8bae-68c7fe2b3fac", "value": "1b39c696c7ebdec56e5bd5e819ff51c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd2bb52-2abf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690271085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271085, "uuid": "69e4ddd5-3b27-4a17-8209-18d86124b029", "comment": "Malware payload (Formbook)", "value": "ad0709cf1533fde8decc5f2810c8bc1e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271085, "uuid": "27e36591-5de2-40d6-8390-dba3f27fa9f4", "comment": "Malware payload (Formbook)", "value": "1e6db8de325bef2d023ece5b3f96258ae70b7fdb5e7c26cf2d907fd56e94affa", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271085, "uuid": "f06fe548-a8ef-491d-80cb-0b910b48155a", "comment": "Malware payload (Formbook)", "value": "113fa18099cf18d78116ca5001eca91304d60eb6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271085, "uuid": "a8a98eb8-dec3-4cd6-9447-e0b24a30426b", "comment": "Malware payload (Formbook)", "value": "a1b57102beeb8f80189e4db4bad937577bafbdbcf5faa981f4321ad299055e51949abe2258d2c767fb5b3c4fa397cf75", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690271085, "uuid": "a0e3957d-6900-46af-9dbb-68d917b39343", "value": "T1C1C4235E18A7904D26438BC297AFF85CD72D49B060CB0D3996F9B739A301E4EE1A4D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690271085, "uuid": "124a791d-4c9a-4e85-bd52-4b5a1870f941", "value": "12288:o47jrDwgdZlGvKa6ti1vyYsgaodlBsIGC2txU:9jVYvNN1aYsFCDeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690271085, "uuid": "bd050c21-6c32-4548-89f8-4d0f7749006a", "value": 557954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690271085, "uuid": "b7439159-1b03-4582-a016-fca62446fb3e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690271085, "uuid": "8eab5eca-2d76-4e5c-a337-3620d8800efc", "value": "Document.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0696cee-2b18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690309526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309526, "uuid": "28254e97-d246-47f5-a65b-e52dc447004d", "comment": "Malware payload (RedLineStealer)", "value": "6659f84db9582049c250a8343dbf9168", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309526, "uuid": "e588ae2a-865d-4f09-b6a1-0fa73524e9a6", "comment": "Malware payload (RedLineStealer)", "value": "1ed33d760f151b33b3d20bf9e6d0b722fe39cbd302ecebb5c6e3d0ee09e4ee05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309526, "uuid": "e8cfada8-401d-4ecc-9878-99ef81e4d1ec", "comment": "Malware payload (RedLineStealer)", "value": "e58b0d6a289be0a12f20587cf8945233a086a27e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309526, "uuid": "9e37d619-0843-4fb3-99b4-ba8b88117be8", "comment": "Malware payload (RedLineStealer)", "value": "fa6ea54dfc701636d327b89999a23805fa485af6d0ff7df03ffdd183c2f65b1c8662071576522e42fa01d36c08cb39da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309526, "uuid": "5032770c-24df-4729-b87a-1658448bc9b6", "value": "T1D9D533AE3D83254ACC4E12B1E75DE49CD028B7D7EF84152138DB93CEA935EA017362E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309526, "uuid": "9d7dc202-706f-431c-af19-a55e9f2eee8f", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309526, "uuid": "4148aa9c-c0c6-40ca-b1f3-73ad3bd8ff33", "value": "49152:4K9pTJqY0xorwlsQRXh9e3rcpadXRZCq3PPK5/AQEiNT18Nnb+vE:4KLvZrAjX/rdlpLk+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309526, "uuid": "6bde81a1-875c-437d-a5cb-efb518fe5ee7", "value": 2964096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309526, "uuid": "84271db4-d8ff-4761-b450-33dcee3f6dbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309526, "uuid": "dc3772b4-2c7f-45f1-b823-1ffdae3c689a", "value": "6659f84db9582049c250a8343dbf9168.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e656d9-2af5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690294587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690294587, "uuid": "4e369f28-b8bb-474c-8899-32602800cb10", "comment": "Malware payload (AgentTesla)", "value": "da32c600c6cb4e240b694143a5d09ebc", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690294587, "uuid": "b5aae90a-f583-4413-8219-d59da56dad3f", "comment": "Malware payload (AgentTesla)", "value": "1ef1c4790b706fe837a7a38ac290eb9677362c97e2c5a976ac6b06763fe23f9b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690294587, "uuid": "0003c4ad-9e93-40ec-9e3f-278cf0593f46", "comment": "Malware payload (AgentTesla)", "value": "acec488e3c7c54ab1da5b632950e0d7e6e51c5ad", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690294587, "uuid": "b903b727-ec75-4be9-826a-12a9bcaecc6e", "comment": "Malware payload (AgentTesla)", "value": "784783964dad123261e9ef96ef5612dfca389fbefb82e0f097a3dfe7c7f47e12cd96313c0821c8dc951ed7ca25875a0f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690294587, "uuid": "b8511c7d-277d-4859-ad80-406d7678e07f", "value": "T13FA423A138C1170FB3A4F7B8446965F91E80F13983B49D694AB495FCA0C9FEAE055B88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690294587, "uuid": "a4489254-3b68-42aa-a2a5-ca0fe256996c", "value": "12288:tQbnELSDr4JNonmHR2KrmJswhwAzqzUbRsK:tQzELwwN0mx2KrmywOzKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690294587, "uuid": "358174ef-02fd-48b1-97bc-b0fe46bdf83b", "value": 467612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690294587, "uuid": "6278700b-0e7f-4572-bc41-20512a7f7e2e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690294587, "uuid": "1e19b7c8-eb9c-47d4-ae5b-6160a728a34a", "value": "Swift_coft.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd95b9c0-2b17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690309146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309146, "uuid": "2b32c329-deb5-45e9-9358-4e5c549e9318", "comment": "Malware payload (AgentTesla)", "value": "3edd713bdeb96bb802072c593d076e43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309146, "uuid": "a5d3a681-39ea-413b-b6d4-1cf2382fa34d", "comment": "Malware payload (AgentTesla)", "value": "1fbe5f912ec66d5c25ad0684a7fc431d87d9f04b47d45418d18821c1f29cdf06", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309146, "uuid": "3b697715-dc2a-41ff-bcb9-dca37bf0ed04", "comment": "Malware payload (AgentTesla)", "value": "dd10477e2464621ee203957dc95120340c6d583e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309146, "uuid": "9c13b727-8108-4d11-acc0-c47d1353d223", "comment": "Malware payload (AgentTesla)", "value": "36c2897896cbd266137d85853e5981432ff718b9fce9fa20507de4d6c357e9f5c8f34df5c84db34136ffb333f4646407", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309146, "uuid": "484b7ff5-e894-4c27-80e3-0c7d14afd301", "value": "T152C4125163ECBB53D17E67FA182140248BF4BA5B6432F7181F9C24DA4D21FA08B86F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309146, "uuid": "e2a8bd2c-5476-4f54-9588-8bbab571d390", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309146, "uuid": "2cc7213d-3c09-42fa-9667-4d43da837c3f", "value": "12288:KXPZ5n0DZMf+fXd1YWOkljEbXzOIuOO2W:oKZf7UtuOO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309146, "uuid": "931e7378-350a-4003-82e6-475fec13d496", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309146, "uuid": "96dd4eb4-b07a-41d3-94bc-3afabdc78fcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309146, "uuid": "ee84b912-9a45-4975-ba85-1f6886dbed26", "value": "3edd713bdeb96bb802072c593d076e43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2774e607-2ad5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690280547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280547, "uuid": "4e85ceb9-c5b6-45b9-a74d-0cb093ef19ca", "comment": "Malware payload (Amadey)", "value": "fcfd494be2136be3811028f83b1a79d4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280547, "uuid": "271ee310-5097-4462-8234-15f273fef7bb", "comment": "Malware payload (Amadey)", "value": "1ff9d4437059ea2f79fecc4df81809fc7b7713ca4d3d30e6a1cb4ccad5bededd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280547, "uuid": "012661da-5601-44d1-8acb-f11221fe399a", "comment": "Malware payload (Amadey)", "value": "ef295495b8764464c671d3b3fab8a16c8049b4f1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280547, "uuid": "6be4d563-c563-41d3-9019-943f331ca658", "comment": "Malware payload (Amadey)", "value": "0ff64c7f10a108ec2c725d467294e8834f20a7ddfbe0c03b60efae54df539cd9fa6292b84533193901ac70e0b1aa76e2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280547, "uuid": "a30e8b73-4778-4093-8091-e09e9faa5d40", "value": "T136B40255E7D49033D9B42B7029FA07930B367CE21978976B3386995B0CB36C4A4B237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280547, "uuid": "382972b9-d331-41bc-926a-09fa1e813a7e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280547, "uuid": "61dc2b03-bcae-4e7a-8926-78751c248832", "value": "12288:yMr7y900ZRRjXI7P4aIq5rvJF1CaN/sDlU:5yjZRRLOrJF1rUDlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280547, "uuid": "ef2fea56-8cd3-4538-8cca-412ec111a606", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280547, "uuid": "2a4d9641-4ec3-483c-8f93-a1b29df0e8f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280547, "uuid": "15d47332-0c1c-4060-b9e9-22f50242c0ce", "value": "fcfd494be2136be3811028f83b1a79d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4fb6562-2b44-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690328539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328539, "uuid": "0d5a0c64-2031-4081-9f63-2141394d951a", "comment": "Malware payload", "value": "87edf2ffcb84c0d885dbdb74b16f6f54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328539, "uuid": "6328de9e-5eda-4105-98e0-df7bf257c3de", "comment": "Malware payload", "value": "203a614497e65ca21d42a4ed05f6efcbc9582ff5cb00652f83f4534f0cf1d953", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328539, "uuid": "d2398589-d713-4d6b-a8fb-f7edb8f2e760", "comment": "Malware payload", "value": "ae58cfd2293b8e24fa8cfa0f74f0bb4c57de5ba5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328539, "uuid": "b11de952-a4a3-4407-bcb7-ce365ba55ac7", "comment": "Malware payload", "value": "48fa5e2b0a41d163f7e3a62524939e43cf7d307ce11477d5365182c3aa2be42526e7d121565e6dd872d28aa5a15611a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328539, "uuid": "76219bd4-7e1a-4bd4-ab9c-7031f32111ac", "value": "T16B75F128B5E04537D173193C9C0A52999469FD613B34EC86BEF42C9DAF3CB513D2A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328539, "uuid": "795e2a39-f2c2-4487-a2d6-80ad4dab0463", "value": "ea8d56a6b9f4ce307f716636038657d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328539, "uuid": "603408b5-7be5-42f6-8ff7-4c0b2e62cb99", "value": "24576:rbGHGrOrQ9gnMC6LO3cQoikKgti8PM2MCUrTDLwVIf2IOXkDtZ3NptsWbJZ:rbGWAJeDingti8P+TwSNO0n9vrbJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690328539, "uuid": "8430900f-dd28-432a-a77c-2dc4c5671b37", "value": 1595904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690328539, "uuid": "b729e723-86a2-4439-87c6-c81d6778a957", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328539, "uuid": "1bcb65b5-5969-4651-84a6-eda6787cca55", "value": "87edf2ffcb84c0d885dbdb74b16f6f54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721134a0-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268217, "uuid": "73f2d837-fa28-420b-a770-c4f82d52c846", "comment": "Malware payload (Amadey)", "value": "49db7ccf4cb5d95a22018354fa424acd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268217, "uuid": "c888e296-1775-4870-8007-0b01186daa68", "comment": "Malware payload (Amadey)", "value": "20515a72a59f48563a710bc54c690ebb172cfeea9fc833a7a771db72c97452ff", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268217, "uuid": "44406c50-ad8f-43ef-8185-056ab829162a", "comment": "Malware payload (Amadey)", "value": "8686779339410996e241237cf2259d92915d1d05", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268217, "uuid": "b3617e4b-ebb9-4792-a9b5-59e329ea4444", "comment": "Malware payload (Amadey)", "value": "1b9192e40a98b2fe0d05bb1be21724517ccb759f84a324411e58884b00022ecea381affc27e3f53c2e188a68deb1462a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268217, "uuid": "2d02a878-faaf-40d2-98ab-27c30b5d99e7", "value": "T1242408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268217, "uuid": "33894163-531d-45d8-b80a-1f404c2cc8d5", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268217, "uuid": "431540fd-73f9-4eeb-a993-e71f14ace6b9", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268217, "uuid": "bb375e1b-612a-4894-843d-e5f24f93b165", "value": 229117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268217, "uuid": "988d107a-df1c-4d09-847b-cb0979308397", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268217, "uuid": "4d0ae678-a073-43ae-93d2-294ef771290e", "value": "49db7ccf4cb5d95a22018354fa424acd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600813a4-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690296963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296963, "uuid": "a2d7007c-56e6-4de6-89cb-3955f8501adc", "comment": "Malware payload (RedLineStealer)", "value": "80e5b85ad2771bd1159d472952a64feb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296963, "uuid": "a9d6dde1-0080-4af1-b932-245dad0a0120", "comment": "Malware payload (RedLineStealer)", "value": "20b011e6cd045f3d056a9faff944746f90dfe511e7310aa045ab3cdffe680cc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296963, "uuid": "4a7b2f39-b8d8-4d83-8177-e92403f5c5b6", "comment": "Malware payload (RedLineStealer)", "value": "698e2da157d1b32c058342f083aadc7897435628", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296963, "uuid": "64a084a8-e65b-4a3d-9893-58ddf7334f14", "comment": "Malware payload (RedLineStealer)", "value": "06f04904af5edbd8ccb009b306ec78be588ce3e3c4a1f036f29b9e5854fb2a89db208cb0c083c455773e04a0edd844e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296963, "uuid": "7f5cc6dc-8c4a-4f37-9612-aecb151b4841", "value": "T1C844C02172D0D073E1B385305970C6A56E7B78729B7885CB73A82A7E2EB06C19F79352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296963, "uuid": "a59890c0-d3f6-4a40-9a84-d77b93d8afa7", "value": "bb615941a9791bad98127d7fa679f59b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296963, "uuid": "bedc8dba-40e9-4f61-a505-b78acf5c4460", "value": "3072:J7HmzX/RFgogwFPvek3jkkqrnxFvGcd1Tz++oSlmjTkinaCzg8r:xYPXgotFHL33Gf1Tz++otY8/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296963, "uuid": "4e3fcabc-70c5-4d77-893c-d9d9b1d1fd8f", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296963, "uuid": "943fa3fc-ada6-4325-931a-1c745fc54f38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296963, "uuid": "718269db-b006-4bb2-b84a-87d0d41bf7e2", "value": "80e5b85ad2771bd1159d472952a64feb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d953e5db-2ae7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690288576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288576, "uuid": "88b31426-ae6e-4249-8b88-035cfad641ea", "comment": "Malware payload (RedLineStealer)", "value": "73c7ffe87431e3fec3f9c1e4084850e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288576, "uuid": "d65d85ca-f15a-4989-8394-34190b361336", "comment": "Malware payload (RedLineStealer)", "value": "21555a064acdc892c3982e3dcd7244f94737297b675284b0256c28c16011fdad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288576, "uuid": "8bddd311-9560-4f5f-8fe5-b75cf156539c", "comment": "Malware payload (RedLineStealer)", "value": "95f8225f7672332ed4926e152eec72ea71170fdc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288576, "uuid": "e8f59029-9af6-449a-830b-3efc983f0c1b", "comment": "Malware payload (RedLineStealer)", "value": "96af04fef7d6c9bfe82aa2024eabf9004ff68cd57cb811f32563e8aa533a4a8ea93fd5f1da89df3abe55421f69ae55f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288576, "uuid": "fe66bc82-d4eb-483f-aa57-18f10b325bec", "value": "T1D374E02176D0D072E07796308874D5A56FBBB871ABB481CF37982A3E2E707D15B7A342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288576, "uuid": "2cf5dc40-4bb2-476e-a776-6d196eb72f2b", "value": "1c187c5419584098cd104bb53d369d28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288576, "uuid": "f883d354-5e93-4dd4-b01a-5e3cf7663d75", "value": "6144:/Fp1g4c4UyIPPaaAegJHKtPcTNhq1wXpDopYuwq6Tn:9pyp4tvangJqtETNhq1jYuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690288576, "uuid": "2a0ae492-d670-4eb3-a6d2-637b40f6678c", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690288576, "uuid": "e113f36e-379f-4714-b46b-567d5d4c1104", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288576, "uuid": "1a9e4021-fe8d-46b1-bdcf-75a674e17d8b", "value": "73c7ffe87431e3fec3f9c1e4084850e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86313d5-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1690273945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273945, "uuid": "4c4bc769-204e-4b0f-b882-d6972af238d1", "comment": "Malware payload (AZORult)", "value": "584b030185b3d62bd057b2f22d0ee1aa", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273945, "uuid": "4effbf4b-49fa-40b8-9308-2e36a7689459", "comment": "Malware payload (AZORult)", "value": "21a3feee6f44d5a03971e5aced1f93b6bc28950d2729f411a477fdec605ec156", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273945, "uuid": "347b37d3-3bcf-4ced-b007-bf78ca7de6a3", "comment": "Malware payload (AZORult)", "value": "9cc69b129f5c79c9f0bdf2b6403bd8b2b96d0967", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273945, "uuid": "df8e56f5-b5ac-4cf9-8f1b-79250361ebda", "comment": "Malware payload (AZORult)", "value": "bd265da4af018216bd908d185e8fd79e6d73873217ff245c63868154d6342d5e8d8fbbdee69b9f9a9716f6cf4861c292", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273945, "uuid": "8d5cc77e-752e-49c3-b565-a145dd74c8fb", "value": "T112F4F12136A9AB9BD57A47F84020327413FEAEDE7436D3092DC770DA6971F408A21F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273945, "uuid": "623b8afb-bd8d-4d64-9e26-182b844dc11d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273945, "uuid": "59f03301-1817-496d-ad92-e0538208c28c", "value": "12288:bfgETM2YiIoFwIrG3XCCaEHsbH7yZ8UNU1MKU0iEqd4q5G+4OltLgHZGPxaRQ34Q:TxQ2HIcTrGCS6yZ8UNoi0iQqlDtLuw42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273945, "uuid": "0ec49e03-48b8-47a1-be9b-1bc8ed96a630", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273945, "uuid": "8c12b33a-cc1f-47ff-9647-82d3d8116b59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273945, "uuid": "2596415c-7254-4185-bc6a-cb245d2870cd", "value": "SecuriteInfo.com.Win32.PWSX-gen.29429.31088", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41940c03-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690296912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296912, "uuid": "d4d7b70c-794d-42f7-af4b-c3633ae86757", "comment": "Malware payload (njrat)", "value": "2cd95483c8d24cd9aa631c5c1a3b2618", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296912, "uuid": "ecf5ed04-3d09-4cac-bd40-870257c8d362", "comment": "Malware payload (njrat)", "value": "21afe39632e3321a24f4d421164880e89eca1d62eb9c49a93e7bb79140714f71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296912, "uuid": "43b25e86-f3cc-4807-8335-b07ad5d989b4", "comment": "Malware payload (njrat)", "value": "68813dfade49208ab476a7a2185eb704a1bcf9e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296912, "uuid": "1893f0bf-4127-4f17-bb65-28de91d02764", "comment": "Malware payload (njrat)", "value": "837791d6a01ae70d897b307f957476adc83bd001ba5a5d3aafe2d42231a2b113e39e1ddcc11d5c117b8db186d8652edd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296912, "uuid": "8177aa64-68a1-4c81-ae6e-59fdcb87c516", "value": "T1C4F48D4AB2408269C06C61F7C5EB546463F9D5C65693CB0A1ED8B3BC3A72F63B80E53D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296912, "uuid": "7d761e89-209f-4851-8de4-31639e3974ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296912, "uuid": "96dea7cd-aa68-4f4f-b592-bf4816296914", "value": "12288:lJBC5/UEFm0fsVoVHR52oD8IG2SD0WD5Ac2M8NchcG2:3BC5/UEomBVxFYL2STyc2MFhcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296912, "uuid": "38ada27b-bca0-46f7-aa37-28326950b5c7", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296912, "uuid": "8150e5ed-5488-4143-b493-418b21003aab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296912, "uuid": "738894a7-cddf-4588-b0d6-b6779df281da", "value": "2cd95483c8d24cd9aa631c5c1a3b2618.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3640c854-2b19-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690309777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309777, "uuid": "8a97d20e-5af4-438b-8295-4166f08e9d8d", "comment": "Malware payload (Formbook)", "value": "a2ec4176f418c4dc0463d31a86290ab4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309777, "uuid": "0012870b-7921-42ee-816c-7844e54accef", "comment": "Malware payload (Formbook)", "value": "22a25e723aea4b02462b73177cc0853f27cd214963bb061846837b88697a7c2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309777, "uuid": "a49a1b8c-b063-49b9-9b9a-c4167460e734", "comment": "Malware payload (Formbook)", "value": "c285390a10807299dbb6aab56fe451ebe8d5722d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309777, "uuid": "3f161457-5a4e-4c6c-8e24-1229c4d4b004", "comment": "Malware payload (Formbook)", "value": "5535564ce1822e7c1c3c444d65c65f439cef44b021bea3f893bc93cdca031b027bd503d2355c9881ad2825a198e8dca6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309777, "uuid": "df48df17-2da3-40b0-832f-6f22274d26c5", "value": "T108F4124052A98717C9E89BF46760A79253F6EBC56963D34C8F87ACE0B03FF245A10637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309777, "uuid": "993b50ce-3759-4341-aba6-2ddd9d7273b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309777, "uuid": "708c691f-0c09-4572-823c-bffd119ac2e7", "value": "12288:SJ0IkPt46c7ujzCWSD6IYktlaA8EiTWJMXU/vmgK1oXp0XNuFH2aWyjw+InUQ3g2:20IwwQCmktlaA8EiChvmgKeukgaWyIni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309777, "uuid": "3dff086b-5960-43b5-b136-d3b89a61506d", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309777, "uuid": "95639652-cb1c-4ccc-929a-515a8fad3e1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309777, "uuid": "3d979fbb-0e7b-4c78-b3b6-01db8ae129bd", "value": "a2ec4176f418c4dc0463d31a86290ab4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5aa241e-2b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690307495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307495, "uuid": "ff350b55-0f9f-4377-afc8-6842313e09bf", "comment": "Malware payload (SnakeKeylogger)", "value": "0d9920eae1982809d4cf5dbf54f3a3f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307495, "uuid": "bb74b4f9-dd83-44b9-8052-b1edb59496b2", "comment": "Malware payload (SnakeKeylogger)", "value": "23b6e6ddaf2fff34828dbbba29c5d6315d78a6660236d5fd0da7d8322c3e6f1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307495, "uuid": "f0ff7362-0cfe-4f77-ba87-675eb11504ee", "comment": "Malware payload (SnakeKeylogger)", "value": "234ded23cba2128012a8011fa57776f5731cba8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307495, "uuid": "67c6cee5-6d26-4ca8-bd82-beef25080e16", "comment": "Malware payload (SnakeKeylogger)", "value": "690de48293cc422e46bde52ca463df4785d25711404877c93b0fb5ed92380ee9d2f18cbacf5e93939ceeec921a35e860", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307495, "uuid": "96c3f9df-18ee-4cc7-ac2d-fdd302313c74", "value": "T11AB412BCA2ACFD43CA6C8FFA81C1110D1AF5E72BA517F3C99ED560D289967701690387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307495, "uuid": "e6e76593-85f8-4012-9ab8-6173d9691734", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307495, "uuid": "6ae06159-5734-42eb-b2cf-e5f3d798f3eb", "value": "12288:RWFQshhQAlCJX7bFDIKQucqLXMzfLbccL+ugcPVwy/yWE3:DshEJLbdIKQliUzHay/BE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307495, "uuid": "c5c39108-b498-42f1-8615-f7a876b762e4", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307495, "uuid": "da415fec-36c1-4579-9723-84be12a91b6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307495, "uuid": "d2c927f6-5f1a-4cba-8252-42b6566b9662", "value": "4567876543234567876543SF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e5d793-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290473, "uuid": "6e9ac891-21dd-448e-9cd9-17f1f2a02a0c", "comment": "Malware payload (Amadey)", "value": "deff9c193b0508086e4a7e4c05d98e47", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290473, "uuid": "63a89d25-b1db-40c6-8b03-453b645705ca", "comment": "Malware payload (Amadey)", "value": "2414583daa6184ebe145a5dbea64a3869a4d5c40e0109e53e982f9d9cc4503c8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290473, "uuid": "de66d5ea-129b-4f6d-9b14-58604ff0f067", "comment": "Malware payload (Amadey)", "value": "3f98bca5eb00ab9d965f1e55b73061f611ed65ae", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290473, "uuid": "f2d2e2c4-4115-4e44-8cc5-37e6eac78adf", "comment": "Malware payload (Amadey)", "value": "d3d8dfc5359f53294773ae4d793f020048d2d98537c7b01b5e938e02e55960cf023976e096fc812a5cec18c9fbbad322", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290473, "uuid": "1f790afc-a718-4750-b55f-dbf9476171ae", "value": "T11C84F103EAD88432D97527B058FB06D30B39BCA19D7C936B2745E99E5C732C0A87176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290473, "uuid": "c4fe7be1-cdb5-4c3f-8297-9bef4119fe1a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290473, "uuid": "31b2004f-a8ea-4513-b61f-69bffa63c575", "value": "12288:0Mr2y909J1TxRbXTTr3PuFC8gBYCOzY1yH:CyoJxxN/r3PjzA0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290473, "uuid": "55e03f0a-f578-4b34-9844-befd6ff7b40d", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290473, "uuid": "6f4858a5-391f-442b-9876-47f15cfcc4bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290473, "uuid": "4a0a27f2-3c38-4b2f-9c54-739fcf505a81", "value": "deff9c193b0508086e4a7e4c05d98e47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df72902b-2b15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690308343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308343, "uuid": "c3dc4aef-48e8-4a9e-aa53-fada8027b342", "comment": "Malware payload (Formbook)", "value": "e7971dcf73e81e55a24b860074fa5f08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308343, "uuid": "7b52d043-b3fb-45e3-92fc-56651736fb05", "comment": "Malware payload (Formbook)", "value": "242076a2e3a87ca52a197c67e4fe43de3d0ed3b371dc2baa33c84245a6dadd8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308343, "uuid": "ad891428-e0a5-4b96-b43f-ad0473cb0cdb", "comment": "Malware payload (Formbook)", "value": "727fa0c33c1c3b0943b3d5802edc3cf2e9de127d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308343, "uuid": "56f682e2-c927-4a07-83ef-f31b72beddd3", "comment": "Malware payload (Formbook)", "value": "858bbb8a93790ce1ca0288a73ad14389f8e5c7347d7c9b64fbdae16e5922811098d6b08ae24b858365abfc9c250fe067", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308343, "uuid": "96c94d70-db34-4400-903d-2e8d4d9b5a81", "value": "T116E422616B89C76BC19E03B814307BB9567D9FD53851E7CB1C93718EA9B2FC8A970083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308343, "uuid": "39107efe-bf71-4fbf-b8a0-f3fdb57422de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308343, "uuid": "be93134b-4061-43d0-baa1-b12c36c3175a", "value": "12288:wYiIoFwIrG3XCCax5ISzJYzW0dnTyw3qfjEj0tII5S8bZgR:wHIcTrGCRZzGv9qfjEj0tbSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308343, "uuid": "c112f774-6b6c-4002-8738-deaf55706b10", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308343, "uuid": "bdcf0df6-e5b9-4f58-8f8a-df2ab46dbc54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308343, "uuid": "9312d762-71b5-48ee-8532-dddc984ce4e3", "value": "Shipping Documents Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3a4075-2aa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1690258273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258273, "uuid": "b947fbde-20ba-40e7-b6ff-b6201bb752e5", "comment": "Malware payload (XWorm)", "value": "e114ee8f34fd485647c0512aef82153b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258273, "uuid": "071c9ae6-7ea4-4d80-b8cb-c34a6b154886", "comment": "Malware payload (XWorm)", "value": "242f11561bddce2000654c9883ce4953ae8783eee3afa005c63cbfe0851327dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258273, "uuid": "55145cf3-bdf0-4a0e-9ef4-cef08285e23e", "comment": "Malware payload (XWorm)", "value": "ebc796f112c6d7f1f0d95ea7cef3e2893e34b97e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258273, "uuid": "587daa32-ba37-4ac2-acd7-4cb171731ae6", "comment": "Malware payload (XWorm)", "value": "9dbec7e9aeb88658bc76bd022299d14e6d6c453dfc691dba72a3b1739a0ca052fb8400cf6a47a7ac23286247cfb69b70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258273, "uuid": "abb78e7e-5be6-4239-8c12-49d3037f706c", "value": "T11EE538A1303E8787E56B4FB22ECE85305DB5256CB5D8E21D31F6D76A63E2350008EFA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258273, "uuid": "ad7a0449-d442-4f01-84bd-6b8038d950a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258273, "uuid": "f501504a-78ed-454c-87b2-a0c7492a3dd3", "value": "12288:R6QFPuY0PSzWUAPSzWUIeRNq0tnJGqSEy/voMEYAL8e:jPuldUmdUnRRwqF+oMEnQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258273, "uuid": "0c6bb8d2-2396-4523-ab01-d3e01d745435", "value": 3145728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258273, "uuid": "369f07c3-dc41-4885-990e-9e61ac7bf211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258273, "uuid": "aaf16201-6286-42ba-bbc8-d2367e67476e", "value": "e114ee8f34fd485647c0512aef82153b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8c75e2-2ab3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690266063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690266063, "uuid": "dcab40c6-5a74-4e8e-a7f7-9c2465480666", "comment": "Malware payload (RedLineStealer)", "value": "4e89c8ab274dd94465d49ed7b67e9979", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690266063, "uuid": "110968cd-35d9-4402-adb4-8f9c42f45675", "comment": "Malware payload (RedLineStealer)", "value": "2432f37cfbe720ce2f627a725367676d71bb944d2306c1eab9bab6b0cab5e01d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690266063, "uuid": "dabef925-3eff-45a4-bcb3-89793ca2c452", "comment": "Malware payload (RedLineStealer)", "value": "6048ea64bf04018bf560334945745677c0d5f1e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690266063, "uuid": "49777ce6-b394-43b5-a0bf-df790cb3f3a7", "comment": "Malware payload (RedLineStealer)", "value": "0e9abe63053a2353b122882a3483e41fea079729ebda7d2e811a26b19ce2848a50f2994a6cce0212b9e9dd05f8e608d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690266063, "uuid": "243204a5-414c-479b-be46-b41404679bce", "value": "T174B4026BF6EC4032D9715B7068F907C30936BCA59D3887A73752AD8E0C726D8643276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690266063, "uuid": "5197e4c1-463e-41f4-a756-2b91aa86c995", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690266063, "uuid": "6e9c1a87-0eef-48ee-add7-2ac4a865a5b5", "value": "12288:gMryy907GpFrreamboOBlpUn7NeXsLrhtRBW3eaXDi:iyEq6ayoAun5eXsH7RBWOaXDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690266063, "uuid": "1b8ef69e-e86d-43f7-bf4b-0f6c3f0cd40a", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690266063, "uuid": "da433a08-2710-4d47-84a8-510e87071eb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690266063, "uuid": "1d710c6f-8291-4bf0-92e9-2ae8aced9950", "value": "4e89c8ab274dd94465d49ed7b67e9979.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c70a8ae-2aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690258597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258597, "uuid": "ea2ff19f-9f5f-4cb5-a687-e748eb9a9d4c", "comment": "Malware payload (AgentTesla)", "value": "30f4b0670b2cd0d54ec80173fc5b87a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258597, "uuid": "e2eaf0d1-6994-4856-ac6f-cddb7dd3bf06", "comment": "Malware payload (AgentTesla)", "value": "243855e161768cb2d782283bcc440dcaeba2a7aeb3f270aca08935280626658d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258597, "uuid": "a384c719-52a6-47c9-9b6a-eb495038f656", "comment": "Malware payload (AgentTesla)", "value": "91a82e119ba24e36bd5456d94b4aeed2bebfe21f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258597, "uuid": "6b01e079-fe11-4a36-a196-9ff7aed28a1d", "comment": "Malware payload (AgentTesla)", "value": "9bdaf76f9e785683fa19d86e11c3f15d9785f3263769956b92567e179aeed9b41c761d87095115f02ffb0f70f948d4e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258597, "uuid": "f58e1f68-76fc-44fb-a72e-08561b17cee0", "value": "T160D4E0663E28DDD7D516673D88E4E6154A18FFA23D91E30FB214776FBB73B04080AA84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258597, "uuid": "0fa927c8-3c9b-4573-9be1-97409898c9a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258597, "uuid": "0a921631-f532-4de0-b19d-36029c9ab871", "value": "6144:zbe/CD3jYNt86pbM0Y3Y4Cp6Q9/XFF3SNzxEpoSU6ygAwn/AtWYJy3UBXGBMOYF:WaD3UfvpFqbQN4VoAly+BO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258597, "uuid": "8f1f9052-3036-4bab-865c-01b2b26c1670", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258597, "uuid": "73b966ba-86ff-42e2-9520-5d9e62761e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258597, "uuid": "b5fa2f1c-f2ad-40bd-b5e7-2df48777dc2f", "value": "30f4b0670b2cd0d54ec80173fc5b87a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6430ac09-2b04-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690300835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690300835, "uuid": "32e6e847-5158-482e-953e-b7afd3cc0d9b", "comment": "Malware payload (RedLineStealer)", "value": "3af762123fb3e732ba82d565b90da272", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690300835, "uuid": "16f99568-8e76-47fc-96b3-fdbe50e5c503", "comment": "Malware payload (RedLineStealer)", "value": "255e9e0a17feda0822bc14e70375984e2a575e28bf694320f2a4698b8c97ad72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690300835, "uuid": "6135482f-a2e5-42a5-94c6-d49672fcf06e", "comment": "Malware payload (RedLineStealer)", "value": "1c9b1b63feeb3622bf9e8935f306644569219014", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690300835, "uuid": "bad48e73-99f4-449a-a60c-58f0d504cf3b", "comment": "Malware payload (RedLineStealer)", "value": "67b84c412de3c12304fb11ab1fa9a780b72c18edbba01f7792c7928898416e2c0f8ac8c05767a597bb031ba8d27b7812", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690300835, "uuid": "7d012d7d-99e6-468c-b24a-0b649b4fbbf1", "value": "T1D87428C0338845DECD4E89F1642969648A74C442E787FF537C4BE8F638D9B997A043EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690300835, "uuid": "66ad12b5-5a87-4d4f-b2a6-553b41dd7eef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690300835, "uuid": "78c715f7-bd97-464d-92d1-2ef9d7387f54", "value": "6144:TTjqXyGXTuKrJUulBEMw8gm0g1Fg1g1l1hgk21111g11eg1e1hjIpkvJZrN1mnTi:bqiGXTfJUKTFkvJZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690300835, "uuid": "b5fa3f06-0272-4635-92d9-cc06a0b08336", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690300835, "uuid": "06a6842b-d780-457e-b8fa-4c238285fc50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690300835, "uuid": "3589248c-7452-4ff7-ac4d-7e2bcbf2bbdd", "value": "255e9e0a17feda0822bc14e70375984e2a575e28bf694.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b929ec4f-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690267906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267906, "uuid": "a95eaff3-4f76-4e97-b5c5-231579d6d023", "comment": "Malware payload (RedLineStealer)", "value": "324e67d87fccefb7e75f2985c9367bd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267906, "uuid": "32571ce5-da3e-4505-9024-bd80a1108acf", "comment": "Malware payload (RedLineStealer)", "value": "2577bd2a22a0df03082a3d61b193668ccfa94a1aef60cb7bb0a7a5123c552c1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267906, "uuid": "fe4ce594-bc4e-48b8-a262-48a4cd49d1c4", "comment": "Malware payload (RedLineStealer)", "value": "38e78535b68963f5ddbd4723affd083eb88505e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267906, "uuid": "ade78a3c-ffff-4a98-bb69-d5b3b4bb226f", "comment": "Malware payload (RedLineStealer)", "value": "621af566239c0583461a58bcd385aee14a29662e80972e7cb34dc941e631a663a94295ea9dc989326e3e13ff6727d576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267906, "uuid": "2ae2988e-9e53-4353-9b81-1fb2b40db6fe", "value": "T149B41257BBD99073D8B6177068FA03930933FC618D74972B2396AD660CB26C49931B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267906, "uuid": "493aef2f-e5d5-4ed3-a0c1-0b1c75b02ee3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267906, "uuid": "befc08c5-ca32-4f48-b73d-b464022fd97d", "value": "12288:UMrvy90CUJ2Myz3olrn+6SPVCL0Hk4mLgZlh4:jyLMuoljSPuWnmLgZD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267906, "uuid": "397d22d3-8f59-4a11-a9cf-797f46e5cf97", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267906, "uuid": "e51889a9-de12-4c38-89b4-998344c92f8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267906, "uuid": "ea22dc89-38c5-4872-82bd-0d5471be3e24", "value": "324e67d87fccefb7e75f2985c9367bd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475e0e52-2aed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690290908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290908, "uuid": "e2edc6c3-a7a9-4a04-b3e8-535336da1982", "comment": "Malware payload (Formbook)", "value": "ab74eebe38a941173d4b38ee2864563b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290908, "uuid": "ed2485d2-8e81-4149-a5cd-6d7c52a1f639", "comment": "Malware payload (Formbook)", "value": "2633fd674505d06c88a704274a37c5ea94c316b9c7e55d15a2fb7bb1f0e1945a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290908, "uuid": "1409a4db-6d08-4306-9f38-180b9bc3a4d3", "comment": "Malware payload (Formbook)", "value": "3447399f7e6d26d51deb495fb0eb4d0e72f1ab62", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290908, "uuid": "34bb2296-c4f9-4bcb-958d-e507f7d853a7", "comment": "Malware payload (Formbook)", "value": "6d5102ae9a62fd176aa02b7191f307ace50bf9df1a4f7afda4c9ea0968e04187aed1ea584cab78695b22c982cfb8da5d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290908, "uuid": "60b29e56-02cf-4b51-a092-fda0f6874873", "value": "T1ACC4235E18A7904D26438BC297AFF85CD72D49B060CB0D3996F9B739A305E4EE1A4D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290908, "uuid": "aa3f849e-2256-4154-9a24-cf80d0e2684c", "value": "12288:o47jrDwgdZlGvKa6ti1vyYsgaodlBsIGC2txU:9jVYvNN1aYsFCDeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290908, "uuid": "9d04e02f-1a08-4a27-ba91-db198666578c", "value": 557960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290908, "uuid": "c0a847ea-834c-4441-bbd3-0cc9c9bce20c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290908, "uuid": "40beecd8-ed19-4dbc-9190-c948a4bf3348", "value": "Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40c9f02-2aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690269159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269159, "uuid": "c602b792-b2d6-41bd-9fdf-5ea02a7751cc", "comment": "Malware payload (RedLineStealer)", "value": "cc66c82c57c64e1f704d9cb9c01f652f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269159, "uuid": "5f63da5a-a02a-46e1-8cdb-c7894afff08a", "comment": "Malware payload (RedLineStealer)", "value": "26fbc16c756e42dbd9c55553fb34e1e422637371c3e51c112ecbb30b4d831029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269159, "uuid": "5cec0178-037d-4ce9-86b1-ad379a254baf", "comment": "Malware payload (RedLineStealer)", "value": "9a4ceb001da2346f1b27fab12af3b4c17a747fc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269159, "uuid": "53dd1f08-e92a-4955-98b2-7873940eb911", "comment": "Malware payload (RedLineStealer)", "value": "4c1c3a42e76cab4ece0b5f390cd26eace24920683cfdc99da5c3cba13c3b987d0880098a976e13c6e20a321d36996d30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269159, "uuid": "6221af4c-0692-48d0-8b53-24598a498e71", "value": "T1CA84F106F7E54077D8B51BB048F713D30B3ABDE29D78876B2385685A4CB3A88947172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269159, "uuid": "cc345fea-b57a-4355-84f3-851d9140486d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269159, "uuid": "283f6c63-ae40-46aa-9d40-74e02a5ae5c2", "value": "12288:BMrny90hKm65uRgjjL2K9rOOQuJXKp3wIk/77M3CBy:Syu5RijiSOOQQXk3wB/XeCBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690269159, "uuid": "b456cbde-5d95-4434-ad20-36591e6d30bf", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690269159, "uuid": "cc0d5553-2533-4556-a984-df8d97c156a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269159, "uuid": "624158ac-93c5-4ab0-8c1c-da1618fe279d", "value": "cc66c82c57c64e1f704d9cb9c01f652f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b605b5b-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268554, "uuid": "958abbb8-965c-4a47-a438-3a3582f8135c", "comment": "Malware payload (Amadey)", "value": "ae03ff5883ce0ace85ff278e2d5acc70", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268554, "uuid": "37dc6382-1c7a-4bd4-8de8-ea3ecdeb15c8", "comment": "Malware payload (Amadey)", "value": "277b2bcaac65acdc682ea6780b505743753d41cf736237777205549945131d32", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268554, "uuid": "7ec48425-9c69-48dc-8560-8d3f5a85a999", "comment": "Malware payload (Amadey)", "value": "fedeea4b9e825454850dc54a365c8b2421e78272", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268554, "uuid": "40f4930a-cb5b-4968-92ad-1630aeeb6e52", "comment": "Malware payload (Amadey)", "value": "e19790e2decb9532e66db75bdceecc30f77a8d7c2c6b518c2f791ec7e8c672b733164a3d79b8e48b4ebf54df89db252f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268554, "uuid": "3b6a0945-ee5c-4d3f-9f05-4a0b6243f235", "value": "T1BB2408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268554, "uuid": "408bd5d3-12fd-46fe-b488-09c38223af9d", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268554, "uuid": "59ead7fd-b648-4633-ae21-c3c0a39bf421", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268554, "uuid": "ff4fcfc4-fd97-4423-9a16-4dca3e18c368", "value": 229324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268554, "uuid": "26a56f0d-fb6a-42d3-a131-8bfa0db09736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268554, "uuid": "ea0babd5-04f7-40b5-bafe-b8c00ebd43ec", "value": "ae03ff5883ce0ace85ff278e2d5acc70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51835431-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268591, "uuid": "1ccb58d2-cc39-4ace-a5f3-72eb3b2aa6b8", "comment": "Malware payload (Amadey)", "value": "a68ebb13573c0c7875bb01ff7480cf69", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268591, "uuid": "736dbda5-3cb4-45d9-91e8-d7c9043d7dc3", "comment": "Malware payload (Amadey)", "value": "27da5584cba11d55bda77fd3af40f3a11bb26a70fdd60b01e930a54f71806130", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268591, "uuid": "e5bd1cc3-5bc5-4e18-a578-48e1a855dfea", "comment": "Malware payload (Amadey)", "value": "31f3aeb81e484eae4295f55b3acc1f66d5fc39b8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268591, "uuid": "6f050a08-0bb1-42b5-ab8d-d9cabf824384", "comment": "Malware payload (Amadey)", "value": "6b7eaf0f4b9a8ddf7cfb05fea1b0d95f28b8496ce4df7acd4cd26500d9a952d51ab509cca0a6ee144f9abe0339efce40", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268591, "uuid": "e0878778-053a-4b23-bdd8-270aa2fb8a71", "value": "T190840142A3E88072EDB227B05EF6139317377CA19DB883573385A95B0C72684B97573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268591, "uuid": "b9751e9a-f555-4498-9b98-a10699a803fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268591, "uuid": "70222b56-d52c-4401-832f-3b74c0ea77e8", "value": "6144:Khy+bnr+ip0yN90QEgTkZMuy9x4KR3QEwmoYwQqOs2kNHaJWwgcrse5K:bMrOy90GgZMR9xZRrwmo4QHaQc75K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268591, "uuid": "3052ab79-a0a8-4964-8aa6-ca396fad8f62", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268591, "uuid": "d5e5eef8-5d4f-4030-97cf-4f17674c7826", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268591, "uuid": "f4c92ef0-c295-48de-bb52-3e10bcfe8ef8", "value": "a68ebb13573c0c7875bb01ff7480cf69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ab06d7-2b05-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1690301458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690301458, "uuid": "74dbc51d-4193-411f-902c-9b4228ac289a", "comment": "Malware payload (GCleaner)", "value": "177f6f385df1d9767da3c0e55fb8ef97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690301458, "uuid": "9c9eb918-3671-4052-bd70-9494a036592f", "comment": "Malware payload (GCleaner)", "value": "2803ae07af0576674bbe5b71be2061c85fb0cd18d9daf78bcd4f8e38a836fe6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690301458, "uuid": "6e4428ef-bd77-4abc-941f-f5ddc612b33a", "comment": "Malware payload (GCleaner)", "value": "ce6c93b1741178d13b7791f5ef1e1c45e0d7f91c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690301458, "uuid": "828492b8-39b4-475b-826a-4d2a5d1efda3", "comment": "Malware payload (GCleaner)", "value": "b3bcfe7962522438d3913c0818205559e01e2d571c0a9f2c0513379b8c500f580b258193be73e104606a48034c7563c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690301458, "uuid": "8e077568-e30b-4cb5-815a-bb989ec5d539", "value": "T14F45236396A61CFCD562D6BC1C30C1288AB77A602C241D4CB6DCDF6D5B7A3A2ED09743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690301458, "uuid": "826b4364-3dd0-4a25-8701-93fbfadd53e6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690301458, "uuid": "6c3ee484-3aaf-4c84-9b8d-5c8543b0b07d", "value": "24576:H2lYvO6nCYf5mx8KmXwMLArckDTYVhJLXMh9GxanV:H20O6Cys8AdmXMhMxOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690301458, "uuid": "8fc2e993-60f5-4500-90ac-dd163ffaf15e", "value": 1195509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690301458, "uuid": "558cbcf2-fe73-4feb-aa71-3a0060fdacba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690301458, "uuid": "9bd49bc6-0d35-468a-b1f6-8b7949459a57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ea7d7c-2b19-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Phorpiex)", "timestamp": 1690309780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309780, "uuid": "73ac9754-4971-4cb0-ad35-d0e948ac68f6", "comment": "Malware payload (Phorpiex)", "value": "a826a2e2e1c0744fb0943bd9133f5175", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309780, "uuid": "286ad753-42eb-4c81-8cc1-def437431b21", "comment": "Malware payload (Phorpiex)", "value": "2814b8bab0cdc1995e7fd07d5f87a1b65e6d7cd592fb3d72ee136dd092d6272f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309780, "uuid": "e6a444a6-35ea-4061-b436-31d2b20c0dde", "comment": "Malware payload (Phorpiex)", "value": "4061ee0c31132f8c22ccf66dab8afcba54c511f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309780, "uuid": "50b9a626-5696-424c-b885-7431ee9a4cd4", "comment": "Malware payload (Phorpiex)", "value": "d1e94ef89a65c0329e7004c161cddacaa3d956c31fd26cdbe069dbfbfd1bd422959656309e73f5fd299c8bf8537336f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309780, "uuid": "57da86d1-2889-47b4-9754-b1fd42c5a536", "value": "T18122E81967E841F8F3F396F0B0F12E49853AF5330B2AA4DE9933D102E8A6351D05978A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309780, "uuid": "e8bdab83-5b6f-46fe-95db-c0a57f7535d8", "value": "85978a72c12a3f13406236f76517c37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309780, "uuid": "834865ec-fdc9-40cc-831d-50250efab3e7", "value": "192:6Yu4yaakuKX6addLaLaP1oynVeMLkWS+C/Q+VIKiIid9mx8:u4yCuKbdLaLk1XeMQWS+C/Q+VXi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309780, "uuid": "9cf8c775-353d-42d3-9c76-7a887fdcbb9e", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309780, "uuid": "6da84072-83dd-49d2-b168-1e05a655a5c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309780, "uuid": "28f885fe-cec1-408e-aaa7-9b496e578bca", "value": "a826a2e2e1c0744fb0943bd9133f5175.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ef4864-2b17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690309129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309129, "uuid": "a9b148f6-11ca-4e43-8ab6-d768249bef29", "comment": "Malware payload (RemcosRAT)", "value": "2632cd3829ea053b43e12c2c7d6f838d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309129, "uuid": "0c5039f5-1490-4d1a-aed4-645f303789b6", "comment": "Malware payload (RemcosRAT)", "value": "28abe1ccfbf25ef3b2b15eb036c2c75116f8c32278f8796ef828406e2639a0f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309129, "uuid": "3b5091cd-fdc8-4635-aeb8-bc78ca07856b", "comment": "Malware payload (RemcosRAT)", "value": "25cb40fb76b3f0c1d201447669e00cdefc9a32a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309129, "uuid": "8880a1e3-7ebd-4d8f-8da7-75dec90fc915", "comment": "Malware payload (RemcosRAT)", "value": "11bfb5f2e99bb0733fbceafaeeefacb49d9d3f8a4ad53de5e85626eee95138b8959e8ba95918de1f562f7a7f18fc521b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309129, "uuid": "d6ac7396-d65d-4932-aa33-ddd9c78d7a4a", "value": "T1EC8412E9314472EEC853E0B3CDB81C98FA5134A3432F446391671AAEA85CDABDF951F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309129, "uuid": "c48379ce-bff5-4c50-aaa0-5a5729c64ae0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309129, "uuid": "d5e8e0de-1f43-4f2a-8b11-818cafa3a08c", "value": "12288:rOMe2Vb3/1eTwHXPcD/zu7KM7yLnD1sz66:rEacTyXPMC9m7DKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309129, "uuid": "1d6e7159-37dc-4f5e-afc2-01de73a1e5dc", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309129, "uuid": "5c627904-37d2-452e-a0d5-aa9f7acd048d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309129, "uuid": "f4952b56-9072-412b-8a2e-f3da2279af8e", "value": "2632cd3829ea053b43e12c2c7d6f838d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d84939a-2b0a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1690303374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690303374, "uuid": "101fb15d-7d08-4bfd-b431-e8e1b203fef1", "comment": "Malware payload (LummaStealer)", "value": "786c39712bfa425b6353bf37675f9689", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690303374, "uuid": "bf9a3f2a-ee03-4a82-b46c-57341ecf60bd", "comment": "Malware payload (LummaStealer)", "value": "28df5a3859116ee3aaad8c0a17425549d52d69d10cc06dac0dfaee8d874c9267", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690303374, "uuid": "18409bb3-80b3-48dd-9f8f-3f3a2a118f2b", "comment": "Malware payload (LummaStealer)", "value": "bc251a0bf2d312ab1faeb616a77a2b6273e480c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690303374, "uuid": "fe9e5c4f-d60f-4178-81c8-d3e88dcd511b", "comment": "Malware payload (LummaStealer)", "value": "75d5eef930b108a4caf9b5805476032fedf4bce74c0c5d585e96b25a95bee8061a2319d6da2e1da86de7cf2b6b90bb8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690303374, "uuid": "c35b4791-ddef-4c70-b65f-6df42a71e659", "value": "T139A4AEF9FAC0E2D2C9EEEDF7920CF56A9454A690416394C2B38A135DE734D8076AFC44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690303374, "uuid": "4d891897-098c-458f-a599-6f8b866a8fd0", "value": "9bc49070ea6894a959186682166b830a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690303374, "uuid": "01374bef-1eea-4c43-a6f5-acee0c8e9d6e", "value": "6144:jApa37PPIFbheia80EPKc0dlv7Q3/lJyRwkmdaxOp8N7YNjHL5J+Dfhyg:qhfa/EPWfzuyRwPdeO8lYNjHLH+Dog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690303374, "uuid": "6e31e305-057e-4886-a2c8-1d04d880f4df", "value": 486000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690303374, "uuid": "45910bb0-d06f-4bf4-ae6e-0c9733f71f04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690303374, "uuid": "0d562454-696a-43b8-89b6-147837228b9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae60ba8-2ad0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690278378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278378, "uuid": "2964cff4-10c6-4aa0-bdc5-df546aad0907", "comment": "Malware payload", "value": "5bc96c1fedb1963299f32ffc5965eb82", "object_relation": "md5", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "pw-888", "colour": "#8C3336", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278378, "uuid": "63f037ec-0dc9-4a20-9385-7b7da4c22d51", "comment": "Malware payload", "value": "28ee57ec65e38911e426ac33bed1fd1b5d5225a9904cc603405a8d5106be4c09", "object_relation": "sha256", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "pw-888", "colour": "#8C3336", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278378, "uuid": "0d0a8bc1-33d0-40fe-98ef-eba1bb6466cf", "comment": "Malware payload", "value": "ae678c9386ef657838fb0c135db18f75b5fc1be6", "object_relation": "sha1", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "pw-888", "colour": "#8C3336", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278378, "uuid": "b4160a42-8433-4f79-b755-18a139d40cc5", "comment": "Malware payload", "value": "c259bb28a9f113138993af452ce44ef7488e6316d39c5020d07da6a14c1da8ff04bc7d1fa6bc8034f75273e726780b57", "object_relation": "sha3-384", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "pw-888", "colour": "#8C3336", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690278378, "uuid": "cce2f0ed-b8ed-4679-bb37-7e5da3449ded", "value": "T198463320FACE91ADA157495D8CC1DF0682592E13E74C4DD4778E382CAFD719AE8A2CF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690278378, "uuid": "9f4a95a8-9666-45a4-a974-6ef5fe917639", "value": "98304:hhs0+GFbVf5+/Iqq2IJdghnj7ynCqQfUrJanQZasu1I4XboIC4tJUEm:PsGhX2mdgRj7Dq3rw6RB4Xb5tJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690278378, "uuid": "887525f5-dcc8-46f4-8159-e9dd802245f7", "value": 5687318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690278378, "uuid": "7f897a10-e3c8-4d0b-a186-0c1cb9b26239", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690278378, "uuid": "02cc3ff4-cc46-49dd-b86e-72a16866ed6c", "value": "Aigoogle 3.2.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf9a574-2b19-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1690309816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309816, "uuid": "71ecfb4c-7a2c-4c12-a89b-bc51bba9b656", "comment": "Malware payload (Smoke Loader)", "value": "7bbe310baddebd0376204d34169fce28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309816, "uuid": "76c9ca8b-fc47-42aa-a75f-8e3e8ce90d4b", "comment": "Malware payload (Smoke Loader)", "value": "29aa8b3e4c2796749d2c2a318dae9b8ae91b8618f498b741429992cd9df75cb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309816, "uuid": "2438ffb5-a28a-4f08-86b8-178901964183", "comment": "Malware payload (Smoke Loader)", "value": "ad15c4e3d7e7582781c175f8294c6d87b07db657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309816, "uuid": "051aa0cc-e402-48ec-bdec-826c9a137ec2", "comment": "Malware payload (Smoke Loader)", "value": "98b734b73047fcbab7f503639c98aa2f7173fdddc7aadce7eaf089980b3c4c8c26d63fe733cd9c831c3beeb9d54292ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309816, "uuid": "2a94e7d3-1a4b-442a-b432-9004c671362b", "value": "T1B744BE2276E0C032D57756305570C6B22BBBB8325B7542CF33A42A3E9E717C1AE79396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309816, "uuid": "b24d8d5a-4006-4346-aee9-60358c3de2f4", "value": "41f54a8bceede5b7d9a3e6f46d43695b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309816, "uuid": "40459528-aeab-41bb-bed5-1e1039d7a0a5", "value": "3072:WVcTC/hyzKvc8WPNPhsUIhzAHHE5ktfsL47WilrbR8oPLhIPr0v+OXrJz6j:LwoWvDWlPMh4eKxBbKALuPtOlz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309816, "uuid": "d6286df6-4699-4fbe-bdde-805e84058ba8", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309816, "uuid": "79f71660-7b10-488e-91d4-127585d31e09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309816, "uuid": "6fa272ef-ba23-4ce3-95fb-17fb59f1a744", "value": "7bbe310baddebd0376204d34169fce28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd643e4-2b08-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1690302408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690302408, "uuid": "b721f23c-a56b-411c-adf3-c8c9a02c6e2e", "comment": "Malware payload (Smoke Loader)", "value": "cadb26699e697c40b3b97eb049798eac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690302408, "uuid": "5e1443ba-c1f7-4f01-a764-e8e6fac49db9", "comment": "Malware payload (Smoke Loader)", "value": "29b902e0c43f5939f9f94b91c29b2982242fddbb8f0180121153d4426fc4bb6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690302408, "uuid": "10db7257-70c6-4cb8-9828-1586cd7b0b99", "comment": "Malware payload (Smoke Loader)", "value": "abb24cbd3ee74f0ae81682fdc9e37d2f11c8f974", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690302408, "uuid": "42d9cf21-ae4c-408a-8bbd-2f9452327f14", "comment": "Malware payload (Smoke Loader)", "value": "f311b60632141b7090ddd12e795440849c388c3d4ec1ed00cd85160772a2f851096d6561d5a4ff9612e5013f25e4c6eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690302408, "uuid": "96c791e3-7e7d-4dbe-9e22-1b7dcbd7494f", "value": "T136B41257B2E85433E9F907B058F603D30F36BC915DB4A72B2786A84A4C72695F63036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690302408, "uuid": "e7fa3d1e-bf71-414e-8976-a2322c436ada", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690302408, "uuid": "ecc6a20d-0b17-4b8f-8047-1bd89e308e89", "value": "12288:5Mrny90niPDjEV34zGKQruUKireXLM/RJ8YB:qyYmE4yKEuUFIQZJFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690302408, "uuid": "afee1d85-96bd-4d86-b43e-f02ae12a9c2f", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690302408, "uuid": "98e586df-b65a-4edb-a6cd-df60039b0713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690302408, "uuid": "87b629a8-e20b-48b4-90e7-573fe6baebca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893c5335-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268255, "uuid": "1ee0a6de-9227-4edc-b489-058e4cab3e20", "comment": "Malware payload (RedLineStealer)", "value": "4c83b3d531a3259e4749d8e28281db14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268255, "uuid": "599914c6-d845-4bbf-a8ed-d3d5267091a2", "comment": "Malware payload (RedLineStealer)", "value": "2a03a64c928717cb93a95a8c513ed90a572d7f378487668cb28c0b984ca902a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268255, "uuid": "313214d1-ad38-4bf0-bf46-3a5ca52eb97e", "comment": "Malware payload (RedLineStealer)", "value": "3257d114edcc57297032c83e11f40fc55a20d534", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268255, "uuid": "76d813be-0430-4896-955c-f90675108750", "comment": "Malware payload (RedLineStealer)", "value": "03744445d84f120da57c8daecccd1f9ae510b5131356a7f8ce00d729abae20acff4d6a0b5b881e77ac22697f73163452", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268255, "uuid": "14db176d-845b-48a7-a30c-8f501388c791", "value": "T1F9840153BAE98432D9B92BB058F606930A357CA09D78832F3B55BD1D1CB36C0A53177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268255, "uuid": "f753d0d4-a3fe-477b-92ba-f03da47fc07b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268255, "uuid": "bb77896c-bbaf-40bd-8e7b-0aca8f2c3b3e", "value": "12288:8MrPy90F/Zjur9P7ua0bsoMQmx2bDLxpfRI:ryD4Ox2bDLTfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268255, "uuid": "b85e9dc2-4353-4d9e-8f1b-63b9394e7cd2", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268255, "uuid": "85e0c87e-8ede-43c4-b20b-5a283295e674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268255, "uuid": "42b17f2e-eefe-4f3f-bb1a-4cdf8b05ba77", "value": "4c83b3d531a3259e4749d8e28281db14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21c3c71-2a9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690257587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257587, "uuid": "d9cf4d77-1573-4cb8-868e-9510c251b3b8", "comment": "Malware payload (DarkCloud)", "value": "e1f944688e00a6753e1dfa4e5d8a7670", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257587, "uuid": "663a2dab-ee4d-4526-b96c-3b57484a8d4a", "comment": "Malware payload (DarkCloud)", "value": "2a8beb4f22747f3d2f6cc851fc70e68e8501c3d81d9a6e6017d37e59712984e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257587, "uuid": "babe99fe-a438-4e8d-a016-8c46030d83a5", "comment": "Malware payload (DarkCloud)", "value": "bc4ac9ef640a74fcf240f14def4948ec6e9346c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257587, "uuid": "93843b06-29d7-490c-8490-a6dfe1ae4896", "comment": "Malware payload (DarkCloud)", "value": "5f420d1dd1e705e5b29794db91a61dbe16df6cb8d697c73ab3024e77c053f1eb856c853c0c763dbfc27df07a64bcb51a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257587, "uuid": "560659dc-9ab1-4f6b-b07e-0b96f2101906", "value": "T122E51267FA6F5BCCFADA0FE90357D3801792A80E5D4DBE036C897131BAE2A50E116543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257587, "uuid": "5294bbae-41e2-492f-9da0-4dcc695fd672", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257587, "uuid": "d4233cdf-303b-4e81-8ad4-877fb756aa54", "value": "24576:V5KrtzH/iYOdy9HQUtiImGqPPUPJp6XdCGQV3JfIR:CrxH/iYV9VeGqPPsT6UvrQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690257587, "uuid": "658fbdc3-3b63-4e85-bf0a-a1b186f90353", "value": 3135488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690257587, "uuid": "3a4d5c19-2d33-43ab-ab8a-bde2754b4f63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257587, "uuid": "ce981840-556b-4c6d-b04b-86bfc675fef7", "value": "e1f944688e00a6753e1dfa4e5d8a7670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9699443-2b14-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690307957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307957, "uuid": "b3807ae6-7dd8-4a37-a3ae-81592d2fc3ff", "comment": "Malware payload", "value": "2294453ea452b146baedaf161a023d08", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307957, "uuid": "593ba6ce-abc2-43a5-8b4a-954c5526b9ba", "comment": "Malware payload", "value": "2aad0b3f892a5b0961815287d1697e625b0d42b5641b189b81d3abcf3aa6ba4e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307957, "uuid": "ff1b96f4-ef47-49da-93ee-c4956781aa00", "comment": "Malware payload", "value": "9f52532582e3be0730388351f3da0945cea186d3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307957, "uuid": "eb031bbe-f8bb-461e-9c89-b9bd9dc5d097", "comment": "Malware payload", "value": "21c78d56617a09ffa381c12d8cfeb6698c1d7f287e06b34f2dd70ef78ae7a2fb8ff261701f37a89429fbc4eb892fb487", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307957, "uuid": "f85d954a-346d-4947-919e-372d5af8c16d", "value": "T1E863022FCCC7C670ED396634460C89D9DBD506E4243229078DF38EFA5662897BD49CE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307957, "uuid": "8877c90e-ebec-4dd8-8220-765c59316d76", "value": "1536:U7JB/LGBtxMO5uzfh9s/qJ1OeBxmwAzrzJHneCJnuxQ1fnYCcQJ:U7DLsx7YoA1OKxmjHeynoQ1VcQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307957, "uuid": "eba67bc8-5ef1-4f6c-b381-25bfc7b5b72a", "value": 69196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307957, "uuid": "d5dc5ad8-45f1-411f-88c0-00aa6083ac6e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307957, "uuid": "a33ef743-23cd-4047-ab54-cf3b51052e9b", "value": "BVNGEN61523 dt.25-7-23.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f22e01e-2abe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690270762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270762, "uuid": "828d59b8-8fa3-4c82-97c9-d71e97f821da", "comment": "Malware payload (Formbook)", "value": "434dd1da43f42f06a6ee1d6832691b4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270762, "uuid": "364a84b4-22da-461a-8543-b771a355ccc5", "comment": "Malware payload (Formbook)", "value": "2ad988ae3330dd6c7886c279f60cc22ab08ba3343e556a2a91ef3a5608383525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270762, "uuid": "11363025-bbd4-4aa3-8c32-bb27f99a4c92", "comment": "Malware payload (Formbook)", "value": "ef34b1dbfe1b74520eb50d73bcda01d6dca91fdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270762, "uuid": "80d48ac5-fc36-4526-a1f1-341d8fc0fe86", "comment": "Malware payload (Formbook)", "value": "f2cccbfe23d4318ff311c38b18b208a2f37c39c967b31ea5c16841b4f30f817c10a6db360f5ae26fb7de47dc360f8a8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270762, "uuid": "5330479f-efee-4fa4-83e2-3c581dfc2fd1", "value": "T113C423403A78DAF2ECFF0FB51D94099212F9B02E6D22EE172F65A0DE1C53B109393569", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270762, "uuid": "7f36f05b-c782-4359-aa5d-769fa19598a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270762, "uuid": "fb7ee472-2703-44f4-b8dc-2e63c5017cf1", "value": "12288:ckVaYut9TRK49Sk1g8OKZucNu/bVI0xHJu3qOf6/zrkBH6R:hVLA9J68PhNYVI0xoaMOzgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270762, "uuid": "44e4f6eb-a389-4f2d-9023-f83e9e67ac21", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270762, "uuid": "cfab2d1d-39e0-4e08-b918-6b188707f8d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270762, "uuid": "fc8af9f2-3271-4aa9-a2ed-eda0844badc6", "value": "Re KIEFEL Packaging GmbH Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae7540a-2aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690269251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269251, "uuid": "dd14d7ca-840b-447f-a110-46dc51372f9a", "comment": "Malware payload", "value": "43c0d4356ff38dbeffe4858f5e22f223", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269251, "uuid": "9c2bef0a-7adb-4491-bb01-d8651bac4f76", "comment": "Malware payload", "value": "2b3898b137dbe5644e4a1ce27bc5237d93a9d108cd2e3175c3f8e1e475580275", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269251, "uuid": "9e21a4f3-70ea-45d4-a550-40f89165c2d4", "comment": "Malware payload", "value": "cce525f971b8343e1db9becfa321ac42f2c4cf12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269251, "uuid": "453d5706-87ce-4b88-b086-e003740cd8cf", "comment": "Malware payload", "value": "35ff542f487b579e884fcff29a2dded6360ed7369694f164475df206aac2da26256dc3f0c9330ccf93b01d53168281e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269251, "uuid": "47cc52a5-57ea-452b-8d11-4593cc70b67c", "value": "T14FA66BC1A950D24AC73D1A31EFDAEFD8E3377E315C846A4ADAC4F33E29B214485E55A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269251, "uuid": "01dd3837-cd59-4437-99a7-0826fe271ca7", "value": "98304:9jXFjiH76/jGjIyEcdRnXcfFCHHo/08/XiKqEeVfR3rZudkVt:VlzagFCHHo/0WUEeVNZ8Kt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690269251, "uuid": "c97f7a32-ff9b-41c6-8105-a40b80682ae8", "value": 10277714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690269251, "uuid": "dd44e447-306d-4436-98c8-ee91642e77d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269251, "uuid": "18cae7e7-70bc-4e4e-81bf-be39bb3c0d2b", "value": "43c0d4356ff38dbeffe4858f5e22f223", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c993b925-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1690273947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273947, "uuid": "3908c68b-2dd0-45dd-9342-2cb21432c561", "comment": "Malware payload (AZORult)", "value": "1e5804b35c0f5f185989fe531c29309d", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273947, "uuid": "d79a1776-72a7-493c-90a1-54815b8da982", "comment": "Malware payload (AZORult)", "value": "2baaf74c1389ce178630b05e954ad614ad11946d299eb0eeadfb8af6b0929a30", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273947, "uuid": "db718b26-4439-4d48-bc84-71a7ae2b3b30", "comment": "Malware payload (AZORult)", "value": "4296d375a77fa21fb2f523b334c8552903ad847b", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273947, "uuid": "ba2500e0-035a-41b5-8cd9-90a9863f5426", "comment": "Malware payload (AZORult)", "value": "d0f7a548f2ec26cce910654a661bc2a7ce4e855479d23442031ece549799b1b04964084c0e4568209ab4fde3c9c091b1", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273947, "uuid": "c5ce7f92-20a2-4957-91c6-e65259304e20", "value": "T10D863B126258B016D0661A3B0D2FE696643E7E703F25D82B3BA82F4C5E7DF41FA25707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273947, "uuid": "c9837cb4-4d43-4b24-b81b-a6f7fd30cefa", "value": "1c3dd32535aee3c5a539d7ac497c828f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273947, "uuid": "f5016c84-17a5-4b3d-82a5-93dba4fafe02", "value": "98304:9ETOxKHMuGsllHdnbFLnzz8OlbYK1fFgGENf1ADpWQg5Gmb3k:9KBzHX26NgGOf1ADpggmjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273947, "uuid": "9c004762-907b-4c12-8dc7-765efe9508e6", "value": 8546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273947, "uuid": "ebd7a975-f333-4caa-9d7a-69ae37b3da4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273947, "uuid": "1108ed30-72e7-4bcf-9e65-cad83f3e0ada", "value": "SecuriteInfo.com.HEUR.Trojan.Win32.Inject.gen.6003.12019", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12d035d-2b18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690309527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309527, "uuid": "4257961e-eec0-4524-b454-56129253618a", "comment": "Malware payload (AgentTesla)", "value": "3fe9d31219589ca8bf3c1e1dc0d82e15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309527, "uuid": "e4fb6ae9-16cd-4c9d-a987-cc808454c423", "comment": "Malware payload (AgentTesla)", "value": "2c738c2b15bab621c7f94261438463073c45ec6b30c922bf65d7857e177ee1cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309527, "uuid": "a30c31c2-4332-41d6-8a41-0275ae1912ae", "comment": "Malware payload (AgentTesla)", "value": "2d0f97c390e5f4368db1ddc236cbececd6e7c8e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309527, "uuid": "3e81c212-d0cb-4fae-83df-3520db4d6cd5", "comment": "Malware payload (AgentTesla)", "value": "f32f9526468768a24ca1d4a874c23072dd1f72c9e39b08b7fd47cb7bd70712585884ccbb6b36e0200e4db57c484d4234", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309527, "uuid": "0f96e637-822b-47da-8fc2-1e7d394e11f2", "value": "T102C4121263ED9B22E4FEA7BE59B050140BF2F4679623E70C0F8D15DB5E227608A41B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309527, "uuid": "6db97f3f-2e50-4465-88e7-589ac5f89822", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309527, "uuid": "77b6e56b-feac-4fb3-ad18-46b1edefbd7c", "value": "12288:RXPZ4MtxczaI107dfEMlsEZnET9plisk0gAmAqpk2LiPzqBHc4Wn:0UcL10xpmEZU7IskVa7lPGBHcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309527, "uuid": "65ee166a-5057-458f-9afb-112190be4819", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309527, "uuid": "2e23527e-10a2-4768-ba10-9ca8eb4ddd55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309527, "uuid": "2beb55c7-f90f-435e-b088-6f051f2f493b", "value": "3fe9d31219589ca8bf3c1e1dc0d82e15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e03f62-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268548, "uuid": "82d952cb-ed3a-4daf-9bb5-e78f516751e4", "comment": "Malware payload (Amadey)", "value": "b23e6770377a39ec57a4dcf5bfe3ddc8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268548, "uuid": "1c87b996-95b5-47e9-b973-f0c1a7250e0c", "comment": "Malware payload (Amadey)", "value": "2d66c7492393e0529f3bba83e8ff2f0c955f29ade4233ddac71751471f469481", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268548, "uuid": "40f70263-f192-431c-a210-52754937c5ce", "comment": "Malware payload (Amadey)", "value": "52d12b014cbc9efe2a178dca851106d1098ca704", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268548, "uuid": "d0ca042f-5b71-41d5-87da-e7c156f8f57b", "comment": "Malware payload (Amadey)", "value": "12a7fd89ac2378c14fdf5733ae54c14132013adaccdcbbe46b3f891defe0bf8df74bea208bf21a1e7c82a73e01e433cc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268548, "uuid": "0954f34a-7be2-47ef-8649-d54e158edc4b", "value": "T1502408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268548, "uuid": "d6317396-ca68-428c-b5bc-91243c2aafb7", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268548, "uuid": "e7652617-8c69-462a-a9fe-ae3b0a5cd393", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268548, "uuid": "c20e1590-7c2c-45b7-aa3f-a47090a2e54d", "value": 229267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268548, "uuid": "a23ed74d-c6a1-4b96-8214-6b44a5bfa3dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268548, "uuid": "4dc858db-0c33-4447-af84-d10de4832d14", "value": "b23e6770377a39ec57a4dcf5bfe3ddc8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d50021-2ad5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690280551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280551, "uuid": "b353bbdc-8826-4c11-8007-cfe2bc9e8d9c", "comment": "Malware payload (Amadey)", "value": "e6a330b4dfd114e7f159d242bb4fbdba", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280551, "uuid": "d4e54da6-377d-48ff-a4f3-a5c2711b624e", "comment": "Malware payload (Amadey)", "value": "2d8f6b3bee67a6d1544ac7bbbffb532193fde717c51a75c19b3034ad93b56803", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280551, "uuid": "5eca2de4-8815-4ba0-a399-8d46c3a2a795", "comment": "Malware payload (Amadey)", "value": "8c74b78e766044aabdd7151e10b3f8a2168b0d2d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280551, "uuid": "3605c8c0-99f9-4d33-bb3d-6147d4005306", "comment": "Malware payload (Amadey)", "value": "8af9958111104f1b96a140c099b969e73d418976800d7ff4412cce123f85ee57d4b2dc7e9f5f9434884db9dc23a420b0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280551, "uuid": "cee59224-8f86-4685-a700-1a236deefbbd", "value": "T167840203A7D89071DDB86BB058FA13830A357DA69D78C77F3746A95A4CB32C4A43172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280551, "uuid": "19d796f4-b635-45d9-a36d-6d9fc6a6b087", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280551, "uuid": "e0ac30f2-9ad3-4560-a462-369ddc0819a9", "value": "6144:Koy+bnr+Wp0yN90QE6IryxJHfvhEF8bVbTEpz7VtzgBZ+t4bDyMcrpjF7cYdK0:IMr2y90QBS8btT8RtzgBYCb+Mcld9d7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280551, "uuid": "105fede8-aa6b-443c-8e02-bb3ebfd2a658", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280551, "uuid": "28b6e6a1-9fdd-48fc-b870-bc7b60d7c0ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280551, "uuid": "c35bec73-a2d3-4d2e-8065-7ba147ac0870", "value": "e6a330b4dfd114e7f159d242bb4fbdba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a5c562-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690267865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267865, "uuid": "e276f36c-a8a6-4ba8-a889-adbf1b76e55a", "comment": "Malware payload (RedLineStealer)", "value": "03519383d227ce282a2870d14344b88b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267865, "uuid": "4eff2b52-0c80-4dfe-a777-cb9821c71165", "comment": "Malware payload (RedLineStealer)", "value": "2d948afc82e00dd1f60cb24271d2c482bc87f04e3f42bcd4147a3e017a974dca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267865, "uuid": "424f48d7-1ba1-4d94-a2a0-3a28139d1852", "comment": "Malware payload (RedLineStealer)", "value": "7aceb1ee4bfda479fd339ce7e7ed1b61e24af93b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267865, "uuid": "154454b9-e369-4cd9-81bf-0ceb504c1443", "comment": "Malware payload (RedLineStealer)", "value": "041bf07cbb1c588586c397e60bce2ad7c6322e959899e044701bcda1b03f14646505d503a70c64c1fd48602a6e2aa438", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267865, "uuid": "4dffad9a-1518-4303-a5e0-3dd3206e60a4", "value": "T18C840113E7DD9472D8B52BB068F602C30B3ABCA58974D76B3751A95E0CB26C4A831737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267865, "uuid": "25e0b9bb-1910-4a10-9aa9-50714bdacd94", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267865, "uuid": "6d65d012-3585-4b14-b87d-29b23fec20a6", "value": "6144:KCy+bnr+4p0yN90QEwiyHaiJM2TNSlguN/CxTOxnqJjFf/9Wkd4Vm7p+IVju57Xp:aMrcy90WiyF3xZOxcjFXZ4M+Lp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267865, "uuid": "1e9cf187-ca8f-4f52-abf4-284338d3e6b4", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267865, "uuid": "c01bb601-29f5-44de-9a23-e473a539ee98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267865, "uuid": "a82007e3-65c4-4b5b-9b76-25f3b7b034e1", "value": "03519383d227ce282a2870d14344b88b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26402fd5-2ad5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690280545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280545, "uuid": "74b0cd08-64ac-45bb-b744-89e8554b8ae3", "comment": "Malware payload (Amadey)", "value": "55254690e8729343cd411922aa27fc7f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280545, "uuid": "5488e92c-9546-4117-aaf0-114794333369", "comment": "Malware payload (Amadey)", "value": "2dc146256ae96f25a0262a183327aedcd7a8d64e6e19ca904ac21b3948204035", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280545, "uuid": "90aa0279-6d39-4597-8083-bbe6d6d12b63", "comment": "Malware payload (Amadey)", "value": "8927668947470b55a64e4d40fcdb3675117189fb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280545, "uuid": "088bdbf4-09a6-4560-a6ec-2e291f411773", "comment": "Malware payload (Amadey)", "value": "7039629eacde440730b6bec6a5247d9820331c2851538b372c526244d9cfe248fe5b5c87c5e0e7c16f65078de90cc399", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280545, "uuid": "a902bd2a-f571-4237-981f-2146d46fe6d4", "value": "T1A7B41203EAE88067D9F5177068FA13C31B36BDA18D78432A27869D5E4C73784A5313BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280545, "uuid": "bcb89044-d55e-46e2-a141-abe386b6ccbd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280545, "uuid": "5536adec-c8fb-4f7f-ad14-ced93cd70079", "value": "12288:iMrpy90N/r43ye4uJvMczIIeZc2EOyJM4x74BPIR:LyUEFxn9fHPQPIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280545, "uuid": "6e34a7e3-74e9-4da4-b085-22db7a4db68a", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280545, "uuid": "5fbd5384-410d-40f2-be5f-46ff7f768cf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280545, "uuid": "2a7b8434-30dc-4cc7-9250-6ded1a6a9f44", "value": "55254690e8729343cd411922aa27fc7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce237c0-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268235, "uuid": "ec03dc43-2879-40d6-8295-d2969474bb7b", "comment": "Malware payload (RedLineStealer)", "value": "51e5186566698abf5d419ef570445c39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268235, "uuid": "ae16d8de-f56c-4e9d-9c4c-55819ae37c01", "comment": "Malware payload (RedLineStealer)", "value": "2dda8fb5bb47e3e77c23b4ae85007e5345f15aacf38c0c8eccf00bf74fb853c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268235, "uuid": "484a4b3d-08ca-49df-bdd0-e84abf84e09a", "comment": "Malware payload (RedLineStealer)", "value": "6a0e0a80c9e2841644b270e8405e41e8ad903187", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268235, "uuid": "745fc7cf-5bfd-426a-ab1f-02a27ab0aca3", "comment": "Malware payload (RedLineStealer)", "value": "8329cdf94e2cd64b1fa0d51bc9666cfd4e5597aa358cdf89db84a0a739bf7ef7685f38822087ed7edcef124280f1a9f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268235, "uuid": "b4a76e51-76d3-44a6-a0a2-5d94e74adf85", "value": "T14DA46C0792F17D51E917CB7A9E2EC3F8760EF5508E493B662219AF2B0CB11B2D263750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268235, "uuid": "722426bb-5453-4fad-b38d-32286bd6d298", "value": "020eb28774c582d508abf5443eb41b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268235, "uuid": "8c636a61-9f54-4fe4-89e9-f529cce68955", "value": "12288:lkUPDDZK40S6MxtPT9dJZoXsAhDlBpRD6P:SstL0bMxtZAhvj6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268235, "uuid": "d24e9367-ba88-44d6-9077-0e397cf94d6a", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268235, "uuid": "e1777f74-a5ec-42ba-9835-8c69a959e477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268235, "uuid": "294e78f8-95d4-47ac-822a-995456c71dfa", "value": "51e5186566698abf5d419ef570445c39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e83272-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268817, "uuid": "74c7d785-7db8-444e-b9a2-3f31f2331e82", "comment": "Malware payload (Amadey)", "value": "cbeb554e995cbae9c4b5618a6af2edcb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268817, "uuid": "b0818850-6314-42b9-81b4-e6c132d95e07", "comment": "Malware payload (Amadey)", "value": "2e6b822281ec0dbb199ee12878f454832800d45e923a9d4c73d432f76cd45bee", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268817, "uuid": "39353b06-3cf0-49ab-94ad-50ff631d7871", "comment": "Malware payload (Amadey)", "value": "c4a23e6cb62bc6eb86aa3c08f75e1974d23bd22f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268817, "uuid": "05e00d73-ea80-44e7-bbdb-11cb18f6c4b8", "comment": "Malware payload (Amadey)", "value": "2d1e3c83f397a29708702e27ca3056bd2bde465d10bc7f52624a0a262dff4b4167e9d821da08736d13c5cf29aa62a00c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268817, "uuid": "857857c9-bf3a-468f-98e8-836b1f6629a0", "value": "T1EC2408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268817, "uuid": "14d1fa04-60bd-41da-99a3-dfa71647a1c8", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268817, "uuid": "315c3dfe-839e-4ffa-825a-e4078eee16b8", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268817, "uuid": "c118c036-8421-4327-a1e6-4aa22f6f48b8", "value": 229057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268817, "uuid": "17632b39-429f-4988-8d2c-6dcb3614a67c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268817, "uuid": "f03eb263-2a6f-44ce-802b-ca726547dedb", "value": "cbeb554e995cbae9c4b5618a6af2edcb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c7ce72-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268223, "uuid": "a79f1d88-0385-43ec-b68a-3a785e83361b", "comment": "Malware payload (Amadey)", "value": "90f4e7656cd4f2ff21d306e9a2127aa8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268223, "uuid": "57b7f0ad-fc9f-4213-a50c-9cc07b14c6ee", "comment": "Malware payload (Amadey)", "value": "2ea5e26c1500a47dc848fdffa31210f94311df256bb6bd7b359e4af6894023e7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268223, "uuid": "0f266cbc-87ec-4391-9f35-17aae6af2638", "comment": "Malware payload (Amadey)", "value": "d7c5ac2b853e2ffb6281a91e1d48a652fdb4ab4b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268223, "uuid": "644ce995-aacf-4036-96ec-7378dd30c7c7", "comment": "Malware payload (Amadey)", "value": "1d771d55b8f8c8fceb9bac2f22608e97f78b6b622cffe335c9e43446bd30a3cf02bf47831a5280584709838a2dc87be4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268223, "uuid": "7dcdf55d-264d-46de-9b07-0d6c4ad3b250", "value": "T108B40247AAC84032DCB12B305DF706930E357DE29C79836B7B45B99E4C736D4A931B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268223, "uuid": "edde7035-1bd6-449f-ade7-710d647ff47d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268223, "uuid": "e5003ba5-3d73-447b-a8ba-207da999ef07", "value": "12288:kMrvy90pmeitVqabcxZthOFvD2ZT58iro7:7yAitsKcxZtsvCLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268223, "uuid": "b85c170b-2ecf-4e6a-8355-b5ef4a75561b", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268223, "uuid": "6b8bf09f-a0d1-45fa-a73c-f921104da860", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268223, "uuid": "709c80c2-0984-4e4f-a518-b12a5cae461c", "value": "90f4e7656cd4f2ff21d306e9a2127aa8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e611178-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268506, "uuid": "7e5717b5-6adb-4761-b974-96ffb36e3af7", "comment": "Malware payload (RedLineStealer)", "value": "9c59be29ef4f3e26803c20202d2a578f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268506, "uuid": "5f0176a7-940b-4524-a7fa-6038f3096665", "comment": "Malware payload (RedLineStealer)", "value": "2ec8f4323279cbb3c829846c70e2e3b3f65d9d4591c18c17eb21dd76a257e0da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268506, "uuid": "0aaec548-9250-4b0d-bdbe-bea7203eeff9", "comment": "Malware payload (RedLineStealer)", "value": "2ae098e847790b599680618d71de7a5e083b0a21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268506, "uuid": "e556f701-2fce-47d5-a9f3-7b36ce4d1bdc", "comment": "Malware payload (RedLineStealer)", "value": "20bb4952da68a2e67d2dec7d41f622f8fda3b365d063d8bd3a0a19efd83ac0afd07fe2e44c138d79b276c4066c0f85cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268506, "uuid": "030b8191-a26b-4bd3-a98c-e937d3c05be0", "value": "T123840102A7D85436DDF11BF058F607C306367CA29978C32B3B46A86A1CB36D0B97176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268506, "uuid": "336267fd-8a92-457d-96ea-de9a3bbdca97", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268506, "uuid": "5ac3a112-33d7-4cb5-abc3-5a5573caa910", "value": "6144:KAy+bnr+wp0yN90QEIlb8Q8Nf1VKGPITYx89NNYEB6LggBZ+t4HDkV+jk9R1:AMrwy90GZ8j1VKGArYSfgBYCHlWR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268506, "uuid": "6726c9b2-86ae-467d-b622-c14a6fa77bad", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268506, "uuid": "fa5cf2c6-e4ed-401d-aeee-6d5e0a7deecb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268506, "uuid": "5c530283-ac34-467f-abde-79887925e40f", "value": "9c59be29ef4f3e26803c20202d2a578f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc44299f-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690267912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267912, "uuid": "ce406ab8-cb74-4dd2-9101-658058aeb95c", "comment": "Malware payload (RedLineStealer)", "value": "337b700a31780ac51d701a09127b45cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267912, "uuid": "543d6149-a750-449b-898c-cfc18912a314", "comment": "Malware payload (RedLineStealer)", "value": "2f8b43b1da9b984e709deed2a1aa6e2ae56e0a25bb05cb84cec38714ce52bba6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267912, "uuid": "906eb05d-6562-49d4-bd29-bf943aae151d", "comment": "Malware payload (RedLineStealer)", "value": "cbfed109ac462d81648fed8f8cd5f0c12f24baf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267912, "uuid": "254ea622-e66e-4ab4-b1db-9a04c9d49d98", "comment": "Malware payload (RedLineStealer)", "value": "3e6ee22b5ef7f5a69a777828e750b51e2b2e1379df9058ea5fe955571cd9ade460d86a0c631616b3680de0edff01851b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267912, "uuid": "8bb18fd3-b962-41ee-9645-bfe112d2ed71", "value": "T196A46D1792B17F71EA17DB729E1EC3E8760EF2508E493766221B9E2B10B1172D273760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267912, "uuid": "100c00d1-f4b3-4fd3-85a5-f91e581f2eed", "value": "020eb28774c582d508abf5443eb41b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267912, "uuid": "4d501a6f-168a-4126-99cf-e0c988f5a86f", "value": "6144:EvkJLG7gv18VpELyNLBd9TepIzjcBE56FNkub2c0g/2DFMDsBpY+g4mRt6hvLzbk:kkJ6Ev18HFpBPyE8hjoW3vs/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267912, "uuid": "5f62d675-8ca3-40b0-a46f-e86c15a52f0c", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267912, "uuid": "9b37b55a-3279-49de-9343-ebcc52b6cf96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267912, "uuid": "ec8e60bb-c5f3-4659-a0aa-656a865bbbd4", "value": "337b700a31780ac51d701a09127b45cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cae3254-2b14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1690307802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307802, "uuid": "7f5cf77e-8496-4a1d-a819-582e49c3b011", "comment": "Malware payload (AsyncRAT)", "value": "28665299db4c6315029004c486f93071", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307802, "uuid": "7e415470-b459-44a7-bbef-101249546688", "comment": "Malware payload (AsyncRAT)", "value": "2fb2f357532c091025eb9ea95103e081f5429347c02d2870593aaf6991443b15", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307802, "uuid": "32b63425-3c5c-4ec0-bd28-6aa888ed58be", "comment": "Malware payload (AsyncRAT)", "value": "a886375d0428926a1993b9436ed1add7f833bddb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307802, "uuid": "5ab534d9-fb24-46f4-b610-9ea3d09a45b6", "comment": "Malware payload (AsyncRAT)", "value": "e45d8358765d4d40d31cea0418746e819b5b136fde06ba2379ffaf564b4ce7a351a15dce80a247ab5212d3b0e25df379", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307802, "uuid": "731b9463-1a07-408b-9a7c-9c8472387287", "value": "T196235D4037E88136E6BD4BB8ADF2E24187B5D6672903C65D6CC814EA1F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307802, "uuid": "a88f50ff-b299-46c8-8569-fe8f30e63ceb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307802, "uuid": "7d12177b-a610-4f5d-9047-808f2da17aa8", "value": "768:d6T3ILNCKi+DiBtelDSN+iV08YbygehgMIKMbfqHUvEgK/J9lZVc6KN:d6YmBtKDs4zb17bfZnkJ3ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307802, "uuid": "844a20c9-e37a-46d9-8605-b2f73e219baa", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307802, "uuid": "784efef9-0766-4a72-93aa-550ac6a401b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307802, "uuid": "9850c0d4-d2de-404b-a4d4-8957d5b8fcd3", "value": "28665299db4c6315029004c486f93071.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172fe9f0-2b10-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690305860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690305860, "uuid": "e7de2cdc-5733-4efc-b437-d6f76d31671d", "comment": "Malware payload (RedLineStealer)", "value": "15dfb4bf5a7c8ffd04d1e6e735db982a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690305860, "uuid": "aafe0d0f-854f-42c5-bac6-07e4036ed6e4", "comment": "Malware payload (RedLineStealer)", "value": "2fe2ce6a894627aaa91d6061a0ac5aae7659c1c740e858ffeab20737b5cd25c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690305860, "uuid": "9a9b59c0-2d9c-401d-b2d1-5a5f77aa1c22", "comment": "Malware payload (RedLineStealer)", "value": "e3465a14bc0876d25f561e06a2d029c81012a4b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690305860, "uuid": "5e20b4c7-1ab6-4ed5-aa10-d6a26426cf24", "comment": "Malware payload (RedLineStealer)", "value": "24c420f36f68f910afd809e619cadde064452116db8ffc3bd193d27e25fe809e4d5496d8462bb21aeb638ce130399f49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690305860, "uuid": "857e191a-5069-430b-abbb-ef2b140a132e", "value": "T11A359E7339C18D22DDE220B56BEFE534026DE0B03B2787C356C66BE985519D06B369CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690305860, "uuid": "3cfece4d-96b8-41ec-bb22-347eb36dce81", "value": "99618c39aafbf01419fbcd53cea0e110", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690305860, "uuid": "8b7bda2e-edd9-4ab8-9a0d-342626d670f1", "value": "12288:ietlNhpItSO5PMZ6hFyIexup3mzrgSyszQuUQ0k+zduzzo7W91Y0u+1CoPKU9sLd:dt7hpIcO5PMZ6PgQuUQyzjq1039j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690305860, "uuid": "0cc5d27a-b01d-4776-b096-71c9083d1a54", "value": 1132032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690305860, "uuid": "165df88f-edc4-4250-887a-457b69ab49ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690305860, "uuid": "bd5bf869-5a26-4b25-8d36-216a30445f34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b543fccf-2b17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690309132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309132, "uuid": "96c01648-3180-4dc5-88bb-134cec0a0ea6", "comment": "Malware payload (RemcosRAT)", "value": "c68e624291b81ca29c2764ba8b753c96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309132, "uuid": "d12dee05-52a0-4c25-b705-b124fe381015", "comment": "Malware payload (RemcosRAT)", "value": "30677a0487ca9917350dfd860dc7ff317e37e0b8d937bb4d4ec20d8afc276eb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309132, "uuid": "410cba9c-ee01-46c4-8fef-c89df0dcc37a", "comment": "Malware payload (RemcosRAT)", "value": "d1808d9e438dbc99ad3f1b1d995a522d0d3c41dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309132, "uuid": "ded24d5a-f0b3-44ca-8f0e-9b585f1937bd", "comment": "Malware payload (RemcosRAT)", "value": "b1ceb4ee96e8a42b7b9f3d7de1da11d4cc637304c4f447c2fd31b03b2b57cbc937b793364b07e3551394e20949d3d522", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309132, "uuid": "1cafe081-56af-4f29-bdba-80d9d742b489", "value": "T12B84129D799471EFC81BD472DEB90CA9FB1224BA832B0207D01B629D9E0D847DF654F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309132, "uuid": "54213b4c-12d5-456c-8af1-c1630c00d9ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309132, "uuid": "423efc71-6978-4ae0-8a9c-7e41867c6fff", "value": "6144:R9aks1B6Q7fAMRfnlJc31C3UCbhi8+YNcY4o8QrCKbFoYwnEutud3KbAY:REks1B/UgnrL3UCk8us+esu6AY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309132, "uuid": "dd63b49e-a14c-4f60-9bdc-05a9d2b3a3b1", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309132, "uuid": "da1bdcbb-531e-4f3f-8594-f1bf565a2279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309132, "uuid": "c28d0398-0b38-4201-9270-c27eec293cc7", "value": "c68e624291b81ca29c2764ba8b753c96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf7c629-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268530, "uuid": "bffd7e0e-5805-44b8-8d98-0fafefad8e0a", "comment": "Malware payload (Amadey)", "value": "9645b817aa60830a0efbe6490a016cd9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268530, "uuid": "3d5b44a0-44b9-4081-880a-393d42239978", "comment": "Malware payload (Amadey)", "value": "3081c20b66a63f6a230e21d14d4043b3a3291bcaa837430354af4476e2f100d4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268530, "uuid": "948b0f1f-b33b-4af8-8bd4-4ff0af66719b", "comment": "Malware payload (Amadey)", "value": "74a258cbeb90459ada98b81f204a0ed93a9e6e6e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268530, "uuid": "2b84142d-7823-428f-9ead-a2c45e569dcf", "comment": "Malware payload (Amadey)", "value": "f97982f703133dd2c22d00db991443dc073f7bb4cea89d64f9f6ce34a335e90bb42a7585574662ae0d861c78afd21d58", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268530, "uuid": "1d2e224c-e298-4c7a-9660-314bda135aeb", "value": "T1D1B41213ABD9C433D8B2177029FB03D31A397CA15E78526B2780699E0EF3580A57677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268530, "uuid": "76283d9f-091f-410a-98d8-31b6a6339420", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268530, "uuid": "40ae9408-144c-4140-933e-f2d60bcf8feb", "value": "12288:GMrly90axwx+uND/y3jupyLCGXoWwryLb:byTM+vPLoAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268530, "uuid": "81e4b36c-5e80-4b1e-ae48-2ef21b69db21", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268530, "uuid": "ad4c24e8-7b24-4915-8b9a-9ce94edb9570", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268530, "uuid": "acdc958f-7cbe-4e38-81e3-9389a97411cc", "value": "9645b817aa60830a0efbe6490a016cd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6dcc5c0-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690273942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273942, "uuid": "9dda8d3a-7d5a-4b01-a3e8-68147b5b7adf", "comment": "Malware payload", "value": "8e8f21f7e49129fc3f03b1291a560699", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273942, "uuid": "63e1a427-6642-40de-84af-41f439330a77", "comment": "Malware payload", "value": "30bf5c6cdf9157361646afb04ed43286c04cc33059ecc0f688f479ac08764d16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273942, "uuid": "65a5209c-8023-42d5-adf8-9570c5b789c0", "comment": "Malware payload", "value": "879def3ed91deacc905cfc44ad3500c53ef71025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273942, "uuid": "fcf1de86-d190-4c47-80e9-0a32634e614e", "comment": "Malware payload", "value": "3d4aa69b1bed6c2f51ff3cb5d77e87a5ce27ba3ce676b3c75d9cb9db453164729520862c327f5fca4407e8928489c4d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273942, "uuid": "ae276b42-57fc-4a89-98fa-161e89d90272", "value": "T115B49E32B6914833C1135B795C5BA7BD9826BF503A28AD433BFD3D4C6F39282791A193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273942, "uuid": "e2e30fe0-aa07-411b-897f-31d783ddc097", "value": "a5604067a4504d3dc22125dc11fa2fb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273942, "uuid": "3497f9d9-06f2-40c7-9966-60df6859d06a", "value": "6144:7Eq3WpccVzOKr77gFfCfodpHyTPNvkCekiCvhs/iKtiUOqJjSh5oU5DbbulJee:7B3Wpcy78LdAPNhe9C2iKU4JjSoAbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273942, "uuid": "a4dbaa85-0599-4df4-b4cc-a56db5c862d6", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273942, "uuid": "ef4eee95-d8f8-4449-8a34-859f942f191e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273942, "uuid": "69a7da47-7bc8-4535-96dd-6e2f54c0b2ec", "value": "SecuriteInfo.com.BScope.Trojan.Bitrep.2404.23415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e53cf8c-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690296960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296960, "uuid": "ea40663e-a2df-4687-b9ee-49793c706594", "comment": "Malware payload (RedLineStealer)", "value": "e34e22b82426037cfe3fe50a66831653", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296960, "uuid": "8326f988-f1d3-4563-b103-c7dcf7e42b8b", "comment": "Malware payload (RedLineStealer)", "value": "3122024e38f6769ed308f951822fb89eea84c3fe13fdc8a7397f6bfabe3d0d28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296960, "uuid": "ab470530-8d3c-4183-afbe-68538eef3f0e", "comment": "Malware payload (RedLineStealer)", "value": "5f23eb9324fe90ebf86b0e21fd446579fca87d9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296960, "uuid": "388be0cf-2d26-49ef-8ee9-90efa7a30e16", "comment": "Malware payload (RedLineStealer)", "value": "2ff743a74805f6aa4c3ca326ead5650110827dc97902b239574521d5c8982acfd263617f4bd1992777155241c05033df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296960, "uuid": "e070dd0f-7cb3-4f76-9f78-d0b2d45d0510", "value": "T12374E02177E0D072D1A795301930C5B16B7FB8224B7591CF37A82B7E6EA13D16B3A392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296960, "uuid": "0d41320e-0fa2-4193-8740-31bdda8fdb49", "value": "41f54a8bceede5b7d9a3e6f46d43695b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296960, "uuid": "5c780b41-42a4-4791-bf8e-6ec4cd895585", "value": "6144:9e6AvAvUeDpdzjGYlQJ0G18aHbVEC7/rY8kdx69:46c2UeDpkJ01Qb/7c8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296960, "uuid": "c5b82f78-d453-4355-9a80-a5b583b2f67e", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296960, "uuid": "6a1a4448-48e6-4f71-9c61-3de05445a157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296960, "uuid": "5a53a047-3988-4ed0-b19e-3f7df1ff52c9", "value": "e34e22b82426037cfe3fe50a66831653.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8e334c-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690290491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290491, "uuid": "16a26d3f-ec65-4c6c-a11c-8d71b1d9af1a", "comment": "Malware payload (RedLineStealer)", "value": "65ca73b78cf20e44d1467eda30f92454", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290491, "uuid": "997e55b6-df58-4dff-a4d0-16d3578cfe60", "comment": "Malware payload (RedLineStealer)", "value": "31d1800a80df7c6158321ca31159dd5ef20dcf41524f51db6dd2e2ed8834676e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290491, "uuid": "8293b5c0-4e2e-492a-90d6-69c28ce42917", "comment": "Malware payload (RedLineStealer)", "value": "32119f4c916051f4f97fd7eb28e24a015e904b2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290491, "uuid": "53bac256-3e00-4f7a-859a-1af96d86da99", "comment": "Malware payload (RedLineStealer)", "value": "f83f110d651a0e87b1ad81425fbe14f3ec45f6773531551680151cc7c712a0cd8a1255ebc5e44692276d75c63f5d6fd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290491, "uuid": "20c0fb67-8892-484a-a8a6-d118081ae145", "value": "T15F84F152F7E88532E9B517B45CFA13C30E36BDB29D7483AB2246585A0DB25C0B93173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290491, "uuid": "2c04afb2-62be-45b9-ac81-1af6e007672f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290491, "uuid": "a10e4abf-2a4f-42c1-b9e7-1ab4b4f368f4", "value": "6144:Kcy+bnr+Sp0yN90QEvqQSPaO5RpV4rV86VRxdKKsCQCGoSj9Kf914dSgmOCYsVoM:gMr6y909phrV86VRLQSU9/Sl1Vn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290491, "uuid": "f00314bc-4616-4836-b448-573ae037d1ef", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290491, "uuid": "d1d6b05e-ef6a-40f0-9586-adeef2124930", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290491, "uuid": "dbe97543-9779-47e2-8e35-7fafc6b5df4d", "value": "31d1800a80df7c6158321ca31159dd5ef20dcf41524f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c96e929-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268556, "uuid": "963c7884-93cc-4dc0-a3a5-467c87f82c4e", "comment": "Malware payload (RedLineStealer)", "value": "c7725ee6655d9bd4da6b942b289d6232", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268556, "uuid": "5e4e81e2-8bb4-4454-b98d-77e2b519a17e", "comment": "Malware payload (RedLineStealer)", "value": "324674f0da8d1f18d94372a9d0ab0953cbfa3dfe7e05601d9dcb47efa80f8f5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268556, "uuid": "1562fedf-a226-4ea4-9097-d49de44aebf0", "comment": "Malware payload (RedLineStealer)", "value": "bc08393722dafe1e03a4bbb55ca3cb447ab6a893", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268556, "uuid": "808f555a-9223-4e72-87f2-172c85cc346c", "comment": "Malware payload (RedLineStealer)", "value": "23e10a0a2f979e9ccc7024664e7b3dd052e937e75c0bf0a6d06a999e307b942ef6d4c8bb6c5a52a88be12f30feb6c56f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268556, "uuid": "a8636660-0255-4f42-89bb-a21023713679", "value": "T1FEB40256B2E96076ECB933B49CF207D30B36BCE1587453AB27545E4E08B38D0A97172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268556, "uuid": "b24a9459-7833-4edf-ab3e-dfcfd7cc3b61", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268556, "uuid": "a757e290-a726-45b9-aa32-82f8ce5dcd11", "value": "12288:MMrIy90oefoY03Qt/PwpN9QVLLljfD2+6SOU4uD//f6:MySOQFVtfpOuDv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268556, "uuid": "716937b4-914b-4d4a-88b2-2ff038f758bf", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268556, "uuid": "f890e5d2-742c-433e-892e-62970764df05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268556, "uuid": "6a0adb73-763e-4f8f-9f09-e816eb51d8f2", "value": "c7725ee6655d9bd4da6b942b289d6232.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf186f5-2ae4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1690287051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287051, "uuid": "5a082acf-a02c-4302-ab1a-dfb441773d97", "comment": "Malware payload (StrelaStealer)", "value": "5a09bbf146d222d2a3374b81f9a71090", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287051, "uuid": "2d9d5b32-d8e2-4dbe-85f9-84d6f03e1b2c", "comment": "Malware payload (StrelaStealer)", "value": "326031ddeb5903762636176319c820dddf6460eb33d020c25db34232b5fe7d78", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287051, "uuid": "3f69ec49-af24-4dd2-b308-18e0a134247c", "comment": "Malware payload (StrelaStealer)", "value": "20f678831eb0aab4ec71a7b2191a7ed5ab7dcb6b", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287051, "uuid": "356bae3c-defe-4416-b438-f58049afbdf9", "comment": "Malware payload (StrelaStealer)", "value": "c4c9d3afcd2a110cc8c204cbff11e20ddf53f1ed4bf9993b2938fb50d0f829950a3f82e6b6944a9ca667d58fbd614dee", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690287051, "uuid": "17afbafc-aab9-4fd1-a5db-91942e41d173", "value": "T1B8647CBE64DB294AFEA28C342FFCB761C77B34A5CB57C7F104A4603029105A7AC46A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690287051, "uuid": "1c975953-f59e-4216-a16c-1028d4866a77", "value": "fcfbe5457e76d2ac347d7db113c0ca3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690287051, "uuid": "81016680-dfac-473b-b84f-51302df8727a", "value": "6144:GG03aAX3DACBFOmEwAtShUbV2uwoVmhPxHTKy+:GG03XX0mOmItwi2FoVMzK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690287051, "uuid": "738f3061-9ffb-4249-bb01-81a8ad67131c", "value": 310453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690287051, "uuid": "af3ae748-1b13-48d5-827a-ef804989af92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690287051, "uuid": "40d008cd-cd0f-4cf7-94a1-f950166462d4", "value": "gfnawhemwlvkqsqcdmdhjeolwyhlyywipgonjoriyqayvwpdpg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5e59df-2aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690269118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269118, "uuid": "db30277e-6f89-4502-945f-f66b3a8ce439", "comment": "Malware payload", "value": "4ec8058ad7fe26eb62041bf6c41e5a22", "object_relation": "md5", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269118, "uuid": "4a6cc1a3-3a8e-4699-becf-05b341734fef", "comment": "Malware payload", "value": "33817429387d31a8df209ec80896c6ec76e280d708729114f8ed6c36b3af24d6", "object_relation": "sha256", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269118, "uuid": "c8dca1c4-3e0b-4beb-8ab6-e8085d802702", "comment": "Malware payload", "value": "8ce91b2b0afc139692f5e7c067abb44b9ec0fba5", "object_relation": "sha1", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269118, "uuid": "5393fd6c-6529-4e19-a70e-c805fb54010f", "comment": "Malware payload", "value": "f7cfa7084659c2bba9a9b4f1c0a104f8657ab7b7ca2ec9de2012f35807ff4903af73cd0c53298b8fd97a913bbf04c862", "object_relation": "sha3-384", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269118, "uuid": "257329dc-5a50-431d-ad5e-5c31ceb1279a", "value": "T1BB83025D8F08DC2EF36EC57090FD22269825786DC49C7D043D2193A869628B97362FF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269118, "uuid": "277c795e-5fb0-48f7-b841-7aa7d7a1e5da", "value": "1536:Qp6lSVlJs4G8bTEUrD0lJU3V69eAmV7SykdOT/ALj7fdHCXgWs2rfH:QYSPe4GmbfEkofmV7S9QT/A7dHCQWsGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690269118, "uuid": "bd2cb21b-e47e-4d67-b6ff-d9a88e00cd9d", "value": 88097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690269118, "uuid": "7bfd5747-b02b-4fd4-b5cd-dcf9e3628cce", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269118, "uuid": "5658a3aa-7c0e-47e7-955d-f7089adf85bd", "value": "INV-Details-JUL23(441).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41936a06-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268565, "uuid": "33ecdd68-b952-4a6e-a1c0-eb7a5d9972bb", "comment": "Malware payload (RedLineStealer)", "value": "ab079c05efbd1bfd76b663202c5094ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268565, "uuid": "61e6b853-60a2-4cce-b5f4-04f48252d71b", "comment": "Malware payload (RedLineStealer)", "value": "338861d9d6f770699d75ed9e5fb31ffbccca9e399321ea869e623fbeda766ff2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268565, "uuid": "5c4f752d-9aea-495a-a46b-f568e8567fa0", "comment": "Malware payload (RedLineStealer)", "value": "8a66bad1103020f480809a26a8e4f3c6f92a14f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268565, "uuid": "82788d33-13fb-4fe7-a9a3-d4087768b4aa", "comment": "Malware payload (RedLineStealer)", "value": "2e451906c9f50d0954d3801cd3b1da4d23a6da5e64fe7eea5da5a6b9abf983adc1a5a729747d7880c0909cef521f84e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268565, "uuid": "2bb48c3f-16bf-4572-bd63-97fe054ed456", "value": "T106A47C4792A17C56EA178B728F1FC3E8761EF5508F793F662219AE2B04B1172D273720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268565, "uuid": "aba65185-c763-4bb5-9cce-20ee7f6c1e86", "value": "6dd6b46f56344bac3e06d5c8db854c3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268565, "uuid": "f1b88936-6db6-474c-be25-5cb0869f85af", "value": "6144:KRXxLG2AcwgXJIWlSLKE9TND4Z4wvDasjewa7UC7Fv1pT2Q:EXx6T+JIWAW6KZvvuAra7xFvPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268565, "uuid": "c88695aa-3e71-4610-a6b1-ba533c73c20b", "value": 479744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268565, "uuid": "89ea3cc3-359a-4556-a33b-f5a5a9b55ec8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268565, "uuid": "66379c65-257d-40b6-94b8-b41c754c910a", "value": "ab079c05efbd1bfd76b663202c5094ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25790a75-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268518, "uuid": "0224133f-8af2-4ff3-9b83-13cd1452c116", "comment": "Malware payload (Amadey)", "value": "9c5dae3e7df613ad6f24975307d3db2e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268518, "uuid": "492fe096-d77a-418c-9b7b-d43ad1fc4b82", "comment": "Malware payload (Amadey)", "value": "33bdb9f734192f3ff437bfeca8478b8a874e6d6ccc0be3d0697646e22fd8c441", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268518, "uuid": "72546afd-ca3d-4aa9-bdd4-18032d7ce736", "comment": "Malware payload (Amadey)", "value": "587e1fb648524cb201229bfd6ad0d544a325a53b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268518, "uuid": "c0f26f1e-ad52-419d-8d4b-01b3664a4d6f", "comment": "Malware payload (Amadey)", "value": "d7812ed839996d7f52444e6a406fdc5f3a4d03018c1b1478ba563f7fc51c9a1a609bf4936d6b8ea571a61c9cd47b16cc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268518, "uuid": "ec100cde-c31e-4617-9c4f-14821b7ad213", "value": "T1202408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268518, "uuid": "d16995e1-491f-4bc8-b84a-6254276292b5", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268518, "uuid": "c2ed2e5b-72b1-45b0-881f-2b71ca1694c7", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268518, "uuid": "25a6be41-5026-4c7b-b4e3-6d7a0181d4cd", "value": 229155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268518, "uuid": "6604f06c-aada-4468-8012-e5d9e88b5d38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268518, "uuid": "a6b54ac4-8d38-43ea-a4cb-733d1b6174e9", "value": "9c5dae3e7df613ad6f24975307d3db2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bb5f83-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268567, "uuid": "884a2026-d736-454e-93c3-304fa2700dde", "comment": "Malware payload (RedLineStealer)", "value": "b4831e1839e1dbec149ebb2b370b10bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268567, "uuid": "fcc4b998-61c2-4503-ad90-8134cb733e57", "comment": "Malware payload (RedLineStealer)", "value": "33ff3a4b4d8c3e465ad7718d651f2a4e7d1327efe50726e2396284e2dbca9763", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268567, "uuid": "c0f10a88-9566-44ff-93b4-4b1760b72b9f", "comment": "Malware payload (RedLineStealer)", "value": "a5b2fcd5fcd713dd42ea5364161518141f8a3635", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268567, "uuid": "e60c9af7-b5f8-4490-a161-acb2b35b60ba", "comment": "Malware payload (RedLineStealer)", "value": "1eff083846ce8cf92ada19e4edf52f4b201893e768d4b298d746bfc2363478da9c5afe8d9a02c998b4eb4854616169f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268567, "uuid": "aac18c7f-f31c-4656-93a1-3840941e04e0", "value": "T14FA46B4792A37C55ED279B729E1EC3E8760EF2508F497BA722199E2B04B11F2D273710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268567, "uuid": "f474bdf4-9383-4ade-8b90-fe17dfd48b01", "value": "020eb28774c582d508abf5443eb41b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268567, "uuid": "9f00f6b6-cd52-47ad-9e50-1f9d43c82f36", "value": "6144:CEUkILKdMM2zpvrtVpVCT0n31IoRzJewNY5HE/Ld1ETj:VUzWdMjpZV/qoRzIwOSdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268567, "uuid": "1ad765be-6874-4518-b061-0beaaadb92b4", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268567, "uuid": "1c7cfd05-c2ad-427b-af54-897d723a2274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268567, "uuid": "85351b8e-27f8-4427-95f7-6bd9b834212c", "value": "b4831e1839e1dbec149ebb2b370b10bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ad2649-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1690296920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296920, "uuid": "fb580bbb-953e-4d97-b911-6002bf4df4dc", "comment": "Malware payload (DCRat)", "value": "1858c416dcb6ab17a4ba38c24003a041", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296920, "uuid": "25fc2ab4-1165-4a88-82b8-752c821b8810", "comment": "Malware payload (DCRat)", "value": "3403bac5c539f75b944da6960af9f9347f9665ad9ac578266602c0bc8b7e5dc7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296920, "uuid": "3dac9741-cd77-4a3e-aa36-c27a72777cba", "comment": "Malware payload (DCRat)", "value": "9fe8a39cdc7bed0b38f3e3bbcf207f18b0433ca5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296920, "uuid": "a0640c41-3760-4f2d-94f5-7b2828df4c5d", "comment": "Malware payload (DCRat)", "value": "ceebf62b53bf1ba365a3338669ab2095d2ba8cb3c0cb251abc2c3edef5480a27bf8068e2b844ac79491f11961cbd18df", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296920, "uuid": "1d3fd9bd-81b2-4d59-a340-b3381d4827e8", "value": "T13AF533FF641D596BFD7A88B557FCB06330414259D1E4DABA88E2BC2C1C81A6F07887E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296920, "uuid": "c4996154-10d9-4b35-883e-2dd19caf5621", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296920, "uuid": "90c536f6-213c-437c-8a5f-6baa9aea1121", "value": "49152:xnW6WQvuHxUDZwlPt2yU9A/nYOg3/Gl4uyujSyLmILF7lCZ+/EiI8t4cpJ:xsQmHyZst2VOYOgOl4LyPLJlxIlcpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296920, "uuid": "b80ef851-e96c-4543-bfd0-818efa882acb", "value": 3424256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296920, "uuid": "94c1aa5d-1b6c-42ae-9882-84c2a4bdc222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296920, "uuid": "fa47d618-f211-4936-b15a-540be23a3645", "value": "1858c416dcb6ab17a4ba38c24003a041.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d911640-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268182, "uuid": "ff86f3a4-d402-4329-8e08-b4e3d9e75490", "comment": "Malware payload (Amadey)", "value": "5129e2aa9577a88546b213ba9aa633e2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268182, "uuid": "99ebf98b-51ff-43b0-8a7d-5102189d8f43", "comment": "Malware payload (Amadey)", "value": "34eac23d05376694cf25e5de3b6455451ef743f0f766b72fa3e5b94726010c83", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268182, "uuid": "e72a4b40-25cb-47f8-bb85-4c5d2538b239", "comment": "Malware payload (Amadey)", "value": "4b5dad0b02d1a52f709bc6440327600bbe2e0a79", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268182, "uuid": "30282c26-053d-44de-b437-b623eaf0ce7d", "comment": "Malware payload (Amadey)", "value": "1a74d27a04edc2e30f3f32b3b09203951ce033f0c6c80b8d2b55470d1bb2cd6c5ef125297500317a21b8fd3cec78e604", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268182, "uuid": "00739cce-094f-4449-8dbf-ce2a47f87b3b", "value": "T1EB840112F7E88072D9B52BB058F703C30B36BDA1A978936B3795590A1CF26C0A935737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268182, "uuid": "556bd979-16c9-43a8-99c6-ddfb80be36b1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268182, "uuid": "0d9d1fe8-c0e8-46bb-b531-4f45255db0a1", "value": "6144:KQy+bnr+ep0yN90QEiS5QTUfkLMG/8FNRkHjQ18xWMmq/908ykUlvmpZ:UMrGy90ASa8y/0kDE8y9sX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268182, "uuid": "ccedc1cc-e38f-4346-9bf5-35a839748b80", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268182, "uuid": "94739638-18ed-4ee5-983f-1745561626d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268182, "uuid": "37785e0b-577e-437a-ab02-da6200dd267c", "value": "5129e2aa9577a88546b213ba9aa633e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2844e076-2ae5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690287420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287420, "uuid": "c43c8654-22d4-4cd2-84e6-5f848c4edb72", "comment": "Malware payload", "value": "6ece9bdcc26a5c5fd8e8ceef02af00db", "object_relation": "md5", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287420, "uuid": "02153297-b3cc-4aaa-bd73-5271c4773199", "comment": "Malware payload", "value": "34fe99e9ccd61702dab2f0d82563c310b0125e413b449c9df2426792f52e9e86", "object_relation": "sha256", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287420, "uuid": "fd86542c-23b5-407f-bcfe-79a5ec76de93", "comment": "Malware payload", "value": "0496647a6321de12ea3638485d1df7b926bd88dd", "object_relation": "sha1", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287420, "uuid": "d407a72d-6fda-4b0c-8530-51859b428ab9", "comment": "Malware payload", "value": "d323d0d8b6ba5ec89e5849eba06f6e1dfa0933655c427969f8fbeabf2bcc19e9424e80d7925bc383d527d808a51a8e3d", "object_relation": "sha3-384", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690287420, "uuid": "5504607d-a8b6-493c-84fb-0754513d44a3", "value": "T17E46334BB8CB1F32D12A47B5709F57CA9E684E040B47162763FB728438F37147AB859A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690287420, "uuid": "3b48b99c-b53d-463e-b5f6-a45399e8260e", "value": "98304:cNWMy2eOSmUNQiveS0nGRehMc6zEmktLFt7s365qqXxHw+v+y3hfHDdu7gQDf1:cNWMyLOiv4GRemc6zEVtBt7Q65qqXxQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690287420, "uuid": "9c2a5a06-36cb-409d-b651-7bb6ddb98ef9", "value": 5881344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690287420, "uuid": "69f89370-5eab-4a10-84ef-eaaf25515141", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690287420, "uuid": "2aae854f-1fc1-4d5c-b254-80fbc0815aee", "value": "Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30dec32f-2b37-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690322653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322653, "uuid": "cb582171-7445-4161-ab74-3a3bf9119412", "comment": "Malware payload (Mirai)", "value": "629a5e3c2fe39432f0919d6784456751", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322653, "uuid": "c63a4808-4668-4c34-8950-3840756fcf85", "comment": "Malware payload (Mirai)", "value": "359710bb6bf4149631b6c08fe8fe44c64014c0bff5ca2b57c4c871e547a032b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322653, "uuid": "7f045f87-2b8e-4b3d-8e62-4e3748f4d80e", "comment": "Malware payload (Mirai)", "value": "750f72e288235540710398c03ed4d6a7a154fdf9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322653, "uuid": "482ab76b-8c50-4359-9fec-0e5cbdb03204", "comment": "Malware payload (Mirai)", "value": "a4d9b54285bf0849cf5f0f3a7cdf2723bb5a89bbe96e13979b21d68e118d224feb496c0ecd675130973a0794c0914d2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322653, "uuid": "81bda4c4-ad9c-4005-9c16-68d557d2d7ad", "value": "T1114301A3D76357329CA16C32FEED49863E53BE7CC09835130B118B9A1B5A247D7F5026", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322653, "uuid": "a17d58e2-1724-422f-a0b7-146b524a7d49", "value": "1536:LMNSnMCw02E+XLUNLAhDYj5t76/MPMxTFEu8sTe:LM0dwNgFAlgSzE9sS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690322653, "uuid": "837cb613-1cad-4760-8dd9-a2a60025d4bd", "value": 58816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690322653, "uuid": "34e980e9-da00-4096-8a86-2b47b801c174", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322653, "uuid": "bf0328e0-b25e-4ff8-a1a2-3a29968a76fd", "value": "629a5e3c2fe39432f0919d6784456751", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5ee4be-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268180, "uuid": "487c19d5-3858-48de-8a96-313c4c29e2cd", "comment": "Malware payload (RedLineStealer)", "value": "0ac02c9b8e6f19479620f7e59186e60f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268180, "uuid": "c7273f3e-a367-47d3-ac72-f86783622000", "comment": "Malware payload (RedLineStealer)", "value": "35c135016a0f649443e821c488d88916ba73f8c81eba1b57cf92cbafb9cd49ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268180, "uuid": "7f2277b4-dab8-4e71-9374-befeb2c7492b", "comment": "Malware payload (RedLineStealer)", "value": "bbc977716a369583ff74aef66e2048e35f319855", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268180, "uuid": "acfc2ba8-e01d-46b9-9d15-8588cb33986d", "comment": "Malware payload (RedLineStealer)", "value": "5aedf5d9d914baa9dbd98bdc7d87e68dbb392eb69e3cdaee1b4c52eb6c4ac081405f06729b39780be9dab706e32f6d1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268180, "uuid": "2caaccf8-a880-4094-935f-a4671cd9e2f9", "value": "T187840203ABE89032D8791BB05CF203D31E39BC66A878576B3785991E1CB26D4D97076F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268180, "uuid": "d7a88677-48ce-4bd2-998d-776e06021a59", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268180, "uuid": "459f6ceb-2b8e-4391-9c8e-d246dbf57201", "value": "6144:Kuy+bnr+0p0yN90QEedTBA8dQIkZMXbdJ+VAwNaGiIy4domfZ6YV:eMrQy90iYVMXbhcplTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268180, "uuid": "06aa0565-90f8-4341-b9f3-8d91d9ef8a90", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268180, "uuid": "a1078d30-136a-4da0-8bbe-45cebcf9e308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268180, "uuid": "06ca3d07-75ae-4c83-bc1f-3fca011360a5", "value": "0ac02c9b8e6f19479620f7e59186e60f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc7f499-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690290493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290493, "uuid": "a1466093-aa46-4fca-b6fa-c328c4dcadd2", "comment": "Malware payload (RedLineStealer)", "value": "3e8e3f99da17defbcc54d0b92d42d370", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290493, "uuid": "7c34fdd0-4a11-45c0-b3c2-b490b5d4000f", "comment": "Malware payload (RedLineStealer)", "value": "35d50aca923965e5a644e1735c8cd657d562282a8fddd8a654982c84f9258342", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290493, "uuid": "539b3755-21b6-49bd-a91c-0d93e1a5be06", "comment": "Malware payload (RedLineStealer)", "value": "4ae4d190f1c7743e707ade02bc452627b85df598", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290493, "uuid": "b12e7043-1383-4d12-8353-5e96066764a5", "comment": "Malware payload (RedLineStealer)", "value": "fb005280d8c10b20f8cc02de3607f2374a96163600ad6a987c5d79e71694be56e0ef9ee61e81c753a99985b1180315da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290493, "uuid": "649cc57f-3f2b-43a2-8401-bc5488b54a33", "value": "T158840263ABE88033D5B457B069FB17C30E32BDE19C38931B2785AC5A1C72684997177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290493, "uuid": "d2485dc1-1d15-4ce5-86fd-f445a70c0590", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290493, "uuid": "00dc4ff8-e1d2-44bf-98ba-5a672b1a4071", "value": "12288:iMrEy9080eKh/MtcyzhXhwB2GdnXxxEpyFpp:qyUe5tFtRjUkIFpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290493, "uuid": "a6fc0ba5-5648-4257-a761-fe85993b7123", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290493, "uuid": "099b1822-6d07-4d13-ac24-08e79207235e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290493, "uuid": "776701df-e45f-4b20-a042-753ea2d24f8a", "value": "35d50aca923965e5a644e1735c8cd657d562282a8fddd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb70a6c1-2b18-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690309679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309679, "uuid": "dfbfc531-99f6-4b2f-9f90-b827bf6a9701", "comment": "Malware payload", "value": "5188b9bd42088b691c9ee17401904aa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309679, "uuid": "87bfeb68-7449-41c4-8c59-9103fed5d30d", "comment": "Malware payload", "value": "3641671b27b5b8a1fead3519ded6348dab567c912968bd26ed1c4a853af4a6b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309679, "uuid": "2b95ff1a-ae61-4d8f-87bf-b9accf963b7d", "comment": "Malware payload", "value": "53a9346d41b707d83b7306697ce34065f3771126", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309679, "uuid": "815478fe-b239-472d-ab1f-e49a349609a4", "comment": "Malware payload", "value": "71c9ecdab280c53526c9e2eb51516a7adb9020abb5358c1ab08e984a70656a7aa2457974b572edb22d8a1c87ba99ee85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309679, "uuid": "c6cd7c9b-acd5-42c3-aabd-1c52413ef601", "value": "T167B40257EBE89032E9B4077148FA13D31A397D62593402672796AD5E0DB32C4F8327BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309679, "uuid": "b5e8146c-d51f-499c-afd4-eae45c88e8be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309679, "uuid": "771dae22-c334-4cf8-ba1f-54837eead4b0", "value": "12288:1Mr6y902H8VZPRGXr8U5xoWnshuQWP5X9:Ly/Heu8kxoKSuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309679, "uuid": "ab0e9ec1-0fdd-4fca-a371-1cac49b6328c", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309679, "uuid": "8cff8696-5e44-4911-a33d-7cfd32199198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309679, "uuid": "6a8e0b91-3c7d-400b-a532-ce791c9b29a2", "value": "5188b9bd42088b691c9ee17401904aa7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea263cc4-2afc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690297624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297624, "uuid": "2fed6103-60dc-4a09-a5dd-ce624b2a7ebe", "comment": "Malware payload (SnakeKeylogger)", "value": "5cb1dd68d5773609c55b1729eab4e085", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297624, "uuid": "0ddec3a9-2e6b-48cf-a9a5-0b76ca3cf197", "comment": "Malware payload (SnakeKeylogger)", "value": "3751533b2ece4b05293d9a9447cf35c06918e1138d00c746feb1ac6df5a7ff37", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297624, "uuid": "bf58e76d-05e9-4f93-82b7-84020c64fa3a", "comment": "Malware payload (SnakeKeylogger)", "value": "85e0415de3a5e800842fd3ab2b9965f63eeb258c", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297624, "uuid": "748b8073-956e-46c5-8b10-9599be8fac5f", "comment": "Malware payload (SnakeKeylogger)", "value": "0a0ccccf79fa27cfdc6bced7da75548a3b0006f40378b7436d5ae344cb8439848ca8b188a3324d7b3a62bad7519d8d5b", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297624, "uuid": "ce2565ba-93c4-4a28-9145-856eb8a64a86", "value": "T19773D405B7CD4225C249DB3AC76791800363AE0258B3C75F7B4E13460B73BABDA4B78A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297624, "uuid": "942376f9-481e-4cb3-ba15-2ebc3b44cb37", "value": "384:P3K3YoRIr5alzViGpoYSm0vE5kYC5Gh5B:yIdFalp5BSq5kF5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690297624, "uuid": "470c5c7b-1e5f-4eda-8111-b3d551124cc5", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690297624, "uuid": "17f84528-3d44-49f8-958f-39335f771ea9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297624, "uuid": "77a18eca-9fff-4bbf-a045-bcadcc6b53bf", "value": "rOowypt.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cafb4b7-2b37-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690322619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322619, "uuid": "d477c146-91f6-43e0-acb6-7f528bc0b9c5", "comment": "Malware payload", "value": "e0d03dd216dcc976e6055858685b3fb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322619, "uuid": "9772aaa1-9319-4bfc-aabd-aefb6d488e83", "comment": "Malware payload", "value": "3856e3903741863095821531d4cc26a0d3198cfd45c64486f25d56d1e64e340c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322619, "uuid": "592fad26-06f1-4066-bbf3-5d8c70aa290f", "comment": "Malware payload", "value": "206448bd3c23bc59415a9ef37cc5a067af60b2dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322619, "uuid": "0e66d8eb-7119-42b6-b2d1-c042a5c49172", "comment": "Malware payload", "value": "16a20768d25ca18601e79e7b2165b680292899b5638a1365e05564bdb304a0b34cb914f553eeb34708881b574f175f3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322619, "uuid": "427eed4a-96a6-44ec-a2f7-4c5cee612b04", "value": "T1F5F2E15FA0E80CD5D71C0EFCD82D1279BE82D4C3794E979AE7903CC98B62643A6DD518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322619, "uuid": "140adc7c-4e30-4cde-b4a2-6bf86ef1216b", "value": "768:xsqEXy9ehOEJ7nUeBVEeYVduZsEdYb8061FHIcPWM5:xsvc4TUeiVdWYAZRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690322619, "uuid": "8728f57f-a76e-440c-9859-676097245a29", "value": 37332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690322619, "uuid": "44975386-f94d-432c-bfa7-feb27287dd75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322619, "uuid": "e7bac500-3274-436f-8f4d-7af40088c2ff", "value": "e0d03dd216dcc976e6055858685b3fb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6eba5b5-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268842, "uuid": "afce22ed-fc81-4c1a-a7d1-60e46663004e", "comment": "Malware payload (Amadey)", "value": "e3b174250b92ede8fc35062276f42c1d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268842, "uuid": "c4830871-ca71-42c0-a74b-89d4d859e718", "comment": "Malware payload (Amadey)", "value": "38763c03957d2c8fc1984872426382cad8251302c27dab92a67a4d434f93dcca", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268842, "uuid": "40b47cdf-d057-4b3a-919e-63e42f5b1dee", "comment": "Malware payload (Amadey)", "value": "e507dad968a155b4d8d8393e23cf2d78e680b6c3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268842, "uuid": "8893ad97-38d8-4fe1-bd3e-927813b4f1f7", "comment": "Malware payload (Amadey)", "value": "0b22101299bcf2a651e247c4964bbe16461190778a7152b8dac0f926866cb60acef863f255682cd9d3d69f49812eafbc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268842, "uuid": "c7eb8da2-e4d8-4802-bd63-3b1d742d4e36", "value": "T17D840252F2E98072D9B61BB05CFA13D30B3BBDA19D74935B2342980E0DB3690A47173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268842, "uuid": "d915b95c-dc53-4829-bc3d-e683a2ed3a1c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268842, "uuid": "5ca67097-fe90-409c-8453-92f08c8ae727", "value": "6144:Kmy+bnr+ep0yN90QE0/8xdrVYhmkZCC7n0jeS+Bgylz16pLKx1Q6msaWjDlA73Uj:qMrCy90CUxdahmkZjL0atBgytrdGU86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268842, "uuid": "8647b11a-f265-499a-b24b-d91a91f8b7ce", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268842, "uuid": "4268a8f2-2535-436b-9c29-11d123af2e9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268842, "uuid": "e2e3150c-525c-4838-b97e-235febede2b6", "value": "e3b174250b92ede8fc35062276f42c1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918b6fc1-2aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690269128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269128, "uuid": "7fea30e6-3b0a-4081-9e45-7f5f973c9099", "comment": "Malware payload (RedLineStealer)", "value": "e933dd87cb8d96bd9ed89469de69cb98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269128, "uuid": "742bd0eb-4fa1-4d0f-b90a-0780bc3671b9", "comment": "Malware payload (RedLineStealer)", "value": "38b0f35bccdeaf39d71e6d7dfd2fe041550ea75de219edb5d7591fd337bb7edc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269128, "uuid": "8f3a7683-ec02-47dd-b0e5-95ac65d6d963", "comment": "Malware payload (RedLineStealer)", "value": "bc44fcb4a6b6e8627e6b4c16bd5ee28a212cf452", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269128, "uuid": "a10d8a17-547d-4545-8822-59a99ade72df", "comment": "Malware payload (RedLineStealer)", "value": "dc798c57ccd9c9970e3c57e351888d6411d74eddd78f58b79c4d5ada78d2836290d6aee2a199794b240ae0fc003b80ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269128, "uuid": "86704ca1-33b9-425b-ad2f-cf0ab82f27b0", "value": "T1C5B41216B2EC4076D8B52B704CF612C31B367DA14E74926B3B85988D1CB36E4A93277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269128, "uuid": "9a4b0c63-d740-456b-827b-823896aeca5b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269128, "uuid": "131e9cd4-8e53-40dd-80c3-375742d9b1c5", "value": "12288:/Mrzy907YVERrEY4N3ZqYSY1nZ9srFsH0t+aJjE:wyAiegY4N3ZgKnPcHjJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690269128, "uuid": "ebc4c12f-b948-414a-b501-5b44b6572f1d", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690269128, "uuid": "86a08e96-944a-4fca-b29a-8b4aef092571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269128, "uuid": "c1ce530d-a3cf-4b85-9013-d967c0010a72", "value": "e933dd87cb8d96bd9ed89469de69cb98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b5ab0c-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690296939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296939, "uuid": "f11230dc-ae8d-4348-acf3-1cd4534f4018", "comment": "Malware payload (RedLineStealer)", "value": "075bb9875f2972309b90a6927b899bb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296939, "uuid": "e59b3ab0-8b7b-47bc-9be5-5a99ee994ca6", "comment": "Malware payload (RedLineStealer)", "value": "38e099ef86c063ecc48440de86109a58c8c748d68969f0fb2262e9b315c0d2f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296939, "uuid": "000fb607-92f8-4ec5-aee5-d770202124ce", "comment": "Malware payload (RedLineStealer)", "value": "9143408f4d9491fbe5ba588c51f8bfb75a4c1654", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296939, "uuid": "cdfcb630-a37f-48ab-860f-8af214363111", "comment": "Malware payload (RedLineStealer)", "value": "eb8ed192476af2bdb1abbc5a4c5c70de26036b5f61c82c0b6c92e8e460f862666ac23ba7d9ac95ee7352cb8bac94a862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296939, "uuid": "217c46c9-9458-4a6d-ae43-224f1c89fffe", "value": "T1CA844C0392B17D51E9E79B729E1EC3F8760EF6508E497B66211BAF2B14B10B2D273710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296939, "uuid": "26a74fd1-e6d3-444a-b2ae-36ba3f07556b", "value": "020eb28774c582d508abf5443eb41b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296939, "uuid": "46ddb274-1f42-47d8-ad91-f868aad7b8bc", "value": "6144:caSVvvLeEF+6gEHdel7erAUkXaHQlZ9WYSLty1pT2:7Gvv6HtKY7BKHCAtyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296939, "uuid": "cb70ccdd-a89b-479f-af38-43f9e6723f29", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296939, "uuid": "e15ed28d-b269-46c4-80f1-5055ce2c6565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296939, "uuid": "9094268d-e0ba-497f-8ce3-18103d6bb59a", "value": "075bb9875f2972309b90a6927b899bb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f83499a-2ae5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690287432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287432, "uuid": "24cb7ef4-ad7a-4829-aef7-f5cc003a1aec", "comment": "Malware payload", "value": "5efc580050f22c6f5b8ed2af0f72683a", "object_relation": "md5", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "pw-888", "colour": "#8C3336", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287432, "uuid": "d7b5f0a5-a4ff-4a7f-8f28-c5df00bc4889", "comment": "Malware payload", "value": "39057a812ec10b904c8dae2837bb672601acee22875088fa2999139747a29f50", "object_relation": "sha256", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "pw-888", "colour": "#8C3336", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287432, "uuid": "6200ad64-c081-4d75-bc12-680a189c9951", "comment": "Malware payload", "value": "91d5ba930962a22e730181e052ebbbff2531612e", "object_relation": "sha1", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "pw-888", "colour": "#8C3336", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287432, "uuid": "149e30ff-a2ee-473d-bb7c-7bba0503b8bb", "comment": "Malware payload", "value": "abf213e3b0f0c705732e42b87afb6e6454c13a4ea3d575aef80625aeefb2ca865c37c9e314f64af1e962f263bf6c0d5b", "object_relation": "sha3-384", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "pw-888", "colour": "#8C3336", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690287432, "uuid": "d470fb29-f21f-4a15-bb93-afc8e9b4250c", "value": "T11F46332523B3685ACDD200C77BE3569512FA63D05E8E16E581BBCC85B5BBBC3AE47C04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690287432, "uuid": "8e5c9501-3ff9-4bde-87b5-0cd8ddb09ae7", "value": "98304:jJcxgTFGfrd/mrjCK0toCGQVcnksC49KiDJfHfX0VMIWhBsFfpoCBnS00WjJ0L+:1cKJWNOjCblQY4fmMMDvS0FWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690287432, "uuid": "3113b68c-c8de-4f07-8547-6c9b18c9f3cc", "value": 5687334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690287432, "uuid": "694d14b3-a834-47e7-8fff-057e80dc46c1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690287432, "uuid": "05e6b882-2b06-4cc5-8e2c-a4a7fdc3aa1a", "value": "GoogleAi Msi.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7ef37d-2b04-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690300826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690300826, "uuid": "4985b9d1-7cdc-43f1-886a-a5711935dd60", "comment": "Malware payload (RedLineStealer)", "value": "23fdb3a1bfe42bf6fdaf5626b8c4ec06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690300826, "uuid": "72a281ca-1eda-45b6-847f-68eb9aef27c8", "comment": "Malware payload (RedLineStealer)", "value": "3939eda08906ccdabf2c128914c02a96ec8a0f7183f0e4becdae79b58662a95e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690300826, "uuid": "08c3e2bf-4955-48cd-afae-f86bce2ba374", "comment": "Malware payload (RedLineStealer)", "value": "f5e255a671fa837f923575d9460f693f25fecb28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690300826, "uuid": "cf65e614-936e-4157-98e0-aa8ce3175800", "comment": "Malware payload (RedLineStealer)", "value": "8bef0087989f7efaccbe7ccf97a66c20c23852a1c59a6a58fa7db0e6eab5ccb6264598fc375172f61c7a0a36b158b57b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690300826, "uuid": "979fa496-5d6f-43af-866a-133726c82ef0", "value": "T1EA74D0117690D036E1A76A314870DAA12A7BBCA39B3541CB33983F3E6F716D05B79B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690300826, "uuid": "62f7c4e2-24fa-4d09-b896-9723da0f0a21", "value": "1c187c5419584098cd104bb53d369d28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690300826, "uuid": "53a803a8-9ea8-4e76-8385-20f356a053e1", "value": "3072:9XfYouaDRgpvaH84ovf4kAHpVMc4sVYFMQosr2VJBUFfMlXWiOMSmPJxrzx6iWT6:BFp1g4c4UfYvtiMGFf4m4SmPfzxMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690300826, "uuid": "5e9ab15e-2632-49bc-87c6-e76bfa9665eb", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690300826, "uuid": "bfec91f9-4c30-4ea8-8ae1-cb314e1a4e7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690300826, "uuid": "4e2e285d-aff4-4485-bacb-45f344ee5087", "value": "23fdb3a1bfe42bf6fdaf5626b8c4ec06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3429c6d-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690267896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267896, "uuid": "daa7f659-6d8e-4861-a9c1-7ea64ccb6ebd", "comment": "Malware payload (Amadey)", "value": "41bf1956897ede050b574b6bc9b2d360", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267896, "uuid": "036199a5-67c9-4a7d-b67f-dc3f7e6f2989", "comment": "Malware payload (Amadey)", "value": "397cdf0c96b8b27daf5a542b0a7f9c68381ea942e9f5de73e0e718117b0aecdf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267896, "uuid": "da3abc7a-aa59-4bb5-aa35-39ade6092915", "comment": "Malware payload (Amadey)", "value": "9d9c1c09e91e1364b2f9ccafa0308fdd4793d3b4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267896, "uuid": "990d513e-f7b5-4d78-8b15-d1c0d1a4d1d0", "comment": "Malware payload (Amadey)", "value": "9ede47d954a8fb3757fe57a984ff39d44bf4a1b2493f800d19a3a99d670aacdd27774eef92460ed3efa72c8e98408280", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267896, "uuid": "56019ad6-db14-4a8c-a732-c5db36a26ef2", "value": "T17A840213F7E88136D5F017B06CF913D30A32BDA18D79826B2A95AC6D0CB3694A47177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267896, "uuid": "223524ce-e857-482e-becb-8c365a423bfa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267896, "uuid": "a90ba35e-6db4-4685-a2fc-029d7f939dfb", "value": "12288:+MrRy90/vyiaPQlrN8VIpP+t+O7LeLJdemV:Ly2O+uVIct3k9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267896, "uuid": "349bb815-ab26-4187-90d9-4efc233f9ebd", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267896, "uuid": "f442c637-4546-4c07-9a27-6fce29dc054f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267896, "uuid": "c442f3fa-8f27-4b2f-8b0a-1a9c92a1a7d2", "value": "41bf1956897ede050b574b6bc9b2d360.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b671e3ed-2b17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690309134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309134, "uuid": "952a25ab-bac4-4810-aa8b-41a00c58fc5b", "comment": "Malware payload (Stealc)", "value": "18b5560ecde5d1261f829aa0f94c9045", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309134, "uuid": "fb69ea21-cc02-46b3-90c9-dd6b1564d0dd", "comment": "Malware payload (Stealc)", "value": "39e419e214eb8eaec3044defec6894257fc814681c4239e9831bf8458c33b7a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309134, "uuid": "dc2624b1-5e4b-40a4-a719-e3dfa7b9d171", "comment": "Malware payload (Stealc)", "value": "e1443acdfa2f607965d111755d5946e8728e506d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309134, "uuid": "6ce51493-bf8a-4ea9-b8e4-817df248f4b9", "comment": "Malware payload (Stealc)", "value": "958bf20fccca88952e06ca8655b3c7a3b48d89436ecfaecf9c503537b76545576fe68bf5382195893a40eff2f0424db6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309134, "uuid": "1e048c81-a749-4e77-ad21-ab38debff1b4", "value": "T12544BE2176A0D073D0675A315970C6A12B7BBCE2EB6846CB33983B3E6E716D05B78743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309134, "uuid": "2f2b2c13-e160-436a-acd0-2bb2170dcf1b", "value": "21f576cdd9781dd6a4a8eb3639210862", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309134, "uuid": "ce4db674-454e-4e5e-bc10-221caa547c9e", "value": "3072:SMrvLzsQ1gO34bcvbSffjLhKAEiq5i0nDh6rVRHmVJZXdEC:ZDgSgOIbIbwXhoi/0nDh1jE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309134, "uuid": "9a224fe6-fb3f-4079-9a12-880897b63a36", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309134, "uuid": "b86f30eb-0d09-4403-aff4-a218ee06c418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309134, "uuid": "b1113e45-d27d-464b-9b8a-eb615de6a7ca", "value": "18b5560ecde5d1261f829aa0f94c9045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c889482-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690296930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296930, "uuid": "8874f46a-edc3-4971-ae50-4b4900c177e9", "comment": "Malware payload (RemcosRAT)", "value": "5bebeb46c3cd437af15adefe96d73fdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296930, "uuid": "c9aaa1df-30d9-48ec-a499-560988ce9bcb", "comment": "Malware payload (RemcosRAT)", "value": "3a3f2a44636a5d8b4e857ac2c5c8b2a8262ee577bf5b17354d5917bc03bdea4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296930, "uuid": "ba0baa6d-6ed2-4dbd-b3b8-9680ee42c9ab", "comment": "Malware payload (RemcosRAT)", "value": "faa219d0ae32fc00960059b6994b67dea15613e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296930, "uuid": "a47b859a-db39-4677-b03e-2b53c9cfcffe", "comment": "Malware payload (RemcosRAT)", "value": "7abb2d3392ce545964a005a380d8ac72ba9017fc0048a092f5ea81a234534ba889a53641cd0ddf0c9b3f9101350af7e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296930, "uuid": "c515103e-b40c-4ae9-94b0-69001f666afb", "value": "T12015BE22B6D08533D16F3D354D1ADB6A60257D201D2CF5873AD93E8CEB763827828E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296930, "uuid": "f255db80-e626-4120-9a92-a6ffc9a3e3d2", "value": "5a228192c4ccf136d4c97f1d42c75f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296930, "uuid": "af4a6399-e603-44d2-b8be-0051a80db445", "value": "24576:qgVL/HkvOe7zm1OHMVy500RNJn135sP54J06:5lMGaNbbJ15c4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296930, "uuid": "93c06f7f-5d01-4f85-aa33-a694b3404a44", "value": 879616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296930, "uuid": "ca5ead3c-aa95-4275-bf28-ff18c2b09094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296930, "uuid": "bc06533e-441a-4139-b169-8a3895672125", "value": "5BEBEB46C3CD437AF15ADEFE96D73FDC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc588111-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690282112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282112, "uuid": "39ab62d1-0aee-442c-95d7-7fadc133d90a", "comment": "Malware payload (Formbook)", "value": "1c0d907f3ead4d3ca9aea33702c83cbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282112, "uuid": "b98f6850-330e-4011-87ff-844bcef5ae23", "comment": "Malware payload (Formbook)", "value": "3a99f6960db39c701811edf0ec230f829ac336e829c551f8b849c997e334188a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282112, "uuid": "01fcf8c3-64fc-494c-a685-261dc00a2084", "comment": "Malware payload (Formbook)", "value": "a2754c8a9e9f76e83c99a7b0c5de1eebea823108", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282112, "uuid": "50c6eb49-5679-440b-8b91-b18a49c1ebac", "comment": "Malware payload (Formbook)", "value": "b6eec01fc4d26a254b22a212b9f753251b35f60c5c02a4614ac60213048c81524cc6f6ac63955ad49c736ad6b8f447be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282112, "uuid": "27189bea-cfa9-48f7-9fdf-6028670087bc", "value": "T1A415DE30F7EBD712C78B0ABD583C7EBB138912C674D2A687680B9D59A584F78490363D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282112, "uuid": "e37f5c4c-02bc-45ac-a42f-289f0d3067fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282112, "uuid": "d0ff63ee-ac6e-42e7-9c74-dbdccafde0bf", "value": "24576:AC426I5+p4+BAbHG506F6j/qtQeTLO8jVfBVfBVfg:nx6I5W4+BAbGv6jyt1XhfLfLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282112, "uuid": "895f9143-db40-4ee8-9348-794944041e9c", "value": 916992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282112, "uuid": "dcefd55b-c0c6-4333-bb09-b79b3a2e5470", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282112, "uuid": "1db44460-7afd-49b0-bb4d-e491fdf0e14a", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d90487-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268834, "uuid": "c15bf01e-46a3-4a69-98be-4b35552aa31d", "comment": "Malware payload (RedLineStealer)", "value": "c17205dc4e5541f69c8a9a872fe694eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268834, "uuid": "e2325572-6508-4483-ae93-c9e25a18c1c7", "comment": "Malware payload (RedLineStealer)", "value": "3ac8c553a44a98e00e09c2c98ac084b9c7bedaed47e28131cc32e756ef5e799e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268834, "uuid": "6ae0c4b6-f821-44e8-8639-ed13870fd357", "comment": "Malware payload (RedLineStealer)", "value": "be9a785a934f01465c9f1b849a1d818374c711fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268834, "uuid": "a28241ce-9827-469d-a73c-3506ae816b91", "comment": "Malware payload (RedLineStealer)", "value": "bb8a698ac72c4288545a78d7895fc5b849d17a29b25b089cc088766348518a351fd22eb418c2901f9e14ae46917de7a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268834, "uuid": "37c99885-64cb-4065-9a04-fa9621834dc3", "value": "T19F840102E7D99073E8751BB01CF306930B3A7C919DB9936B3745A85A08B36E4E93573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268834, "uuid": "88af816b-3991-404d-942e-47e0442c995e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268834, "uuid": "993007f6-a985-4880-a86f-0011b6056189", "value": "6144:KZy+bnr+ap0yN90QEHdrX7gVhKQsZR/muXEsnoWYagBZ+t48DdkmLbSB:XMrGy90vTcjKQ+RTXfxYagBYC8xkmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268834, "uuid": "b0101d75-fd8e-428f-b90d-4d8acebabff6", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268834, "uuid": "a888976f-05e0-42ba-b44a-6330564f1d0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268834, "uuid": "4e958d5e-bbc8-4c6d-96bc-329d2c194d44", "value": "c17205dc4e5541f69c8a9a872fe694eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05af59d-2b15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690308345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308345, "uuid": "411a3968-e022-4eac-a10b-d6f77725cc45", "comment": "Malware payload (Formbook)", "value": "87276c54edac566212607f7d16893412", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308345, "uuid": "c044ae85-d394-4e40-ae2e-957b930653d1", "comment": "Malware payload (Formbook)", "value": "3adaefb94e006670d66c9675ecf47b65a27bc39325bf96432c79ce47d473edcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308345, "uuid": "b5ccd5e4-c8d9-412f-ae52-e9098d2b94c0", "comment": "Malware payload (Formbook)", "value": "306c104d27b2b43c769440330e26d571c04b3a96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308345, "uuid": "d06acc3d-d33c-4650-8bd6-60c2964c7de7", "comment": "Malware payload (Formbook)", "value": "4566225ac4f21f7eb3f9cc3fa0a291d8cccba5a08068e78883ee99b7e2b0f745f7573b2fb0915210e826b2b7aba2614a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308345, "uuid": "ad184c89-d0b1-48c3-8278-1847dc7c5279", "value": "T10FE423293DDE5A9BC10A0FF6649073F5637EDFE26821D6A35D87B098AC26F6CC631101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308345, "uuid": "c45b129e-5841-41dc-b2a5-3b37186bb38d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308345, "uuid": "a27581d1-930e-47da-aa9f-16b1ddccafcb", "value": "12288:qYiIoFwIrG3XCCarV+M1qb6ZAoPpiB5l5lHK+08//omNGE/d0olR:qHIcTrGCLVp1w6ZAohiPlWG//xGiWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308345, "uuid": "5a22faac-6d0b-4dda-a37c-cfd6cb303080", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308345, "uuid": "cbc7ea89-4224-4a21-9407-4b1e52084297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308345, "uuid": "c8effbe7-ff1e-4d27-be65-11510333e9b9", "value": "Order confirmation_Aeon vietnam PO 259 25072023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d851e6c1-2aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690269247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269247, "uuid": "ccb376eb-01e1-4898-851f-194e44080658", "comment": "Malware payload", "value": "750a787957a54193576cdc4300c783ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269247, "uuid": "e21c674b-d11a-4d7a-b282-621fc631cf01", "comment": "Malware payload", "value": "3bd3c58437619b3ebbc316fc549c099825b1e688afb8d18d1e435800ee2c10a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269247, "uuid": "2dae581c-0e57-4166-957b-c8b2bc4b14d2", "comment": "Malware payload", "value": "ebea9e2fe78c9e5262d8ce36768382b74717db92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269247, "uuid": "c74a3cc7-5f84-4024-a10b-b1091dfda4f8", "comment": "Malware payload", "value": "c9d2381f9e6c94f5877b2cd689df4e4a089aca6e85506effaefcbea0751f3b3afc9ad6ea6d56333c416393b95a9d7453", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269247, "uuid": "65e5b142-0d36-402a-9a78-b10dcf244322", "value": "T14DA68D87B8814657C6E42A3BACBE40D433675EB9978B63566D00FE3C3ABE19C1E35350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269247, "uuid": "fe74c1ae-ddc7-49bf-aa04-13626e2b60f2", "value": "98304:8bGqsu6HZOnOkUbH5xrytS8YXD5AHehH/F+pmyExSzcfI:8bGqsZ5xrytS8s5AH49+pmyEcYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690269247, "uuid": "50ddbf25-3199-4df5-90e6-52f201bce5f2", "value": 9526725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690269247, "uuid": "c042ab02-4d89-47b3-9357-ab27c140c6c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269247, "uuid": "876f0f03-ce5b-4ea3-921c-681d89a64460", "value": "750a787957a54193576cdc4300c783ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a858cfb-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268526, "uuid": "7f93cc98-55e5-4fcb-ad46-aae9bf9074e7", "comment": "Malware payload (Amadey)", "value": "a7b1c8434e0b3026abe612ce6e5e04fb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268526, "uuid": "6523594f-1b4e-4b4d-90a9-3fa8d8bbc4a9", "comment": "Malware payload (Amadey)", "value": "3cb5d62d664df608ef06c25436699f14368ef14ca67a475db5297141c5c67853", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268526, "uuid": "6d4914e4-8527-4740-8f44-ad101393b18d", "comment": "Malware payload (Amadey)", "value": "88fa33468dba6333a4e04b4275d365f238b7e7ea", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268526, "uuid": "392661fc-be5a-4082-8acb-6636ea70f399", "comment": "Malware payload (Amadey)", "value": "4437a6b2c67cda8f78f12262f211f591d9b86e06810732089c359eeccb6c91e3d9af08a8f5f819e4502abbc48ede0cdb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268526, "uuid": "798b1059-077c-490b-90b5-6281d11f76b2", "value": "T15B2408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268526, "uuid": "347aa384-7342-43f2-aca9-5a8ed2f085b5", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268526, "uuid": "1536e069-6096-4fda-921d-f7106a1f9721", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268526, "uuid": "56a7c112-060b-4c76-b3dd-d97cc9ac0b48", "value": 229080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268526, "uuid": "3f30f480-60b0-476a-afea-d9ad4307bb2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268526, "uuid": "969cd9e5-4467-46dd-9c3d-b308ffdd4236", "value": "a7b1c8434e0b3026abe612ce6e5e04fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571e5bef-2acf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1690278050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278050, "uuid": "0d57fd29-f073-4833-8ced-86a9478c9797", "comment": "Malware payload (QuasarRAT)", "value": "a68c52bcf23ee991ccc930e391435f48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278050, "uuid": "8ca86beb-4563-4081-ab9a-d9ddf48f2302", "comment": "Malware payload (QuasarRAT)", "value": "3cea309d8b6b448883aafcf5f31119d212b71f4757e9b57c8315f1e5573e6fab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278050, "uuid": "9c0c6095-2f17-40d6-aa81-b81ca497de98", "comment": "Malware payload (QuasarRAT)", "value": "5664622a63b1d78c7947cdf191126f032cd4b0cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278050, "uuid": "f218d5a4-60f6-4ab8-8980-d6c75f8b79fe", "comment": "Malware payload (QuasarRAT)", "value": "da7b482fa8188d9a382f86519f68a8a0936069b546aba37729b87395a4e08a1cd5ffc3d2f8d2b29b1f229e1c2830eba5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690278050, "uuid": "f72ff548-0775-4559-9e1b-2b3f3ddb2fe4", "value": "T18FF56C143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6591677A1C53B5098026A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690278050, "uuid": "c53516d2-ca0b-4e97-905c-e51d263569bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690278050, "uuid": "1538f70e-6fbf-41b6-bb15-d05da962464d", "value": "49152:wHp592AYawl1WPOl6NVtRkJ0xWyER16PbR37oGd+THHB72eh2NT:wHj92AYawl1WPOl6NVLkJ0xWyER16F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690278050, "uuid": "be3fc26a-2f00-4f78-ad47-32b832ff5297", "value": 3382272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690278050, "uuid": "2a85c444-60cc-4e56-a790-865785af83e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690278050, "uuid": "823f723e-99a6-4318-a02b-84dfd213e6d3", "value": "opera.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07ca7ef-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1690273958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273958, "uuid": "ceab20a1-0388-4769-965d-f922bd37a0bb", "comment": "Malware payload (AZORult)", "value": "b0751e57a9fe1d5c91ec0a64b51942ff", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273958, "uuid": "d78116a7-77ee-4e53-937d-4c8a6353410f", "comment": "Malware payload (AZORult)", "value": "3cef92673995af57c8a2ff4d5c2637fead90f9c19c01c9b44f016477235e5a4c", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273958, "uuid": "e6b65984-ea1f-4c29-a2f6-b72082892b1f", "comment": "Malware payload (AZORult)", "value": "d9ba47865d8f4074ebce3aa4be4f3ab79eb8b61e", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273958, "uuid": "3a976322-d5fa-4360-ae8e-520701101374", "comment": "Malware payload (AZORult)", "value": "faacb78ef27cbd49ea2bd8d450c6bfa700190dc926a42534a62fb2b9214a97d7e9f986aafc0f3d84276cb68430896e8e", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273958, "uuid": "bd3ac45d-756e-4de1-8e57-d530bf95cfdd", "value": "T114864B126348B026D0661A370D2FE696643A7E703F25DD2B3BA82B4C5E7DF41FA25317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273958, "uuid": "b3554419-dad8-4a6d-8c27-df8f10192264", "value": "1c3dd32535aee3c5a539d7ac497c828f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273958, "uuid": "e9e3e8a7-75fa-4c2c-bdc7-09e71f44ee38", "value": "98304:NACemR3MFGsClranrcLra83jblj7kx4U8uf0sWcM59SD1mg5xKi:NLXxrPJkxdtRVM59S5mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273958, "uuid": "d53f17bb-84cb-46b9-930b-d2d88ac95d46", "value": 8566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273958, "uuid": "1e0d54a8-b77d-4a04-ad14-d9fea1bf68ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273958, "uuid": "d840e41d-d3bc-44e5-b0d4-aea7edb2f003", "value": "SecuriteInfo.com.W32.Inject.tr.10649.19192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3ac863-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268532, "uuid": "6d2873a0-7ee6-4d17-b420-1d9c5d602287", "comment": "Malware payload (Amadey)", "value": "bf563439432ac3c78acc59067f958e56", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268532, "uuid": "2ef9ae0e-0184-487f-9a9a-5657c7771e36", "comment": "Malware payload (Amadey)", "value": "3d03f2fde9b9bf8b3069d0b3bdf2625973d4f23daa92673be4185d9c0d5f2500", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268532, "uuid": "03c07c0a-6397-44b8-8c1f-333d0a03899d", "comment": "Malware payload (Amadey)", "value": "23ccf3dce712ac5e26a59aba66593b785b8f7463", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268532, "uuid": "c7862169-e072-406e-9483-442a4bce4d08", "comment": "Malware payload (Amadey)", "value": "5e73a842052ddc9e0a4e2395dfb20d838d2d1877a91e1c6d877bc82473b38b8a5152ea93f9ffde78e89bebb2631346f2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268532, "uuid": "2f675413-c9fa-4487-9110-abca2f9fb29f", "value": "T1A88402527BE88832E5752B7028FB02D30F36BD614C74836B23856D4A1DB3AD4E972776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268532, "uuid": "5c17b6b2-e8c0-4710-9c65-e352cd30b255", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268532, "uuid": "d70d71e6-bd2c-4304-b407-ba468a5b0333", "value": "6144:KTy+bnr++p0yN90QEzo3Vcq21/X3pKBlMUepPXqKmCrjywubTdubmRVmjnVu6F34:dMr2y90sOq21/oalLvy3u42wWg97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268532, "uuid": "189c240c-0dbf-4c2f-a4c9-08ab309a32fa", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268532, "uuid": "818536f8-9bee-49c6-a5aa-f6f3249e62fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268532, "uuid": "6fd7613a-ba17-48d2-84e0-4735c880a514", "value": "bf563439432ac3c78acc59067f958e56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c188c04-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690296956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296956, "uuid": "36a91d3c-fca9-4bea-8ae7-1eb56cfe5e45", "comment": "Malware payload (RedLineStealer)", "value": "38dc0b5bebb21bfc3c942db7c0667e7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296956, "uuid": "14fb5002-53f8-44d7-8af8-029e5b0cc09f", "comment": "Malware payload (RedLineStealer)", "value": "3e18f9b7e8cdd8a1f059a105846c613234cbfd791c0660872c226071417e7dd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296956, "uuid": "fc016b23-5a17-43c8-8f74-ef3ad0102d57", "comment": "Malware payload (RedLineStealer)", "value": "12aeb79f1b6cb0c930277b51579b7e7d6815d02d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296956, "uuid": "3f0f7a0c-0f96-4057-9635-8068db637e11", "comment": "Malware payload (RedLineStealer)", "value": "bf14b2713395cd64c34fb3769402906aca35da1c4506136820b7550a53387f4ee8598e4fccc598e69316655d77bdb746", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296956, "uuid": "a62a5d80-51da-47d9-8bff-ad2280400280", "value": "T1B674E121B3D0C032E0775A349834C6612B7B7C726BB4958F77982E3E5E612C16B7536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296956, "uuid": "7a02929f-5961-4c2f-aaa9-75e374d8fce2", "value": "41f54a8bceede5b7d9a3e6f46d43695b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296956, "uuid": "d778a645-6572-468e-b715-6f4427735029", "value": "6144:dUqZvGc1eoZVtBMbiTl3GxTeJK7sNtkOnqiX:Oqdr1eoZZKO3GxTp8ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296956, "uuid": "44230c1e-7aa0-4c97-974a-2afb6df441df", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296956, "uuid": "4cee3d3d-d882-4876-bbcf-7c35c1be81da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296956, "uuid": "2b2b8283-922c-436e-9dff-89e07038a5ae", "value": "38dc0b5bebb21bfc3c942db7c0667e7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7032e00f-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690280239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280239, "uuid": "d39d1b41-728c-4e65-8245-0bc3c0123a05", "comment": "Malware payload (RedLineStealer)", "value": "8c9a53a119b7a7cba81dd77404baffe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280239, "uuid": "951b5a58-3c53-4f1b-a1a4-3ce8cbf3d113", "comment": "Malware payload (RedLineStealer)", "value": "3efe9035f3d786ffd788b1308a4d60233573bcb466ea2367bda3e13bc0b1f6d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280239, "uuid": "1b05fec7-c8a5-4ba7-a37d-c37329e120ea", "comment": "Malware payload (RedLineStealer)", "value": "4ed031eb8c4ed5a8b6c127bb64f172396e773278", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280239, "uuid": "b0b5395c-f060-4092-ba58-7e98ac1effbb", "comment": "Malware payload (RedLineStealer)", "value": "7b95d8a072b16b60a50cefc86869aa325b07937e6c9e70e34a6a1b4fd687d5251016e3622a3320dfe54c9549c7174d09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280239, "uuid": "1883a36f-77df-4be5-83fc-6c938b8bdae0", "value": "T17F840202F7D88032ECB917B018F703D70F3ABDA19D74826B2755A94A2DB3694A53573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280239, "uuid": "fd167a8f-e5db-40d4-8368-5a0e8db93f9a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280239, "uuid": "a580c805-8d87-4cae-a6f7-80ffbd83b0d7", "value": "6144:KKy+bnr+Ap0yN90QE4ODLy9d0DoCTuaT5dbqVz9X22s0Dvqxh8AmdjkQZKOqwJ:mMr4y90LGXIpTu2nba802xqkQZKOqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280239, "uuid": "4caf6d98-544e-4838-8b3e-290e12d3ce26", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280239, "uuid": "d0f3d363-84d3-44f8-9def-542903a03892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280239, "uuid": "bebb24c4-1611-43a7-b6ed-7df1dc096c6c", "value": "8c9a53a119b7a7cba81dd77404baffe4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03cf5cb-2ae7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690288588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288588, "uuid": "7cf104ca-360d-4b76-9537-1a906a7a29e1", "comment": "Malware payload (AgentTesla)", "value": "97de4b2cbcbdcd7a45666eb28c67ef1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288588, "uuid": "abf9c7a2-4eec-487d-9b68-3f1ab963b09d", "comment": "Malware payload (AgentTesla)", "value": "3f0cf344e07b02b4c2724d6b3c03f0fb087b279978dbf904a7f458cfff898856", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288588, "uuid": "ff352640-f14f-414d-9743-78c5e3bb4c3a", "comment": "Malware payload (AgentTesla)", "value": "b761d33926974564f2e507f00ee72409ed2cd1b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288588, "uuid": "01dfe79b-f696-4305-a63c-eba4599ef570", "comment": "Malware payload (AgentTesla)", "value": "a0b7b19e821281da048b14de08fa3e0d09fa825d6f6d986617b29b4b62645ca6d273837f078fb57b67f518151b52a61c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288588, "uuid": "90f460e8-f432-4c79-87fd-058368e0b598", "value": "T111D4239E919B0F22812B3FCFF035CA43290CA79D3537A953D1ABF11E706A95DA528F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288588, "uuid": "4f7a7bec-50d7-4599-aaf6-698e20b685c8", "value": "12288:kXAMj+VlJQjuDt55rS8T0KCScp10kmyQS5wlAvxCv:mj+VlJQjcs8JA+6bxCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690288588, "uuid": "58361166-786a-477c-bdf4-df7a977fbc71", "value": 607103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690288588, "uuid": "dacef233-645e-425c-86a1-faf5391fc940", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288588, "uuid": "34e8e536-eca3-404c-abf7-a9253634ab4b", "value": "ITEM ORDER 222999.PIF", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f4cafa-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268522, "uuid": "e8fb3b3d-19ff-4637-bf83-86f81bf89a69", "comment": "Malware payload (Amadey)", "value": "9afae2cd83ff2ac35557d282ff7d563d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268522, "uuid": "6a3ba72d-dfe2-4689-a693-e0611aa2cee1", "comment": "Malware payload (Amadey)", "value": "40347af388fa0bf9f0a6c98c893d466931dd3b8940a8da9a603aa4102a442405", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268522, "uuid": "00f4b10d-f694-4944-8db9-da91f15f989d", "comment": "Malware payload (Amadey)", "value": "89a9c152e2a12d4cdeb91238ffc35206b1697a61", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268522, "uuid": "06a4a847-60cf-4dfe-b14d-11c3ae4432e2", "comment": "Malware payload (Amadey)", "value": "eebabb0246dda536824f7c79662390b45f3160e46aa2a629f98365dc6e884267ff31b86789bb80b2be3da5b265654432", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268522, "uuid": "ebc13377-8c5d-4bd0-92eb-dca1ef64dd27", "value": "T114840253E7E99072D8712BB068FB13D30A38BCA15978836B2345A45E1DB36D4B17273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268522, "uuid": "795d47d8-cccd-4085-8ff6-24cb422ea7ac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268522, "uuid": "604a3e05-fd15-4100-a15c-fffffe8773f1", "value": "12288:dMrary90XPYoslbivyHXzIEgBYC3SiEWzjJcd:pry8YbluyqzJfzVcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268522, "uuid": "9627d9c3-e586-4c81-a10c-35d8e463a692", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268522, "uuid": "505e77a4-2adf-472c-a7b9-956abe4475e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268522, "uuid": "e6bdc509-7700-4f06-969f-02a18ca81821", "value": "9afae2cd83ff2ac35557d282ff7d563d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4632e55-2abc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690270046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270046, "uuid": "8e4806d5-9c85-4274-848f-7cc6a8bcd935", "comment": "Malware payload (AgentTesla)", "value": "27cc2f3d06de1e0b1590270409ff49c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270046, "uuid": "4e19b980-672d-4efd-a9d5-b3c42cd05181", "comment": "Malware payload (AgentTesla)", "value": "40b13eac9c868bb9896445a13f99cc163f2da6128f9c229a0783a54d3fee180e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270046, "uuid": "f01ca3d6-d500-47c5-87c8-1529da0e63e2", "comment": "Malware payload (AgentTesla)", "value": "13b9270eed0f39296bbc77933a3ce70b916be141", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270046, "uuid": "53332892-6d96-4f4a-a590-fb0843254253", "comment": "Malware payload (AgentTesla)", "value": "61dbf177979665678cce1d13151d710388dcfe8d5a538e6bed9dd96ea2d208b5a79f1be7925068e371609c9beee55c6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270046, "uuid": "85bcb908-38c9-489e-92c7-492c51f067c2", "value": "T189354A7239DAF886E28CD33C212EED145B6DF8119613A1DF80053E85976BE4AF547C2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270046, "uuid": "627c6383-5da0-4e83-b0f6-4e1b2d6371b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270046, "uuid": "ebf32b67-89f2-4d40-bffe-ab28a24b0560", "value": "24576:S73lcIlqs2+xOt+etWuziI1OYyNUqTfJYOW:S73lcIcDtWuzbAaqzJYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270046, "uuid": "f1babbbd-19de-4911-845b-820a19c663ae", "value": 1075200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270046, "uuid": "0646e364-0f9e-4173-a523-3f4273a996e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270046, "uuid": "7ee144dd-0173-4ed3-a029-2287ff9167ae", "value": "CSID 270883.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371719f8-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290451, "uuid": "20a1a788-af2a-4980-8bbd-9b34abf4aaea", "comment": "Malware payload (Amadey)", "value": "1c159711a0fa545221fe8691458a6937", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290451, "uuid": "95b1e03d-b620-430f-8aa3-54e4443ef87b", "comment": "Malware payload (Amadey)", "value": "40d54c2855f2d7fa637ffb916d28fb16513aa414f6fd1a641b34f92af0d12f14", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290451, "uuid": "fda1d157-d83b-489c-bba0-a9702f780cb5", "comment": "Malware payload (Amadey)", "value": "43e192dbba8a69c2a991113cd76384ff226c1bec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290451, "uuid": "5b4af133-c007-43f7-a2b7-95ce04d90316", "comment": "Malware payload (Amadey)", "value": "dbb4cdccfb7d6ef807c2b906d6529ca31d4a0e8ceb537dfa0eb3ee09b5a60b1346c963d3bbd1703621e1b59407c3d061", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290451, "uuid": "0edf1b2e-aed9-4b81-a61d-b386d7b31abc", "value": "T172840113A7E88576DDBA1B702CF603D30B39BC719D78932A3746A94A0C73284967573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290451, "uuid": "3cf8d8a2-0c7b-468d-8662-617868c61a14", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290451, "uuid": "396f0745-3942-4afe-aab8-e40104467cd2", "value": "12288:7Mr2y90/IdHAL/TtEh1a6SESB/MMMTZKOCW:dyladEbaaPMMTAO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290451, "uuid": "ed4345cd-55a2-47ec-8b4b-1e038ad39894", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290451, "uuid": "eb03301a-ebe8-4b66-b7fa-df8094f090e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290451, "uuid": "fd4b9c90-1409-404b-8d3d-becf071d5e32", "value": "1c159711a0fa545221fe8691458a6937.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feaeb005-2ad9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690282626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282626, "uuid": "e3e53b5e-d291-4e66-b710-4059d402f82b", "comment": "Malware payload (RedLineStealer)", "value": "f5e274f82dda5395da2b06c1e37567ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282626, "uuid": "1acdff4b-500d-49ac-96f7-c2476c806c27", "comment": "Malware payload (RedLineStealer)", "value": "41eb10298ecda748977837bf1c15ff97cf47c0317b78257863e4983f66ebd011", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282626, "uuid": "5fb31d8d-7e9c-4558-858c-f917eed38c08", "comment": "Malware payload (RedLineStealer)", "value": "f7bcdc7f56592c3bf4bf4d7dc11cb6eebd52a68a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282626, "uuid": "a53330d7-b5e4-4363-9b5f-53bb9eae95f9", "comment": "Malware payload (RedLineStealer)", "value": "141bfc9e84c0763fcad57fc288ef89fbc44b5643c32da141a6f45502400f4c09d23183ab3d1976973a14faa2b8845cdc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282626, "uuid": "6feb99b5-f1e0-4ac5-bb4e-b5073122f61d", "value": "T1AB74E12275E0D073E06796309934C6A56F7B78625B7881CB33941B3E2EB07D26F3539A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282626, "uuid": "30441c54-743a-4af6-a925-0c10ee32c3bc", "value": "bb615941a9791bad98127d7fa679f59b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282626, "uuid": "52a8d490-6daf-4538-8c57-06bd187e042d", "value": "6144:dOdwgVymGf4XiK9ratg70uvHPfbXkpEZCmSGQ9Q4C:0dHom5XB945iXbXklZGQa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282626, "uuid": "1539be39-ea37-4484-8a87-a63733231cd0", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282626, "uuid": "5fcd00ed-6903-402d-a1da-37767948c77f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282626, "uuid": "5bffb902-75ec-440b-ae60-ab5345d9e417", "value": "f5e274f82dda5395da2b06c1e37567ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3275be-2aeb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690290166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290166, "uuid": "044bf90d-457a-441d-a18a-fd3fc0259ae2", "comment": "Malware payload (RedLineStealer)", "value": "23e7870a4f54dc6fc956afc6759af6c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290166, "uuid": "b388e02f-7b11-4729-afe4-6d07c1618301", "comment": "Malware payload (RedLineStealer)", "value": "437213eb4b67386b44ee8203e45489fe45f788fa215cc4f60982184a2231a6b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290166, "uuid": "0ccc83dd-c008-4fd0-a1d8-716ded2476a1", "comment": "Malware payload (RedLineStealer)", "value": "5d27746771ffca43b616dc354411cc1095c4c614", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290166, "uuid": "b3d7fd39-2eff-4d20-a962-2741c7419631", "comment": "Malware payload (RedLineStealer)", "value": "9bcf191053c4bab009ce352408b45efe81c435953fad57628c35c46cd5f1c08e22c3be12d62288cf4ac5a7e60c49179f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290166, "uuid": "8dc22978-2d1e-444f-a59e-52abdf17086f", "value": "T145840113B7D88033EAB5077158FA42C30E3ABDA29C7483AB6785658E0CF25D4A57573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290166, "uuid": "83750609-b43b-4b80-a598-2743beb1216b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290166, "uuid": "660352b6-a76f-47b3-bd44-b1f907f2bded", "value": "6144:KVy+bnr+yp0yN90QEXDMl237e/srokwdpCUVrebbPg4g+AVmCN6bD4GbpDYHoArv:jMrWy90V0Ge/2wdEwn4DAqbVYIArv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290166, "uuid": "848d6b0e-4f66-4e57-946b-95ee2f9a46a7", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290166, "uuid": "260936c7-23d2-4e22-89f6-3ab2bb03c5fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290166, "uuid": "7f3431d4-853f-4c59-9249-912fdeb1a13a", "value": "23e7870a4f54dc6fc956afc6759af6c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a262f20-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268552, "uuid": "50391fb7-066d-43e4-9cd8-1478081895c4", "comment": "Malware payload (Amadey)", "value": "9550c662025ed9d15ab2ab529473b953", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268552, "uuid": "efd12364-62aa-4e87-9638-ac74e3ee8260", "comment": "Malware payload (Amadey)", "value": "43bf87904a8e7b3c9476dbec00d0f8c875a931f0d470fd72d5e02f000eca9f57", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268552, "uuid": "4bb7730f-6f66-4c09-989c-dbec581e3f3f", "comment": "Malware payload (Amadey)", "value": "5442d3dcc76a4b2218356168b6c4956c250abdf6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268552, "uuid": "75127e8e-ed67-48dd-b1fe-333cfd065a42", "comment": "Malware payload (Amadey)", "value": "5a07ffd10bb99467ad6c440791ccc3679b4b1bfb8bc18eea42722204e6d52960e47af78d212b95337d7ac4addbd458ee", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268552, "uuid": "06bb7fd2-ce37-4265-8a89-36ba80e49caa", "value": "T1B1840107A7D88132C8B267B058F716D30B35BC62A9B4D36B2746991F18B36C4793277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268552, "uuid": "c84803c1-5fe3-4759-a7ba-61b6c6d15536", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268552, "uuid": "9795b57f-185a-4317-ad7b-69a19c85b55b", "value": "6144:KWy+bnr+gp0yN90QE1rOPS2k8ObE141fNP+Q+mq2KX9mRy+yNgBZ+t4JDz36P6fd:iMrky90A8t+KKX6ypNgBYCJX36C5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268552, "uuid": "57ca2807-a06c-48ee-a12d-d7e5270b3a70", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268552, "uuid": "7e9d09cf-f5a7-4f70-8acd-9ba7b8cd7e4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268552, "uuid": "139dc342-afcd-4e02-9103-909124606ac1", "value": "9550c662025ed9d15ab2ab529473b953.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bba99dd-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268528, "uuid": "a25bb6a6-a822-495f-855e-e88530dee35d", "comment": "Malware payload (Amadey)", "value": "944dec31721f49205418753d82d12ba2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268528, "uuid": "cfdc1e2e-8ac3-4766-a2e6-368798e27484", "comment": "Malware payload (Amadey)", "value": "4409a49dcc9e50f5183fba01b2a6193042f889e24146ee31fe9b14bac060c4ab", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268528, "uuid": "d060dd74-2a01-417d-a243-e23ee824f83e", "comment": "Malware payload (Amadey)", "value": "29cd737b06f1b22558ad6fdf6da9c7fe5419518f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268528, "uuid": "9f1db091-ad2c-4923-a07c-4ea7b7e54692", "comment": "Malware payload (Amadey)", "value": "87c1151e40f7cbcde6c7e3bcb0190acb703df8f361394ec725982af3d3c0a42d8f107e1b08d4961a78a88c51e8c78e60", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268528, "uuid": "c64a732e-3c95-4b60-aa80-a6bc302b5aa3", "value": "T118B40162ABD85433E9F81B7018F703C31B3A7CA26C7853AF334A651E5DB2694A431767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268528, "uuid": "3cad512f-e8e3-4eb9-9cf1-9814da5a07a8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268528, "uuid": "6c8212b9-75e0-493a-b539-76cafccc4cc5", "value": "12288:NMrvy90hi82CNZjmHOzH5aMFv0UmnwL8mW/gB:Oyp8dLcOtaKkwL8mWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268528, "uuid": "38fd6c5b-3dd4-4902-8eb7-c9be74e9edbd", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268528, "uuid": "c9232ceb-d33f-41e8-921f-f1a9ed2a1836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268528, "uuid": "2566569a-1b20-45be-963e-703cc4a3057c", "value": "944dec31721f49205418753d82d12ba2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd1f369-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690282086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282086, "uuid": "8fbe5305-409f-4d50-9358-c7e1263a222c", "comment": "Malware payload (DarkCloud)", "value": "3a7ab4ad6d9a36447689d25b84b8e341", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282086, "uuid": "4899d989-fc5f-4a67-91c0-e19b390f264a", "comment": "Malware payload (DarkCloud)", "value": "4422d10b6d41c54487f2e72541ffccbbb0bc6f8e8328d409f5e9f6ebf1c5c54c", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282086, "uuid": "6e1a98ae-5190-4a3d-a77a-03cf1f07bcb5", "comment": "Malware payload (DarkCloud)", "value": "1d5f6d004a7f200bfcb7262100e22b6cc52e5b6f", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282086, "uuid": "def89719-7080-43a0-ba93-0fe8b3954839", "comment": "Malware payload (DarkCloud)", "value": "63214673a469670ba14a04ebeb74d7fd11599f23ea3d5ef90ca939b825fdd74842c16c81d770a48eb0ec3aa3ef637ac0", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282086, "uuid": "451d3f06-5129-4110-abca-43c4ac5d5d28", "value": "T12BB43A2AEB20612EF063C8F1E6E452576854AD7712A8AD1BF3819F0935351D3E8F172F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282086, "uuid": "005e96d7-3edf-4fd0-b5f1-af70b3a9228f", "value": "12288:66nq9ahuwlWR7Gl9vzZ1dl/LxMrKCqJjYKkJj6GmZUN:vhVvl1dl/lMrK3xYb6nZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282086, "uuid": "9dc928d1-1d17-468e-9da4-835e6cb073f5", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282086, "uuid": "5d8aa9b2-af4a-49d2-a49a-2daecb6ab8c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282086, "uuid": "1fd1c934-dfc7-47af-b0bd-b2f9c3f3c862", "value": "4422d10b6d41c54487f2e72541ffccbbb0bc6f8e8328d409f5e9f6ebf1c5c54c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d61383e-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690290489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290489, "uuid": "57056f4a-bb85-4bc4-b9b0-26fadd590efc", "comment": "Malware payload (RedLineStealer)", "value": "d454a249c86d3b585f68a856f2b69685", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290489, "uuid": "7bd5db2b-22b8-4d97-acb3-60489ab87f29", "comment": "Malware payload (RedLineStealer)", "value": "443f74c1a76699a1600a1ed79cfc10549b1d26601334d1b8b5d1c8132d1524b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290489, "uuid": "2943ca7d-eeaa-49c3-a909-fa7144a90ba8", "comment": "Malware payload (RedLineStealer)", "value": "5f5a86f54bcf71715164b81d6774f482e7fef676", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290489, "uuid": "c26833d9-c5e7-452a-bee4-ac54279db0b1", "comment": "Malware payload (RedLineStealer)", "value": "d1504f27aedd3050739f2075b13535cd7ff3e834fa93b57948beb364429b24d60d193f5b87a6bc0a7a3f381ed58f45d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290489, "uuid": "b6dc4931-66ed-459a-af19-f6de3cbd496e", "value": "T123840213B7E95533D8BA17709CF643C70F3EBCA18D7842AB2345695A1CB3690997132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290489, "uuid": "10096db6-b833-4351-bd6f-78cbb3c3fa04", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290489, "uuid": "a50ea7ac-5b1c-4e84-b042-88494962c71d", "value": "12288:bMrWy90xvckX1Z7Sqj+05hTlUoFkKR55W:ByEvckXHVllBFkKz5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290489, "uuid": "86dfb2b0-fded-4015-90c8-f94a0a34d98b", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290489, "uuid": "e4eb9d5c-9ca3-4591-a58f-dcd7e16b4cf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290489, "uuid": "fe268bdb-5108-4e71-818c-418b122554d8", "value": "d454a249c86d3b585f68a856f2b69685.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a7445c-2ae1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690285946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690285946, "uuid": "e97beed4-1070-413e-a7c6-d6035f0f37cd", "comment": "Malware payload (RedLineStealer)", "value": "1de02e1da6b030faacbfbb6d3e9356a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690285946, "uuid": "a7541fd4-f902-47c5-8f82-255185e9269b", "comment": "Malware payload (RedLineStealer)", "value": "44b1d29af4ce404ce5a6a3806afa0c43717fc39b3ec7c7572fbb6e5a0bebd21b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690285946, "uuid": "02d9da21-4873-4706-8b05-a2cc18afcae6", "comment": "Malware payload (RedLineStealer)", "value": "a9c32e2eb860e60f3d6d57dd17a7eeda3cdb5ed5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690285946, "uuid": "3170ae29-1876-481e-ac99-6625954dcea1", "comment": "Malware payload (RedLineStealer)", "value": "92c62487e2728e1fe51f18c3c163d3aafcf9d42c4b20be2315a1e7db6c43582064c8a675a9adfa9b158198bb9b889e88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690285946, "uuid": "410cb9c8-d0b2-48bc-9c2e-8cb35296e383", "value": "T1BEE2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690285946, "uuid": "3640d055-dc4e-42bc-9241-39eb6d2be124", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690285946, "uuid": "99420c39-addd-4bb1-95fd-fb7b96bb5202", "value": 33810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690285946, "uuid": "a74a9abf-4a80-42be-b9b1-bd80c978d078", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690285946, "uuid": "a5d5e57e-23b2-4d5c-888f-295172781653", "value": "1de02e1da6b030faacbfbb6d3e9356a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de17b45-2b19-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690309951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309951, "uuid": "bc132cd0-2255-49db-bcc3-646228c2d9ba", "comment": "Malware payload (AgentTesla)", "value": "786d058edc8b5a9f797f30ab3b3459d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309951, "uuid": "68c6fa4a-96f1-44cb-a29e-170ee79c5597", "comment": "Malware payload (AgentTesla)", "value": "450ac397e5ec1c38fb8b238ee604baa624bdb6e6be91c51bc31f331056420c80", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309951, "uuid": "660ecadc-92f7-44ef-8b88-bc3ea21b5812", "comment": "Malware payload (AgentTesla)", "value": "c721cb52b77c6e295111b82d256071855a543023", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309951, "uuid": "e269021c-4997-47cd-94f9-af5d06c35393", "comment": "Malware payload (AgentTesla)", "value": "bfea50741a7114420aa47aefa98de945a91202927f0ef6c263e3b576f1d0fc8367b982de87de548633602813b3ec242a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309951, "uuid": "9a014ea6-ef2a-46ab-8f2a-4cab5de95b79", "value": "T120E422162E418913E22D1BF44100BBFA5BFEEFD83435D98A1DDBB589FA65F8C8861701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309951, "uuid": "e75bbb4b-1c98-46a5-91f0-a476a437e91b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309951, "uuid": "eb00ead7-4866-4c8e-b6c0-8a32e6f7ce32", "value": "12288:I2YiIoFwIrG3XCCakj8zQx1oODuyeGZYjIaPUVEvMrKSfcxBU/w:NHIcTrGCLKL3/ZXaPU+vMGQcxBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309951, "uuid": "2e5f7c83-294f-4a4f-b37c-41b9f764ca90", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309951, "uuid": "629015a3-ac0d-4607-8ba5-f773a3e5c1c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309951, "uuid": "8cd7993f-4499-48a7-bb7f-3160421d4dbb", "value": "qEmQv7ULDYtgQcj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5becdd-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268209, "uuid": "d70406d0-fb65-42e8-9019-5cb0b16262cf", "comment": "Malware payload (Amadey)", "value": "622827984ff70e4a5a6af9d4151374eb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268209, "uuid": "11f379f7-d2b2-4c91-b724-7dc1d27b2179", "comment": "Malware payload (Amadey)", "value": "481c85f2a63cff775788d61e2a39be11bb44b000bf5ea4bade9e98fce8999a08", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268209, "uuid": "126381a9-5fdc-479f-8d30-53cf5d08408e", "comment": "Malware payload (Amadey)", "value": "8249ed9344a7d5d2e0af91bd30613cb9d9f232b5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268209, "uuid": "869f4957-d3fc-4e04-8976-60bcdff1221a", "comment": "Malware payload (Amadey)", "value": "7ab4b721b7d9454b373b7523eb25ab57c117f481009b4d894916a4b7d79a2d8eedea539902ea1c24f862a800e707e6e2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268209, "uuid": "5aacdf0e-719e-44d7-b859-3f06a8356868", "value": "T1422408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268209, "uuid": "546c7477-d705-45a5-92be-02772813e631", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268209, "uuid": "a695c162-616d-47b0-97ff-aad5fa2d78c6", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268209, "uuid": "ea5bd7b0-d7c2-4716-8a78-b6ff1903217b", "value": 229307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268209, "uuid": "1a792661-0d30-4fc3-9cc3-48234ccde689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268209, "uuid": "0324b258-7a23-473c-aa7b-15529818c2e7", "value": "622827984ff70e4a5a6af9d4151374eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010e8fa7-2b19-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690309688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309688, "uuid": "d8587108-e24e-4066-99c1-4bd5810f1b16", "comment": "Malware payload", "value": "b32cd752f591c166de93871092bbdfed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309688, "uuid": "405d16cc-fdbf-4838-95cd-af85e19a66d2", "comment": "Malware payload", "value": "48778230239d8f2d1cb50b9aa4c27ceed7cc49473af472b59320838813646c9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309688, "uuid": "1aac6127-4b37-4127-862a-6b6282ab1ff8", "comment": "Malware payload", "value": "2f69b941c5a5f5bf70180c3150cb70cd9af7d7c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309688, "uuid": "16795da0-5c59-41ac-9f33-60e48aa2e807", "comment": "Malware payload", "value": "bde7345af2009651b48e0f815734692d4a25274dac5926165ca0d038fd1ba461f1792ce4c6671de72d4ff521d1e0e804", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309688, "uuid": "bd57c4cd-ab6f-4a73-9357-416883231962", "value": "T16C93BF21B921C0B3C492A574857583B16B3E9A3213B9CDC7AB241A745F717C2EB7B34E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309688, "uuid": "bd3a9fcf-a3f1-4194-b156-66fbfefccd00", "value": "1536:yaRrWkiA1MaoAVRyKuOaLQPiVI4Zx0QQV1gHfvLDuLFEQACPM3n:ya4kiEVGxLZQV63+LqQO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309688, "uuid": "2a42b2a1-32b1-43e5-aa86-6d447cc3e439", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309688, "uuid": "5dbf9cf4-e89c-4193-86c2-4beab160dde3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309688, "uuid": "d875416a-6380-40b7-a85f-78eb0b50a157", "value": "b32cd752f591c166de93871092bbdfed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed281be4-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268853, "uuid": "f6ab1a81-08e9-43c9-848e-72fa96df4729", "comment": "Malware payload (Amadey)", "value": "d698416bb4c5307e9137415bc07fa313", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268853, "uuid": "4e1286f8-c22a-4d13-bf7c-fcedab194efd", "comment": "Malware payload (Amadey)", "value": "492b430761b721f8dae0a6a856910fe30d89aecb8a269d99d28e4bdd7fe3044f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268853, "uuid": "0fc5024e-1853-410a-a3a3-8efa9f7b54f6", "comment": "Malware payload (Amadey)", "value": "749d47f1d89516c1e3f283b0d820c0d1f1ee960e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268853, "uuid": "d1baabba-20dd-4f50-8f22-3036d499a6a6", "comment": "Malware payload (Amadey)", "value": "d241a7ab648eb443fc9e5f5805ea8c39b5913de8384a4ac999c7a9d0130e8fe8776948abffb2817f231df7bbeaa916fc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268853, "uuid": "1af91056-777a-4809-acd4-59e3b0b977cc", "value": "T1602408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268853, "uuid": "95d9da8e-e81c-4b51-ba3e-3a4b1ef78138", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268853, "uuid": "0f2ab555-68e1-4be7-aaee-9f9344a5a4f3", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268853, "uuid": "b704837b-8a2b-4318-bab5-86dd21e5d19f", "value": 229209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268853, "uuid": "b5b4a5b5-a134-4504-9e78-06f7977aa5d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268853, "uuid": "673d0453-6680-44ce-ac58-04b1db9d070c", "value": "d698416bb4c5307e9137415bc07fa313.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ecdfd8-2b18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690309535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309535, "uuid": "4b7829aa-03a1-4259-9efb-bb349ec1be88", "comment": "Malware payload (RemcosRAT)", "value": "a20975fa1daf5a6c54392036f664f0d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309535, "uuid": "e0b39ae0-ae0d-4902-8906-f4866cdcfc94", "comment": "Malware payload (RemcosRAT)", "value": "4a23b3a3cc728ab547f5f3f5149f70242187b45aefa26c5f5663f8cbabeb2330", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309535, "uuid": "140153ea-8df2-46c5-9c92-687374c9d1fa", "comment": "Malware payload (RemcosRAT)", "value": "48324337f8a4196a2107f4c68f9814ed4e388c40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309535, "uuid": "24763c31-96fd-4bbb-91f6-ee5abff6587d", "comment": "Malware payload (RemcosRAT)", "value": "1e47fe48f06be5ef0adfc955e1b3c6fb4cde1d6c0ebf80a5e1e84cb4598ad10fc101db86bd25811d7bdf353c875d06d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309535, "uuid": "ad42c5cd-b46a-41c7-8acc-fcabb5080862", "value": "T11215231563CC9715D5EE27BA0C9098200BF2E99B2233FB4C2E9E64F54D253651B83B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309535, "uuid": "8dcad098-ddef-41f7-b6d5-aa58dca412c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309535, "uuid": "91a1fe76-fa17-4cdf-9686-f9137f53c691", "value": "12288:OXPZE28gvHh0uiZPrnQpVftyKe/C54B1pIVho1aXtTwFx5qhFnykr1X9J2demMmn:Z3wHh0D90pVVraCsIVhvOx5tE1Pm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309535, "uuid": "1f8e164a-36d5-4dab-ac26-2170f7214fed", "value": 911872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309535, "uuid": "b2fcebe4-2246-4386-84d5-b178de90f690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309535, "uuid": "b25fe24a-1778-4fb8-b5d3-1efb52c4a68c", "value": "a20975fa1daf5a6c54392036f664f0d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c8e516-2b45-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690328728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328728, "uuid": "7cf16d31-6ca3-412f-a042-65a254bc61f7", "comment": "Malware payload (RedLineStealer)", "value": "3a5fff8a73bc80295ec22b5e07667a9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328728, "uuid": "cf539273-a89f-44cb-adb8-49986770bdc0", "comment": "Malware payload (RedLineStealer)", "value": "4a3c8d71ef89682a540ccd26a5f940b3ebdabcd3d566f4fef23016f467f56fb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328728, "uuid": "7728a66b-5d24-467a-9396-4b3a57a8121d", "comment": "Malware payload (RedLineStealer)", "value": "76bdee548b9f386643ed87c9c91aa983cbfb4bca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328728, "uuid": "6ca3db9a-bae1-48de-9d43-194c839b69b3", "comment": "Malware payload (RedLineStealer)", "value": "7f76fdda4d4fbf5263be52817deebf3fe530c1cbae9302f15f204930b25cee6dd1e0245e382a69762e52632d1652bebb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328728, "uuid": "91a28d89-f8c2-4e44-af82-e9063da573eb", "value": "T17B840242EBE88072E9B917B05DF613C30E3ABCA19DB043672384995E1DB26D0E57177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328728, "uuid": "f8175f18-bea9-4b65-b044-834c32475352", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328728, "uuid": "fb979040-f3e6-4777-bf6b-b294015472be", "value": "6144:KEy+bnr+0p0yN90QEZe23iT/Qn5gO9soc+iwy0ymSeB8NrW1cZ4domg+SraGjxZC:4Mrky903p3M/hB+iwyZmVAab1FGjxcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690328728, "uuid": "e84dd8eb-b11d-429f-a918-262703402132", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690328728, "uuid": "bfbbdd68-5f84-4c37-88dd-31f747e49f9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328728, "uuid": "1e7ca4b2-0aa1-431e-a44e-88950fd075f7", "value": "3a5fff8a73bc80295ec22b5e07667a9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b0312d-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690267931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267931, "uuid": "c215212c-ee7c-4475-80f3-c38b5ac622e5", "comment": "Malware payload (Amadey)", "value": "476312e3c4f36a6599bf9978e6d605a0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267931, "uuid": "5bc71deb-bf19-4deb-ae96-ef0dab81b13a", "comment": "Malware payload (Amadey)", "value": "4a64601cda22ee78c5a65b16c6140cd47a27949c9b5b09685526fa936b55c3bb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267931, "uuid": "78fa9e29-2c47-45b4-9e90-88473aa60902", "comment": "Malware payload (Amadey)", "value": "ee25d5db5694aadc3a9efaa67fae8a8dcaf56629", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267931, "uuid": "85fde621-3e2d-4f69-af3e-fa0ce7f46a6b", "comment": "Malware payload (Amadey)", "value": "b2b00630ae8e3cc72bb325a9fc0db5d2f1d0fa20f5cae9adcaab35387fe43b3b593b48e1c40a9bd76628798a70b318f1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267931, "uuid": "0d1a3a87-5246-4cad-9bc0-ad77312e0b75", "value": "T1F5840153ABD98033DDB92BB05CF603C70B36BCE25C74872B2745A94A0D73A90A57176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267931, "uuid": "75ca0172-dc40-4622-9075-0f8a35f90975", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267931, "uuid": "93cafd40-a013-407c-b281-78d90e71c701", "value": "6144:KEy+bnr+bp0yN90QE8QNSryj31/wS5QRv4ZuHAQ3ojb0uDeP9VFh/5OqN6McLO:YMrTy90aQNS+j31vAKR0GzeTFhEqOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267931, "uuid": "77d6e41d-49b9-4a50-af68-3e4a82a02a08", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267931, "uuid": "72fee7dc-6a0f-4ff8-b70d-cfab8e131dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267931, "uuid": "012bf21c-854d-446c-8999-15a6850a92d5", "value": "476312e3c4f36a6599bf9978e6d605a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c701baf8-2ad3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690279956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690279956, "uuid": "8f1ac66e-d6c7-48b2-9e9e-c3a626256d50", "comment": "Malware payload (Amadey)", "value": "100149dc97ea773f17dcc5d245f1d8a2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690279956, "uuid": "04e1f5df-5560-4de8-9be7-744fbb2cc968", "comment": "Malware payload (Amadey)", "value": "4a73e5254310a38253f121ae159be654dbc9ab8a613cafedb9436f4b47269d3e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690279956, "uuid": "56f8d609-4774-474f-b511-358a25835e3b", "comment": "Malware payload (Amadey)", "value": "84b958940431d3fb1fbc2683dd5a4d07869d5bb5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690279956, "uuid": "36db61aa-ea3a-42e6-9525-ac9ad7ca0536", "comment": "Malware payload (Amadey)", "value": "255f988f3d03da82666501b32363cb320ac6d8da05667f9c84c7d4d50670862f79d4564b7d8a3ff95b48a233c6bbb9d2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690279956, "uuid": "3cb7071b-e2f3-483b-96bd-a2eddffeeebb", "value": "T1D7840202FBEC9072E9F517705CF607831B327DA15C78976F2786696A0CB2690A93172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690279956, "uuid": "d44c3185-f3f2-487b-9031-28f84510fc03", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690279956, "uuid": "9d93ea08-ece7-4ec3-acbf-455e36d486d8", "value": "6144:KNy+bnr+Sp0yN90QEVYgM+ejuLAxrePC99fAo5D5E8Yd5I4BPdZDZhTVmhFp5KWx:jMrWy90/0u819IU2BPLTVmhcJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690279956, "uuid": "485aa4a8-0079-4449-acd1-17240193b368", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690279956, "uuid": "f22e07fc-3ec4-4582-94b0-2c3d4754c77c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690279956, "uuid": "83f2298c-d960-40a7-ac6f-26d553ecc4b0", "value": "100149dc97ea773f17dcc5d245f1d8a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a84d73-2ad5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690280549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280549, "uuid": "12aa5a2f-b09d-49d6-9fe1-f9bbd7af3c3d", "comment": "Malware payload (RedLineStealer)", "value": "f94c67eec10513ed9326ecce76170823", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280549, "uuid": "7588b75f-27d7-453e-9d62-463bed8fedf6", "comment": "Malware payload (RedLineStealer)", "value": "4a809436e6ff65a0f67ac52c6eb85332fe5a678facceb51b01e89f421efeb2f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280549, "uuid": "d8ac73ca-02e5-4a56-acf0-0c62a8d8f3c2", "comment": "Malware payload (RedLineStealer)", "value": "5bffb3627a81e23fe00f23d40cb4121a76ef0e26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280549, "uuid": "0d3a2a89-c0cb-46ce-9bea-8c59b1d74567", "comment": "Malware payload (RedLineStealer)", "value": "9789c73666ac6542547a3b140ced7d25969364dfa1a3c750d0774a6501a5952f39a289333efa98004a6c80639ed60353", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280549, "uuid": "6bc2a055-6cdc-42ee-8049-67f030ae2709", "value": "T19AB41286B7E88037DAF51B7009F602E30636BCB15C78C36B62955D4A1DB3788A53772B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280549, "uuid": "6dd34240-f5cf-44e8-bcda-510f73527ab5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280549, "uuid": "cf6447aa-41f1-4039-88fb-290477623fe4", "value": "12288:qMrhy900xMhyy7J7bB/y94srszHP2PoKXqPzJvRmvcCFy:jyjxGdg9LoHPG0lvUvcgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280549, "uuid": "d03e4436-50d4-4853-8137-dddf3af8d211", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280549, "uuid": "f9dc3bc9-7608-4491-a144-30868bcb8f29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280549, "uuid": "1b30ce1c-dad0-4124-a18f-3deda1a90c6e", "value": "f94c67eec10513ed9326ecce76170823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b342b2-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690282103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282103, "uuid": "6d4d0ec5-4be1-4955-806b-ed22c7a83d8b", "comment": "Malware payload (Formbook)", "value": "10be6e68d8866d42f56bddf3f483d447", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282103, "uuid": "a5d37c1b-5ab9-4dd5-a965-3d3e5f163d8d", "comment": "Malware payload (Formbook)", "value": "4afdcbfec30e01b2acb21c8c175e088771f9d9f478785b8f6f4fe9388c90b2d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282103, "uuid": "9767d6a7-a82b-4c54-ab03-969fd59f84b6", "comment": "Malware payload (Formbook)", "value": "daf3de462772167e4ccef1c406c76573cbc68210", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282103, "uuid": "d980ce8c-a504-422e-91bb-32605e6d6d1b", "comment": "Malware payload (Formbook)", "value": "8d3bed7a1ce009a8fe26135f6d47fca0f3ff90a243f6005ab1f4482451cf1cf464a58de86e74b631a4ff3c58cfa93902", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282103, "uuid": "6899c822-3e7e-4ec4-9d4d-44474fc5a924", "value": "T1DB541378F2D5C533E8F37B722E79A682AFE5B40665689A3763509F5C7832141C80B353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282103, "uuid": "d75e09d6-a087-4fbb-bc9c-fdf9b66127ac", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282103, "uuid": "0b483089-ccc9-4a0c-b657-fca77ff9d8f1", "value": "6144:vYa6KOCh6uAnJ7QZnFQdXZLGivaSlhY4bq5e30NZrxE9J0NI:vYcOGrIJsZnadioha5ekTIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282103, "uuid": "4e7544aa-0afd-4430-8a18-55a239b9e005", "value": 284592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282103, "uuid": "bf94bd16-83e6-4698-9dc9-7347af4e8cd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282103, "uuid": "3c55c2f7-d1ab-461f-b980-cf839dd5f3ea", "value": "Bill of Lading.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b927d6-2b15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (WSHRAT)", "timestamp": 1690308139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308139, "uuid": "ae112f77-9a5b-4c52-8d75-ef7ae2a0a0d7", "comment": "Malware payload (WSHRAT)", "value": "6b57f84625e48278f611de466e10dea9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308139, "uuid": "fb97782c-c01f-4328-ac2c-eb4622a30b25", "comment": "Malware payload (WSHRAT)", "value": "4b88ca8115abf6400f900d9eeadd9793806c3c4314868bb6080e88b697ecef1a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308139, "uuid": "5bda8676-3fb0-43e3-a80f-76982e9e089a", "comment": "Malware payload (WSHRAT)", "value": "61432ddbd911264ce613f1549ab33f9635d446dd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308139, "uuid": "5e004139-3b2a-4825-a320-f9859233131e", "comment": "Malware payload (WSHRAT)", "value": "64ed2fd0dfc440fdfaa9927489e93e798f039f5fb5250d7c12a5a2cff05eb8dfd007f4d0c4655fe8221b1edc98b4deea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308139, "uuid": "3625fc4c-585c-4368-b39e-18e33cd0e36f", "value": "T1C2F1BFEDE57400B494DE35E2D94664B8FE1C561B3B637D4F439AE6F2082CA4FB2864B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308139, "uuid": "4474775f-fa14-4ea2-91f8-e13d02938fc7", "value": "96:MUf+CjnaYRApwXr7HRPNYtQH3srX2zWwPhHr/trkOHr+wc+i:O3PN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308139, "uuid": "76dba2b7-471a-4e8a-84ba-3f05be28ee7e", "value": 7935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308139, "uuid": "c57384cc-54b7-4794-980d-ee21f52f6ebe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308139, "uuid": "6fc4d2eb-a623-4002-9798-2f40aa9ed2f7", "value": "ORDER-23788.xls.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377b4079-2aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690268977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268977, "uuid": "d8a1193d-c571-4291-9ebb-c297b14b5cef", "comment": "Malware payload", "value": "a6aa4610e6c3eed54b69e4ec1be346b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268977, "uuid": "1d92bf76-3662-4a72-9b8c-1cc01da4caf0", "comment": "Malware payload", "value": "4c04d96abcd6ab3540d02e805b81a381ed29e678fabca040ff4634f2ce427457", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268977, "uuid": "ab0bed45-4ae5-40f0-a3e5-84423d20368b", "comment": "Malware payload", "value": "ee336a703bdb14f44916ec0d855aa43d97a3edc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268977, "uuid": "eab6f658-4fe7-4554-9ce1-cfae22d9f152", "comment": "Malware payload", "value": "8e78082c241bddc86bc4d4bec156d9d8d4a4242dd9d28ce43cefdbc0247f7d5f7d9be261c641faa594fa0b2f5671d7ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268977, "uuid": "d48bcded-a20f-4664-b15c-1e48aca2783d", "value": "T15FA6AF81FB08923ADB9A073248A30B7433756C02D4D0D96B5709F76F1AB15EA7A4FED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268977, "uuid": "9b59e2c5-61fa-431a-8249-50eb33c21ac3", "value": "98304:aJSHMQCEFO2Eg/R9Va//6QnahVAJ1fpDxinrUOMCW4GHakv+P1U:c3QCcO2Eg/rVa//6QnahWVD4gOqHT2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268977, "uuid": "5a6c3f07-46e2-45ad-8ea0-021016f66f13", "value": 9695602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268977, "uuid": "8b7d8951-c7ca-4e83-bdb6-fa702bbfa24a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268977, "uuid": "6007defd-0710-4131-99bc-5c8d82d83a07", "value": "a6aa4610e6c3eed54b69e4ec1be346b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23adc2ad-2acd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1690277105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277105, "uuid": "5665d667-6f32-4f1b-b792-95aab8f10c3d", "comment": "Malware payload (AsyncRAT)", "value": "b4f60407cc688d2327c5bc8dd39c0b00", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277105, "uuid": "642d4e74-be75-47c1-9178-1be6d3c72e0a", "comment": "Malware payload (AsyncRAT)", "value": "4c93aab05c2fab29246d01a12e0fcd1f7f72d1c4562a42c794cc2526b82b83ef", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277105, "uuid": "24e6f613-93a0-484f-8799-b7352cd121a0", "comment": "Malware payload (AsyncRAT)", "value": "0a7af4bb31249419603b60005670aec36aa7d6e4", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277105, "uuid": "1cc6de7a-c124-4351-8398-040de5726591", "comment": "Malware payload (AsyncRAT)", "value": "35918c60e4aaca02839d3d2b52527c216d581ea15e5c1a4c96fa02d29edfc1b5df8e893a1044553eab1bf13ea14bb1c8", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690277105, "uuid": "c48551e3-ce80-4dec-945c-fd211a5db4be", "value": "T1039423250BF523DAD47103B042C0AC59367F81EBE45BAB4A8C0A86AE8D8377DB5445FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690277105, "uuid": "c67f260b-1fdb-4902-9529-04428eb4f6fc", "value": "12288:9QRlML1eQcUtQbRselQswFhg7nkwmMfwJ9MgjqJqim7PH7:9QK1e1mKQswFhgLnoJ2XJqig/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690277105, "uuid": "dbf54488-f5ee-4dee-805d-ce7bd5cfab96", "value": 418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690277105, "uuid": "509127bf-98b7-4658-b9b5-498665299489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690277105, "uuid": "3f0a09e4-31e0-423a-90e9-1eae129948ac", "value": "b4f60407cc688d2327c5bc8dd39c0b00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dba3489-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690280235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280235, "uuid": "4dccf905-cdc6-449e-aa01-f554c75013d8", "comment": "Malware payload (Amadey)", "value": "0a27c86967c1f65d7d3d89941ea9ea27", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280235, "uuid": "02e08be1-c1ed-430e-9273-5715fd4f323d", "comment": "Malware payload (Amadey)", "value": "4cd80cc05cb0ccf35b27f04e8afc909de0ad10011d88bf7e517340c16843c3b8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280235, "uuid": "555ae411-468c-44be-b6c9-84686224ae57", "comment": "Malware payload (Amadey)", "value": "b2378b556b4fffee67017c62ecbc811da5072c54", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280235, "uuid": "9de73da6-dabe-4805-b827-384334c4d921", "comment": "Malware payload (Amadey)", "value": "13d50bfb0d5c0b3320cadc249beb124573e33d10fe3659a29b4c80e8e762c40ccbc8afad045f7a8b8dbd9e5cb3a707d5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280235, "uuid": "2d5325a1-60a8-496f-a46d-bf6eb0b331a8", "value": "T11C2408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280235, "uuid": "891c9b94-4285-4da6-92f8-493daf0dd98c", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280235, "uuid": "bf379001-d2fe-4462-b397-1bd02b126102", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280235, "uuid": "e6d6393e-6868-4388-b25d-68807df731bc", "value": 229446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280235, "uuid": "beb6998a-6967-4540-82b8-f366c16a19d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280235, "uuid": "299c0848-be23-454f-b1c3-473b030651ba", "value": "0a27c86967c1f65d7d3d89941ea9ea27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473b4bef-2aa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690258266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258266, "uuid": "5b3aa46a-92a4-4dfd-8a84-65c8bf13a912", "comment": "Malware payload (AgentTesla)", "value": "ff5fec4a83b38cec5781ca7184e098b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258266, "uuid": "cf07d26e-fa90-4f57-918e-901ac75f9740", "comment": "Malware payload (AgentTesla)", "value": "4cf04223c56e29b7ecb5abb763ed840fecb68c1e9f718daaf823bf94f7ae9efb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258266, "uuid": "d3ae0f11-e1fe-4cd2-9705-2ae0333805d0", "comment": "Malware payload (AgentTesla)", "value": "f89e0eecea660a00311ddebf151da0493ceaacc9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258266, "uuid": "c4596823-c608-4b4d-aee7-9067a12e8394", "comment": "Malware payload (AgentTesla)", "value": "419a1a951062bbd93903d08423d4e85b853e2d047c1abe7884831b593a6f4c5c0977af700f49a6377211dc5579903b5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258266, "uuid": "b3fb934f-dc45-4cf1-90e1-9245468985e5", "value": "T1798429B519B98CD0F91EF0388329EABF6B526C520D2542FC1C9AFD258B71341DB61E72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258266, "uuid": "481626cf-9286-4fd3-9185-58e8757249d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258266, "uuid": "2f48d5b8-a4bb-4854-97bf-3a45476cb4ea", "value": "6144:RX+4bb0xdKu3hqgYBNrS7Zj/ZdndqmFxYZjKFNHeLp:RXl0xwuxqgYHrS7ZrxrxqYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258266, "uuid": "96a0f28f-95c4-4544-8f05-3560ce8603d8", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258266, "uuid": "bd150567-be18-4d3b-b602-da2e7ed717f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258266, "uuid": "823ff84a-9580-4238-b637-7e7fefcf479c", "value": "ff5fec4a83b38cec5781ca7184e098b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881c318b-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690308626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308626, "uuid": "d29d5bec-96cd-4e17-90d5-8e30991240db", "comment": "Malware payload (GuLoader)", "value": "4d8a5c20126b390dbecfaa7447ad3484", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308626, "uuid": "f307182a-12fd-4622-8d3b-7e19c9fb877a", "comment": "Malware payload (GuLoader)", "value": "4d73e80068d609d993214a98021116dad4d2b288fe34aee5c38b0d06454cd4f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308626, "uuid": "e91f1253-ef0b-44b9-9313-25397802b816", "comment": "Malware payload (GuLoader)", "value": "99b74cb3451a579297add314d19ac39f0d1f7e85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308626, "uuid": "0148b755-b8d9-42d9-b4ed-2093a28569e6", "comment": "Malware payload (GuLoader)", "value": "852dc7e89c6203b0fbd96413fa31281194cd84b5fac2518e251b41395f7175ee48ad6a02b7b615352f914b8c0165104d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308626, "uuid": "f375d76b-4db9-4dfb-b571-e1cc4b2f3d4e", "value": "T18814125367E0D4AFDA2643320F779B68BFF9C09A41A08E5B47A45E1F7603113971E12B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308626, "uuid": "50191078-1827-4ea8-9f6b-6d2c6314fb21", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308626, "uuid": "27f5bf0b-2578-4998-a88c-991f8b898ab6", "value": "3072:nwDijpS4DbYcr8bDv/6qdHWsrEevM3aXLqssOCo8esV59CT29OIJ3yY7mtB4Gmed:nFPez/26FvjXL/sPksL973y0sWed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308626, "uuid": "0be9b993-8524-448f-b53a-3e00871d75f3", "value": 198001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308626, "uuid": "cdd3c733-240e-4cba-a353-d99e00714339", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308626, "uuid": "cc84b9d3-748a-4dcf-897f-49e18e024bac", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95d60bb-2ae7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690288603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288603, "uuid": "af7e34ca-8f09-496d-808b-dd9c7a79d5e9", "comment": "Malware payload (AgentTesla)", "value": "6861ed52bc98bb04a3a08762a4264f74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288603, "uuid": "cfdd813d-bcea-4d99-ba74-6206597f79c3", "comment": "Malware payload (AgentTesla)", "value": "4e17b2121074596f9b62e717025c7b3858ea3e36bbf1af02d9276dbbdfaeeb1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288603, "uuid": "c9ea7e60-a830-4ea8-8ff9-0608fd1dbca2", "comment": "Malware payload (AgentTesla)", "value": "f00fea69d69e8285f3d0ac032f4a44935599e1d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288603, "uuid": "e30d9932-dd55-4252-9c3d-8bb64894ab94", "comment": "Malware payload (AgentTesla)", "value": "9192185532f97ef2f4f96c535972f94cf1cb6fccba451e72863d0f8ae88efee6b4b85fb35fa354d5bbc91c56a191a705", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288603, "uuid": "6c787d37-fb6e-4fee-923d-a18fbeae322d", "value": "T11CE4338B934A1B4CE3A31D751785DE8B8DF1B22F66B40717B0AD803B4C1B2D7978D9A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288603, "uuid": "094bcd57-6394-4410-9a09-06e00ce247c1", "value": "12288:jr7uKujIZvu0kkpV9fBj1IDpMQdSNOB656cpDlf6BTuYXmeUvHJ5t:XSfIZkk3ylMQme6ccL8xmdvHJ5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690288603, "uuid": "9741653b-8379-47ae-bd38-83c5f9a5e02f", "value": 714554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690288603, "uuid": "22d3c390-7e96-4e5a-886b-10b8a84e0266", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288603, "uuid": "5428e465-3c8f-4f3c-9a69-35e9127739f1", "value": "Quotation for 12 Aro Pump 666053-3EB Spares ._1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae96280f-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690267889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267889, "uuid": "2f69319d-4342-494f-bc69-0f540a7a1e09", "comment": "Malware payload (Amadey)", "value": "4739ef4d2060ff2d90813db92fddeadc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267889, "uuid": "7d94cfe1-022d-4934-b98d-08b1894c8570", "comment": "Malware payload (Amadey)", "value": "4eb94831dc8c5d208a185b7f83469113379a05db96af352e5c0de634611050dd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267889, "uuid": "78cd0897-30f3-4792-8b7a-95341e229350", "comment": "Malware payload (Amadey)", "value": "4446ebf49f56cbf1ed49e45f51a30392604ad371", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267889, "uuid": "67bf57f1-2af8-490f-b7c7-888ccbb346d9", "comment": "Malware payload (Amadey)", "value": "80496691a45420bf5c2cdc68b661b90b1b788dc52ec6b87a74133937b060d9cc99e4d3f999037f52eab80a06f375949e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267889, "uuid": "80c06891-046a-4c01-86e8-0cabd891458b", "value": "T15384F212F7E94133D9751B706CF603D31B36BCA19DB8836B2746691A0CB26D0A93277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267889, "uuid": "3c9f261c-06cd-4a31-bb10-99748246d7a8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267889, "uuid": "ae9c8736-a36f-4b0b-93a2-4b583d5d754b", "value": "6144:Kry+bnr+Dp0yN90QEtbZQniMvjNGu9ntB8UsXfCv4Rp0mbs0bsYhHCAbKFtnn:pMr/y90foFz8UsXNpqas6CeKFln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267889, "uuid": "4f117f3e-52ce-4d8c-b081-88aed2bc24d7", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267889, "uuid": "c5e2b8d3-c132-4a45-8896-6ff2f3da840a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267889, "uuid": "d99c63ea-f4d6-4270-a06b-703821e9b540", "value": "4739ef4d2060ff2d90813db92fddeadc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ce43e5-2afd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690297664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297664, "uuid": "459e44cd-2a61-43ae-9f92-30792ef3cd77", "comment": "Malware payload (AgentTesla)", "value": "2fa91b29acd464a28cd63769331a890b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297664, "uuid": "4e4aec04-b0c3-41c0-b783-7d9e2f0ab4b8", "comment": "Malware payload (AgentTesla)", "value": "4ec62084038e8febdd30e816e81846c038a95aec5e0ce778f753015d29f1b039", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297664, "uuid": "050e78c6-f422-48b7-b2ba-d28d3a3d158f", "comment": "Malware payload (AgentTesla)", "value": "75db93a920e48282d0571aa66c99d782f1d6811c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297664, "uuid": "ecb2152b-a620-49ed-a71b-0ad6523dca44", "comment": "Malware payload (AgentTesla)", "value": "75d5b6cf3ebe89e639b017d3ec74c980a430b489ee5c9d1f6ad3738782642e10dafaf3f31348b3ecd5c55b7076505fde", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297664, "uuid": "2da6299c-c5ef-4678-9e64-2f1c2fee97f3", "value": "T15C45121A6E854D57D12E2FB904207BB8A2BDAFF53031D6D73C5EF18ADB65F088690207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297664, "uuid": "01ce05e9-5493-4385-ab60-0bd855c90cb0", "value": "12288:JYiIoFwIrG3XCCaQ2mXrLr90l0H44v9QOC4aCbR8rD:JHIcTrGCwPX/r90l0H44jhhSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690297664, "uuid": "6e547ef1-1f6b-45da-b04f-4e470eb742d0", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690297664, "uuid": "894cd650-92b7-4ebf-9f92-d4066754c90c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297664, "uuid": "c6b30362-af33-4965-b163-f126b7c5fe32", "value": "n98298.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f762515b-2b18-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690309672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309672, "uuid": "fcb480c4-94ec-42c4-866c-7c984cacaa8b", "comment": "Malware payload", "value": "1cbb57f5b9eb4afbac449d40a1aa1727", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309672, "uuid": "a3c06730-8f5c-4400-a70e-f76be799df4d", "comment": "Malware payload", "value": "4ee34cc00d2276e1398af50014c25ac15f1570ff1613bdffd65b63440ab9dd09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309672, "uuid": "cc895757-d531-400a-9f20-d1bebf08d236", "comment": "Malware payload", "value": "1aae19e3183c88be0ca6922128efdad9c832a55b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309672, "uuid": "f350d755-8f6a-467f-ae8f-dc455962f80c", "comment": "Malware payload", "value": "01c5a957d23173bcd101319eb520b6ec6bfdb15070de2fea339e463ac505cbbc1254b8cda6e11d01e36ad47faa170e70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309672, "uuid": "9d50661d-9a2e-4edf-9722-51eb0d19afb9", "value": "T118E4232585C7A70BC9FF9231114CEC768462D2973662598FC1A10FC2F9EC88F7A69BD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309672, "uuid": "30826932-d370-420a-b619-165797a5f468", "value": "d5e0355f8764c235b38759b860077ceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309672, "uuid": "1c4b8d9d-adf9-4aca-a4c8-2399ec6b3e44", "value": "12288:0WygipjUvypL/CQi8ozInJksJ/ZOCqJ3pHWs068giLZzys4C/VO0/9a:kNbqQ+zIaEEnHW1VLZG3CcE9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309672, "uuid": "a38808cf-ef80-4944-bc7c-16c7b66109f4", "value": 670461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309672, "uuid": "20ad8bff-6347-455f-be95-77b58fcc6084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309672, "uuid": "2aabb94e-7223-4cb6-a628-f09c81e29b2f", "value": "1cbb57f5b9eb4afbac449d40a1aa1727.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda535b0-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690282087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282087, "uuid": "737821cc-4153-4035-b54f-e8c8ec5fd710", "comment": "Malware payload (DarkCloud)", "value": "dade9b6cbad90b9fcf73dfb31a775f39", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282087, "uuid": "76ecf277-6b5b-4703-bfe3-2c49a4b7d684", "comment": "Malware payload (DarkCloud)", "value": "4efc90ae76d32655754a1885cadb870f90676ed1457d096bbe3c6f472a9102fa", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282087, "uuid": "00b465ef-681c-4ef9-8717-1dedfc9988df", "comment": "Malware payload (DarkCloud)", "value": "fdf4be302acfd7ae498d9db3c680ca3fca7b3f96", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282087, "uuid": "14cc1834-ba9a-4699-ad5f-28dcc425ccc3", "comment": "Malware payload (DarkCloud)", "value": "7725edabab743ecccaea4777e54f109d4b6569f3795ada316bf6142fdd3e748c45178f2211db1a698af0856511d7d415", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282087, "uuid": "538b577b-a11f-488f-8f3e-4d9399cd0f59", "value": "T1EDA45D26EB61602EF063C8F0F5E5925768996D7A12A8AC27F7815F0935311D3E8F032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282087, "uuid": "5810c442-10af-4292-977d-1b8fbbc0593a", "value": "1bda00bd756d4ff86cecf1c4d4088488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282087, "uuid": "b95874e3-c5a5-4be7-bdef-e3d80abd39bc", "value": "12288:WVGVbzVTvd5/8xmIaCMBUt8ztJ0oKQiSjYKkJj6GmZU:DdViuztJ0oNxYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282087, "uuid": "562c4b26-81de-44c8-a22d-bf589dc98f55", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282087, "uuid": "0eed6c32-dda5-460d-b61c-d816b91dc741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282087, "uuid": "fd16d2cf-d04d-4ddf-98bf-42e223aefadc", "value": "4efc90ae76d32655754a1885cadb870f90676ed1457d096bbe3c6f472a9102fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fabf522-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690280292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280292, "uuid": "c6a0f9c9-77ec-4cc1-a31e-ac1b3151d9de", "comment": "Malware payload (Amadey)", "value": "78e56eba276e03c1bad708c66150f95b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280292, "uuid": "89424af7-d666-4093-bdb5-4a00712a3448", "comment": "Malware payload (Amadey)", "value": "4f3598c17194ca02702c691f1a275386fa6fe783f3dbf8de0db4369822b3859c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280292, "uuid": "6f35570b-5c32-4633-99cc-2cfe9cdb322b", "comment": "Malware payload (Amadey)", "value": "79f963f9dd3c453ba40a487e7a8dcdf04f32eabc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280292, "uuid": "bcd8e42e-f747-4e99-bb18-99e2c7a67f57", "comment": "Malware payload (Amadey)", "value": "dff5755a7c56a84784291904c122b190ba089227dc0550f5dce3b94991d8ae0e7f114d1b315be94ccb4e007ae2ef7c7e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280292, "uuid": "936202f2-1a04-4643-9bf8-41efca5dceb3", "value": "T146840202AAD89432DDF517B048F702C319397CE29D78875B3385AD5E0CB3A90A57577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280292, "uuid": "948fd1d1-f734-491b-9427-184445501429", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280292, "uuid": "4a76f672-546c-4a00-91cb-434d1c0300dc", "value": "6144:Kqy+bnr+Cp0yN90QENi3RDN4AY8rPRLZ0u1/5fRgdp6PL/gKa0RgM7a:mMrey90jizY8JLeSVuu760Rgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280292, "uuid": "c6276c66-a84f-4e5b-8585-6530cfb08cde", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280292, "uuid": "c7804889-e24b-4e56-af3b-1fe49e988a4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280292, "uuid": "07ea931a-306f-429b-ba70-a8198737cb25", "value": "78e56eba276e03c1bad708c66150f95b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00eefa64-2b46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690329015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690329015, "uuid": "7846e975-c015-43f8-8ffc-b1f9810c3c28", "comment": "Malware payload (RedLineStealer)", "value": "7c18df4a1aab5314b4a499c3e84f055c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690329015, "uuid": "0f21f56a-4946-4307-bfb9-c008c5c930eb", "comment": "Malware payload (RedLineStealer)", "value": "4f3754655ee4cb040cac0cc3beb2f43f8fa5288aa48d6c65b24bf6c893e5eaeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690329015, "uuid": "935acca8-a533-4dbb-91e8-0a50bc9ed574", "comment": "Malware payload (RedLineStealer)", "value": "0f1ebb8c6dedebd3a98a970316bf756e639f39f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690329015, "uuid": "c25a8f95-1c95-4b8c-987d-47ffaf9ffdc4", "comment": "Malware payload (RedLineStealer)", "value": "8a1fb0aaad1007e5c9c19d48092e678ec9184c1a0ad9199459e23cd41a541c67aa493ba6a16526264eb5886f029be712", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690329015, "uuid": "12aedc9c-77a3-4a2a-8719-4de00b1fc4d3", "value": "T12874E0227190D073C06725352870CA511B76BCE29B7986CB33983F3E6E726E16B35B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690329015, "uuid": "314fa122-4b89-42c1-ac20-0a1bd523422c", "value": "5ea05395629dd7cfa2fe7ed080de0303", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690329015, "uuid": "c2246a6f-64d4-4162-b0db-4bc0765b7edc", "value": "6144:x8MMguMsmHX9cbcPsoeonEASYbHAR+uTfzpFvDy/M9O:GMjzsKRUoeiEXYbHA4uTrnOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690329015, "uuid": "615ecaa1-8f18-4dec-b8f8-34f63cbe1d1a", "value": 360960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690329015, "uuid": "acee08e1-3cc4-4088-8f5a-6b419fb743ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690329015, "uuid": "41b7d627-b3e0-4ede-904f-e2448da1e812", "value": "7c18df4a1aab5314b4a499c3e84f055c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa997291-2b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690307530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307530, "uuid": "a307c11f-eb95-4288-9ab5-e81dea41ca31", "comment": "Malware payload (SnakeKeylogger)", "value": "079ff89db58146e3255b627ed7e2ae28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307530, "uuid": "3e05ec04-f8dc-4025-9907-9196db9af39e", "comment": "Malware payload (SnakeKeylogger)", "value": "4f46c0a7109435ba7a545e90c7bc7255cfbfb946c2bc8917d3b232006c2a65cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307530, "uuid": "56eec807-8c20-4e5b-8506-08044b539094", "comment": "Malware payload (SnakeKeylogger)", "value": "1e18f9fc28b05b55e3e31bf048b56d7c21bd2d39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307530, "uuid": "9f9bfb44-0dca-4164-b11d-74fba7f35d3e", "comment": "Malware payload (SnakeKeylogger)", "value": "0508ad653a2f84d96e6db7f1be5304ac241e6fead9c87d644ee590fc6ac4a9920830533e78cf981a22b301850589da9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307530, "uuid": "8bcf1bca-45ff-4dc0-9fb4-34dce2d4fba4", "value": "T137C44A3C1CBC7223C174E6B28FACC461F650956B3D618E3765D39999471EA0229CBE3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307530, "uuid": "d2741846-65be-4587-babc-777128353168", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307530, "uuid": "e002c79d-7206-4850-9055-c94dd7e66e1d", "value": "6144:7lKR2geL3C9QNRHXkxCI5rPBkwyFB/WKPsonGEn/z7o7GAZo9h2DFsoYtEkN4xRJ:nz/noSA/BYzN4vB7WhLrcNTs8JuU2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307530, "uuid": "e5eec7b2-f14e-4f79-8c3c-1e00dd23b533", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307530, "uuid": "7ccfeab8-98aa-4b8a-a099-d59467b82bfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307530, "uuid": "98c6975e-0c96-46d6-acd3-ee8989b992cd", "value": "079ff89db58146e3255b627ed7e2ae28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82f7f61-2ad3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690279958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690279958, "uuid": "fd435e7b-f821-4c4d-9756-171778e73b84", "comment": "Malware payload (RedLineStealer)", "value": "7029bd0b72ef68903ba7755403ef837c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690279958, "uuid": "8f4dac4b-4c60-4e6a-aece-77a74135634f", "comment": "Malware payload (RedLineStealer)", "value": "4fbcb0a2f45aaeb44239e2e00233d34f6efb6c46aa551acf21567602c1b83573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690279958, "uuid": "2f21014d-fa94-4a93-ae4a-fad0e1c0d37f", "comment": "Malware payload (RedLineStealer)", "value": "7e5fe966a2e74bc6e5ccff71339f8794ce8c4d7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690279958, "uuid": "d851e825-8fd6-49b9-b3d9-25432f076e90", "comment": "Malware payload (RedLineStealer)", "value": "c7d4ba24fcbeec2d0cc097a457686205ffb533417f29ae1f493ca2f7c137fa7f1e51f9d155b51dda723175b0e9fe5787", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690279958, "uuid": "41393357-bc3b-4c3b-8350-747acf59feb4", "value": "T1B2840263AAD48432E9B5177064F603C30F3A7C915D7893AB2345ED8E0DB2AD0A57673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690279958, "uuid": "b253fee0-509b-4090-836c-30eaa6f65db8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690279958, "uuid": "a344137a-0653-4d3c-8122-1145d1532bbb", "value": "6144:K7y+bnr+8p0yN90QES1d8f5qOkWcnZNbQR5zRPdQwiAZAKWJaLu5GIJwEUR:FMrUy90QfMQwNZQJEu5HJwEUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690279958, "uuid": "0f73983f-753a-42a4-b450-1a1d60586b3a", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690279958, "uuid": "a0613a10-4599-486d-9708-184efc319c23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690279958, "uuid": "9ec6d0ac-4a14-423b-a8cf-b2d3380ed8a9", "value": "7029bd0b72ef68903ba7755403ef837c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d77de7-2ae2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690286203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690286203, "uuid": "5e80001e-f34a-4905-8be4-4906b8717407", "comment": "Malware payload", "value": "a690dc90302a1e1a6086d4c6dbef7c9e", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690286203, "uuid": "062f145f-6121-48ea-8bd6-d1f78fe54a84", "comment": "Malware payload", "value": "5015c54014939fbeac22f665ccaa4f94bb043de2209cf4ae27585d76e3617442", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690286203, "uuid": "4b29032c-834a-4aa1-bc45-fa241d374b3a", "comment": "Malware payload", "value": "f38c902d811c99e5ce96e5f4e8978f0b506e6ab8", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690286203, "uuid": "3ae22189-7e6d-4608-b4e0-61215e8aedaf", "comment": "Malware payload", "value": "dd3a09198d6ad6f943133c9c043e2973bdade9377173a0358a3174385b4eeb35384c1c3090088c3489087ef71cb6cd06", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690286203, "uuid": "20410f1d-5312-4086-8b0a-c576d5a5ec66", "value": "T11F949EB066C13BC70F742D4DB78EC1F23C58B657B0AD9E4A16D8492D5AD01B88FA6DB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690286203, "uuid": "62562e63-1df7-4979-80ca-cfccd6142f4e", "value": "6144:L1E6J/ieNB0Bu3vKz0LHvhKwqnhwSwMKOacwiJcLrJytU9Iz:i6JK20avo0rhgWS1Kh5iJcLrJgOIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690286203, "uuid": "6e366eef-d414-4d98-8de5-3ae652dbd895", "value": 439028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690286203, "uuid": "97e4902a-d034-4bf2-8cac-6eae6dcbd243", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690286203, "uuid": "ca75d712-4768-4584-8412-9bbf52f9b3e9", "value": "fywxwnaflujdxmxhenhqapuyhhhhoujanjkryaxnxneyctdmaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31da61bf-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268538, "uuid": "d16ec7a9-ef72-45b4-a0b5-f07599b9f090", "comment": "Malware payload (Amadey)", "value": "b98765fd9fa676950200180126ca55fa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268538, "uuid": "3e4d0a43-c2ca-43d5-8a3c-c35cffd920fa", "comment": "Malware payload (Amadey)", "value": "50be51fdd59dbf4ac078600bca6c8481f0e5baf0010085e6e0ce8d763e87da4b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268538, "uuid": "6348485d-3cd3-4d75-8929-e1ee013281ec", "comment": "Malware payload (Amadey)", "value": "b90c5fb7694835cf0d411b0573a6e5ccfc87029e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268538, "uuid": "8e46f297-7c5d-4aa5-a7ec-0171d3296f7c", "comment": "Malware payload (Amadey)", "value": "63f0be0e4a4805a4574621afc1f22cad712be74ee622d7985ff6450a8b5c1be8472b105604d4cf0bbbc70fda242dd894", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268538, "uuid": "b0a9dc35-cbae-47c1-8157-dfb6024cb4bc", "value": "T199840112E6E98473ECB627F009F202D32B317CE16934536F3745A95A1CB3694AA7137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268538, "uuid": "59e82eee-f63b-4104-9ea6-c6f63be6b346", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268538, "uuid": "5b6205c2-65cd-4ccf-b3aa-a3288a75d95f", "value": "6144:KJy+bnr+Fp0yN90QEtKC6Z223SgfSsBjvDfu/xLGC9wxrRf9x3S5V+ekRsR9TNKI:TMrpy90bL+i+7YF1wt59R5eOsTTkypL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268538, "uuid": "fbdb60b7-d2bf-4123-b37c-be86f858202e", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268538, "uuid": "2960de87-3ea4-4833-b256-42dc5eaf39c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268538, "uuid": "3e640e58-db8a-49cd-8a43-0f5c928f4f0d", "value": "b98765fd9fa676950200180126ca55fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf533ca-2b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690307509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307509, "uuid": "a44aed86-40a5-4e08-8cef-31e60f65b22b", "comment": "Malware payload (SnakeKeylogger)", "value": "1f213027df6064645d19ba5bf139d6cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307509, "uuid": "17996427-7f7e-4ae2-8583-76703cd397e0", "comment": "Malware payload (SnakeKeylogger)", "value": "50beb2ed6fdbbcb5e959cb639485fe61d02c7b3d6e7fddd3a662ef13552f19d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307509, "uuid": "99e3bc4f-3b59-42d4-84cd-1a77302b2f0e", "comment": "Malware payload (SnakeKeylogger)", "value": "dd2ab400340e5053eab5aa1cb3f45e9b6dd3ad55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307509, "uuid": "11b129ce-b601-4520-b54b-a2601c846a9b", "comment": "Malware payload (SnakeKeylogger)", "value": "ecce4039f8fa46efd69d42f40f9242e7fa4a0bc54f4d87a64ef2a0670a93bcd3df6e47ee672a5725afe467033b29b893", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307509, "uuid": "ca97aa71-e5cb-498a-b9c1-0f2ba1c0e838", "value": "T127C41219294A5A27D40B3FFB14023276533E9EE57411E7930C2AF0FAEA9778E8C91753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307509, "uuid": "deeb8712-6077-4d5a-bcf8-b19db6df2a35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307509, "uuid": "4650c505-57bf-4109-a4bb-100a598f00a5", "value": "12288:3mAY2kcdbL4Ef0sywOzEfbchPEGmJbO1c4x3C7/ha:WN6GEf0ofbccFJbcJJC7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307509, "uuid": "2107903d-06e1-4644-afdb-34a88ed0c652", "value": 586240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307509, "uuid": "989189c1-4d23-4878-9c38-3ba5bfd784aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307509, "uuid": "251d0c98-1e1f-4610-8ce0-90d4be57a6bf", "value": "1f213027df6064645d19ba5bf139d6cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143d1f75-2aa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690258181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258181, "uuid": "01b20acc-a49a-4860-89ca-552af9d3246a", "comment": "Malware payload (AgentTesla)", "value": "ae457c392c600dc90d4d0b9dd3bc8a7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258181, "uuid": "5bc2838c-8286-4fe4-bf35-18f9334caa24", "comment": "Malware payload (AgentTesla)", "value": "50ee88e94c3b5ee3652c4768305f6924679cfd6a48792ed322f0ef858ed06c7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258181, "uuid": "cf817cc7-f58c-4b61-90a9-8ba9a67d013b", "comment": "Malware payload (AgentTesla)", "value": "4d4d5392a9c89e54b2e0d45e0ba5274de0ccc414", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258181, "uuid": "d1c78ad9-e999-4fe1-bb79-23843863da15", "comment": "Malware payload (AgentTesla)", "value": "ef36e10e84b974ebb1ebe7d41fe73a2d1a605f07ee0eac3eb874e7dd0d2a0a141ad796e97051c5e3e6377bd606fc236c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258181, "uuid": "051a851f-bce3-4f58-a9f8-601c79245095", "value": "T12EA53AF02EA8D993F384C87480B4EBBB8679A57A0D934111E87FB6DDF718B786C51211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258181, "uuid": "a8d2b284-25e2-4459-8ef1-d1e5de603fdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258181, "uuid": "6f08bb12-4a57-42ab-82c2-6d7fc79da22d", "value": "6144:EbCZDK1BJQRHu9AG+VaYzEHmCYUcxhBF+DMQ5hnACrprjLgC:5ZWBJ06AG+wYMmC6hE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258181, "uuid": "725f7605-9731-4c02-9e6e-b1bbcde985a5", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258181, "uuid": "fdb5b4ed-8963-443f-963b-e76c8e0ba5d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258181, "uuid": "f51912a0-2644-40fe-aa52-d728e461744d", "value": "ae457c392c600dc90d4d0b9dd3bc8a7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36bcae85-2ad6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690281002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281002, "uuid": "b6274c27-7bfa-4641-a3af-a3592da22730", "comment": "Malware payload", "value": "5fe80f1b1e90815886a0553f2c322cc7", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281002, "uuid": "62f8cd2f-b483-4f52-aa2c-2aeefb7f2fd5", "comment": "Malware payload", "value": "510898ad9082dfc559aa511848c294627df87bbbc874cb411fe9f7fc638d86d8", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281002, "uuid": "89d07153-6c60-4b13-99ac-5e86cb6e5af9", "comment": "Malware payload", "value": "0c2a7c8be354638a9f7aa876c110c74cd0c02dda", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281002, "uuid": "1043c45f-f4c5-49a5-a25a-7bbf7346a4f2", "comment": "Malware payload", "value": "5bd4943f79e7fb4ac8d30a87dd73d401c3da96e404a96711d3738038d1ffdc6cfd152f9d60e2953263b5fce9d680b8dd", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281002, "uuid": "6d5bb003-f032-4eda-8813-2669c16a531d", "value": "T1A6C18410FF6ECA2A8183D15E2B56DC99F91E513221944CED7C8CD686478DE8D02FE27A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281002, "uuid": "993025c3-dc47-44d3-be26-485cfd6e7abc", "value": "96:KheFTjQVyiE3H1HXB5AOnNGi8UYKpDMmIVPcjpCh+3zQPpZNlBNYgoAwP3Pvhoo2:pachHNjrDM4VDQPplQCpLLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690281002, "uuid": "bea72da6-b1c3-404a-abc0-3b950e59d0df", "value": 6081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690281002, "uuid": "f62bf4ac-34c9-4b53-b695-e4e346c28f67", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281002, "uuid": "f20adc67-39ec-462e-8173-aa1a27ced33f", "value": "demo.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a122f35d-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690308668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308668, "uuid": "b084b12e-7d59-4d54-b086-9fae9f58c601", "comment": "Malware payload (AgentTesla)", "value": "79ce23315e199cccc53b298d54bc343c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308668, "uuid": "e394074a-c4e3-460e-ae17-630eae1e05ba", "comment": "Malware payload (AgentTesla)", "value": "51706a5b676216b363b5c7bedd9c233eeccc223d66eabe3a4591b0c3eaace1e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308668, "uuid": "5e31ad3b-44db-46d1-b374-1be3c234fb5e", "comment": "Malware payload (AgentTesla)", "value": "3f358787dfaf5e5c7d97fa463e4d5da705a5984c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308668, "uuid": "e0d11d1d-2fac-4233-897f-a40fa9288ba3", "comment": "Malware payload (AgentTesla)", "value": "10b59ccd6633ea2e53bbcf1dee1a031a22511dfb87ff2921ddf6994588cdf6803c2acf70b7c1766ed02e121704790833", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308668, "uuid": "5954fe5c-2380-477c-bf92-4e3a3805c8bf", "value": "T17FF2319C721032DFC867D072DEA95D64AA6078BF831B4217E06726AEDA5D497CF180F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308668, "uuid": "0ae3d4c6-40e1-4668-ab79-cc1cdf01fdaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308668, "uuid": "c1238e65-d47e-41ef-9a9c-557f7c32af26", "value": "384:GCk3Gv2+BISMLPZPthq8HiVvLD8b1EqtjTEQQeN4cYUHxLYbjmjed:Y4BQr5thuVv0jhNyryje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308668, "uuid": "d0f7fc06-d46d-4ff4-af2d-c664d0c13c89", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308668, "uuid": "613eaa56-276e-4168-9d57-7767e315a605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308668, "uuid": "8d299fb4-8a68-49c2-bd71-0b2a239a8918", "value": "\u00dcr\u00fcn_Fiyat 10243975_forKARDAG A.S scan%001% doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74797c58-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268221, "uuid": "9762837b-3899-44d8-9bc1-7aef33a6565d", "comment": "Malware payload (RedLineStealer)", "value": "774f13b360ff5e9caf5eeb26222458e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268221, "uuid": "23381425-09d4-469b-b298-e3e1d8896cd8", "comment": "Malware payload (RedLineStealer)", "value": "51b0a627ad567050d1080b681ae48d44c45c7d6fc28f80ac4c63f99804938d9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268221, "uuid": "48912096-cdad-40a7-8890-a9fa412881d4", "comment": "Malware payload (RedLineStealer)", "value": "8217341ac13ece399ab6281a08b33d0908f34dca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268221, "uuid": "0712df8d-e132-4c8a-bb98-43d036be12df", "comment": "Malware payload (RedLineStealer)", "value": "f40128bc99f3a8786b778c3c6b150bc0c1fbaa0a2affbc9c485f9ad14c0332afe37216c8e6dc55c96b569d3181c6c0a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268221, "uuid": "40530095-b180-4456-8cac-01bb9357cf92", "value": "T10BB41293F7D49033D8B607B05CFA179319367CB1AE7C522B22866E5E4C730D4A63276A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268221, "uuid": "4059c90c-077e-4ef8-9cbf-94f7b05cd722", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268221, "uuid": "70ae0823-48dc-4f2b-a947-cca71e92d084", "value": "12288:oMrgy90PNTyJzSgEe3TYp1IJd0O2kLd2kAyQasM:YySNT82U3TYDW0O2kb5sM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268221, "uuid": "00ef6703-aa0e-4833-8b5e-6e76278844ba", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268221, "uuid": "114ddd7e-ced5-46e8-aeb3-a65c802d718e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268221, "uuid": "0cd8e4bb-82ae-423a-a626-f663c3a9126b", "value": "774f13b360ff5e9caf5eeb26222458e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8d7f22-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268259, "uuid": "3cb0145e-63e0-4176-ac43-f4608bf1cd3b", "comment": "Malware payload (RedLineStealer)", "value": "88367423d5ec488af6fea26015989118", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268259, "uuid": "1d76bcaa-8955-41b9-aba3-d89f0447abd9", "comment": "Malware payload (RedLineStealer)", "value": "51c28c3d11c496302e545a9033cec252f2418bc49d1e06efe0e9ec2680fae577", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268259, "uuid": "8409ec58-b9d1-43b0-bf53-8205cf973f5a", "comment": "Malware payload (RedLineStealer)", "value": "e73fda8125d86d66f8bb3ae0ad47b8a14673f065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268259, "uuid": "3edf53fe-8842-400f-a3da-643adcc66e56", "comment": "Malware payload (RedLineStealer)", "value": "fbe9ee62cbc5ea3c78dc721a78c545797a391e77985a2a452bf684d02c13706c64b712f81216b18a957e398bee7af594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268259, "uuid": "3da977ed-66df-478f-bf51-488ed02c74d7", "value": "T106840152A3F85073EDB527B00CF707532A36BDA56874876E2B45A91E0CB29D4A93133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268259, "uuid": "9e9b0df9-027d-4fa2-b1ec-6269104a9fbb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268259, "uuid": "cfcf11f5-1875-4318-9168-cf7c200ceea4", "value": "12288:FMr+y90FWVIEWdZ+wJdCLfKeLVLoFWR/:vyHx3wJQJVk+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268259, "uuid": "32c4d48c-47af-496d-a01f-69a157c28789", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268259, "uuid": "0c8ab5f4-d8af-4e8a-b9e8-7a4c30986e1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268259, "uuid": "116c0e24-8fe2-4313-80c3-010d0657f37e", "value": "88367423d5ec488af6fea26015989118.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c3f067-2ace-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690277798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277798, "uuid": "82b28b4f-5ffe-491a-a13f-a9d744193999", "comment": "Malware payload", "value": "e55f39c1f4cde3fd39f36c80beb00016", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277798, "uuid": "63f258f0-6a4e-46ab-9b77-680ea91fb72d", "comment": "Malware payload", "value": "5252cf30b690a7dfb11e75c1def619745f1755240242aff3d51f230ed47e8b7e", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277798, "uuid": "3aedefa8-e9ef-4c0b-8b56-b17f62ceebe9", "comment": "Malware payload", "value": "b9cf66225a1c5e6a3f61ea384c2843a5d4b7637b", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277798, "uuid": "3b8da4b8-2d7a-46ec-a4ca-d91fe90ea525", "comment": "Malware payload", "value": "15e9c265da92295bda494752f4153c9f898c6c281b225acedd1b8040333101d86e730ce2c5c9e2bb34bc5a5c57d77b88", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690277798, "uuid": "26ebda32-0f97-4293-8a48-b76b5b736501", "value": "T19E74BFB569D63BC60F301E4DB68ED2B12C9CB797B0AD9A0713D8092E2AD01748FB5D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690277798, "uuid": "94663bc7-9bb1-4389-813f-0938f852ec42", "value": "6144:LumZunPKkY8ANff1BslgFJ2QNecAenljMXUG/3wbYi8QO0:hZunRY8AR1EgFJ5oOljNQwWQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690277798, "uuid": "d3565b39-19d1-4020-94f3-e07460971008", "value": 369512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690277798, "uuid": "a68ec15e-23ee-4de3-b40a-2c96298580e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690277798, "uuid": "8998481c-ecdd-458f-8639-9940104b58ce", "value": "zrduqsunlaieexabrevwjtvofkjwwxofqqabbztmasmavdwuox", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7779632-2aed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690291070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291070, "uuid": "83c5c2ae-1cb8-4da0-b6b7-305bb90ffe17", "comment": "Malware payload (AgentTesla)", "value": "1c56d5842f0f5cb191887615a65ba007", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291070, "uuid": "cbc5c72f-dfbc-45ac-9fb6-2b61f14f3e81", "comment": "Malware payload (AgentTesla)", "value": "52a98d9a3b0bc741aaf73a4efb435797f130bd0a7ed960957e8e08346388d915", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291070, "uuid": "a899e11b-72b4-41c0-91fb-22563179e401", "comment": "Malware payload (AgentTesla)", "value": "d540094a3ae0cf5c3b8ca04aa703185c1a18ede8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291070, "uuid": "41928acc-528f-4087-8f1c-a83757d96d16", "comment": "Malware payload (AgentTesla)", "value": "a4197098ad166b0376ebd1aecbebdb8ac52481ed737e2e36b83e6934e826a3cd5dae581001273764d40b20ee24394d8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291070, "uuid": "4c46873c-ca59-4344-b25b-4447f1adb47e", "value": "T1FAB24A06BA9D5134D95D973FC8EFC5042630DA423897CB0F79AA138D68333E9DA465CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291070, "uuid": "b188b2cc-18b5-4225-acf5-80ab8767a1c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291070, "uuid": "10903727-ca18-41e8-a35a-27fdf0d1da7d", "value": "384:WdmYFG/Gj0MOHpJIzcg2g9Hxx/cCK/FhM8TaiWimL/qgH7FdB77aRd:Wdml+jMJCzj2gzxkCKthhgSg9ar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690291070, "uuid": "6e18cf4c-df9f-43cf-a178-efecbb68de72", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690291070, "uuid": "f0d114cf-866f-4818-adf0-3a6c87cfb48b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291070, "uuid": "4bf7fe5b-f2b2-45ae-b622-074dbee25b6b", "value": "KOPIA PLIKU APTIV SUPPLIER BASIC INFORMATION FORM 2023.XLSB.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4d08b9-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268828, "uuid": "a4902f13-1862-4126-8342-b4a5caae9d7f", "comment": "Malware payload (Amadey)", "value": "b075f44207f0a6248df687aef529814d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268828, "uuid": "614ce581-3f73-406e-a9ea-3c33dab03b61", "comment": "Malware payload (Amadey)", "value": "52f36f91447efd6543f79f2cc99f8cffc9e636fd12d6abc185e7900e7b4e2f05", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268828, "uuid": "421dd16f-55f3-4f53-8a92-e55964480807", "comment": "Malware payload (Amadey)", "value": "a4647dd77b1d03dce6021c0cab63614297ddfdf6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268828, "uuid": "17351b35-4595-4618-82f5-0422661e116f", "comment": "Malware payload (Amadey)", "value": "545bfc6fa83c99f6ac5fb288c07d2207897f14e43c3c9258ec20461f5f742da884b93e096fb0752c6ff219b82cb265c0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268828, "uuid": "f768f435-c86b-4904-a536-d392c58aabfd", "value": "T140B41247A7D84472DAF51BB008FA06D30B36BD618C38861B2B95A99E1C732C9E53573F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268828, "uuid": "9733e526-81d6-40a0-907d-b248645c1c22", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268828, "uuid": "f4e2744a-1004-4830-8bc5-2cd933baad7d", "value": "12288:cMrLy90F6RBO37F1zDVM9sngajeLtQa1hLvx6F:XyrRBeF1bng+eLtQe5v0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268828, "uuid": "277882dd-cc81-4753-9492-ac94cfb83740", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268828, "uuid": "a88419f9-ff0f-413f-8f88-ee2488455dcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268828, "uuid": "675f3a35-339b-456b-949f-d2f41b3e980e", "value": "b075f44207f0a6248df687aef529814d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6c8a1f-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268534, "uuid": "a19d5edb-dd26-4b80-aa5f-24c9e356a42b", "comment": "Malware payload (Amadey)", "value": "aa1d6405b25cc56b7eac59335582c2cf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268534, "uuid": "ecf92c8c-1a57-49e5-ba96-8953f671fad7", "comment": "Malware payload (Amadey)", "value": "530bc48595857770b051a0ca0ad361f2927f0a10c7426b5a6bd52b36b4de282a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268534, "uuid": "3746c75a-327e-499e-8204-a9361eb319a9", "comment": "Malware payload (Amadey)", "value": "39e2c687811387eb36a4db00808dc6b6870ef50a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268534, "uuid": "595c7471-254a-4d5e-9756-8fce36c9d7cd", "comment": "Malware payload (Amadey)", "value": "2517e69c886476261a685d4c53ef622e555fc0d683957da534d7fc580ac6653b1704647a30ebae2466ee5a8845fa4fbc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268534, "uuid": "e2fd7f5c-ee5d-4f5e-90ea-1e787c7c1e6a", "value": "T1762408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268534, "uuid": "05efca8e-9d7d-4157-ab7a-edb694b721df", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268534, "uuid": "be67cee5-c62e-4b39-bbc6-1da96e84bd9b", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268534, "uuid": "9a28a93f-40a6-40e2-b143-db34811570e6", "value": 229422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268534, "uuid": "edd25d36-a828-4bc1-a1aa-3323e266268f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268534, "uuid": "0791529f-cbcc-4235-92d7-7c478fcfe411", "value": "aa1d6405b25cc56b7eac59335582c2cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39084ce2-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268550, "uuid": "92d9ff98-8ddc-48a1-86b3-052ab77f98db", "comment": "Malware payload (Amadey)", "value": "b5677f1cadbbc2d3c602c0232d15ec3e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268550, "uuid": "d6708cb4-3709-40b5-a2fc-069ff959180d", "comment": "Malware payload (Amadey)", "value": "5326715dae3881303a739d0156c1f533f9eccdbbbed9995c323dd20b005377af", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268550, "uuid": "6c017eac-7054-450a-85c4-3127d0fa0274", "comment": "Malware payload (Amadey)", "value": "98f595c44a7def844c6f5e93b89fcae174e1cd71", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268550, "uuid": "63f5ce03-42a9-4a3e-ab97-343204860877", "comment": "Malware payload (Amadey)", "value": "475b3a282c2e17302649cfd9363232149fca53dd52b2f7216afe1e0703feac77f3eda490d344e1647b76998279620d48", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268550, "uuid": "7736138f-3e47-45e8-b0c2-796a4848a3d2", "value": "T1A92408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268550, "uuid": "ddcb4155-ca70-4218-aada-d80fcb48e43a", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268550, "uuid": "dad90094-42ca-4969-8398-a86a510575b5", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268550, "uuid": "362ee1e4-f6c4-4c71-913c-fa2c5ed7dbbb", "value": 229110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268550, "uuid": "eb9a0efa-5a45-475e-994e-5489721547ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268550, "uuid": "5ddfd38b-ef09-4a80-9a4a-550e93eebed2", "value": "b5677f1cadbbc2d3c602c0232d15ec3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba48720e-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690282082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282082, "uuid": "e54ed37c-c700-42f0-b4d4-7c60e54186b0", "comment": "Malware payload (AgentTesla)", "value": "226b1119662e7d54c989c42e2e556057", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282082, "uuid": "3e9ea753-fa26-470f-b428-b2faa8f48139", "comment": "Malware payload (AgentTesla)", "value": "538f32599c08cdebb335d75f0d876133ac006126f3b7ddf005316fdfdf0acbd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282082, "uuid": "73e39326-e2cc-47d6-aadd-56b8b40c4691", "comment": "Malware payload (AgentTesla)", "value": "75165c0b8d64fc562ae54414925fd9e731d81090", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282082, "uuid": "6fbd3687-06fc-4b54-9458-ce52c9688caf", "comment": "Malware payload (AgentTesla)", "value": "b32e7c52378084f8488591ad2919e50f6464d7bfa5ec7952cb31385727e903ee0eefc94aae8287e29d545042077f58cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282082, "uuid": "74091403-126f-4ed7-afab-4131d656ba4c", "value": "T1CD15483858BC1727C1B4EFF28AD18417B2E0A96F3215E9386DD357D64216B05E9C3A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282082, "uuid": "a673f37f-4de2-4f15-9cf3-3d2061e4b792", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282082, "uuid": "d571db2c-f5a4-4c31-ad62-d3f228dac64d", "value": "12288:IKTD0CWEG3Axb9NBP/kw5Kj6wL72qiHn8LoQKE32kD:IKTnlx9HP/kww/igoQv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282082, "uuid": "b133516a-636a-4ad2-9d8d-16b0184f94bc", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282082, "uuid": "d364848f-d9f1-46ff-ae11-ff3bfaa8d2b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282082, "uuid": "4e3375d8-0b68-4498-9e5e-076c85237752", "value": "1AIxISNpa3JnH3C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e2992b-2ad5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690280541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280541, "uuid": "08ebee3c-9038-48d3-b6b4-dbfcbf1375a4", "comment": "Malware payload (Amadey)", "value": "721cdf94a8e81b489d510d66052c869e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280541, "uuid": "d93b528a-c6ba-457a-aadf-97f6fb574c53", "comment": "Malware payload (Amadey)", "value": "53ecffef24ddea22780ff63e0224bd9c1bf9d8533760949fff138bd5c432ce36", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280541, "uuid": "76a68470-b832-4800-9ad3-95c92d9aaaaa", "comment": "Malware payload (Amadey)", "value": "57c76085e66f4dabbcd3a06f782688f323722642", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280541, "uuid": "16ca5be2-d13a-4b76-b3cd-3d50cd591051", "comment": "Malware payload (Amadey)", "value": "37b83bf3ea53daa2ca3384f2bc569114c59b22c37b3637833a383bc31b4da87f7dba4a2dcfa4852ce7838c20c7113554", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280541, "uuid": "4b184c58-3931-49f8-9a1a-42ab04cce912", "value": "T10284022BBBD95032D9F25B7058F602C30B367DA28DB4832B2B45996E1DB32C5A531377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280541, "uuid": "057fdb15-9a66-4dcb-acfd-6e87dbbc69ac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280541, "uuid": "bcb03c6b-ca73-44ad-9f23-540f4d98a60d", "value": "12288:nMr8y905KXq38E0oTFiMibgBYCU4tRuvk:fyUKO8Ku0zjfgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280541, "uuid": "dcfff4b7-a7c8-4a75-8b75-435d88b403d0", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280541, "uuid": "7c9dd460-1745-43d1-93f4-075b2658d85b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280541, "uuid": "fa4ad736-fdb2-4731-9a1c-ee3f4d84cf45", "value": "53ecffef24ddea22780ff63e0224bd9c1bf9d85337609.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c09ee7d-2aeb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290165, "uuid": "dbc346a8-741a-4b67-b607-d8eddce627bb", "comment": "Malware payload (Amadey)", "value": "279d33c6bc3c597a48c6625ba1fdefd8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290165, "uuid": "620c8a06-99d2-4574-b77a-28c25ed57d01", "comment": "Malware payload (Amadey)", "value": "54a19d5a7a4bbca3496b0edc5d80a240350e944513622d242341964e048d96d8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290165, "uuid": "da49f483-b540-436b-b4cd-dbdceb749cca", "comment": "Malware payload (Amadey)", "value": "0a1d3a2795b88a0071665bb3e9d0f48c0f0ed3a5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290165, "uuid": "2c0d2b05-9919-4fb0-b381-7ad30c418c22", "comment": "Malware payload (Amadey)", "value": "991d05c722b59bcf9187fbb0175ffacd4dfb12b4b7d301ce8d4dc0e10eba3592d8425148f24611c937a816e0b1b8f57c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290165, "uuid": "a4950d6d-765f-43f4-818b-c6a1b72e243f", "value": "T170840213B7E88576CDB41BB018F603C30F367DA19D74936B2345A99A2CB36D0A47276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290165, "uuid": "fa17d9d3-4da9-46da-b269-41cbeae78546", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290165, "uuid": "a37c7cd3-1e11-4766-8a18-b47b50647ea8", "value": "6144:KZy+bnr+Ep0yN90QEJvmjdAmWMjgJZqWh93SUE/LUa1zmAX0TbUf/sduk:XMrsy90nmjdAmVjgDv3SUyDCYfcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290165, "uuid": "0de6140e-0cd0-4c2e-a19d-6a4f57b1c593", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290165, "uuid": "7ef680ee-4c86-4b55-878a-f043e02edac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290165, "uuid": "0339000f-533a-4d7d-b825-3b40abfb4486", "value": "279d33c6bc3c597a48c6625ba1fdefd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d13e12a-2b19-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690309762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309762, "uuid": "1b94c6a3-c249-4588-9d92-5a1f86508648", "comment": "Malware payload", "value": "d11b83aea702726ed5a7a618addf2903", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309762, "uuid": "6da4807a-c5b3-449f-9b88-d1dc9ac55732", "comment": "Malware payload", "value": "5531ff2bb97c0131856425e055856c1873b25f72467490b2804d214fb92130a0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309762, "uuid": "c1c831c1-a7e9-482d-9d3a-a9aece12014e", "comment": "Malware payload", "value": "be23876b80ccd9e92605b516d72bd6110fb7af57", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309762, "uuid": "aa347fbe-2005-4b1e-a87a-d50b64567d1d", "comment": "Malware payload", "value": "28fbffd90887bacddb17902bafced9bb52f9bc5a9e9c17063766b62edb431af4bd8a7284a269a34683e230fe68dd69a2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309762, "uuid": "7724ba3b-5304-41b4-8897-036f568e58bf", "value": "T1C6F5C8E611C13FDFC05ADE7A8642FA6E9B9FB47A4125A4A3B0EB65325837C047D20F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309762, "uuid": "98213f23-9b06-43e2-ab8b-72969cad7cbb", "value": "7e60c38086d25d57354ecdf04c4b17ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309762, "uuid": "24d6fac8-aa26-40ca-97b2-68c1622b747e", "value": "24576:T+y61lMqvsZ1mLrYOHJXzdJegqu8BQoHTjGaGrZIzwS/rFkiL8bz+Jw+:T+y6I9edJ9qu8moH+xNSJJ1LKz+J3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309762, "uuid": "8a9d62c1-661f-4527-8c73-03df08a748fe", "value": 3358072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309762, "uuid": "7c984d84-1aa3-4c29-be78-abc81b1cdf27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309762, "uuid": "33bff426-1ce6-4af3-a4e6-31ddc562f362", "value": "d11b83aea702726ed5a7a618addf2903.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e4589af-2ae2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1690286195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690286195, "uuid": "925391b2-307f-4246-9dd5-c70e3b4e5621", "comment": "Malware payload (StrelaStealer)", "value": "a224e5df6994893f3d4fa286089429fc", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690286195, "uuid": "400f7271-3c1c-4d45-bfe8-4a32b754e670", "comment": "Malware payload (StrelaStealer)", "value": "55599a55b0579a1f3155ae2ec5f3fac350987cf7617f8edfc189af715f74b1be", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690286195, "uuid": "5badd791-9eed-4acf-9f47-cc6acd38332a", "comment": "Malware payload (StrelaStealer)", "value": "910cc2502f87bcaeae4dad695a6b29f2d5923743", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690286195, "uuid": "3331140c-78ac-4bf9-8ab0-3582300b9876", "comment": "Malware payload (StrelaStealer)", "value": "710c3c65db1dd1b773a3c8dd6b2414d647ed961e546502c8937f4799661ea166eeb59bedb548cd4ad6adad88abe15e08", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690286195, "uuid": "3a6a4a91-4c0f-4579-9ad6-9fda48f15c4a", "value": "T1BFA48EB096C577C70FB62908B69FC1F12C48B643B4A89B4E27E4056D57901E4CABBDF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690286195, "uuid": "512da63e-a6c4-49eb-8805-8b1cec7ad6c8", "value": "6144:J1E6J/ieNB0Bu3vKz0LHvhKwqnhwSwMKOacwiJcLrJytU9IP:o6JK20avo0rhgWS1Kh5iJcLrJgOIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690286195, "uuid": "d2a8c6e1-fa36-4faa-8fce-8721d16afb0e", "value": 480236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690286195, "uuid": "336102ca-18da-4223-8bb7-8c56ca998752", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690286195, "uuid": "530c185c-1e55-48a1-b3c9-5e5fd92839d5", "value": "PDF1986294715967.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825e37dc-2b44-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690328374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328374, "uuid": "9a6ef796-f261-4e75-b7af-b47e0c01c89c", "comment": "Malware payload", "value": "f597d74b84929ded948fc42c6f6210e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HelloKitty", "colour": "#BDEE1B", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "ViceSociety", "colour": "#E4580F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328374, "uuid": "b4fe1f6f-2ad0-4af7-b3d3-352b269d3c08", "comment": "Malware payload", "value": "556e5cb5e4e77678110961c8d9260a726a363e00bf8d278e5302cb4bfccc3eed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HelloKitty", "colour": "#BDEE1B", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "ViceSociety", "colour": "#E4580F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328374, "uuid": "b76d9d44-7ee3-4050-acbf-1fdc170965e5", "comment": "Malware payload", "value": "ce84c75b28f7cde633db0076309c45683029efdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HelloKitty", "colour": "#BDEE1B", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "ViceSociety", "colour": "#E4580F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328374, "uuid": "3e8f2d7b-0d13-4563-b1ec-ea7bf736fc97", "comment": "Malware payload", "value": "96f1a231f899192ce3b484ec2bf55363d4019a80d79d2cf1a78e32cbb2b8c75d3bfe4baaabfc3016f7031fb3ce7d8733", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HelloKitty", "colour": "#BDEE1B", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "ViceSociety", "colour": "#E4580F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328374, "uuid": "7dd3f7ff-f93c-4490-9114-dbdb818b928e", "value": "T159834BCEF4E678BCD696C531CC4B29B22456F2588AF26C7F2680F77839162400E3ED65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328374, "uuid": "f9e01142-be44-4b16-94e4-32267168d9ab", "value": "768:MxHWw88+bmkfRk9gqzCM0CiRgQTcF7onjj7ef/6+e2YahXG+cwuX+9KPlL0+HjMv:MNWJbffRzqzJi3e1Nx+o5V4+nFSDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690328374, "uuid": "01989239-a4f0-4a4b-bf21-0b5ed23d4c63", "value": 82384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690328374, "uuid": "2a71a653-89ed-4bc2-9a92-6612f7f25afc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328374, "uuid": "1b6dbc8f-2fa3-4565-add0-7a26c9e2ff7e", "value": "556e5cb5e4e77678110961c8d9260a726a363e00bf8d278e5302cb4bfccc3eed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04443c67-2b15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690307976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307976, "uuid": "b313f160-0f54-4b90-990a-f31a0a415078", "comment": "Malware payload (AgentTesla)", "value": "5b48256f7492a6f835d462d700719eab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307976, "uuid": "807e4b5a-8f7f-4855-a9b1-6c7a6ed24108", "comment": "Malware payload (AgentTesla)", "value": "55f47949fa46a7652f50e310846d3a98711dd942ce021cbf68f57bf69e858d2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307976, "uuid": "a9400ba4-99d9-4be8-8e4f-976a7d790f26", "comment": "Malware payload (AgentTesla)", "value": "31308aa331c824e3b0e3eb4195bab277cc0a7165", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307976, "uuid": "96b5be1e-cec6-4673-b899-1d52ee85b235", "comment": "Malware payload (AgentTesla)", "value": "915d45b7776e21b06d039d2285d4ef113665e3acb345564f84d355829f053d034b71947233d8b316d903bb1e9879ebb0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307976, "uuid": "0ae4fddd-3acf-488a-ae32-21149ee94de4", "value": "T1E4D4E5013EEF500876B3BE895BE954984F7B75620E3EC449304E160E17EBD90EDA1F6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307976, "uuid": "2355e735-d46f-4610-a328-8ecbf9209d9d", "value": "6144:Zn+2Mxzak5pA0BflUXjnlIzzy0Vx1ZsMqhw:JMxzak5pA0BflUXjnlIny0Vx1ZsMqhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307976, "uuid": "d9573d44-332a-4d08-8f91-c9f4722ea549", "value": 638374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307976, "uuid": "3cafddc4-edea-4ecc-8959-ae9e7f85240b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307976, "uuid": "7ac7558a-1559-46f6-9bde-bb6c925ad262", "value": "DC9089432.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a457b13f-2b0e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690305238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690305238, "uuid": "54f31c36-ae0d-49e8-90bc-190f30423255", "comment": "Malware payload (RedLineStealer)", "value": "c6be5cd9399c44a91240ef3a20fa0217", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690305238, "uuid": "b513e798-4757-4de1-8807-cfe30046207f", "comment": "Malware payload (RedLineStealer)", "value": "562dc490399f1012586e940debe3752d422fe4ce76676f5d7746ca5ba1dc96ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690305238, "uuid": "445c67ba-d894-4755-97b4-841f6ef03b28", "comment": "Malware payload (RedLineStealer)", "value": "21de3109c9bcd343500d02d4451a2c9eb9bc4f5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690305238, "uuid": "0ceb7eaf-b5eb-46e3-bed4-e54dc021de49", "comment": "Malware payload (RedLineStealer)", "value": "a7fe4092278fe5e65d0ddc738f74f8db59ce8e2b3e6c518c4c60b902a0aeaeae486539c08399335fa5ef9c8dadea0ddb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690305238, "uuid": "5670e767-14e6-4b7b-8dca-6cce83ff251d", "value": "T165159E6139C18172DDE210BB46ECB924C27DD7B00F27CAC756C857EEDA20AD17B3598A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690305238, "uuid": "763a21ee-6a3f-491a-852b-af960a2c2769", "value": "99618c39aafbf01419fbcd53cea0e110", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690305238, "uuid": "945d6104-5f2a-4b5c-92b0-291e9f30a4b3", "value": "12288:seUIkhpIPoS5PMZ677sK0wupXmzrgSyszQuU2asbRduzze6bysYnma5d:rUvhpIAS5PMZ6cgQuU2hRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690305238, "uuid": "50307e2b-944e-4ca1-a320-09093887021d", "value": 945664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690305238, "uuid": "3f7d4d8e-e58c-42a0-b974-7833f06b3d5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690305238, "uuid": "769a2a82-60e0-47fc-b51c-8ed694b12282", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2005b96b-2aa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690258201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258201, "uuid": "9dd698a2-1cfb-4980-b323-3c6e97690d2f", "comment": "Malware payload (AgentTesla)", "value": "60946f42e3a48cc81ce831da555443e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258201, "uuid": "475ae4d6-09cf-4b9c-959a-3b162cd4a5ba", "comment": "Malware payload (AgentTesla)", "value": "5764353e2fff82abee68ba0302929bb871ec75ee9416628de2f2ea6cd3eab52e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258201, "uuid": "457efca2-00b8-47bd-bd4f-6a4263021b48", "comment": "Malware payload (AgentTesla)", "value": "86ffc1cf7b3a6795e10ee1952c0808052ca2249a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258201, "uuid": "7500a4dc-9ec1-427c-bd2c-7731af94981a", "comment": "Malware payload (AgentTesla)", "value": "f821b417c08efdbf9d7d17b227041b3cc6f81361793f18ca6ee4631deceb06d97d92337ec210897972c651515f5662e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258201, "uuid": "cee85471-f726-43f1-89b1-eac28bce94b1", "value": "T1BA74F19173679E7ACA2159364137526D9130DF8A3D62D383276BB2EBAD322C560C1FC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258201, "uuid": "48d7ad16-cd87-4015-8999-68913c174d02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258201, "uuid": "ed84526f-63ba-4dbc-99da-f65898f40819", "value": "6144:XwFQbPUS/AloVyhDz0iCW7my0a+yRrHjl4oFgZGbpYByPT7lyvIc7SIvF680:XOSoj3ptRrDa5vByPHly52Ivk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258201, "uuid": "1771bf05-86d6-4844-b507-c8e7ac305a2b", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258201, "uuid": "089efcde-b14b-43ee-8957-52bfc256a39f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258201, "uuid": "94f31644-0716-465d-b19a-88b299ba6b60", "value": "60946f42e3a48cc81ce831da555443e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20eea994-2b37-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690322627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322627, "uuid": "46fef448-d88a-4671-87b5-4425c65f602d", "comment": "Malware payload (Mirai)", "value": "4b7f74eacb460937670146b6f753fed5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322627, "uuid": "2845663a-413c-4fbd-aa7e-ff5cb823bf81", "comment": "Malware payload (Mirai)", "value": "58724d2dd315f0223d8823163f20140685e4665a483554a9de72b1bd4b6c3374", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322627, "uuid": "6e8e40bb-42d1-42a1-b05d-21dc3e06c989", "comment": "Malware payload (Mirai)", "value": "c2d9bb7be278969cc2e272e05ada37c2e113f31c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322627, "uuid": "942b0f2e-0ab6-4de0-8c97-d592ea44b100", "comment": "Malware payload (Mirai)", "value": "b8149c0724d8759639f0ae604af3eec3b0e672e917b51a9dca8d90014659c4271854aba54883e73b61a962c458c6d96a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322627, "uuid": "b09d3268-657f-487f-a082-867a5f5e025f", "value": "T11FF2F1C661B80318E27F61350DDF671E5990F117F3544D6BE588A7860E66B283E393A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322627, "uuid": "b26a9948-800f-4c87-995d-0fd231bd416d", "value": "768:Zg2a8C7J9ANnDuiBgENvjQiLKsx8CBZni0a9sJUyQO5a9nbcuyD7Uxyqu:q2a/09J0iRxhB9ba9yLa9nouy8Yqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690322627, "uuid": "78e107fd-6ab3-4d74-8c11-691e142feb86", "value": 36064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690322627, "uuid": "0b3d1a65-eeb0-41c3-8fae-87ea01bdc689", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322627, "uuid": "933e6a77-e890-4cd9-88b8-9e9d09a670d9", "value": "4b7f74eacb460937670146b6f753fed5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31dddb60-2aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690268968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268968, "uuid": "e90f83c9-0aab-4d75-9f57-a8fddebd696a", "comment": "Malware payload", "value": "b3ba6ab99406675c89ef9e56a99eacde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268968, "uuid": "3b808569-838a-48d7-aadd-502b09c689b5", "comment": "Malware payload", "value": "5886e2dc879786f2a6f6532079a1b2b227d9e8b8eaf0834b3d8da19d8acad8c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268968, "uuid": "1578573b-65cd-4cab-8769-ac339455f1a9", "comment": "Malware payload", "value": "8574650f9dc06307c2bdef8010a7232bc04811ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268968, "uuid": "2920c585-2b1a-4934-839d-f11f89690d20", "comment": "Malware payload", "value": "13109798fbfec71fef035c5381c7754975552323c1b5aedef304fe155f6279b5016df99cadcf8cd61f8f6772f13de0ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268968, "uuid": "69caee05-46cc-4ede-ab86-69dee39f5b3d", "value": "T12CA68D42BA041FE9CA944D3385B34AA03B726D546F319742A704F67EBDB23491F46FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268968, "uuid": "46dc811b-f9aa-4d88-bef1-d75274e6c183", "value": "196608:oVPHs4mkPSxpAIbHRrWWMkEiWz0MyZqV9me:oVPHs4mk1OrldbXqV9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268968, "uuid": "88e3955e-549f-4bc5-9a44-a483b119719c", "value": 9643057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268968, "uuid": "df4e26b3-fe95-401e-a6ed-b2f53eb45445", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268968, "uuid": "a09cad7e-af17-4a9a-89aa-847453ef3ab3", "value": "b3ba6ab99406675c89ef9e56a99eacde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c66dc1a-2abc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1690270006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270006, "uuid": "a98fbacd-c725-47a1-acc6-af6487473da0", "comment": "Malware payload (IcedID)", "value": "d9765495d7cedcadac21fdfa5d4355ab", "object_relation": "md5", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270006, "uuid": "e1897a3b-0c9b-44df-8b9b-244c359b518e", "comment": "Malware payload (IcedID)", "value": "595349f2bee834c22d2fce1f640d6fd089df862daafeaeb388bc2f1b79b53002", "object_relation": "sha256", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270006, "uuid": "9533f7d7-dd8a-4a59-82a2-1a815f09c8dc", "comment": "Malware payload (IcedID)", "value": "b42e39beb04f4b02a83a300e7d7567e7ce9388ef", "object_relation": "sha1", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270006, "uuid": "2f44d56c-daf8-4a7d-a598-f35ad6172d15", "comment": "Malware payload (IcedID)", "value": "0a28c50c0e1f4fee384e3ff2d1d741e077ea93c34e6bd47058e0fe6a66458e1e385aa302e1653c88bf592e9202bcc93d", "object_relation": "sha3-384", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270006, "uuid": "6bcdabaf-77ed-4bff-8170-76ddb02bff83", "value": "T108A425C6BA56F8F9CBF3C076E45123363D0DF9D144A09E724761C3BA6C24818A86EDB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270006, "uuid": "592b803b-8bc8-413d-b675-d10696f31264", "value": "06f25df4360c0ab9ee30cbac816de0f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270006, "uuid": "e4a59a60-8705-4501-bd6f-963140e79c1f", "value": "6144:SWuzrM1ukesfTqAYVTuFOBTfh3SVOFJzlBSFHds79zAADpgSHK6BdunGa:S3zwukBCiFel3tFJz6DeDpgSHKUMnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270006, "uuid": "b07e2871-4374-47c3-8cc0-72327eaf25e3", "value": 458416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270006, "uuid": "e58844f0-0097-4025-9794-55fd837da229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270006, "uuid": "6bb474e3-0140-47d4-8afa-e2dda51b7c05", "value": "INV-Details-JUL2023(124).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4299fef-2b15-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690308271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308271, "uuid": "c5a1201c-18a7-42ef-9998-381a81e092a4", "comment": "Malware payload", "value": "4debff87b4c5cba4741ad8c75f49d49a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308271, "uuid": "b98d4922-463a-454f-b1d0-86c16fe7e95e", "comment": "Malware payload", "value": "5972c9880760bf0610b24a7ecf8686039193b145b5a5a7e0a51777eba4e23673", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308271, "uuid": "eea3c036-009e-4f40-ba5f-a02ddce14a07", "comment": "Malware payload", "value": "8700b8ef87e5bb4243c2810cc93ac8125965350a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308271, "uuid": "c256026a-cd83-4b3c-a9a8-6b23415a209f", "comment": "Malware payload", "value": "126215e55b310967202344f50700b0db7b405d792b573bdb42376e11d1724166b5d6a062206389bbafde6a4834f4699b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308271, "uuid": "4d0f4dc6-c551-40db-add3-f06d1a8b177a", "value": "T14131AC2027F21308D6B6CB39E8FE73118676B865D9115FDE124186545863212FDA6F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308271, "uuid": "1e26f0d6-536d-4dd3-a801-58d049c05ac2", "value": "24:8uqGZJ5tS0W+JKmWa/qY/A1Wkp+/CWP2+/CopAM/psBkWbtsfnMxjs4VXpACCabI:8uhZJ7SfaaR0uMRsBTts/Us4teaZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308271, "uuid": "8ee76ca8-96f4-44f1-a269-2148dabc6761", "value": 1621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308271, "uuid": "3b9dbfa8-c9fa-42f4-acd7-7e282ece29ae", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308271, "uuid": "0b2f2ee0-8e76-4f41-8b21-8267456701a0", "value": "resume.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f03f65-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690282130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282130, "uuid": "54712e1f-028a-423c-a56e-c22142b2d613", "comment": "Malware payload (AgentTesla)", "value": "bce591d34f951021d649f655106c1724", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282130, "uuid": "b200dfe8-9125-4c10-aa5e-5018f37a9894", "comment": "Malware payload (AgentTesla)", "value": "598ebcfd70979792ac2c51a66868540c1b55883a325ea593e8195fe56b5da563", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282130, "uuid": "8c875842-272c-40c8-a88b-b3d7a83b7554", "comment": "Malware payload (AgentTesla)", "value": "257f0af5913988e5374141cca42d7c054fbea2bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282130, "uuid": "d0d8bf60-6eef-46c1-8409-abbf58c4cd9d", "comment": "Malware payload (AgentTesla)", "value": "fa03bcf1bbb7a473715613188e6a796fe714ab5afcae77cd46dbba62c83ccdba8e8afa704670a62c040ec7fcd5d3c3d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282130, "uuid": "d2897b78-2974-4c22-a86e-8ea8577674af", "value": "T153C4CF38103C87AFEB87DB76E434129222F013A66AF297DCCC7A605F7E75138A1546B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282130, "uuid": "77adb88e-bf99-4442-b324-416a829e0802", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282130, "uuid": "8b1a7bd4-a0df-489c-9934-b0c9db81f8d7", "value": "12288:gqTrQaSejL8ZzhcfTm48ngk0Sgm05kQoiHld9BUOuPdxZu5T9h6nL:gqTrQaSejL8Zi/cgmAk4HlnuOuA5T9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282130, "uuid": "72113716-862c-4adb-aa1e-38623492b5ef", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282130, "uuid": "6f1ce708-0eb2-4594-aece-cf5259dc99f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282130, "uuid": "f7d9cf20-b1e8-42b6-89c7-40107f78f5ee", "value": "Repeat Order Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723b02b8-2b14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690307731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307731, "uuid": "161604f4-711c-4ee4-a274-7094cb9fd020", "comment": "Malware payload (Formbook)", "value": "84f07ee8de17f42aa5ffeb7018112021", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307731, "uuid": "f209b8b6-d2c8-4f92-a03a-d01e30db33d2", "comment": "Malware payload (Formbook)", "value": "59e0a97082a7acedbc4f01fb46cab4050cbfab1061b90c23aff41d67c189fbe3", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307731, "uuid": "ef1cd5c2-5f79-4763-8384-e0fb245e5a9d", "comment": "Malware payload (Formbook)", "value": "c9af52b3d7a93b2cbbcfb540ee92755986bf8601", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307731, "uuid": "ffdaf2d3-0d42-49f6-9e07-93f408c19dcd", "comment": "Malware payload (Formbook)", "value": "b839ce62e3fa315cb4c4d58c6e42a2fac8793e70473dcd38eee315e05521425298f587747cfc8aa94fa22cafa11bbfde", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307731, "uuid": "efd0dc51-1072-49ff-8757-4a4c9217cecc", "value": "T15F75F113A8149FA3C51C87F4BE630DD94F2A7F09E8957DDB00123F8B3A35B62599A21D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307731, "uuid": "c6d1eb4d-eb2b-4e10-ae67-af25549b6951", "value": "24576:qou9VNZyOw6VtjZy4w6VqViNhuuvvtH3oqVUbXQwNgZffsLMy5w2x:qouP+6Vtlo6VCiNhv3tXMXXNhLr5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307731, "uuid": "bc043c3d-7187-45b2-b6d0-29ab5a22bbf9", "value": 1623040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307731, "uuid": "b545f046-2c42-46dd-884e-8902e8be5dcd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307731, "uuid": "c09f80b2-8b5c-4e63-bbfb-f26223fda5d9", "value": "P0_6978654675856464.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5b0b3f-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1690296935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296935, "uuid": "f1ec6e5f-d9e8-4956-93c2-07c56974c0c6", "comment": "Malware payload (AsyncRAT)", "value": "a24679577c8348470f53ffe030567003", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296935, "uuid": "3d214277-5e02-4fcb-8f84-eefa89c7be36", "comment": "Malware payload (AsyncRAT)", "value": "5a0fb0a46a2dffb2974aa1341993c09342d29ffd08240793142e4c929c614e47", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296935, "uuid": "0437a000-cc30-47dc-bb3d-1d4fcf340bfd", "comment": "Malware payload (AsyncRAT)", "value": "f809aaece8ce15e7799d93e85f5abe070c72dca9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296935, "uuid": "6a41c897-848a-4b4c-9f57-90afb64d8dbb", "comment": "Malware payload (AsyncRAT)", "value": "5676c8d618a694ea6d6b22fdfa557c7cce29c46ee9178f0f1aaedea4fb2c4877335e6f023054c25bef3310d5007d2919", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296935, "uuid": "077c84db-3f1e-450a-85e9-d0893d20dd8b", "value": "T185231B103BE8812BF2BE4F78A9F22145467AF2637603D5492CC452DB5713FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296935, "uuid": "0c41985b-f7f8-4319-b346-27eec86db77f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296935, "uuid": "4d4dc992-9deb-4922-a841-be69f75594bb", "value": "768:bu439TskvpDWUPANxmo2qbPKjGKG6PIyzjbFgX3iHxEb0CF8yBDZ3x:bu439TswI2uKYDy3bCXSHElFxd3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296935, "uuid": "391f791d-c5e4-48bc-b7f6-14ea14b8ae6c", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296935, "uuid": "1170559a-7079-4adc-ac74-a9a2e821d195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296935, "uuid": "4bff63f3-bd68-462c-9687-fb078e166012", "value": "a24679577c8348470f53ffe030567003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be70b1db-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690282089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282089, "uuid": "e189468a-5f98-49c7-b5d7-9ea36ad7a9be", "comment": "Malware payload (SnakeKeylogger)", "value": "a2fcf76133dfa226e583288a17b9e76b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282089, "uuid": "1a0725f2-53f1-4aaf-abe7-618479eff70e", "comment": "Malware payload (SnakeKeylogger)", "value": "5a1216bc81f899b1267e4cb591f9aea37db44627189cf48e84b5e297c751e095", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282089, "uuid": "da86b1b3-7df1-4201-aeb5-776986fd17e8", "comment": "Malware payload (SnakeKeylogger)", "value": "a969b0c38a68e44ffe2e95b376c6ce83ff35c858", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282089, "uuid": "abeb5772-a7aa-4210-9c36-48cbd4dc6abb", "comment": "Malware payload (SnakeKeylogger)", "value": "79fddae61cc48163defcb9b73929b9f6bece48b146b75bb8b498f494f8a5c3c7323a037d20205c67b316bd1996f01b33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282089, "uuid": "a37a27b2-deb3-4633-9748-8b6cb68fa0c6", "value": "T125D3191D2BF88840E5FF8A7705B15212C776BC52192ACE0D5AD2F5192B3D7908E0BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282089, "uuid": "4c46f058-b973-40cc-9f56-8e3974fb9d81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282089, "uuid": "ec9011af-3dec-473c-b79e-2ebce84c7163", "value": "3072:tAgAEAb97xI5H3Ewx3Mob8F8QRwBHOmFbY:GNcXCob+8bOib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282089, "uuid": "1376fbc0-14bd-4b30-9b0c-11b152ac1e1a", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282089, "uuid": "bcd34b94-6bb1-42e6-ba05-f224586ace32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282089, "uuid": "ddce94ba-9631-45ca-9248-9f9ecb2794fd", "value": "5a1216bc81f899b1267e4cb591f9aea37db44627189cf48e84b5e297c751e095", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0a12b1-2abd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690270408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270408, "uuid": "022f9632-8900-4807-ba30-ca21b0d5e20c", "comment": "Malware payload (Formbook)", "value": "3a6af6f443e1f0f35975ab0ec89b215c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270408, "uuid": "5fcf03a0-df3c-4c09-855f-eb8d8276e64f", "comment": "Malware payload (Formbook)", "value": "5a9431c130db37dc5f76a82fa584562fc497ba8d42101136f8a5bfbe257d0f37", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270408, "uuid": "af806b48-89eb-4b9f-90dc-1c04c53d09f9", "comment": "Malware payload (Formbook)", "value": "4147afd65056470534132aecbe1aaa67d8b90268", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270408, "uuid": "b077efde-6c8b-40e3-a629-8b54bd4ddefe", "comment": "Malware payload (Formbook)", "value": "d3fcc70839bd77d21ea08620248900e68727b982759e328df3eceeff050a936317cef2fdd966b7f8375b334fa993c59e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270408, "uuid": "0db9ea0c-2e40-43f4-a80d-1f3e9772f96a", "value": "T10DC4230B867A158654ADE6BC100BE0FEFCA0E4F22E4659028454B6FE2548BFC57D8C6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270408, "uuid": "9947042f-e557-4de1-8980-305a4a1e113a", "value": "12288:PG9xU+nPPgGnqgQxuHdpm7BxNUApjQzT8LYj:PE5g9gQUzSjyzYL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270408, "uuid": "01e8e51d-ae9b-4369-9e7f-88461d62cc13", "value": 572693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270408, "uuid": "2f1838d6-84b0-48bc-b425-32bfb37dcbb6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270408, "uuid": "95f713fd-d0c2-4e36-b1c2-58c8c9e6417c", "value": "QTN74895.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0fc799-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268587, "uuid": "45346c10-d3bc-4465-b235-5f8ab9113618", "comment": "Malware payload (Amadey)", "value": "be27f3a93fd10aed3b8996b5de663801", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268587, "uuid": "e026f259-2c99-44f1-ae39-09c385e2e092", "comment": "Malware payload (Amadey)", "value": "5b6b2c0a1610ca14b4f04df7fbe9e244966e79d261c620480d988de14d92829f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268587, "uuid": "5a06bbf4-5202-4085-af68-f41da629cefb", "comment": "Malware payload (Amadey)", "value": "445c81cc0ef0076c05c9033b064091cf455c4e84", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268587, "uuid": "3f75ccda-3d8e-489c-86bb-2b3f8e21748e", "comment": "Malware payload (Amadey)", "value": "d17c27b1f3af7d5cfb7d1f216d9e25bcbcba8489518c1d5c51448c9eb61a700b464d743935c355664171a743338bcad8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268587, "uuid": "2281a1bf-ab76-408d-bdb9-fa3caa2b0631", "value": "T14F84F103E7E44133DEB12BB458FB03871A35BCA15978875B2785AC5E1CB26D0A63277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268587, "uuid": "4dd07b53-f0ef-44e7-bf3b-ee685177b43b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268587, "uuid": "98be5c36-cc27-4d2c-a765-11a0261619e7", "value": "6144:Kyy+bnr+Zp0yN90QEzj9i/75pzOB0KjczAegDZOI0+zVgVwxixC93cybE:OMrpy90Rg/TKcUwI0WjM4xcybE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268587, "uuid": "e203954c-3ce5-4d01-9680-ffa7c3482249", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268587, "uuid": "df18adf1-ee48-45fb-a8ac-9c9474e84179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268587, "uuid": "bc6606a7-6061-479f-a0c7-3376c112b1c0", "value": "be27f3a93fd10aed3b8996b5de663801.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf35020a-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1690273929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273929, "uuid": "0501ec28-70af-4b54-89af-e452a8334c9a", "comment": "Malware payload (AZORult)", "value": "ac469ddca85db41e87fad78c06073709", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273929, "uuid": "fd4a7634-c1f5-4ab4-91c8-ee7cebea7071", "comment": "Malware payload (AZORult)", "value": "5b7ef066a16a8f2855bfcfe404acd8cb34cecfb20fbf6534f87931bd811063a1", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273929, "uuid": "e8009ef0-f859-48e0-82ef-6369df559106", "comment": "Malware payload (AZORult)", "value": "3a2abb122f5af495f1c2c021306f33425d5a053a", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273929, "uuid": "7141947a-3087-418a-a683-140efe7f7128", "comment": "Malware payload (AZORult)", "value": "340287c21c6ca242db83177d97daebbe11e8b589136adfcfd552edda9fc9163de206af368684a3d03d86578973da91dd", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273929, "uuid": "870f6e83-af99-457f-92e5-0bce5487fe16", "value": "T1EC865B167289B016D0661A370D2FE696643A7E703F25DD6B3BA82B4C4E7DF40FA16307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273929, "uuid": "95a7e3ec-839b-4b28-89da-a8168927a308", "value": "1c3dd32535aee3c5a539d7ac497c828f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273929, "uuid": "9016c6bf-1a75-4ebb-8af4-6d76b2236ab2", "value": "196608:ZC3Vxe0O0xv4Fp04GbDGDThBgaunj/5AgtNL8Kyk3:ZC3VxBDGDTb6D5AgtNL8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273929, "uuid": "89a28f98-5fb5-4470-b0f2-c26111582bf8", "value": 8326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273929, "uuid": "79a2b9bb-8884-4597-bdfb-82a5e697a752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273929, "uuid": "ce8b0030-6540-448c-b475-e1b1558a453d", "value": "SecuriteInfo.com.HEUR.Trojan.Win32.Inject.gen.17957.25792", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee9bd2e-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690280237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280237, "uuid": "99cdd528-61b0-4b7b-912d-ff2dee977a3d", "comment": "Malware payload (RedLineStealer)", "value": "fc66082e5c52515ad070d09746d6846d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280237, "uuid": "cf9bd89d-6ff7-4b5a-a240-1df0a5292a62", "comment": "Malware payload (RedLineStealer)", "value": "5b8f95a596a6a8fb01b91837828548c39577d0378b8ad75ee4cedd149d288937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280237, "uuid": "ca5dc2a4-dc4b-46a7-a2e1-2a0460d5bc3d", "comment": "Malware payload (RedLineStealer)", "value": "28af2627223e2960b43b5801dd7768c867ebbc80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280237, "uuid": "9c791152-d11c-497b-8c27-7d3b2fedc757", "comment": "Malware payload (RedLineStealer)", "value": "8c5e60d0024acb869c53f8a04b9cb991cc2ae22d4c4a175c3701c96d18e8a21f69adebca5bddb44ebbf8aea048f703c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280237, "uuid": "64984857-cb2d-4d70-8573-5351b74ce47a", "value": "T14A840203E7E99032DEB11B7058F6038319357DA1AD38836B2796985B0D72BD4E67633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280237, "uuid": "42b9d104-8dda-4b13-b478-114543bee99c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280237, "uuid": "a3c6ea04-8f2e-4099-a5cf-c76d8411237b", "value": "12288:YMrQy90fQjqiYI/eGjytyGSFTgBYC5ASj1NgD777w1uGd:IyshiYweMyDz7JNQ7Q1uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280237, "uuid": "edb6fff0-6232-4c40-806f-a63a5ff70869", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280237, "uuid": "6ee94f48-c846-4b39-bb5f-3b5198d42da5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280237, "uuid": "449edb37-b26c-4a21-8de0-b2893bfb0cf2", "value": "fc66082e5c52515ad070d09746d6846d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37cfc729-2aa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690258240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258240, "uuid": "f000681c-d8cc-4efe-ad8b-ccbfe625c6b6", "comment": "Malware payload (AgentTesla)", "value": "69a99c9b3bff7c4f1ee808ea5b2bb2c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258240, "uuid": "00b022d0-f10b-4510-8a01-53a8060c6be0", "comment": "Malware payload (AgentTesla)", "value": "5c6ec17d071914d391a3566bb945ff2307bc36092d3666dc0aef1ef85210df43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258240, "uuid": "559b7a29-5f6f-4af5-8839-c94532ed358d", "comment": "Malware payload (AgentTesla)", "value": "c09e2e86f4365f470d0f87fedef5f38e5cf53654", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258240, "uuid": "f98a241a-3738-4e39-a8bd-db6052411492", "comment": "Malware payload (AgentTesla)", "value": "c8238d2909cc16430c03ed516cf114e13b27b4daaad71b28a7a32a5d03289902a2c7953f7b6be46a3b357630a5380c8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258240, "uuid": "9d3b01b2-ea57-48ee-8d0d-4fbe7582de71", "value": "T19F941A382D524730E07F56B8E65B3E1B3614FEAB6460D61535B63E0B3B5A213B4F2329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258240, "uuid": "2603fec0-ab1d-4d11-bbac-a2aaef40ee68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258240, "uuid": "71836a6b-9442-477a-b5dd-5b9944a4df2e", "value": "6144:Fca2FXbisx0wQUut1rms4sfJWG0VZ5o3J+mCkW3Dy7Fx3+8+I3Dfv+mdQzHAbx:FOOsiUEpms4sfJWZ/+Zz8Dyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258240, "uuid": "9768f812-396f-4d29-9c8e-c3dddf0532fb", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258240, "uuid": "3cc5360b-cfb1-4d36-bd0a-d1635d71f51e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258240, "uuid": "66538c61-1220-4ad3-82c4-884f434a90c4", "value": "69a99c9b3bff7c4f1ee808ea5b2bb2c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ddc0e57-2aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690269122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269122, "uuid": "a5f37f6e-e410-4ead-97cb-aecbad5532f9", "comment": "Malware payload (Amadey)", "value": "e66a804951096a208eb3248b10470a69", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269122, "uuid": "732c0ec1-f11a-4cb9-b955-589456be32c1", "comment": "Malware payload (Amadey)", "value": "5c9b2c2a2f398aa411947e784302528316e07f66b23f769ef9eb23390b402e8b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269122, "uuid": "37ca3fad-7241-4582-916b-40b737ed80ce", "comment": "Malware payload (Amadey)", "value": "5aa5de3a0daed83c4bec85f67f64a3a69229af56", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269122, "uuid": "cf8bfab8-8c34-4310-ba50-62b698f228ff", "comment": "Malware payload (Amadey)", "value": "a29b6dee4f53971f7d942e5992582dccc6ebd715e25a179715750bf5d1e0bceb2a1dab7bb23f1339458df680abb8114a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269122, "uuid": "85e296f2-d24d-4d3f-90f7-52487a00f618", "value": "T1DFB41256A2CC4022EC751BB41DF303830B35BDA5AD38D71B6786686B0DB36C49976B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269122, "uuid": "89d80e82-5c5a-4465-a514-32e8c4214947", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269122, "uuid": "39861637-4808-4bbf-ac98-95b06fb66935", "value": "12288:mMrvy90AEVIQkWOhzdWJW7NEFwM14RTqwpaCp:Jy5/Qwd2W5EyMKF3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690269122, "uuid": "9f10001c-a61d-49df-8a79-4e6b79b388f1", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690269122, "uuid": "03368835-1663-40f6-be34-f1dd85130297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269122, "uuid": "117790af-7c26-49f1-828c-f2906ef90a5e", "value": "e66a804951096a208eb3248b10470a69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb77f9c-2abd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690270197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270197, "uuid": "74ca550e-1eb5-49d7-a5a4-44a00938f27f", "comment": "Malware payload (Formbook)", "value": "e8f558cb2cce6d7753cde64b792121a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270197, "uuid": "50790c27-4610-4775-baaf-247f1b51c758", "comment": "Malware payload (Formbook)", "value": "5cbfb7154648241fbec88e87e2ea973816c38ee892344bd742dfc4aeb044fae3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270197, "uuid": "0083c60d-3da9-46b0-a075-3104fbdda933", "comment": "Malware payload (Formbook)", "value": "91b67dbb0dfbdb313a8e33a00ee99c54a0db836a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270197, "uuid": "98378268-1b63-4146-b7fa-a7b53eeee852", "comment": "Malware payload (Formbook)", "value": "c852a74aa49717851447fe76b3a4f26d25f31ba038af8c68d329dd0a0fab598044cbc5f7569624e36ebfbb895b8cc6b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270197, "uuid": "f30ae70b-15ae-4523-aa85-86d859a83708", "value": "T164E422226A708B8BC53A1FF8157077B5637FEEDA7061E3CB1D87F049E9767889620211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270197, "uuid": "b500c0d6-0337-4f5f-b4bf-0b3e875fc7de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270197, "uuid": "20d6c21a-843c-4f8e-85f3-548abf621286", "value": "12288:OYiIoFwIrG3XCCaI0vNoXBQC5FruhHzLLkpygL3rz2zjUqTV/L7ft+d9TvA0pK2L:OHIcTrGCorRQkKLkpBf2Zfod9DA03L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270197, "uuid": "e4e88479-5a43-47e0-8e49-fee2de627927", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270197, "uuid": "ab91e939-7418-4282-9b01-64f4ae7f2aa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270197, "uuid": "2f90e1bd-b108-45fe-a367-5ce3b50d9939", "value": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u043b\u0430\u0442\u0435\u0436\u0430 - \u0438\u044e\u043d\u044c 2023 \u0433..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52bf9c3a-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268594, "uuid": "409c6a52-70a8-4aaf-9795-c9c5ad438520", "comment": "Malware payload (Amadey)", "value": "fd863ef986678f78557c164652b6fc03", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268594, "uuid": "34cbe9b1-27aa-4012-93c4-f7caa0372fe6", "comment": "Malware payload (Amadey)", "value": "5ce63c8e961779510b657eeb51dcf219074e1f46ba2075190eee920ef6396721", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268594, "uuid": "2a7862be-e573-45ff-9734-747763d9213b", "comment": "Malware payload (Amadey)", "value": "fc5c4657a046998a1a5ed102f70742ccd418635b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268594, "uuid": "bb5b35aa-7eab-466c-8ab2-b85327df084f", "comment": "Malware payload (Amadey)", "value": "f32fb35d3a4e0fb34a8cf12987365b12064914ba345a85ff6c747aec63148fafba2770b388cb7c6d398bfbedd2f8fc61", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268594, "uuid": "036290ef-a6a6-4473-a6d5-2b2da648bafa", "value": "T167840142EBE88073EDF667B05CF202D30B36BDA15878876B2745A95E1C722C0A57176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268594, "uuid": "f5845bee-1aa9-4a08-81b4-d42e0847e828", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268594, "uuid": "84bc80fa-87ec-4680-a436-715e42932b4c", "value": "6144:KCy+bnr+7p0yN90QEj3vXqqXxkWcnZNbQR5271SuaGjxMkwbYqJwFr+JkLhzD+BE:+Mr3y90J3vamgpSu5tfwuhzD+xs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268594, "uuid": "7f160dab-3f65-4efa-bb53-8d68cb157c18", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268594, "uuid": "0e8d32ad-6a31-4708-a5b0-835845c8d115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268594, "uuid": "daa9ada5-293e-44c3-80d6-da9f380d1fff", "value": "fd863ef986678f78557c164652b6fc03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5392d0ce-2b19-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690309827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309827, "uuid": "bb307fe8-2d79-4621-9d5a-251a1cd5809f", "comment": "Malware payload (AgentTesla)", "value": "6ef7968d22707fddf0eab6d68a980c87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309827, "uuid": "21911057-7bd0-467e-a58f-e0db5c726db4", "comment": "Malware payload (AgentTesla)", "value": "5d47b03e4127869e2fd59a55a6f018b270dbfaaf78522077a8bd99b61e06dd17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309827, "uuid": "38dccf73-6ebc-43e0-97f3-ad690757216e", "comment": "Malware payload (AgentTesla)", "value": "27eadfeeabad5914036b325e5ded6e4a1d06006a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309827, "uuid": "94580d5e-144e-4fba-b887-4008baa1221b", "comment": "Malware payload (AgentTesla)", "value": "32f69d2d1a389bc9f862683135cda65e6a8de3180becd6d66fc4f830aa81ee8243bd7ab494f03334ad054450c2aeec0f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309827, "uuid": "5db631cf-fa59-4804-ab64-7cf0e45b4dbb", "value": "T198E42305FAA25D5BC13D4BF9012177B52B7EEFE27431C59B0C8BB0CAF9A5B581B61202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309827, "uuid": "6cd502ac-95b2-4aa1-90e3-31c813236d5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309827, "uuid": "c5358b7e-ccc2-45b8-b327-efd9e47c45bd", "value": "12288:6fYiIoFwIrG3XCCa25/tspjtCEmTv2oJfXsOPLRekmam+a9s4f/RoK:uHIcTrGCkmjcf8ilhmp/fpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309827, "uuid": "dc9f0278-f22c-4235-bbd2-54ae7a28b4b0", "value": 664576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309827, "uuid": "fd33c9be-8639-43a1-91f1-3248c3160197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309827, "uuid": "71d4de85-515f-477e-b690-4e0ea23a8beb", "value": "6ef7968d22707fddf0eab6d68a980c87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526b04ef-2aa0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690257856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257856, "uuid": "56f0dea1-b8d7-461b-a8a2-83d8e7dec5cd", "comment": "Malware payload (AgentTesla)", "value": "aa8d7080773627ba1687c23a1e202f00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257856, "uuid": "6b858d2d-4b71-49f6-be1b-e231e3f2faef", "comment": "Malware payload (AgentTesla)", "value": "5de39368fe80ef49986db86c1fd8719ea2db295d4e036cebea57f1592eefe74f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257856, "uuid": "4404aaeb-74f4-40d5-bb37-6b4188aa4f38", "comment": "Malware payload (AgentTesla)", "value": "d5b074c8877fd6232f09fa6396dfcf319fda8c1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257856, "uuid": "218dda0d-2c8c-4d38-98be-9a2270177934", "comment": "Malware payload (AgentTesla)", "value": "3e80585bdeb6bbe5f1837c0bccc54c866b106b82eabee1842554c472e9521ecb566061ba1d9f3e1cc8b092aa6025bff3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257856, "uuid": "64c4f970-5683-4bb0-897c-1c12b8949893", "value": "T1C7A5976F618DC8CCDECB6A7AC860314DF2679A8ACF67017D03146C854FB9E7548A0BD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257856, "uuid": "819aa43d-e811-46a6-a615-6b40796e528b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257856, "uuid": "480fa5ac-ef28-4311-a341-2428e1ad595d", "value": "3072:Pg4pxdLrA1CwQ7x0b2LOpdtQE6j9X4VMU6n3NgS4bVnbCQ2WkaShhkltin+bAfTz:4SvCbTdI9X4+30tcC/i1UHvOkZkFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690257856, "uuid": "f009aaa1-b057-45b3-a10c-17e8980e0068", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690257856, "uuid": "87877c85-6221-49d3-b8f6-78c9ad91ccdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257856, "uuid": "fa91df77-2ffa-4127-bada-b00a1c2cfd5d", "value": "aa8d7080773627ba1687c23a1e202f00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e8809bb-2ad0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690278358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278358, "uuid": "51604bbd-c054-4fa3-9f3e-bff0e04af9cd", "comment": "Malware payload", "value": "2a790a65b3772baa70fad18f6954f56b", "object_relation": "md5", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278358, "uuid": "1f4c87e0-2153-4631-8dca-1f2b5e8dfb49", "comment": "Malware payload", "value": "5de7adefe57982a54018e6f7715c3a302f17b70149de8b7b9ab63187e0adf310", "object_relation": "sha256", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278358, "uuid": "12dd07ff-13e1-4360-a0f4-b64a34e7ec1d", "comment": "Malware payload", "value": "399843d3be27e6994919943cfe4db541cc89df84", "object_relation": "sha1", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278358, "uuid": "cd3039ee-f791-4bd4-bab7-109c4ecda993", "comment": "Malware payload", "value": "ef32a38c31832e377fa517192ac981a7cd6e4c4fe77550045a176def17ffb2506809b68389f59a8f2211b6227d00d6b6", "object_relation": "sha3-384", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690278358, "uuid": "1867dee6-b3bb-49d0-b62b-cc88a31faa28", "value": "T1DD46334BB8CB1F32D12A47B5709F57CA9E684E040B47162763FB738438F27147AB859A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690278358, "uuid": "1e47ec66-4f67-4567-9278-68874bb2de95", "value": "98304:mdWMy2eOSmUNQiveS0nGRehMc6zEmktLFt7s365qqXxHw+v+y3hfHDdu7gQDJ:mdWMyLOiv4GRemc6zEVtBt7Q65qqXxQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690278358, "uuid": "843379fe-7e78-4240-b047-019e8d98d211", "value": 5881344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690278358, "uuid": "9fcf62f7-938e-4c2e-bcea-a1832b9dd3a1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690278358, "uuid": "8b7227e6-210e-461a-af51-334f91d4ad0c", "value": "Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3816569-2ad1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Adware.Generic)", "timestamp": 1690279144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690279144, "uuid": "7e53d897-6491-4199-aaa8-fb5d1712d482", "comment": "Malware payload (Adware.Generic)", "value": "a3da3dd84003b2a9ab2cdde9577f0e92", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690279144, "uuid": "b2a31d59-ca20-408a-b51f-ca86745eed2e", "comment": "Malware payload (Adware.Generic)", "value": "5e8fac6112512b2f2a726424c8acfe486043905a2b8efc0219be0c551a4a6cd6", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690279144, "uuid": "8ccdbbf2-90e1-4d7a-a36c-3fe32611d5c4", "comment": "Malware payload (Adware.Generic)", "value": "22b1fee4bc17ec38575e8dac40e0fbdcbf9c7950", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690279144, "uuid": "8472e02a-95e4-45a9-b5de-dd514bf12b44", "comment": "Malware payload (Adware.Generic)", "value": "dece929209bc6b4dc2116371b15e055dd5675b1eea84a0e5c2bc4360d63693a4d7a655ac17b00eba9f6894641e950511", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690279144, "uuid": "eba8e3d3-c926-42f8-91a9-a93c69ee9d14", "value": "T1CC56CE1437F85E32E06AD2B3D5B0542663F1FC2AF363EB0B6191667E1CA37505C426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690279144, "uuid": "98d0bcb2-c045-41bc-b82b-1e7f9d2e2cb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690279144, "uuid": "d8b946ce-a95d-4c62-a91b-c990cc609e12", "value": "98304:lGh5ziNlRUaub+MPDrc/c+NmXnKyFrsqCQHj92AYawl1WPOl6NVLkJ0xWShD:l3NlqaubXgUCqCuBjx1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690279144, "uuid": "9a1497e9-df18-4ff2-a01a-cf94397fc947", "value": 6351872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690279144, "uuid": "7acb230f-71fa-477e-9853-f227f4d3d71b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690279144, "uuid": "43a110a1-9360-48f6-aeaf-2674a6831447", "value": "OperaSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca9ea58-2ab6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690267402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267402, "uuid": "45c1d18e-7e9b-4d5c-ae6f-0d9457e317b2", "comment": "Malware payload", "value": "af57788a52529a6151a822ccb44865bb", "object_relation": "md5", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267402, "uuid": "156d4ce7-4315-49c7-baa7-c9ca0e19f266", "comment": "Malware payload", "value": "5ec1711bc66fc58ee942bb88868c8685d715d5fa9a65783622cb94c3bac09162", "object_relation": "sha256", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267402, "uuid": "c15d0c6f-812c-43cb-b031-5af35949d27c", "comment": "Malware payload", "value": "4e155fdfbc84005b9d046f715c32b8d4a760fc33", "object_relation": "sha1", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267402, "uuid": "e7204899-b74a-4fbb-a386-6e5d7cf09cee", "comment": "Malware payload", "value": "012fb0e51b36ca43b3e081c0c868f0923e5a0961c9fbea9fa0d93d9683fb1ecacf8724fbaabc390954187ba9dd93fe2b", "object_relation": "sha3-384", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267402, "uuid": "d84c4186-4cc1-498c-951e-1da2338cf22d", "value": "T19446334BB8CB1F32D12A47B5609F57CA9E684E040B47162763FB738438F37147AB859A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267402, "uuid": "954b449c-1f8e-49cb-9866-836400178e9e", "value": "98304:s9WMy2eOSmUNQiveS0nGRehMc6zEmktLFt7s365qqXxHw+v+y3hfHDdu7gQD1:s9WMyLOiv4GRemc6zEVtBt7Q65qqXxQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267402, "uuid": "75f0927a-0e89-4dda-be18-dac7618c8da0", "value": 5881344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267402, "uuid": "ae9e046e-fac0-41d0-8cbb-43d5d788c6b7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267402, "uuid": "886ad97f-4f9b-4dee-8bdf-9fa12781ebcd", "value": "Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd0b8b1-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690273931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273931, "uuid": "df59abec-7add-435a-b836-1d61727c0e34", "comment": "Malware payload", "value": "398b7cb129d26919df3efef9d7017fbb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273931, "uuid": "899bc5d3-f1e9-4987-99a9-1b70ee2e837e", "comment": "Malware payload", "value": "5f1b1da6663d14597c87755ee0581200945687f0926572a2f6e697bf73973743", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273931, "uuid": "7961a7ec-0d1d-45bf-ad07-b8bc69136a8c", "comment": "Malware payload", "value": "7903fbf9cd06e7ec351bff756013bb8c8e3950d3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273931, "uuid": "cf93b8ed-93c0-4e31-80ae-35a228b94241", "comment": "Malware payload", "value": "836d2054809f07794f454aa81b0217bd3789f99036a5b47427b4e5597f945cbe28a3106c1f0cdc4d4206936fda260021", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273931, "uuid": "1734f7e4-8ad8-4b07-9415-ec1f39c0a55f", "value": "T126235E45B7E24E51C0D1AB349117C35CBB39CA723B7424B2ED6FBC50DE25702A5B127A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273931, "uuid": "b7ff9035-327d-4322-8143-b4ee1ecb84ee", "value": "384:vKTqAQg9srXWUeBmsAw3L784k7v7qCFi8F01de:vKTqRrXWUPIL784k7TqGi8Fod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273931, "uuid": "c531b3dc-d8aa-440c-81a1-185901271853", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273931, "uuid": "25b5ac4b-a589-4d8d-945c-e68ca4fd63d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273931, "uuid": "c7064753-dac1-40b8-90eb-859e4423a94a", "value": "SecuriteInfo.com.Win32.Evo-gen.19972.18484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0605720-2aca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690276025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690276025, "uuid": "1a2aaf5e-71d0-4e4e-9003-58ae42a84861", "comment": "Malware payload (AveMariaRAT)", "value": "b7b4ff3d387c5d8eb6dc9a2a3d651830", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690276025, "uuid": "742e1642-e5f4-464f-a160-b9fb10fc3211", "comment": "Malware payload (AveMariaRAT)", "value": "5fe3357ebe53e43e1f359cced32cbab441e56fad5534e3f7a484dd675099a6d9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690276025, "uuid": "7b51c9ed-931c-4160-99b0-6400b5805ec1", "comment": "Malware payload (AveMariaRAT)", "value": "4c2bb9170a87d91692795b1312d49679c28da0a9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690276025, "uuid": "6acda928-dfd1-4f97-8908-a0ac0afbbe67", "comment": "Malware payload (AveMariaRAT)", "value": "b0037ac66cd799584807320c1e7b140fc498692dd133888143c75ccc42494862c0185b3edad365cfa8b438ce94a86687", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690276025, "uuid": "1d7851bb-3e23-45a0-b9b6-0604685bc8db", "value": "T1A424027647D42025CABE637259F3AA8E5B304782E923DE2FB5CF00299F07911F9521E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690276025, "uuid": "81f3d0cd-830e-47c5-92d8-ac8c5ac59243", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690276025, "uuid": "bd0bb384-dd53-49cf-bf4b-05730fabb9c9", "value": "3072:gjOLRveLpmUPgXFIB3uOi7Vs30rte50LoHto:uOLRvUzu1Oi7Vs30rEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690276025, "uuid": "1d66681a-f287-42d5-8247-7cf462980671", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690276025, "uuid": "d70708ce-c46f-4da5-b2df-de46332ce0f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690276025, "uuid": "d799441b-4534-4384-b862-353276481d45", "value": "SAIPEM_RFQ-Q10056286-250723.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a902ba8-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290457, "uuid": "50d1bae8-989e-470b-9b52-1a80874da99b", "comment": "Malware payload (Amadey)", "value": "33aca759fc7ddd2c0ba87b20d2cf8986", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290457, "uuid": "af72b37a-ba79-4e1a-b26a-e86ed350c1a0", "comment": "Malware payload (Amadey)", "value": "617783538bdab4bd7c8fbacae9e8749b50cd02e596dc328612ea1d600c11dc1f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290457, "uuid": "c387fc72-6f81-4bdc-9428-579e81cbbba1", "comment": "Malware payload (Amadey)", "value": "f4e5f0de1188385931c81c61229f03c508e29fc7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290457, "uuid": "7f2d7ba3-e6ae-4e8c-8ee4-ac65c2f55886", "comment": "Malware payload (Amadey)", "value": "dfd018a37b95c55f2c17dcaca65d762585ee716283a5bb26233b4a1bb755c27416279a3f58a67c147640c4cc6df831f9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290457, "uuid": "096e0262-1826-406d-ad82-994471c0c7c4", "value": "T147B412026BD99072ECB517B029F703C31A36BD908D78976F23DA595F1CB39A0A53172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290457, "uuid": "ce652ee9-6417-4b10-ae50-a2eeabb421ba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290457, "uuid": "138c0243-2032-43f8-a978-33ea00490e62", "value": "12288:EMrYy90ZQGHay0dMZCvYOiGRD/qYR+J8gDSMuUCyjylEsCmjt:EykHaHdMZmYwIlJ13uUCyjylEhit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290457, "uuid": "b303bd75-0dd1-4bfe-a90f-60745a5192c7", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290457, "uuid": "5be7492f-8861-41e2-b3db-a7d726f650b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290457, "uuid": "18fe373e-6ef6-41a5-948c-383fc25e76a5", "value": "33aca759fc7ddd2c0ba87b20d2cf8986.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32ef802-2aee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690291492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291492, "uuid": "335e6a48-029d-4e0c-8f94-e5be13ca2892", "comment": "Malware payload (AgentTesla)", "value": "fb976fcfdbbfbd56b0587e17ea0aff4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291492, "uuid": "54a30997-3824-4f43-9e44-f56eb5a12c09", "comment": "Malware payload (AgentTesla)", "value": "621d810b1170a19891830225b7c29d147714a36597e43e92ba3c9076d1244bd7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291492, "uuid": "52607f75-859e-44e4-bf23-c2106896dd4b", "comment": "Malware payload (AgentTesla)", "value": "477fb08589ccec6ab5779ed29c535a954d2a12ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291492, "uuid": "f9457eff-7a0a-465f-9a2d-c4765bb62431", "comment": "Malware payload (AgentTesla)", "value": "a832f9579603db6893254b72de64eb453e1948e24f91091e4931f807fb6b7e66f45f5b6eab0a93c641109f2267a887fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291492, "uuid": "c675efad-3b76-44f9-a954-22dd5ccfdc9e", "value": "T19BF2FFDC726031DFC86BD072CE995D64AA6078BB831B4207A05726AEDE5D997CF180F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291492, "uuid": "cb0ceeba-6fcc-4e45-94cd-fd8eae68dbff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291492, "uuid": "3344906f-950c-4738-b483-82806a55dc1b", "value": "384:y2e031/0y5rAfVX5xfa4Q7oVJ3HiVTLErwA+XAEK8vjqJNOUHxLYbjmjed:y2e03W5C4QcVsVTrAmBIOryje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690291492, "uuid": "6b817e89-6690-4cb2-a493-0f96e485f3c5", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690291492, "uuid": "c9b64ceb-b8ac-42da-944b-23fc4e3e9da0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291492, "uuid": "edec0355-4104-40c1-82b7-a4092d175c65", "value": "ZIRAAT BANK A.S. 25.07.2023 Swift.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491e6fe5-2aea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690289623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289623, "uuid": "5f80dc8d-ae6f-4a41-b3c7-ab65c79f45b1", "comment": "Malware payload (AveMariaRAT)", "value": "6a26eaedf2926097f2e227255fb2c490", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289623, "uuid": "5f207959-c7d1-4dd2-91a0-af42fd1f4ddd", "comment": "Malware payload (AveMariaRAT)", "value": "627c836e806b1a0f85bc59ca399cd041020fc6bbedb42826b715377a670d0eb7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289623, "uuid": "206faa31-63fd-4d3b-85c7-7363021d25d0", "comment": "Malware payload (AveMariaRAT)", "value": "97f240c18c4d23a3ac23d0e6d3c063d79a0cf796", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289623, "uuid": "942ab9ca-42a2-495b-9604-a27acf4d0fd8", "comment": "Malware payload (AveMariaRAT)", "value": "7dc04a6a1431f496c66f629133cd042f5d1783de396893b58abeb6d83a2e63d4e63e9c9d9444f56c0eb2426587ba2ec5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289623, "uuid": "bc5f99f0-1110-4c17-a2d8-23b587a5f316", "value": "T16A84DF0EAEC620B4D1948C74BBF9A6EE66B5635F51066BEB208902F6DF0175F71020F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289623, "uuid": "d7895454-fbb3-4bbb-820a-16c1018a9339", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289623, "uuid": "43bb030d-216a-4701-9a6c-1b33d7979217", "value": "6144:8+XYDIdyvkfesBJi4SsXdTEuWPBn/h1hot:8+XY4yvkfosXuuWP9h1hY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690289623, "uuid": "a378e82f-f0f5-4678-ad67-8e060bb1b23e", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690289623, "uuid": "326bbb26-4783-4cb6-8717-08ce5dd8bc37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289623, "uuid": "6f14171b-7c27-4bb8-9e7e-20c0f7147862", "value": "Orden Nx-0019383-938990.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf38df7-2b07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690302325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690302325, "uuid": "5a9ffe5b-52c4-400a-82a4-4b948fce08a6", "comment": "Malware payload (RedLineStealer)", "value": "0dde183351f48665734eaa76277e3058", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690302325, "uuid": "ec813cf0-fddc-441f-b5fe-7d46d1822514", "comment": "Malware payload (RedLineStealer)", "value": "6295a983138ab0f8503d3f81992d3214115728986a3f42f14dbf4f2808852933", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690302325, "uuid": "5cd23fe0-c67f-4442-88b1-c5f3aa01ca2b", "comment": "Malware payload (RedLineStealer)", "value": "616db88ceee46791f4a959bbcac6a154e0044776", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690302325, "uuid": "2bf9168c-c8e9-4963-9659-1322e7ade5ab", "comment": "Malware payload (RedLineStealer)", "value": "dc196679f431622e612f1b8c07535f5e6a2e3bf71fd69b3004a7edd7045d51368d18e21ef61f53ecac0bd91aea8e4196", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690302325, "uuid": "f4389f02-c367-4a54-b3d3-486e6efaf8d5", "value": "T1BF74E02175A0D072D0A39A316870CA511F2ABCE3AF7582CB33983E7EAE716D05779717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690302325, "uuid": "ea549133-42e6-45f5-955e-60e03e969d03", "value": "21f576cdd9781dd6a4a8eb3639210862", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690302325, "uuid": "4a4633c4-efcc-40f3-b404-9fb2035f27d5", "value": "6144:R+GUgDMu4BnIXpL2sBs8QTDPZOPasqRYkdzWQb5:MG74uYnIZaEs86PZEUYkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690302325, "uuid": "3eb14bb4-871b-46bc-8abb-1fb033c10159", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690302325, "uuid": "dfbbbc8f-f892-4e1f-93ea-41e92c9aada6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690302325, "uuid": "ec15cfa8-1a6a-4034-9623-be98e8895369", "value": "0dde183351f48665734eaa76277e3058.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a274d0c-2abd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (jRAT)", "timestamp": 1690270378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270378, "uuid": "0005f47e-63a4-4d41-bd7a-97412970a8b3", "comment": "Malware payload (jRAT)", "value": "261b9cccbf347d864e683502e8679a4a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270378, "uuid": "55c641a5-fe83-4b69-a260-9a4b34805f08", "comment": "Malware payload (jRAT)", "value": "62f01908c1efd3a5862000ba552e5f08fbae36449e2173baa5f778565255fec6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270378, "uuid": "4e658f68-4a2a-4945-96c8-1448877601f7", "comment": "Malware payload (jRAT)", "value": "5c505cc516977a1e83310e3230a9c76ffd28fa44", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270378, "uuid": "1e72896d-b548-43d2-849f-8d87bf1e5bde", "comment": "Malware payload (jRAT)", "value": "c31b49ed8d372965f9b4fa7e851c40b6a451f4cc0ec4b6d09562d4cc158529e410a5d4414c2ba941146e2569f2aca5f0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270378, "uuid": "2cc7af95-01ca-4030-b72f-b3e19b5e8b68", "value": "T1CE63028AED8FE843DD95AA30F046472A670049D729CC808ED6327B62D7476293D0E6D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270378, "uuid": "494ee0da-a305-4490-b9e7-7fbcc24d4b0b", "value": "1536:Ubbo1iD1LCZ43l5ucF8upA++wcgIF8TBZNIuzTaz7:U/awLCW155pyfFCBnIuzWz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270378, "uuid": "1267f3dc-5774-4046-8159-3bc991676c05", "value": 69085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270378, "uuid": "2dae89e2-d3e5-4d71-9d18-bb6474028369", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270378, "uuid": "27862eac-c107-4446-84d1-b24cebf7ab7e", "value": "Order 23040.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8e2957-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268211, "uuid": "1a7aaa05-703b-407e-b32d-0cf3a4e569af", "comment": "Malware payload (Amadey)", "value": "58639e5dc75ddc026cfe4401f01ff148", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268211, "uuid": "87cc553d-4df3-4025-a43b-b10fc1db66eb", "comment": "Malware payload (Amadey)", "value": "63718438842cf9dd79735336f7b120a0d1af6dcc7bfd439af8af52a796a35d7b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268211, "uuid": "ca45b906-24f1-4cd6-bdd4-69660aeb9de1", "comment": "Malware payload (Amadey)", "value": "3366c83c7d067ba77614c90e14b696fa3677ba8c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268211, "uuid": "6f8a5e54-d88e-45a6-8ab1-19448cb4f188", "comment": "Malware payload (Amadey)", "value": "4cb2744586ee9908beb28b3627842178c2600f7fc89a87a2ff214d1b92920cd063ffe2f02bb3e8fde5ebbd335b5f72fc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268211, "uuid": "62e45431-e590-4cc4-b954-6ff6ce905e86", "value": "T1D42408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268211, "uuid": "c83de19c-de80-429e-b939-fe13f55ecc77", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268211, "uuid": "014d166a-211b-429b-81ec-83696ce21df2", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268211, "uuid": "83ed335a-23b9-41e7-b323-d65508d5b556", "value": 229339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268211, "uuid": "acffd845-1593-4e49-b729-4c604887c15e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268211, "uuid": "c0b3e9f3-0700-4169-ac8c-0021c31dac26", "value": "58639e5dc75ddc026cfe4401f01ff148.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6e75ed-2aeb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290170, "uuid": "d9c3699f-dc4c-4559-a0be-7aca2cadd805", "comment": "Malware payload (Amadey)", "value": "4bc8766eac843e1c9ee5fb7085c662aa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290170, "uuid": "4dd8347c-42d7-4cb5-a9b2-e2f559418412", "comment": "Malware payload (Amadey)", "value": "648bf08ad6dc90d54e295e044911ca8a25570cd1894c1ae2fb7c3335a32a1ec5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290170, "uuid": "af9d7ca4-38ca-4c29-b92f-c3ad151e6fb7", "comment": "Malware payload (Amadey)", "value": "145ee38e9e041cbdb7811b52a71217d6d6a408b1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290170, "uuid": "537070eb-a4eb-4be2-81bd-c22f76c085b3", "comment": "Malware payload (Amadey)", "value": "1a761ad0578705f3ab1b6676e0671ed62dbb767bbc41c4b5cc5c9729712c6cd95e3519ef40904263271f2afcf4218447", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290170, "uuid": "29d01c1c-02a4-43eb-b113-eb523a00287c", "value": "T1042408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290170, "uuid": "ac07b6d1-0aef-4a6e-9c08-f98fb1305385", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290170, "uuid": "cd7c3043-e64d-4af5-b825-62c186b08a57", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290170, "uuid": "a2d6c1d0-5681-40e9-b002-28d81c9eccef", "value": 229509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290170, "uuid": "463e33dc-7d0f-4fe8-b521-859c8aff3d8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290170, "uuid": "3148a849-b496-4417-acc8-9de720e5d02a", "value": "4bc8766eac843e1c9ee5fb7085c662aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1fcb6a-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268207, "uuid": "b189887d-3815-4998-8d61-ecb7321e5fac", "comment": "Malware payload (RedLineStealer)", "value": "6b622d707523cfa2c217564724e759ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268207, "uuid": "82741b9f-7cca-4275-9da2-4b84d523729b", "comment": "Malware payload (RedLineStealer)", "value": "64cf949948734e10ed6783ba1d9d60663c7f6addbe9191c4b7388c7d766d8265", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268207, "uuid": "73a869dd-29f8-48b4-afcb-d6d216c1d5e8", "comment": "Malware payload (RedLineStealer)", "value": "b534d3d515b49d9833b9ed500f0ad12bfd0f8bb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268207, "uuid": "ec261210-a832-423e-a9f5-d514d52f2259", "comment": "Malware payload (RedLineStealer)", "value": "e089a6638427610b3fac128aaba6f6954b921d6cb4de0d64181092ce05377299720849f9c2ff3c8793c61f00248aef0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268207, "uuid": "80eda7a2-6149-4848-8365-a92a1ff01d64", "value": "T1CC840213B6E99032DD7557B0A8F603D31A36BD619978936B3786994E1DB36C0B83033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268207, "uuid": "a80543ce-07d7-482a-b7c8-c05c212122b2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268207, "uuid": "58d00afb-0ec4-46fe-855b-1c81c510afbf", "value": "6144:Kry+bnr+Wp0yN90QEHBjkKUqlKUodIM7DlXxG8NS4nxZ4dzmFuk3mWKHfAMYfiX:dMrCy90DkuFuDlBGAS4n2509K4jiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268207, "uuid": "1e6d7206-2569-4a2f-afbc-9f3624b3f23d", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268207, "uuid": "db1aad55-956c-487c-b8d6-ae18c72620ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268207, "uuid": "7e54cf35-16ee-4b25-9bdd-14be02fab886", "value": "6b622d707523cfa2c217564724e759ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4b2fe0-2b19-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690309731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309731, "uuid": "6a26243c-0edb-4eaa-b913-365d7f828ce9", "comment": "Malware payload (GuLoader)", "value": "abcd81b466f04af41a2461d214cacc7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309731, "uuid": "306c82af-5c27-4687-b093-1d1d7a114f45", "comment": "Malware payload (GuLoader)", "value": "65b9d65a82e6197a80a9214334c81d373440e12f53feb6896399647666c22792", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309731, "uuid": "03e96aa7-6e65-4b81-9ba0-891a642c22bf", "comment": "Malware payload (GuLoader)", "value": "a6ade575b1cd51af8a0e9c24ddb4f662fbabf8ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309731, "uuid": "df620e96-7233-4f25-8ecc-6ac58396f4bd", "comment": "Malware payload (GuLoader)", "value": "7feb40e0da54babfca621a2433f5d5ab0c247e36b213d6f850a3dd6cf2980722f0dbc465b682f53ded058d37dc7ab30b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309731, "uuid": "2a9e1b63-1adc-41be-967f-fd3c7ec0b947", "value": "T11A7423130784E56EEE178E726864A3F7EDF3E6254A3F671313196D463E83B42784E064", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309731, "uuid": "1efff32d-20e3-49fb-bef0-29eeffda0453", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309731, "uuid": "e6408b11-9a71-4698-b404-259b8df26c8d", "value": "6144:RpkXchFCzydDejPm6qVkRRkwSwshYw8uktKgJEwc+IxXzcg+Zw4fdJNorPWvuzAZ:A6SqAmVKSwSwshYFJLPmDLiwOdI0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309731, "uuid": "8481d229-6dd1-429a-a419-235bda99edc9", "value": 358128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309731, "uuid": "6a8a2621-c84a-42e8-bd24-f1f8b53f00e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309731, "uuid": "f059c816-feda-4bb4-a42b-aae4ca906252", "value": "abcd81b466f04af41a2461d214cacc7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3559046d-2ade-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690284436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690284436, "uuid": "2d303f17-1428-45ba-9ed5-52809a23e642", "comment": "Malware payload (SnakeKeylogger)", "value": "c4eae7457a1f31228532d3e0f230fdaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690284436, "uuid": "9a33ac0b-c073-442c-bc2d-3f2cf986043e", "comment": "Malware payload (SnakeKeylogger)", "value": "663142f32de0caac83cb6418b0982e82a1973eb3eaa916a24f88ddb9ae12edc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690284436, "uuid": "1c821732-5ba5-48ff-a8ac-290b7c30267c", "comment": "Malware payload (SnakeKeylogger)", "value": "537592b44464fc68f80a590c2cced4fd77689785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690284436, "uuid": "8374c48e-9c43-425c-bb0e-6b013c24e3d6", "comment": "Malware payload (SnakeKeylogger)", "value": "3cf19821073be78dc201874e4b10cce7fb7ae9af0e8b7419c06d77f227ce00842fa2ccf0b8fcb6d603fc61ba5af9b41d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690284436, "uuid": "c8d3a6bd-6f74-4c3e-b00d-a042c6b51a8d", "value": "T1A3F4F12136A9ABA7C1BA43F98030363053FD9E9E6436D3096EC375DA6871F848721F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690284436, "uuid": "ad121395-d77a-47d7-9026-99e9482b531d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690284436, "uuid": "883b21a6-1a42-4ce7-8510-9b2704cfd79a", "value": "12288:NfgET9+YiIoFwIrG3XCCaEHsbHNCxQmW2PJB3BY+O0s3KxR2jHVc2I0VWE:hx5+HIcTrGCSe8QoxFC0s3oivVWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690284436, "uuid": "0ce5e3ae-07b6-4013-993d-42c1fe6c75dd", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690284436, "uuid": "110b5d5a-c4cb-4dff-8f9a-03f704037d41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690284436, "uuid": "c465bf1c-74dd-4a2f-811f-54d4490acd68", "value": "PO-151186023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b219e27b-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690267895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267895, "uuid": "29ec8cca-1244-432b-aa5f-f80ba182edae", "comment": "Malware payload (Amadey)", "value": "1e6d11e2a9a40c2d205a289ef607ae24", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267895, "uuid": "dd8773fa-a6cb-4b96-aeea-cc26da51b8b0", "comment": "Malware payload (Amadey)", "value": "678b5c88fa07f2f823b7edf52683e4214bda0273e380b7a5d2d8c4b6bac35f33", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267895, "uuid": "d89b8067-78f9-4648-b948-f50b8ecece19", "comment": "Malware payload (Amadey)", "value": "f26f81b52bed31e6603334652139784d0a8bfaac", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267895, "uuid": "a556388c-44aa-478a-b109-1f80951e0e72", "comment": "Malware payload (Amadey)", "value": "4dc84bf22e59fcd9fc8a7a2a86bf2ab2a7579fdb595feb5083cde5937ac59dc5e0dbdf2d79853c07e77de716ae05030a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267895, "uuid": "75d0a933-f53d-4cf4-adc5-7e89156b1734", "value": "T1AEB402539BE84073E8B717B029F713D70B35BD61497487AB2661E94A0CB3690E87237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267895, "uuid": "77539d18-ad00-403b-86fe-6e0446000ef6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267895, "uuid": "06b4279b-5ee4-4633-8556-c00d3a1575ab", "value": "12288:aMray90Q3D/EZvDisHKwoWljc/MistLDMn2OxRfsfO0lNKc:AyfEyMY/MiKLDqHRfsfO8Nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267895, "uuid": "5816ff72-262e-41e4-9396-f0ec8efb5579", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267895, "uuid": "cd64445c-7b5c-4e95-855f-a4734c4f5c4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267895, "uuid": "637ca7f7-947b-4eda-ab5f-15dc7a269a99", "value": "1e6d11e2a9a40c2d205a289ef607ae24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7514a7c9-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690280248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280248, "uuid": "e7dfc22c-a2d4-49c0-bc26-3bd38b439259", "comment": "Malware payload (Amadey)", "value": "d6da429f94d4e7275af159aba367d08f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280248, "uuid": "96d7a44e-8969-4b60-9a25-b9d6bc9534d5", "comment": "Malware payload (Amadey)", "value": "686de77f237b12b0709a6d35c1ef73aee4edf44dd81dba56211bd724bcdcb5bf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280248, "uuid": "cf8eb6df-0764-4ae1-bc3c-3c8da3e3d4f0", "comment": "Malware payload (Amadey)", "value": "cb57caa3d332adee30087a965283ecce5390b304", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280248, "uuid": "dcec00ae-1663-4ec2-9392-acfe3c8ac11f", "comment": "Malware payload (Amadey)", "value": "901a6c69954fb8d723064c0b12e578d47e5c6329fce10067b9392675dd5b5c10792e2e138548bd07036644c0496aafef", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280248, "uuid": "8cfeadda-fb08-4ec8-9668-e617dcde37ef", "value": "T1EF840142B7D8D532D9752BB058F702D30A3A7C919D7C836B2749995E0CB3AC4A87273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280248, "uuid": "8628b352-380d-408f-9099-b96a83a3e98a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280248, "uuid": "b1770727-fbd8-49c2-b773-1460d8b11b76", "value": "12288:/Mrxy9059UCxEYQyJXMmoAgBYCGcMTdlx:OymOY7JXMlz8Td/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280248, "uuid": "f2186dab-8f23-4940-b7ce-85a44e82f290", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280248, "uuid": "f3e9fc8a-8d51-46bb-996d-66823e2b91e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280248, "uuid": "98d58e34-d22e-4681-b188-04d07d31ee96", "value": "d6da429f94d4e7275af159aba367d08f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64db791c-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268194, "uuid": "6c99aecb-672e-4f67-998d-128f89fb3423", "comment": "Malware payload (RedLineStealer)", "value": "2cf9f25408c19e737e517b14d7e7c96a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268194, "uuid": "1ae42445-2638-4537-9df9-bf3f1560df52", "comment": "Malware payload (RedLineStealer)", "value": "688bb6aee212d596f20e52adf6472ec0ca5bd524130ee12c8ccd32d4cf42a483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268194, "uuid": "5a35c375-6e76-48f7-8971-6558d265026d", "comment": "Malware payload (RedLineStealer)", "value": "7319ceae0809e22bba7bd9c21039c5625efc8b56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268194, "uuid": "75125670-c676-40b4-ab48-ee4d3fda400b", "comment": "Malware payload (RedLineStealer)", "value": "50884e739d45962f3d46b87c5873558a75b8642c98fc81c34e8dd65f60b182ca951cf1770eb559ef2b08bd6e677adb9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268194, "uuid": "b5650525-258e-40d2-84c6-2765622043f2", "value": "T115840212E7E94432DEB52B705DFA43D30B36FCB09D78826B2396991E0D726D0A931727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268194, "uuid": "7eb0b122-faa3-4f56-b0ff-928a7064b436", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268194, "uuid": "1a8689b7-1c01-44e4-942c-18535a550f4b", "value": "6144:Khy+bnr+4p0yN90QEVL0xOodIM8SYz57KmJ0NWpoz44d+mjstyjuR1ASYs:nMrcy903L0xOvR7JoycgkuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268194, "uuid": "d3d4631e-6566-478e-a150-ff0652ca0d86", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268194, "uuid": "a9277ccd-0aac-4d92-911d-ca2ae6b6e54b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268194, "uuid": "55ece3d8-178e-40ff-8117-b2295f37c3ea", "value": "2cf9f25408c19e737e517b14d7e7c96a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfb7739-2ad6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690281283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281283, "uuid": "d4ea6bcd-a97d-4b27-a6b6-a6938d49626e", "comment": "Malware payload (Stealc)", "value": "7dcee1865ca8ec2f8b1769774b3d5801", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281283, "uuid": "6d364a2d-5fd7-4c70-8e80-52caf8f2baf9", "comment": "Malware payload (Stealc)", "value": "68afe1c1cef069a7386dd3a8d406d291d0da0ff654a5fc741cce02b7d54a434b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281283, "uuid": "93f8a188-ac01-4796-8c97-78dfea96f967", "comment": "Malware payload (Stealc)", "value": "aa48743bfa79c6aca3304d29ce24073ae1f059e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281283, "uuid": "b0c524bf-fe16-4328-8a14-ca4cd4d02804", "comment": "Malware payload (Stealc)", "value": "00a9972c97ae5b05197735529b78934b34ab5a5cc877e9701bf7c6da68b8ff94ba0a7916c9cdedf026bd3dd4fc8f2cc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281283, "uuid": "4bcf4574-7738-447b-8069-68ef0baed000", "value": "T1CCA3E601D940642EE1A540FFB99E5BEAE81C7AB51304D0C3EBB26D7635E10F664B05BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281283, "uuid": "70e6dd85-6d87-49fa-bff7-f427ac8f6666", "value": "cd99bce8ebad6bc5866d19d9d387c282", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281283, "uuid": "b41eff2d-ec07-434c-99eb-4a4a7e774551", "value": "1536:++LDkDXWg1IIfbMny0eDEgU5ZOw9mbNFG7x6pt9Dvdp8R+jHb546+qUlE4SJrIOs:zLu1xMy0117esKhpV46+8raOOz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690281283, "uuid": "e963c0f6-04e2-4df0-956f-5680eada9501", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690281283, "uuid": "7cb78326-1ecd-4cdf-8c34-d521a6285d43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281283, "uuid": "47050314-711d-49a9-91bc-b767f5190f04", "value": "400000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ea2d49-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690308569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308569, "uuid": "b044aa52-be9e-4b4d-a351-7185c5b2b624", "comment": "Malware payload (Formbook)", "value": "76b672ce949adae9b0899ea1fd3f3802", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308569, "uuid": "0299193d-8cb6-41c0-b9d7-b0d28c800a3b", "comment": "Malware payload (Formbook)", "value": "69390302e6a82cad49f3eabbba2f274a63202c9df899709de1d78d7f8a9a9584", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308569, "uuid": "404fdcfe-d6c2-4f41-9f5b-e7c0de55fe06", "comment": "Malware payload (Formbook)", "value": "6ebce586c6a361f18283e4742eb967a8068dffa4", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308569, "uuid": "4ed2800b-5f14-4e22-9baf-908f96394d06", "comment": "Malware payload (Formbook)", "value": "87aa27057740dcec0e37471f644d668474c674e956838565a772f6869f5301432c377cfeae076691d1f46849bd7caa34", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308569, "uuid": "724d891f-0405-42ab-8943-e762381d05e1", "value": "T10EE449E1D68488E9FC6A0BB6A8339C3615677D7EB9B4641D561EB6312B732C30077C0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308569, "uuid": "454e5837-9092-4be9-8142-988e31569df7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308569, "uuid": "977e728c-7571-4853-a69b-cdbaba0bd8aa", "value": "12288:IYGGr4VVVVVVVVVVVVVVVVVVVVVVVVVVVVVHa9XGEDmQFr0Mp4T5mu:IYeadPrzSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308569, "uuid": "7ac7a89d-2f64-4f2c-b663-75e131656606", "value": 702014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308569, "uuid": "a803e3b2-43cf-407e-b6d7-778a3961105d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308569, "uuid": "9d8b3b55-363e-411c-858e-776ee25f0610", "value": "DHL SHIPPING INFORMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a246b4-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690267900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267900, "uuid": "09f2761f-3f50-4519-992b-b9705f1188f9", "comment": "Malware payload (Amadey)", "value": "42e68c505b5f4ef5aa3ff6b5bd1e1df0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267900, "uuid": "a2137bee-f2fe-4686-8e33-223f2d8dcb69", "comment": "Malware payload (Amadey)", "value": "6954873d28ea95a9c8a54a5ed0b7e08ebcd026d3f7c562369ca4c8ab5c517b12", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267900, "uuid": "f8707863-b837-4e89-96a6-30012cbba58f", "comment": "Malware payload (Amadey)", "value": "29360d2697bc782eefaf828018cb20eefffaa05a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267900, "uuid": "bb644d4b-11bc-48d8-b4c7-525be590c2de", "comment": "Malware payload (Amadey)", "value": "c8657345364af11af237526ff80c42507fbd79d4781e18b05e694cd1a1681adff2a44486cf4a0a5f0567b98592dafd5c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267900, "uuid": "1c6595f2-de18-48de-a44e-b95fd1d99f0c", "value": "T15CB41256BAE58073D9B117B029F706830F35BCE16D2883A73781A88E1D73694E93177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267900, "uuid": "a4229ab1-05e9-429c-968a-ccea29df35ce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267900, "uuid": "c3bf9878-2ab1-4572-a54b-d9b772f07c0d", "value": "12288:TMr1y904B/F8gHGn8UflPbJ6dTMsOWZDFJpZt:yytdm8ql6dT5Rtjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267900, "uuid": "6cbfbfc1-a463-4fd1-8069-5a4aace71902", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267900, "uuid": "b77d13fc-b865-4628-b1c8-70574a540e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267900, "uuid": "c8585e68-06eb-48f8-b9be-7c845553a9e7", "value": "42e68c505b5f4ef5aa3ff6b5bd1e1df0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57af76d4-2b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1690307257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307257, "uuid": "f4384ddc-552c-465f-b9bb-8269d15dfcfb", "comment": "Malware payload (LummaStealer)", "value": "36d4a7ec6a9ad04aa447dda96ed21611", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307257, "uuid": "157b70b3-bdbb-4343-9a80-1955718d4ef0", "comment": "Malware payload (LummaStealer)", "value": "696808a3a7971c3af2b8a5e69803fd45c7480da8fa42711491c608d583ff4f56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307257, "uuid": "2580c106-52d7-4f64-b4cb-14ba7204b1f6", "comment": "Malware payload (LummaStealer)", "value": "0b1e924be77688d3f2171bf36bd420f5c60d5805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307257, "uuid": "c3d806a6-fe94-44a4-9bcb-c6988eab8650", "comment": "Malware payload (LummaStealer)", "value": "1a02a01fb982d65f52795ed1b2b09471035b0db0b986984ab75ea7649f80054d31ef3c295bbc2a4159732bb3a165cb70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307257, "uuid": "2c796e97-7ff8-4b90-9920-8ed6bd5ea725", "value": "T196559E93F1A3107DF8A6063F6E9A776890953D23DC95342332E42F887F2D9817299277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307257, "uuid": "e784af7b-b4be-4d86-a639-9000bb9145a1", "value": "cf8ff96989815c808fcc0c398575fadc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307257, "uuid": "9e416b88-5c66-4ef5-926d-f20b3cdc4b0b", "value": "24576:sDWv+KX/VnxU/wcXbtmRodFpVjv27dTtNcbORbRt648:8WRFxkwcp1VgdsbybR8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307257, "uuid": "51fe920a-2b16-4762-af5e-3fce78a90bf9", "value": 1289072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307257, "uuid": "9b8e6a02-92ef-4cea-a9db-39d65331366d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307257, "uuid": "b8cb96d1-0952-490f-96f0-115f3d27d767", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e366b861-2b19-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690310068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690310068, "uuid": "9f28b750-96b5-4527-a7b5-7e77e1dd41e2", "comment": "Malware payload (AgentTesla)", "value": "bd9d1d7c7ef91201f3e3b2517ffac7f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690310068, "uuid": "971b2415-73d2-4b8f-a284-033b46b796c8", "comment": "Malware payload (AgentTesla)", "value": "696e61d463de9a976ba014bed15d1a627c9644d1ae8080aa1be7dc2e03acf5ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690310068, "uuid": "1c789dc5-e999-4419-a342-025f2faa65e6", "comment": "Malware payload (AgentTesla)", "value": "50167ff3317db441254aa5ea81f1572467a7a2fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690310068, "uuid": "16a28ca5-9157-48b8-b3b8-86c3e4d729cf", "comment": "Malware payload (AgentTesla)", "value": "b3cafa98d27b68aee473644594a9f3a595edc9d5ad78fc9aa130d81edc93ed84d8001da5572c527f0bcc9fb9c5a722df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690310068, "uuid": "01a36b6e-7dd5-446c-9cb8-27ac8a7ca2c3", "value": "T138E4126173EC9B16C97E57FC1A6184000BF0AABB8531F60C6EDC52F64E21365D782BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690310068, "uuid": "d6c2876c-2382-423c-87cc-130537b75cc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690310068, "uuid": "f1e4823c-f957-4d49-b118-076f8dbd3b0f", "value": "12288:8XPZJuF0A1+1xo53y+aacZMPkCjowfO+8f82AvKhAaC4ILyxxyUkgsSnLud:OjAg1G57WZMPkCD8f87v8AOPx3kgsOKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690310068, "uuid": "f5dbe74e-9422-4324-a68b-3340e157eeb2", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690310068, "uuid": "3a348325-5d89-4122-9bd4-35648f9e3682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690310068, "uuid": "8bb44fc4-621c-4357-b9c6-d9ebc1cd0299", "value": "ORDER PO.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0f1769-2aa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (VectorStealer)", "timestamp": 1690258253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258253, "uuid": "49e03cf6-c55f-482e-a1f8-5a4c77a36004", "comment": "Malware payload (VectorStealer)", "value": "979b9d716947bbcdc72364d800714cb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258253, "uuid": "ab6ca2f3-c885-4f5c-93f6-e6424feb64d8", "comment": "Malware payload (VectorStealer)", "value": "696f262f6124407556e5f3829837d689c48e9488fd835c55cc5bfbd32868f59e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258253, "uuid": "f0923ea7-e2b1-4732-a9f0-f1645a19e70b", "comment": "Malware payload (VectorStealer)", "value": "f331e9d1e991fd4fb56c4a9377e958c645fa975e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258253, "uuid": "35a37862-4ca1-4458-9f58-42fd3d7f1888", "comment": "Malware payload (VectorStealer)", "value": "7979a87c85f0a970e5f1664e1bdf838b80da7591e73a74695d829ac07d3ff8dfd82cda5483ecea10491ccf116e84c003", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258253, "uuid": "acc9cbdc-e5ad-42ce-96bd-02de371d6c3e", "value": "T1E8A5E1E42AD8C9A3F384C57490B4EBFB8679607A1D534111E9BFB6EDF718BB86C15200", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258253, "uuid": "fb0aa76c-2b5e-4b6b-a4cc-1feff07b83ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258253, "uuid": "4fcfc624-74f6-426d-ba33-c7b25d7ccdbf", "value": "12288:soProkp7rc7fVGcz4Zmtnvu6aWlXU3XMcZtXuWTCVHBSP5ce+UUs/7RuMT79JaKK:shZMZsvu6Hl2McDa9i+UDz8UaoC+yTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258253, "uuid": "dbf81c84-ca91-43cb-b119-3ec3438845ee", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258253, "uuid": "d5e88c92-9fdb-4dcb-8b70-c4dc8fca6f82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258253, "uuid": "118efaf2-fe80-4a07-a3ab-dceec6768212", "value": "979b9d716947bbcdc72364d800714cb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60fa088c-2aa0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690257880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257880, "uuid": "64d5fea3-25cf-4022-bc27-e07ef14e1a9d", "comment": "Malware payload (AgentTesla)", "value": "87b5d7e79ba17f3819a61ec39099defd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257880, "uuid": "4b50d1cf-9035-4f11-b578-ecf43a63de8e", "comment": "Malware payload (AgentTesla)", "value": "699a19c6832f8848da4e76fd02f941cd6be4cb615b1bfcbe94205549cf925d8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257880, "uuid": "241a4d31-2012-4dfc-9297-bcf57ed1376c", "comment": "Malware payload (AgentTesla)", "value": "a71e22218e8391cfd7ddbda518abedab3eb6a3d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257880, "uuid": "87782811-575b-4c91-9a62-ffd39cfee656", "comment": "Malware payload (AgentTesla)", "value": "bf181cbc5f16c8986d7d05a984a8314e0e5733af7c6bf8c9e65daa312a12a05c43bafb0a26c89d0d4c9cc4cf4234aa2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257880, "uuid": "903ed833-04bf-4b25-8e15-fedfa42aee54", "value": "T1F5753939158888CCEE87157E8CD2226EF9679946CBA302781F24BC459FE7978C4D0FD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257880, "uuid": "d3e9e3d3-6cb4-461a-9109-45876bc3f04b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257880, "uuid": "fd8012ed-f345-4e1d-ae3d-0980c3d0dccf", "value": "24576:s0u5dUmdUhRR6C+Mq/z9bc4d3nUl//Ghus1e4M0EtMqnJnE8V:s0uwTB6C+Mq/RcM3nenGhE0GpnJxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690257880, "uuid": "29eb985e-fb9a-4dca-bc26-04c4d635fe77", "value": 1583104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690257880, "uuid": "f2d5c48d-1f01-4648-acef-a90006398e3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257880, "uuid": "5e39e5e8-d232-44b2-be56-81dce412e528", "value": "87b5d7e79ba17f3819a61ec39099defd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4d19f2-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690273953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273953, "uuid": "4a75990c-a7cc-4f78-a758-0f9efaa3a1bc", "comment": "Malware payload", "value": "43cc70199d6888e2bfef4edc477808f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273953, "uuid": "bba28d30-2adf-4e50-91b3-e8c4a438eac5", "comment": "Malware payload", "value": "69e730f8b0629ab1564ebc645b2d449a3cba764a8bdc24af0997749cb9db45d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273953, "uuid": "831c5230-e027-4a4b-bd08-008856de232a", "comment": "Malware payload", "value": "72a473cb7c64817cc764b47a92aa1e30350599fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273953, "uuid": "e9583863-969b-41ed-aae5-127c82ba61dc", "comment": "Malware payload", "value": "44210d35dd5ef3747b872093cf290f657697f40829c0a7d642ad34b96a53f803a4672c28c0590f208a60dbdc8f2ad4c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273953, "uuid": "be0282f1-481c-474e-9854-bbceecacce4d", "value": "T16DB49E32B6514833C1135B795C5BA7BD9826BF503A28AD833BFD3D4C6F39282791A193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273953, "uuid": "2541622b-c4a4-4a5e-ac5f-c99dd2a37393", "value": "a5604067a4504d3dc22125dc11fa2fb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273953, "uuid": "42855a3b-6551-4f57-a77f-a386368f4656", "value": "6144:7Eq3WpccVzOKL77gFfCfodpHyTPNvkCekiCvhk/iKtiUOqJjSh5oU58bbllJYe:7B3Wpcq78LdAPNhe9COiKU4JjSoRbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273953, "uuid": "c4fcc456-2013-4146-bc94-e187878d85b4", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273953, "uuid": "64ec946c-4283-4bc5-b917-308acb81f75e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273953, "uuid": "cee05535-a09c-4826-923f-d08d42dca5d4", "value": "SecuriteInfo.com.BScope.Trojan.Bitrep.29688.12631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b13cd0d-2b06-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1690301786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690301786, "uuid": "d581e9d9-725d-4f01-b4e3-398d67258633", "comment": "Malware payload (Fabookie)", "value": "d3df81fa3bcaeed0e35c7189ab32c8aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690301786, "uuid": "8422e6ba-82e1-4ba1-822f-73ec3f49682e", "comment": "Malware payload (Fabookie)", "value": "6b18ec5cae276be9f2cb878aab10cb95d0181d3add903c265907f6a97fe8cda4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690301786, "uuid": "7cae5382-1d02-431a-8d85-581fafc31d55", "comment": "Malware payload (Fabookie)", "value": "07d31d6c83b1e0f35af5d2909d8113ba203437c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690301786, "uuid": "9e083ffb-be33-4775-b210-497e0cc96fed", "comment": "Malware payload (Fabookie)", "value": "318db36f7312be47d9c42e1b8d5da50a96e84d4d667a16575d5b357f81152f171e4defce5f4492850b9f30f3caae020c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690301786, "uuid": "2c1c27c7-420d-4371-816d-4b8129be4988", "value": "T18784DD64F0B2ECB3DA126B7039FCF91C91AD71551386869E365AF0B692D330031DDBA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690301786, "uuid": "2a309073-05a0-43fb-b5a4-7605fc158337", "value": "96cc98468ed325b3857363887597bc67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690301786, "uuid": "2d1bf617-c93a-4354-b0b1-14cdd7c1a19a", "value": "1536:qyK9MjWCNKIuOCWqeyGaOi2K+Sm6uCWqe+aOi2K+Sm6uuCuCWqeyGaOi2K+Sm6u1:qX9MVPuUXnAYy4AZ6DvcgJFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690301786, "uuid": "a887133b-215e-4a4a-a5d0-7000ffcff0ba", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690301786, "uuid": "3d3e1a65-5c41-4a07-b583-f6500b203aa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690301786, "uuid": "dc07378e-c4f7-4499-b0fe-b02c574e470f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a3825d-2a9d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690256767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690256767, "uuid": "10d8ca6c-3f7b-45de-952d-2f279aa241c9", "comment": "Malware payload (Amadey)", "value": "a36331a116a2602012468b1d9f045790", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690256767, "uuid": "0b432f66-ddb2-46b2-b3a7-769f743bf717", "comment": "Malware payload (Amadey)", "value": "6b7cb068d3f3d4e2b7e50f06cb3a58dccde129c91852914b62ee7a2720ed113b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690256767, "uuid": "1b56911d-c30d-4206-87af-aa872ac37550", "comment": "Malware payload (Amadey)", "value": "6365c350216043550e519324d68007923cf3e274", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690256767, "uuid": "20b9b7a9-ec12-4fc0-9342-9a91c3a7201f", "comment": "Malware payload (Amadey)", "value": "9f56a6718417c133831d50995b4cc547d3dfde1dc7b36f383dcd4217b4551e0e3cbfc717ea20b869057cc4762ba741f3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690256767, "uuid": "b66490b7-1c91-438e-a4ad-8d87846b7915", "value": "T100E2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690256767, "uuid": "bd2c6f2e-950a-41d2-a939-01075676c67a", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690256767, "uuid": "cde7981e-ddb7-4287-9cdd-8bb12f7b640d", "value": 33265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690256767, "uuid": "d2459a02-cbb2-44e3-a57f-ddb538b76971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690256767, "uuid": "269c0d78-4d44-4627-b85e-279e40b6ac1c", "value": "a36331a116a2602012468b1d9f045790.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4949f4-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690282090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282090, "uuid": "19c30299-ee6f-44d3-9e70-b21ba29877fe", "comment": "Malware payload (DarkCloud)", "value": "682f00df92d5cbde1e437ed310cd9c63", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282090, "uuid": "ecb9d821-7cfe-4e48-8f93-3336b2eb8b3a", "comment": "Malware payload (DarkCloud)", "value": "6bbbb66c3488291feee8db06cb7acc0c837dc5758dc1b7c2446e035eb239a5b0", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282090, "uuid": "a88e398e-ef36-4e1a-a69a-e610ea72f141", "comment": "Malware payload (DarkCloud)", "value": "3977904a23fc02fa90bb632664b5f9eec0f27100", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282090, "uuid": "af7c06a3-c326-4959-85e6-0c72938facc2", "comment": "Malware payload (DarkCloud)", "value": "0f6598126bd276c9caec51d0dd9e4be33526f7bf68c3b6ccd39134ab32fbb7095e15fde9fea7b902ef540ea1eef1d2a9", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282090, "uuid": "c4ef44f9-9204-486e-bc8d-98e1ffad4165", "value": "T132A43A26EB60612EF063C8F1E6E452576894AD7712A8AD1BF3815F0936351D3E8F072F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282090, "uuid": "58ee3399-15a9-457a-ad78-f2b16549c4a0", "value": "de17b8441a9e3905b88bfe7909089a80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282090, "uuid": "84f3103f-b661-4eae-9ba1-7182ffc355a1", "value": "12288:7nq9ahuwlWR7Gl9vzZ1dl/LxMrKCq5jYKkJj6GmZU:/hVvl1dl/lMrK3hYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282090, "uuid": "a043340f-3103-4a1e-924f-f30226ded92f", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282090, "uuid": "67dcfbcc-dc57-4066-841c-61829b2794c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282090, "uuid": "9fe05b6d-9891-4e2e-a3cc-8d6a1e715837", "value": "6bbbb66c3488291feee8db06cb7acc0c837dc5758dc1b7c2446e035eb239a5b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90b6be6-2aeb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290213, "uuid": "86397de9-d7cb-4a61-a35a-02543a020575", "comment": "Malware payload (Amadey)", "value": "54c918a054a58d3fe6838ce4c31344ae", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290213, "uuid": "3a442ee2-5d2e-4961-887a-2da4653a0d00", "comment": "Malware payload (Amadey)", "value": "6c3c673ed879b79fe56de07cf67f2547b37ddb371c94a074e9184833681145b1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290213, "uuid": "f7ccba62-7ddb-4b7d-8032-06cb3877e309", "comment": "Malware payload (Amadey)", "value": "84132b9e7a9dfb09181d37588e2d69c9dfa7d8c7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290213, "uuid": "bf2332fc-246f-4c00-a4c7-4a73300bff08", "comment": "Malware payload (Amadey)", "value": "6df0b45fb1efcf21ba450230c098deb6d9479d6a55d4ea4c6439279ecde5e635cb1e21cbe5900bfe4e6f19816db9b1a1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290213, "uuid": "14290cc8-98c8-4f99-9067-7f4ca0e1b04d", "value": "T1C3840152BBD85532DDB467B068F703830B36BDE159B8836B3786E85E48B25C0683572F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290213, "uuid": "348b28c2-eccb-4fe9-adde-2c900323f028", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290213, "uuid": "9f4b0cf9-153c-4394-aa05-cfb0878d4722", "value": "6144:K0y+bnr+Xp0yN90QEcHiyKnpVK7KFibk30yxOF+2SlqcK+usm64j1pSSQAJM2Y:cMrPy90GSpk7KwbbyxwMqcRusmDZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290213, "uuid": "49e54424-d3eb-42b0-9e1e-3b08b441aacd", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290213, "uuid": "1f7449e5-5519-49df-b38d-eb8b7a880d4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290213, "uuid": "0e0bfd80-58cf-4361-b723-5d11fdde100a", "value": "54c918a054a58d3fe6838ce4c31344ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245b9e17-2abf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690271093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271093, "uuid": "163a664c-5bb4-4113-934b-e9b962c7f2e9", "comment": "Malware payload (Formbook)", "value": "42274be151cd98b40f9b9d9c7b390f75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271093, "uuid": "655ff055-7b0e-48d3-9fb7-4f844de4cf15", "comment": "Malware payload (Formbook)", "value": "6c5d418831206f110eac092468ea4197e3253f3350e48b0986e130995bd46451", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271093, "uuid": "3b678cd5-4829-4193-bc69-234a327fe067", "comment": "Malware payload (Formbook)", "value": "18231e157bd13e26c6ee1bb53752bafda34a20dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271093, "uuid": "af0f6615-178a-481b-ade1-7fb337eeffdf", "comment": "Malware payload (Formbook)", "value": "779e45453b2b25ccc462ab93b0fdc307d5296fb62449ee3e7709801db83011b7a6f5f2284f10ac354a73f52a0b5ba625", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690271093, "uuid": "7647103c-f528-44d1-b0bd-33c0cade27e4", "value": "T189C423083BF8DF74D7AF2B745672585503B1A86B5E31DB29AD81B0C3B953B100B5292F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690271093, "uuid": "99f082d4-3bdc-44cd-b1a3-19ce4bfded8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690271093, "uuid": "0dd6f7f6-9337-40e5-9bb7-374f7aaf9dff", "value": "12288:t6h3LkdwrZjM8obBSp4BcAWRFmVvLgWmW/vLhWfW2vLqOf6/zrkBH6R:sbkmj9Iwp4qHRMVvmW3Lx2v+MOzgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690271093, "uuid": "25d10bcb-c6a5-465f-96db-f9cca0fd6193", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690271093, "uuid": "e3290a62-f72d-4a06-82f7-8caafa3859a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690271093, "uuid": "47f2b21c-790a-4ce4-b96b-02f7141cbb01", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd50abf-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268824, "uuid": "554122e5-b233-4777-af4a-b608f14317d6", "comment": "Malware payload (RedLineStealer)", "value": "ded7a853b99b5dc08e7c42ba5e7b0887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268824, "uuid": "66f6a23c-ad63-4abb-a6bb-8d8a85c251e6", "comment": "Malware payload (RedLineStealer)", "value": "6cd1ec6ac45497f1b99390cf5747efdcc7998d1a708b60f64193526e13d673e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268824, "uuid": "e0f76530-db44-49b7-88e7-1f16b86b5c11", "comment": "Malware payload (RedLineStealer)", "value": "420aac403eb864b6aa30ee9c7bc8fa9edf415e83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268824, "uuid": "a54f59ed-324d-4570-a4bf-ead66cda2226", "comment": "Malware payload (RedLineStealer)", "value": "375f6fffb062ca9b0becaf32f1f955695f3903cddcf2c1d68a7eaf53098af6350552aea78f5e43c392e137d17187201f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268824, "uuid": "212cf7d7-6470-4638-b154-9cd46c8a4203", "value": "T180B40253AAD88077E5B623B01DF607930F3ABCA19CB4875B2795998E0D732C0A435B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268824, "uuid": "f49238cb-1915-45ad-8c31-a5f46bc1d344", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268824, "uuid": "bfd43e15-dcfc-4ea5-8ce7-1583624653f8", "value": "12288:CMrJy90Za897Bdz7p786jjRDZV5bvX1r+OLZ3vVo:TyX6tdzqGj5jFZfVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268824, "uuid": "2ee0177a-ad43-449f-97c2-177eaadb3d9d", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268824, "uuid": "ba8fc144-c677-44b9-b416-d96c27a12d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268824, "uuid": "86a78cbe-131f-4d18-b247-903eaf59323a", "value": "ded7a853b99b5dc08e7c42ba5e7b0887.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b600d1de-2abb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690269619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269619, "uuid": "7d3340e2-6e45-4c19-babd-5179c584a500", "comment": "Malware payload", "value": "c78f72e49b0b4459e97697d02b200dec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269619, "uuid": "fe6d5a81-bfc6-4c7d-8b92-aaa9b85c1522", "comment": "Malware payload", "value": "6cea6cdc5065aa7d2e5bbe185355dd27386ef0f3dcaafbf4636d89abeff77bb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269619, "uuid": "a35ddfd2-746c-41f9-871f-7727100b7b8f", "comment": "Malware payload", "value": "a2576af5e7d152c93de7924a130b03a3734d6e9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269619, "uuid": "c7377687-9e9d-4144-a9fa-6348651973af", "comment": "Malware payload", "value": "19951537b50e267c3c383201b85776bc9c8ed5d7823982ed05e2559e6c64a8938655815553f088670e64314b5f77a51e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269619, "uuid": "35189987-12fa-40ed-be40-2143763c5874", "value": "T19875831CFFA1F804DD563E7BCEE621048B7262D12B219183715A6EFD4B45B3688E61BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269619, "uuid": "0bdf9f28-6d5b-4d01-8d7b-b31211f2cbf9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269619, "uuid": "51bdbd18-5261-413a-8a88-1660536fa5fe", "value": "24576:esOg0IUCehjNjpCVhi3rHrf4v2oPYHGhK:esO1jCexNt8h8vhoBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690269619, "uuid": "10c51b81-1858-4589-9319-83bdf2eec1c1", "value": 1699328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690269619, "uuid": "ccd001e9-6dcb-44e2-927b-a1d0d1f5856e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269619, "uuid": "ca5c6c71-4e31-4aa1-a639-3923524795a1", "value": "tmpD763.tmp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3310ba56-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268540, "uuid": "d32dd776-c371-4a86-8af0-9ce24a199f6b", "comment": "Malware payload (Amadey)", "value": "ba7c1433a8a2bb1e7b1a368615558d17", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268540, "uuid": "b2b9e9f7-a500-4213-812f-a6ba2efd4800", "comment": "Malware payload (Amadey)", "value": "6d0921e34f705333317843c9a614a376ab59d2cfcaa9ec69518278d6cb987fa9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268540, "uuid": "b9445e0c-996c-4aed-8e70-2d9a4b60a65a", "comment": "Malware payload (Amadey)", "value": "e095d3469f3f360cd6d5b378667c2ae694909b73", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268540, "uuid": "f76496c4-b742-4bb8-ad67-f19bf030cdc3", "comment": "Malware payload (Amadey)", "value": "072ddc688ca027f17a544fda04bf12c31c64a00fb091969ebf3075eea0d90dc0b847f2d4e65c8f99ae3e859680ebef2e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268540, "uuid": "5cd4c07a-37d4-48f2-b1fe-520636c3bd19", "value": "T1BD2408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268540, "uuid": "b7a57bc1-0af2-4dd5-bbed-b1be3eff47ac", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268540, "uuid": "6a7caeeb-a70d-4e26-ba84-b57d3b106175", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268540, "uuid": "92241396-8495-4278-b5f5-dfa254d8ac01", "value": 229254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268540, "uuid": "9feda9b3-d588-4ea4-9a88-21cdd35bd8d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268540, "uuid": "8e802e9e-8a18-43ac-b61b-65e1cf967fbe", "value": "ba7c1433a8a2bb1e7b1a368615558d17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d0ae9a-2abb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690269642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269642, "uuid": "e10acad5-d178-4faf-a61c-9b6296177c2b", "comment": "Malware payload (AgentTesla)", "value": "f913b3e196839a26cde9be45d08f4b40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269642, "uuid": "6b176218-e56a-4923-bd34-311e079d0681", "comment": "Malware payload (AgentTesla)", "value": "6d72f4025da3c4ecb04b853671c5554d401cb308191784b77508e4810ca4acd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269642, "uuid": "ce53b6cd-76b1-4d69-a6e7-e368868a168b", "comment": "Malware payload (AgentTesla)", "value": "9e4411c8c557e060928685aa847c30cd3718f25c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269642, "uuid": "16a69ca4-5e6d-4bf0-908a-0715a54a08dd", "comment": "Malware payload (AgentTesla)", "value": "38486de6e2330ba14333118f17afc51803d415f7766fab1dda91136cdeb03e16b314e2a11a6f36ac50a801c4d5652d46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269642, "uuid": "e754e79d-bacf-4348-804c-722b72b7ceab", "value": "T10FE423B0D36C6A6675349B5F8F8CBA1E3D4160F48E2DF52A06F0688DD092B74B2591EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269642, "uuid": "476be8cf-0600-4e59-bb17-5d0990807ca6", "value": "12288:EgJNx3pphWZpiGHiSxCFL33RdjHNs/SaoA0kLYzh2bSMTU1/IhY6GN5jMBSA:EIxbhWHiGCt3hxO/P2k0JMKJnh+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690269642, "uuid": "ac6016a4-9b43-491b-a749-0d3c86ffaf9b", "value": 666847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690269642, "uuid": "45809bb6-cf38-4881-b7f4-5f909a8ec7f1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269642, "uuid": "39ada3dd-e95d-4477-bf1b-3ce34456567f", "value": "Our Profile.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7605a711-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690308596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308596, "uuid": "0f5616fb-3355-4703-a991-0167c5351243", "comment": "Malware payload (AgentTesla)", "value": "53220acd807b2ac5079de82eec7a786f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308596, "uuid": "59916ddc-470a-4863-9690-9d8b614c996e", "comment": "Malware payload (AgentTesla)", "value": "6e85ae5489a02c4209e4eb062b52e6dece076e12663e7aaa2e8e497664643a8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308596, "uuid": "cc1e7f78-043c-4851-9be6-6d0f93629ea3", "comment": "Malware payload (AgentTesla)", "value": "fac8aef1a8a8ce42ac36dd6a3e78ccb3a6182a7b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308596, "uuid": "c7fefa51-33c8-4fc8-94e7-37f3466fe25f", "comment": "Malware payload (AgentTesla)", "value": "381eae5ae44817c4c2fd9ee9affe8423da50db4264f9aa146623e62557262224e22ced51b4930994423145322861c213", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308596, "uuid": "69af479b-0b1d-437e-9a4a-db1473327df1", "value": "T165458DD1B1908D9BE97B07F1AC2A653011E7BE9C64B4C10C5E9A779B26B3341209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308596, "uuid": "c8f7ab25-7639-4bbf-a75f-8855d8a0ff66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308596, "uuid": "3b2a1b25-ad47-4f58-baa6-c6399f56f0a3", "value": "24576:lxOzHIcTrGCSHkvCW7WZL+bZ9pX79pd5V/h:zwHIkrzSa/7C+ZP9j/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308596, "uuid": "f9e45ce0-99fe-4484-aac7-2587cd6017d5", "value": 1200128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308596, "uuid": "5199d3cf-30f4-4541-a9c0-b589c6cf6d2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308596, "uuid": "4e9e488c-c57d-4584-aa4b-351734708900", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b547a52-2abd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690270326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270326, "uuid": "0bb66d25-281a-4236-8a4a-14a53d51f3e7", "comment": "Malware payload (Loki)", "value": "7e2662004aa42dcc8009e71eb036d6b2", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270326, "uuid": "a75dfd0c-4cf4-46c7-b3a7-ec8e503afc4f", "comment": "Malware payload (Loki)", "value": "6eb237245b12fa0069cb7898786b6517fbf4a5cf0f12060fba3da9d52fdade5c", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270326, "uuid": "3a42acf3-db8d-462a-9926-50e8c287df99", "comment": "Malware payload (Loki)", "value": "280b32be0bd0e560236d50ecb8817cc03170fa16", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270326, "uuid": "9a2c1ac3-16fc-4183-85f5-e97ab980f23b", "comment": "Malware payload (Loki)", "value": "901daa165aa9d607e7d744bc4a38e510af566175e26d306bdb4280611bd488e715783d5a8933db3d475ecf4f7d7c168e", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270326, "uuid": "b40410d5-e4d9-4d87-9170-f4c728c73700", "value": "T1D194230AAB62000BFC69F48DE28ABB144914F7A11B0FBB96504873CD259753FDCA9AD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270326, "uuid": "07350095-592d-4e3e-8e05-550b48e204d5", "value": "12288:HqCW1y9r206dwYtG2uJxz7NAieAEHlBpCwFDu:Hq311bw3BxzxYHjTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270326, "uuid": "8f6dc8fc-577b-4bec-a47c-a0335182499e", "value": 443089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270326, "uuid": "45fb1c7c-8b79-420e-b0f0-961370254f5c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270326, "uuid": "0db57344-1a60-49b9-8c19-ea70f865aee3", "value": "Proforma Invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3577d881-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268544, "uuid": "9a23fbbe-e78c-4774-9900-d7fe496584d2", "comment": "Malware payload (RedLineStealer)", "value": "ac486ca366632ce0fa3ca502c9bf05af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268544, "uuid": "9a853fba-17b5-437f-b3d1-93a96a5e9f1b", "comment": "Malware payload (RedLineStealer)", "value": "6ee7e1f5ed634bf6356cf45195f080abe10a8961ec53e3a9e2896e98a9dd9355", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268544, "uuid": "6f9ccf1a-77c2-4e0a-8d75-10bc0c27a4b9", "comment": "Malware payload (RedLineStealer)", "value": "884db12b88c73df2779faccc6504f441ec0ce67d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268544, "uuid": "01634b26-ad96-4d47-8664-afbc0b50f3a4", "comment": "Malware payload (RedLineStealer)", "value": "fb917bf6fcae21cc9cc2c277f5f10fd561b24e3ad0149da6b17feea99cf3d75fcd222665787fe81d4c0aa8a523aebf39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268544, "uuid": "cbcdcdf0-2527-45de-b006-12692da8aad4", "value": "T10EB41203BADD9132C6B517B154F607930B3A7C62ACB4876B3398A94E4CB35D0E63136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268544, "uuid": "49388c19-1566-4cd8-b767-1ee5bce1be67", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268544, "uuid": "f754e18e-9218-47eb-83c8-e397225d0fd3", "value": "12288:EMroy905et1b2zyDLLoK0qeiZvDu0sx1KE3wpb:Uy6sK2f2KDGPKE6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268544, "uuid": "cf840acc-d48d-4da5-9a65-c55602be88bd", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268544, "uuid": "256152ff-14ae-4406-bbd2-5167f24039df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268544, "uuid": "ad87d2a1-2ceb-4786-8370-3d4bca78314c", "value": "ac486ca366632ce0fa3ca502c9bf05af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f89ea2-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690308646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308646, "uuid": "dcaa6757-366f-4113-b08b-9016c9add009", "comment": "Malware payload", "value": "458282c2f67af53e32d807a54b13d9ab", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308646, "uuid": "a4ad1ca2-34d8-4929-b3a1-b5d5bb8381c0", "comment": "Malware payload", "value": "6fc5a46e51f003429a4620082cdeee106a32f3c0ae57eb1a3d03f8fcd5b3fac0", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308646, "uuid": "d8d7e361-f2a0-43b3-914f-2fdecc5567b7", "comment": "Malware payload", "value": "6f60fd058c7d08f0f658ef307b7e24ae8feb088f", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308646, "uuid": "dfe348ab-6ef3-41c6-9e8c-430955cd1618", "comment": "Malware payload", "value": "d14d3c84a5e5c724e1268e4a97bc413494410ab4b9ee376c876a72d704e494b3d7d99dd4fc0a597565aed553203c8d74", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308646, "uuid": "c0f47121-53fd-4227-9156-b3d312c20e54", "value": "T1CAE4AE57F7D7FAB0E6FE827A82B1891C527774520260A78F674072896D23392493DB0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308646, "uuid": "71d15e31-702c-4cbc-8e0f-22f0f926faa2", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308646, "uuid": "03e2cfd5-0bda-45e8-b650-070101ed56ee", "value": "12288:8n/zDvGHAykHSzLW/4+8bzbBSreMdshgFK/UqWeKk2rAqi+h:OzbGHAzHAjX1LcLeh2r3i+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308646, "uuid": "5bc2c341-167a-4f95-84f7-4bb12948f2c0", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308646, "uuid": "1f74ee69-e296-4fbf-a76e-7a478dcd62df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308646, "uuid": "2ac171b7-b5ce-4b91-b30d-a4320bce266b", "value": "Design sample 75398.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b21fdc-2b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690307528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307528, "uuid": "ac055439-d62f-4b2d-bc3e-c5d20a047be7", "comment": "Malware payload (SnakeKeylogger)", "value": "152160bfdc106ec5d9560a7220517d2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307528, "uuid": "5364a4fb-7ba9-46e4-add2-50f9333618bf", "comment": "Malware payload (SnakeKeylogger)", "value": "702a33366413dd5d4e73406e4559090bb204cbf1b80f04157f539bbe4610ccaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307528, "uuid": "dc26b437-574b-482a-859b-b8203afd891a", "comment": "Malware payload (SnakeKeylogger)", "value": "2a12947d541eced217b849ec80cc22959679c82f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307528, "uuid": "0722eb9f-0691-40a5-b167-55ee5baecfc8", "comment": "Malware payload (SnakeKeylogger)", "value": "8a658a02db99aea886b27f7779a406f35ee2a21366b9a513ccd38ebc5f1ff45b1145c0713a6f94fdd4dd562b6715748d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307528, "uuid": "caf4e46a-e01e-48cf-b1d8-e3da40ab423f", "value": "T145D423215A56896BD02A5FF91550BBF5B3BCFFD43420D38A2C83F0DAEAB5E4C9361112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307528, "uuid": "18885618-4b37-4acd-9be6-5ef70589defd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307528, "uuid": "b3b94711-d0b3-4c2b-a89d-503423204348", "value": "12288:lYiIoFwIrG3XCCaddZG3372POkW4lwKmfWS19nc63uLf:lHIcTrGC9dZGHimkW4lXmfWSPc0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307528, "uuid": "f272eb37-709e-4265-952a-a375e4b6d083", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307528, "uuid": "d7dc2f25-2f96-4cfe-a9c3-a3a6786821a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307528, "uuid": "0f02b118-dfd3-4e33-9b5b-80e47088a63c", "value": "8557_3312.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd3d589-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690296932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296932, "uuid": "a4dd1fc8-fd0b-42f7-89c8-104e4b741e82", "comment": "Malware payload (RemcosRAT)", "value": "8b1059451f32358be0301999b57a8e8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296932, "uuid": "58a1e400-7c1a-4d95-b61f-353c54d530af", "comment": "Malware payload (RemcosRAT)", "value": "70d96c94df50bdde7114a022880f0cb0be3a671e5952e4e007af121f3b01e7a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296932, "uuid": "5b53e5bb-d3c8-47c7-96a2-21eff518b50a", "comment": "Malware payload (RemcosRAT)", "value": "911a422f1a167c61654d14790ca91f5f26af459d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296932, "uuid": "ffe763ab-198c-4806-b48b-4115d3fe2ab7", "comment": "Malware payload (RemcosRAT)", "value": "e6fcc886c41fbc5bf4009a4a372c3996b3d251a123a1ff6eecbb1edc2713e31818d9391d1b1436c90b8ac56ca6a43d07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296932, "uuid": "c8dadd71-3d85-4013-be02-b126fdab782b", "value": "T1DE15BE11B2D08933D15F3D384D5A9B59741ABE102D2CF98B7BC53E8CEB37282B815DA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296932, "uuid": "b89ba8c0-3461-4257-a3a6-73a46cd36476", "value": "5a228192c4ccf136d4c97f1d42c75f4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296932, "uuid": "8756a5c7-6b04-417d-994a-372fb14d751d", "value": "24576:qgVL/HkvOe7zm1OHMVy500RNJn13ZsP54J06:5lMGaNbbJ1Zc4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296932, "uuid": "f99114bc-1945-4d36-981d-c706e7c521d2", "value": 879616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296932, "uuid": "334553b8-b555-4158-9fd0-806235442e1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296932, "uuid": "faa2f977-44f0-4d1b-b040-a8fe2ebe373e", "value": "8B1059451F32358BE0301999B57A8E8C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6744e83-2b44-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690328488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328488, "uuid": "8c19348d-7a8e-4b5a-b22a-30d8dcc9bba5", "comment": "Malware payload", "value": "171d2a50c6d7e69281d1c3ef98d510f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328488, "uuid": "9fdea47d-384f-4548-8391-10c335b5e693", "comment": "Malware payload", "value": "713b699c04f21000fca981e698e1046d4595f423bd5741d712fd7e0bc358c771", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328488, "uuid": "c3119de7-cf97-47cd-b02a-d36debe9642c", "comment": "Malware payload", "value": "322db4ca435004a127acd4171cc52be9edaf5338", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328488, "uuid": "2b7e8249-fe12-4444-b24b-0e14bee4cf11", "comment": "Malware payload", "value": "dd430d9e5eae9933d67140c0accc66da8223f751de78d68acfb5495f8c5e87347c8984663532f716ea22badc1dc92746", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328488, "uuid": "21366f3f-1700-4fd4-b9a0-588bda4b2468", "value": "T18DB54C43B8A065EEC4AB93304D5192D6BA70384D173863F71BA197B91F72BD4AFB6700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328488, "uuid": "9150bee8-5cfe-4511-9f5b-f069d9f160c1", "value": "49152:bC9tUNrb/T7vO90dL3BmAFd4A64nsfJcm9M3YJIpgfDVw0ksgg778GzvyKYUcTD1:bzcM4IyEWyKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690328488, "uuid": "19505ad7-3990-45d0-80f0-c0bc6f77b060", "value": 2367488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690328488, "uuid": "96c059bf-2b72-49ac-b506-e187067d886e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328488, "uuid": "98fe81c3-792c-4100-8f86-2dc8f273ebd4", "value": "713b699c04f21000fca981e698e1046d4595f423bd5741d712fd7e0bc358c771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d370894d-2b08-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690302740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690302740, "uuid": "56aa94b9-2e84-4fd9-8032-ae1c48ae8fa8", "comment": "Malware payload (RedLineStealer)", "value": "fdf6b17c3ae46d5761d3e6e417fb9b1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690302740, "uuid": "ba1db8ca-d23c-4fd1-abab-4d8166633f43", "comment": "Malware payload (RedLineStealer)", "value": "718034f9b541fdf7866851cd4ced6b406e07952944717e4291b38e75ac763e12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690302740, "uuid": "2ba4869b-c952-41de-a3e1-8e3df4a49118", "comment": "Malware payload (RedLineStealer)", "value": "d6ad48bcc77f753c7ba6047dcde6a178db3c2eea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690302740, "uuid": "f55c31c3-c96a-4fa9-96d9-8c7d932a6ca5", "comment": "Malware payload (RedLineStealer)", "value": "06eb09cdb741ea0eae704c192c902a405aa2f15a64bf94d72c410a987d4a3d6f849e186fa38a8a53bc6beee6a7f0bb87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690302740, "uuid": "624ef5ff-b321-449e-ab5f-65043454b72a", "value": "T12274E0217590D077D0A36A310870C6662A7AFDA2EB3486CB33D83E3FAE712D05675B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690302740, "uuid": "d4391fc3-ceb3-4cb7-b2b8-51390cd7e08f", "value": "21f576cdd9781dd6a4a8eb3639210862", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690302740, "uuid": "3b6a5014-002b-455f-880e-4d497f97b21c", "value": "6144:XZhZgGTk/oPXfPKaEyfc4gYVxv/K6xCOT5UzkqW7tJcnAvI:phW8kgPPPK2fjFRUQ5YuJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690302740, "uuid": "4ef35432-a412-4411-80f0-4f96841f7d5a", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690302740, "uuid": "579763cb-ab91-45b5-9c13-25f4dc76361f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690302740, "uuid": "e4742a80-19ca-47c1-acc0-2564d77ba6b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3837feab-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690290453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290453, "uuid": "576cdf78-d95b-4a2b-a7f2-44f4a6f30e84", "comment": "Malware payload (RedLineStealer)", "value": "4263fdb87c02e3f55863ed2b34abdba9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290453, "uuid": "2fe7c2fc-a4e4-4884-bb16-86142f31a72f", "comment": "Malware payload (RedLineStealer)", "value": "71a14398385c0ba2d0f044b02f2de64b249d7266600d655274e22b2cb5139845", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290453, "uuid": "05b502e5-3bb2-40c6-a30d-114b3c0783cb", "comment": "Malware payload (RedLineStealer)", "value": "5cc25ed8f3c4764898034d9835fc9071ce6e1538", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290453, "uuid": "1034be11-2499-4144-992e-aba7fb6e8267", "comment": "Malware payload (RedLineStealer)", "value": "9dd416f3839eac604b7f9ae842f39753915d31bb2a94462dd186a12871940a24b32f675cbf45742dd2c6e898ff6ed7cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290453, "uuid": "baf748f7-48d8-4af2-aa41-8bd6676037a6", "value": "T1B2840253E7ED8072D8B5177058FB02930A3ABCB18C75936B234AA95E1D722D4B47236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290453, "uuid": "20da7197-f530-4fd5-96fb-75631c75205f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290453, "uuid": "225f9845-fdbf-436e-9b4e-e05fb872304b", "value": "6144:Kwy+bnr+4p0yN90QEoWvZCVeyHanMSUGbVqRlGgBZ+t4jDh1ThVK6R:MMrcy906WXy6nsRYgBYCjbTuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290453, "uuid": "855b0820-a262-4f1d-80c6-c386e18588f7", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290453, "uuid": "c4225e72-5663-49b3-a166-5337afd467ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290453, "uuid": "c5a26815-1d1d-4ea2-bf1f-647247c7571c", "value": "4263fdb87c02e3f55863ed2b34abdba9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc347a11-2ae7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690288581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288581, "uuid": "7254ee3f-148f-4be0-91a2-79bda9896768", "comment": "Malware payload", "value": "7196caed7fc7dd4a709841a3e2e5d447", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288581, "uuid": "3fc74622-9b9a-4713-ac2d-01741c575a50", "comment": "Malware payload", "value": "71c1358e98af254a8a390dfe8b3e01827c0fb9cc7431fc81b91d054d31722226", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288581, "uuid": "f1b8d6d3-7d82-4c93-92a3-de4742a1d8d2", "comment": "Malware payload", "value": "ff965b282e841e71d727192738e1d9b4f52f9408", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288581, "uuid": "457ce232-6ac4-46cc-b997-114720a71b18", "comment": "Malware payload", "value": "42640ba34b5665eef75f77d8ee3ef017c1481e9cc511375875c4a950dc276a095d494a542f54e13e887d9fb0c8e4bb23", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288581, "uuid": "6977d6ff-d698-4d5b-a062-1a6ce895ac98", "value": "T1E945EE9D325072DFC857C0729EA81D64EAA4787B871B4207B05F22AEDB6C997CF150F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288581, "uuid": "574419ec-a1c5-449d-97a1-a2ae52061471", "value": "384:HaQyoWLwVt1YFH+Z0J6Y5hpMhANv7VE9cVfUzgpu8r83psrXSM:6QyoAwP1cH+Z0c6pMGFVcqfWEdr9rXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690288581, "uuid": "22c5bcdd-4d82-43d8-98fa-9e38a747e3c6", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690288581, "uuid": "3101760f-5226-469f-8274-7b5df8724f30", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288581, "uuid": "48af6033-2e07-4efd-a873-a81cfd043d82", "value": "99143_1.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cfead8c-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268503, "uuid": "03a60b0f-003d-4c8a-8c10-c9ba8b826dce", "comment": "Malware payload (Amadey)", "value": "a08e48c34720ef2c2648b67ca24b92e3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268503, "uuid": "6fbabbf3-3943-4375-8192-b2c849242df7", "comment": "Malware payload (Amadey)", "value": "7248c31d8fd4aa1376099b289ab738e3d69a796e3fb6c9d3ae939f3a10faacc5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268503, "uuid": "d44dcf10-dbb0-4cf6-a2e8-45bc76aed9e2", "comment": "Malware payload (Amadey)", "value": "32e8997de5fc9c36f9891d301778697791cbaba6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268503, "uuid": "ae89e9f5-8a06-4cd7-8cf5-8d543e39b9f7", "comment": "Malware payload (Amadey)", "value": "f5d992ee78ee533fc864ab0df307f7caee584b04f521cae52c7e2029e88c8daf4cb417ad166a45df1316bf45fe8af095", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268503, "uuid": "fdf748a1-8619-4dc6-9a7e-97705ca047e7", "value": "T19D840223A7D98032DDB917B059F702C30B39BDA49978936B33819E0E0D72691E97573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268503, "uuid": "ddd71201-bf53-405d-9564-c76b24943c57", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268503, "uuid": "48bc86ab-87a5-4f34-b397-171e12880a0f", "value": "6144:KJy+bnr+Kp0yN90QED50wir9NJLG60NWZMnlAL+mH5lRXNAmmANtFOOnyOw:HMrSy90N50b66oCMnl8RX4q6Olw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268503, "uuid": "c3a1a650-1f12-4b01-acb2-a80f72717c11", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268503, "uuid": "e7eee58a-4644-433f-adb1-b773738418ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268503, "uuid": "c48caa7f-8c6e-4b8a-9283-728e211ff860", "value": "a08e48c34720ef2c2648b67ca24b92e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bbc3ac-2b17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1690309112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309112, "uuid": "1341f98c-42dd-4e24-b1a8-4b7ceca27deb", "comment": "Malware payload (ArkeiStealer)", "value": "79ee3f218e6a4a67e44020c5cdd19330", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309112, "uuid": "f1e68f67-1687-43ce-9bf4-c2b21d90ea6b", "comment": "Malware payload (ArkeiStealer)", "value": "726855dc870ed0224d91891b898e542393149b0eaef7817aa332b71c13b22ae0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309112, "uuid": "a4acfad8-15dc-4968-a93e-08c2cc086dcd", "comment": "Malware payload (ArkeiStealer)", "value": "0c1115343c1ecc0491f0b49e0ee62c0dd2977494", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309112, "uuid": "0f2de1ee-a9d3-4646-b4dd-ca5c3cc0d5cf", "comment": "Malware payload (ArkeiStealer)", "value": "e6c53f1486740903cbca33b5dca8bedeadad7e0c9b3c88da0ff9eb50788d5ea2d33cbbc695ff56a33a945b192bc7e952", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309112, "uuid": "5f87e53b-96b3-4b99-81bf-e60ea149eb57", "value": "T12094E01275D0D072D46369361830C6A52B7BBCE2EB7986CB33983F2E6E712C15B29747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309112, "uuid": "8516ed2a-3463-4fab-8151-4d5ad3601e57", "value": "21f576cdd9781dd6a4a8eb3639210862", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309112, "uuid": "87a23cc5-9309-4006-aa4a-29608c329f4f", "value": "6144:nIAPg8tRtSWHXck6eMVhj4aZKM/3QI4PJNCkJCBvlsBZzPeGJ5rxn9BQr0:IA4oRdHsk6eMVnQM/QFUyZJ59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309112, "uuid": "cd8c8bfe-0696-4087-a212-00950a83c40c", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309112, "uuid": "ccfa61ea-14fc-4610-a0e6-9c2597796528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309112, "uuid": "e6d845b2-8d40-47cb-a5b5-441e44f8a75a", "value": "79ee3f218e6a4a67e44020c5cdd19330.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809f2652-2b14-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690307755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307755, "uuid": "86c9a636-8359-46cc-8206-d5c8701604d2", "comment": "Malware payload", "value": "f423d9497992375066197e94b538d8ae", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307755, "uuid": "b8b7b981-64d5-4db2-98fa-ed3b9c5b71f3", "comment": "Malware payload", "value": "73bbebede4d2e4e036d0eba1458156ef62a0422df981eaf8bb5d9771bce8bdee", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307755, "uuid": "6c5bae9d-6be2-44ec-890d-95a26b08d792", "comment": "Malware payload", "value": "77313a5b6edc036cdaf6f4701f6ae00f0e70ea1e", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307755, "uuid": "e30eb35d-6c47-4988-9b0a-f1a6b85d6952", "comment": "Malware payload", "value": "eddee8772dbe6227ea99fbabb5bf470d861769a3fcd56d016b69de6d9f4360192397165ab9d72f861c43c86bf2a5abb0", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307755, "uuid": "a6360d53-5668-456b-b113-eabe7f7010c7", "value": "T1E4E41215B2D49A1BD801CA705EFB71CB061FBC01AED8F6972539775D24B9B3AA0223D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307755, "uuid": "eec7a8b7-f430-4cff-af8b-98e56934ee1c", "value": "12288:GZo3BC6uEkqqCcBC6uEkMqUu9VneVFfBd+gvmhwA4PKPkC/yUKUSucGPfG:jw6sjw6s6u9VGfj+BwAIEHT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307755, "uuid": "6e23d8db-b34b-4ad0-9591-00a41d6e4e8a", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307755, "uuid": "cab5040d-05a8-4fe9-a533-e19e318088c1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307755, "uuid": "8dd67232-348d-4b1a-9ddf-35fb20b97cfc", "value": "ORDER ENQUIRY.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59214572-2b45-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690328734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328734, "uuid": "5289b87d-b1c5-4b28-9ae5-8276c73eade0", "comment": "Malware payload (Amadey)", "value": "dfc0b35c2897aa52a484d4af4a71909b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328734, "uuid": "9d960613-bf66-4a08-9854-1deea20534d2", "comment": "Malware payload (Amadey)", "value": "7441f682fd21444e592c422ca9297f38b71cb56fbebf9d0fce5e50e64f4ab4a0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328734, "uuid": "8b7603d6-a777-47ae-a3e8-758e42491c17", "comment": "Malware payload (Amadey)", "value": "16307fa70e50fedab555ba533f5884e7bab504b6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328734, "uuid": "16ef4626-d256-47e1-bf84-85b7488d8f13", "comment": "Malware payload (Amadey)", "value": "aa80cf741028236ecf29246717231743bcaa6d598f181ac535cdb4baf72134594981b3bdd31831a7bd62f463742b09cb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328734, "uuid": "4fe98990-0974-4b61-b705-e1c9213df5a7", "value": "T13E840113BBC98072D8B527B018F616930A35BC925D78C36B334A991E2D726D5B93273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328734, "uuid": "817de7ca-70f0-4b3e-89a4-23f56832b983", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328734, "uuid": "41d7a6b4-9ac0-4343-983b-35a6825b81b1", "value": "12288:/Mroy90lB6nnuDCPuO7wQdCNygBYCzyabcE:nyiMuPrQdoBztT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690328734, "uuid": "8d9c7a42-a625-4eec-8f7d-f1a304337166", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690328734, "uuid": "f1af99c3-8b34-42a0-a520-125fc80c612d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328734, "uuid": "080cc0bb-45cc-4385-ac01-707496325a09", "value": "dfc0b35c2897aa52a484d4af4a71909b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e804da-2abd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690270558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270558, "uuid": "f1bc3519-579c-4ddb-96ea-0d7641e6597d", "comment": "Malware payload (AgentTesla)", "value": "a568eabf6caf8d9e60a3d89836a1ab8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270558, "uuid": "d7596698-2d7d-4eb0-a777-d17c202f1bf5", "comment": "Malware payload (AgentTesla)", "value": "74e32d627908ba34556010cb469812beab29672d102d1ef23b6e67de10ed9041", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270558, "uuid": "7bfe14a5-def2-47c4-91d4-cc3e3891d348", "comment": "Malware payload (AgentTesla)", "value": "125e6bad491beed8bfb7b72b4c6a69904d41d8b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270558, "uuid": "fab8d3f8-7c48-4ceb-95bf-de38637187c0", "comment": "Malware payload (AgentTesla)", "value": "28ccada1b3702897fd18e75a096ef3dc7c471a96f50c5e49395bf237cdd4a36475de02ac404f19fda745e9c8cc51c5b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270558, "uuid": "aa4f444e-12e3-4168-b808-d236f004d60b", "value": "T1A54412A07AE0E0ABD47BCB742D7C0659AA73EE350175D71F1B106A58B932481F61E3E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270558, "uuid": "7914d691-debb-40d5-8cb6-520abfaefaac", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270558, "uuid": "d4c7f23b-8c37-40dc-afc7-ab8d72f796db", "value": "6144:/Ya6T0OkbnBUR18mA+onqsJhqhKokLIDsfVqkCytiePFL8TSqn:/Yh0OkbuR18mA+EvhqsdLMsf4vjQSTSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270558, "uuid": "b077fb25-b211-4c55-ab7d-329f0281327c", "value": 272974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270558, "uuid": "d6920a97-cb95-4452-91c9-979d747419fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270558, "uuid": "b28e2e75-4b7c-4637-af09-78c5a66fd031", "value": "QUOTE PR009583.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbacee3-2b14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690307720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307720, "uuid": "89f1e45d-11bd-40a0-a89c-9acdfac4f1bf", "comment": "Malware payload (Formbook)", "value": "bd86259ef85ed5eb85469ffb5702242c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307720, "uuid": "eb030c53-d7ea-40c4-b0e5-621c50bc1057", "comment": "Malware payload (Formbook)", "value": "758572b4a482bd4f60e05e1cd8669396ade4eb0a0be89effeb88428658c0debb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307720, "uuid": "afb9f743-9ec4-4832-b5ed-186bed4f01be", "comment": "Malware payload (Formbook)", "value": "5684cff108fdf071b2780ff0606f95a47bfcc398", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307720, "uuid": "7d241abb-1e61-4276-82eb-46da09cc3db7", "comment": "Malware payload (Formbook)", "value": "fcfed6af930613f61458ee56541ae580c5ad2385955be7b5ba76c7774725b5aefbd8b0600bdc74e1844c81023eec0fba", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307720, "uuid": "c05a7eb7-f39f-4eac-8565-2c007799ee4d", "value": "T1C9035B1AE79F02A4CF5102B7631A0A8996BDB33DB35155B1746C833433EDC3E4666ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307720, "uuid": "897fbec4-418c-4681-a858-0bb62fa1eba9", "value": "768:NFx0XaIsnPRIa4fwJMuCvNyFe/u0w4+3CUQtezd3lHR:Nf0Xvx3EMqeW0j+3CUQyVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307720, "uuid": "faa3e6bd-ad52-4e93-b1b3-948f4ce9ecf3", "value": 39754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307720, "uuid": "9fb84656-d0bf-4b07-ad20-732f6f08f9e7", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307720, "uuid": "8d1462cb-ce2a-486e-84fb-567daea03d61", "value": "bd86259ef85ed5eb85469ffb5702242c.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7edd535-2b15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690308331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308331, "uuid": "3ced9bc3-3741-4c45-a5d8-d54b9bb75457", "comment": "Malware payload (AgentTesla)", "value": "36b3bcb27c3820613e5e32f4d4019d6e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308331, "uuid": "91b708a3-5d68-4de8-be19-73035eba5148", "comment": "Malware payload (AgentTesla)", "value": "758ebfe9abda91060e57c14ee1aaf699199a02db641bf5e7db620af5b8160f58", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308331, "uuid": "4f0eab03-1284-4586-afee-30dff80e41bd", "comment": "Malware payload (AgentTesla)", "value": "d82892ddfb420eef95df7c401690404e638c9fbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308331, "uuid": "28f9e71f-ec6a-43ef-af9d-4f000ad531c1", "comment": "Malware payload (AgentTesla)", "value": "05b8d4df69de9e2f5a65ed34c0c5cb6aea733a4d724c4258a122ad793121d01bb4c7cb7ca045e04f4d61011c01357384", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308331, "uuid": "b665e6de-4043-4cea-a457-107d50a17822", "value": "T1EBF4236A377E6E23E698BEB44690D540033661A43D13D3DCDDB670892E97B80BF122D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308331, "uuid": "7177f607-43d0-4c4a-a130-b8889e3d6b31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308331, "uuid": "c4d31dcc-3475-443f-a641-c0e4f1e5c03a", "value": "12288:9kvJRBusykq07Df+LuDhFb1hFlCjDZIGIem6T2ZK/5mjkBiisoy:cFuwq8f+LuDHb/FEDmPiT2owQi1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308331, "uuid": "2c3884bc-d846-4311-972f-339bd97a98d7", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308331, "uuid": "5f68b441-272d-4167-a3d9-c9a6d26f4bb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308331, "uuid": "8ec929b5-b8d6-421c-9a07-4cf4a18db148", "value": "RFQ - AUTO PARTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e21548-2a87-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690247223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690247223, "uuid": "de8489f1-168a-4369-9e07-58a4622b7418", "comment": "Malware payload", "value": "cc4cd10205f5f64a5bd20c2f8e14ab22", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690247223, "uuid": "5e2c9c54-dec2-4efb-bc33-1844a1d3228e", "comment": "Malware payload", "value": "75f2d5c373bb13910ae6c8857a7bc8bc8fcaf6ad823c73870a852dd4de86875f", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690247223, "uuid": "d2b79fde-4afd-4793-a3f6-953794ddad67", "comment": "Malware payload", "value": "da5f38fb762f7fad8cb491dc4ae467184c3aed76", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690247223, "uuid": "626968c8-b0f7-4484-a37b-da7079f14d7f", "comment": "Malware payload", "value": "021d6cf6251b8cb6a4150974a68e77c0350a95858d4c6d2d1329633b6f61f51c1d3ec073108a5e40a37efb72e46e01ec", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690247223, "uuid": "ad4b5d4f-4d8e-473f-a61d-13d92085c9af", "value": "T11CB3F116DD083CCFE26A6BB22B5F3D5F648FF462A0C064A0317D87438360E6B9927657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690247223, "uuid": "ba25a74d-cc3c-4e42-bb0b-f47b05bc184f", "value": "3072:yjHREx/2IvMk9A//eSWEuE601I3w7eb6aSSay:yz8eky/QEJaKABHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690247223, "uuid": "f2f51a56-abb4-467e-b916-8189857502e3", "value": 107712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690247223, "uuid": "afca0dbd-c646-4a15-8a77-40ddf41953db", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690247223, "uuid": "96d940ea-f479-40cc-969c-787511d10727", "value": "Statement-8761253.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5966b588-2b19-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1690309836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309836, "uuid": "40b492ab-e687-41f4-bd8c-f43cecf46401", "comment": "Malware payload (AZORult)", "value": "d19bdfbdcf39ce812d112ab94f452167", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309836, "uuid": "31fc729e-b873-4a5f-872f-9995b2d7d1d1", "comment": "Malware payload (AZORult)", "value": "7668813fa91e72ded7f90af046672d15f2037d6694b087dd5ebec7d43fa78ee5", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309836, "uuid": "4b4a7b9f-baba-4ce1-8161-1d1f1ad5f319", "comment": "Malware payload (AZORult)", "value": "d4a91be1613c2da56ab1bd732cd58722875c9762", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309836, "uuid": "635d30f2-e7cd-4b9d-90dc-1eccf1bdcf1f", "comment": "Malware payload (AZORult)", "value": "91c2d277f39a4b5892aad40a5e1aa5ae71b0d583c70c7df8b9384e1035b8121935933fef521cb847016804b76eae47e2", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309836, "uuid": "d32939e3-62c8-4447-a30c-4d98c207be8c", "value": "T168141287B7E1D8FBC93903358A766B667BFDE9290460564353D98E4E3C13681C22F386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309836, "uuid": "03131ab1-d9c2-440a-8ee2-5d12dd058fb1", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309836, "uuid": "8c785f93-6402-4ba1-a755-4d33dd8fb3fa", "value": "3072:nwDijpS4DbYcr8bHHnwfFksetcO5FJHNmi6ZCUuMAKbIJ3yY7sFemkYf:nFPeQFkPBZQi6YUuMAr3y0sFeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309836, "uuid": "4acd0261-66a2-43d6-8c8e-1ff8e3359e1b", "value": 191125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309836, "uuid": "248a374e-13f8-44e4-946f-f920bd7f2ad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309836, "uuid": "2f42278a-d4c4-4a48-80e4-3879f1bfaa64", "value": "OUR ORDER DATED 20.07.23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3066a4c3-2ad5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690280562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280562, "uuid": "ea705b7d-16a3-4a40-b56f-d86fb7a37cff", "comment": "Malware payload (RedLineStealer)", "value": "2b5197c2b3a9c14d7cb949b809a27863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280562, "uuid": "80d6248b-c26d-4bfa-a7f0-10ec13f6b2d2", "comment": "Malware payload (RedLineStealer)", "value": "795a49ee81e6eb25d2140b564c0aa63d165592e4d3b7bb4c29423c619b51334a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280562, "uuid": "780a2377-dee5-4ea9-9ac1-b4a3405a0a0d", "comment": "Malware payload (RedLineStealer)", "value": "e78dac9c729de8b6e9064b3bb2043401063ed616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280562, "uuid": "25839902-1dd8-4d66-808e-b4ad7297551f", "comment": "Malware payload (RedLineStealer)", "value": "a60d6a809bd3f73582e1b7c8cd3f6a24718cb31126fe38aa145a4365dec02fe200fe39ea68558273ac8c932b25cb7601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280562, "uuid": "b46ee787-17a2-4c96-9396-46aad5430aa6", "value": "T18C840252B7E88072E5B527F05CF703D30A37BC629C78839B2395991A1CB2590E971B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280562, "uuid": "c99d879c-b7bf-47de-a9b6-d7509b47f23f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280562, "uuid": "9d4f6ad8-06cc-4c3f-ad19-260e8da65df6", "value": "6144:KXy+bnr+Op0yN90QEymQY+TOYTc28XYmEhrORHTqij+jmMrLWJeXsuIGpt:BMr6y90r1+TOSp8oNhCqij+pzXs5Mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280562, "uuid": "5d601e89-aee2-4f09-8908-339aa70db35b", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280562, "uuid": "896eed2b-12d9-40c0-a666-1a1e05841387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280562, "uuid": "8c166eed-2c8c-4666-a404-1ece2cdb3acc", "value": "795a49ee81e6eb25d2140b564c0aa63d165592e4d3b7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01b3201-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690282091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282091, "uuid": "66a72864-91a9-4183-bbb6-00f9167d91f1", "comment": "Malware payload (DarkCloud)", "value": "228933713c6978cbb549898457553a02", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282091, "uuid": "8dbe57c9-1ca7-4c9f-8224-e3188d52b54c", "comment": "Malware payload (DarkCloud)", "value": "79c4777d731a557a998595e55385c43b6e656bbe6f258a86119680228d04db9e", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282091, "uuid": "f32d6125-1313-4b61-99b1-701a0c72c68f", "comment": "Malware payload (DarkCloud)", "value": "eacaf5d518dd5fff033e2b0db8e24705a13815e5", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282091, "uuid": "0e44551b-4e1f-4c8f-a44f-a47e87dbc0af", "comment": "Malware payload (DarkCloud)", "value": "27c1fa68c0d87aa0a357dd4aae48750616e754f7af2db250214dfb9ec53e4383149678c5833fbdcef6f854b2a34d8665", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282091, "uuid": "8269660a-0cfd-43aa-bb2e-bbe53fa67dee", "value": "T1F6A40826E660602EF093C8F0E6E5A2676814BD771288A817F3915F4931365F7B8F172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282091, "uuid": "bca806bc-06a5-4c31-8825-aa5de0dd2b81", "value": "829c6527a0c555fb4836135cfd531918", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282091, "uuid": "60be711e-75ca-4ce5-9ed6-6d9cc41c73c7", "value": "12288:MaG88NqWx3CMj21piSU+FfUZ6DWnejYKkJj6GmZU:ONSTU+FfUZEugYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282091, "uuid": "c4bb12a1-1e62-4fb6-af06-78d840332245", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282091, "uuid": "e9c68051-021a-41a5-bc24-2e5ac6d67ca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282091, "uuid": "83352517-f507-4954-af4d-ae6493f5fb39", "value": "79c4777d731a557a998595e55385c43b6e656bbe6f258a86119680228d04db9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276835a7-2b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690307176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307176, "uuid": "e0de87e7-df00-41e0-9f0f-fbf06f9030d0", "comment": "Malware payload", "value": "d6038a058cbcc54094f6ef9c6fa5cad0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307176, "uuid": "fe60ca39-6246-4fb7-acb1-8f3866362df9", "comment": "Malware payload", "value": "7a9abfc30be9fdf6ad8c4b1547ed3bfa7c7fe391219b50b6016fb73ac6674a95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307176, "uuid": "17f7c87b-d792-4faa-a728-78240106cdd1", "comment": "Malware payload", "value": "35e7a57edaf23caaa97e44c5ad87fd22e5452522", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307176, "uuid": "742c17ad-ebd0-4f08-86f1-702e8b158490", "comment": "Malware payload", "value": "e53ab4f3a93e6771950dd9c41e93a3db1f19287f9b5a62e07894e84ecc84e02bdb15f3d5e0d7af91f22fe13c94de8eda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307176, "uuid": "39d12377-4768-46ca-8b2e-5dcdbda7e68d", "value": "T13265BF21FDC59073EEE611B606DCBA66816FF0B0071849DB87CD57EAA2502C27B356F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307176, "uuid": "133982d1-46c1-4357-ae0a-7c44fa00d74b", "value": "a3419201e7c91c6bc9f529bc8ca5e7ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307176, "uuid": "d05cf251-0418-4fe6-8b74-a23d4440e0ec", "value": "24576:8d6ETGAW9gnvbryzAFe+hmH2s5bz+ubdfSkul6aimWmdo:OCqDryzAFe/xbyRemWme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307176, "uuid": "6322729c-bbf6-4477-a706-ffe99f1758b5", "value": 1499728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307176, "uuid": "d90f808d-5500-4593-a656-300fd2cd03d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307176, "uuid": "85268150-5593-43f1-80ed-f97f48981815", "value": "d6038a058cbcc54094f6ef9c6fa5cad0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea62713-2b14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690307725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307725, "uuid": "68050ce8-c0d1-4595-8589-712c39d06330", "comment": "Malware payload (AgentTesla)", "value": "d700eb7c8d92973910badaf4baf3ce48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307725, "uuid": "eb78f064-252e-4e9f-9b0c-f7851368cf4b", "comment": "Malware payload (AgentTesla)", "value": "7b370a2c49a1dea80d74d22797c03eee3a334405635f57fda595bb9da6ca0bf1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307725, "uuid": "8f58f18d-b394-4791-a396-f673f9742917", "comment": "Malware payload (AgentTesla)", "value": "3104baaac098e8cb569269640387947242f83327", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307725, "uuid": "d664bb17-5f04-4ce3-8b95-0013a6400e9c", "comment": "Malware payload (AgentTesla)", "value": "150af071f08a6b3d2ba0521a86c0e82818037444105e76881d62afb7a859f812d5ed5669a1a9a58f94e394507f281ed3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307725, "uuid": "e233182c-1f19-49a5-b4e8-b2a8bcafd585", "value": "T19F137C5AE78B02658F911377131B0E899ABCB23DB35451B1386C933433EDC3E4666ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307725, "uuid": "9cd53df4-9268-4ffc-9bd8-c9cf7cfa4639", "value": "768:+Fx0XaIsnPRIa4fwJMCvJiDvdp/tc2MVpHV1W:+f0Xvx3EMUijK5H/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307725, "uuid": "1518b137-6625-4b8c-8c88-6d2ab63f02f9", "value": 41958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307725, "uuid": "76dd2615-9863-4037-a257-e6ca43855fd5", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307725, "uuid": "53efbf35-364a-42ee-b3fd-d130e2429409", "value": "d700eb7c8d92973910badaf4baf3ce48.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5ee626-2aed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690291001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291001, "uuid": "e22e0a3e-55a6-466d-8b55-a73932b36545", "comment": "Malware payload (AgentTesla)", "value": "8877646bfd59e9582f54669fbae4fe62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291001, "uuid": "3bf93256-c825-4d11-919b-be03aa4f2074", "comment": "Malware payload (AgentTesla)", "value": "7b45edeb6fbc58e7d03027d46ed1537af3b19a5a55a9e02ef0c169fde30ff72c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291001, "uuid": "0d9a111b-4f0d-4650-b69c-8319176de5ec", "comment": "Malware payload (AgentTesla)", "value": "916be8afa8db2d1221d0b307c70b9f660b309628", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291001, "uuid": "b24f480c-673a-42c4-a333-73c33e204b28", "comment": "Malware payload (AgentTesla)", "value": "5390b7b4f8d7161012d0651dbcb86f6461c9afc2b3c74168cd5fa960879d1dc774b17c0da0f2243214f44811b3ab1693", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291001, "uuid": "331cafd8-9772-473f-a8cd-88ad094f154a", "value": "T16C44126136A6C56BF87320702E7787BA9FF5DD1208F56757A7108ADA7833200C64F7A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291001, "uuid": "cbb229a7-6782-4a78-a07d-1bda2c906b58", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291001, "uuid": "99880747-6978-42df-840d-f255688b4cfb", "value": "6144:/Ya6jQlFvAjSQQbMv3NZRZp1HzkY8jAJ7X1seEg0:/YBQjUSQQ4v3NZRZ7gip1sC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690291001, "uuid": "bb5064db-6e38-4f8c-b99d-d62f25ca82af", "value": 273430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690291001, "uuid": "68eb4a79-c14f-4bd7-8995-0b05b6709031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291001, "uuid": "f64983ed-6072-43ea-a509-793f0ee0aa77", "value": "vvvv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a06a3eb-2b15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690308012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308012, "uuid": "dbf47e11-662b-48b1-87d2-134fe4ba36ca", "comment": "Malware payload (AgentTesla)", "value": "926d9f00a5eb0d5422d7adbe5be67ca5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308012, "uuid": "0030b912-09c4-4de7-bd77-a2af19f19f5a", "comment": "Malware payload (AgentTesla)", "value": "7b68d4fdbcefd5a20a744d9a7528f94d2fc54ea7696a58fc83c4154f8672c965", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308012, "uuid": "9100c4eb-e782-4e9e-a9b8-dd23dca188cf", "comment": "Malware payload (AgentTesla)", "value": "28ba5f3b8915ab7547d70ebd4967cc0a51c4284e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308012, "uuid": "8931b496-fb41-4441-8fd3-8ff659c94328", "comment": "Malware payload (AgentTesla)", "value": "b50fed99a007430ab8639ec635d6df87f67918e1163d64e9fdd2f409844a628a41cdc2cd6ac8ed62330ae3a99611b892", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308012, "uuid": "580d5b52-ef62-443c-a052-d34a78e3127d", "value": "T1BAF34AA992891CD1D31D4074E4AD1148CEB2A137A657E75D0DA0ACF63B4BFC3F22AC67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308012, "uuid": "1c12cc7e-cd1e-4473-b96d-69c6f3a63f72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308012, "uuid": "3f10b637-52f6-482a-8c95-2926640830f3", "value": "3072:VdH4it484a1tdlSLa6kTJFzrZH9nw4HZt+i2cKnFD:s8dtdYWLz9+i2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308012, "uuid": "c1979db6-264e-485e-9a03-b9282546644f", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308012, "uuid": "7929b97d-1d21-4bcf-98b2-3dd6f93e0f90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308012, "uuid": "4f563968-c690-4845-975b-846811fc8575", "value": "169030801003aafc3d7b27929d55d35bc84c9439921e7c4c731a1ed38620c4189120bccf4e387.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de9046c-2aed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690290946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290946, "uuid": "ed15b60a-052d-4189-a384-ffaeee43854c", "comment": "Malware payload (RedLineStealer)", "value": "3878b03638487d7fcda504b7b6112f6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290946, "uuid": "392d48a5-601f-4d15-b9ff-c155192d0858", "comment": "Malware payload (RedLineStealer)", "value": "7b7ce936fd017fb3d3de8552a69b50012fdf9778cf317ec09212df4830d993c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290946, "uuid": "426283ef-3ce8-460c-8282-86070dd28930", "comment": "Malware payload (RedLineStealer)", "value": "62a91750f680cce74a674c1188230b30a9c8284e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290946, "uuid": "5439e5c5-2560-4d62-b00a-aba4473627b7", "comment": "Malware payload (RedLineStealer)", "value": "bff4f596ba49f3b90900884721449e8824092c03b00762b4c1cd805f4a57eb886f04df5cc6a09ba3007f8b3b47d18a9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290946, "uuid": "7e21379e-aab9-4b12-bd49-8faf10ae5adb", "value": "T16F840103A7D44033D9B51B3048F606C30B367DA2A974937B3B89E8592DB22D8A97577F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290946, "uuid": "756452de-fbb3-4a5a-824b-2698f667fb11", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290946, "uuid": "1779c911-38f2-45ce-8d30-0cbd1675b55c", "value": "12288:cMrTy90xzhDbGx71diTJXu8RXxZm+a+LfafLIpD:fyOzJGQVxg+aU7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290946, "uuid": "adf5499e-2ede-4738-bf84-794e00f12d81", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290946, "uuid": "21ade1cb-8c3d-4147-971e-8dd7e6c395f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290946, "uuid": "32d92ab6-23a4-4ef8-8650-0e1592559713", "value": "3878b03638487d7fcda504b7b6112f6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8cfcbd1-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690267933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267933, "uuid": "a4c988ff-dec5-421a-815b-0916012cc035", "comment": "Malware payload (Amadey)", "value": "50934aaf7bdeea19404491b568fad850", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267933, "uuid": "fa9b7272-4663-449e-8e2e-08e433f6c15f", "comment": "Malware payload (Amadey)", "value": "7ba1ecff945330ba39b0d1bc0a81272da1abf8acbbe727db52a09c23c16c0c00", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267933, "uuid": "2863617c-c770-4113-9bb7-6c4d78fe2ce9", "comment": "Malware payload (Amadey)", "value": "4ca4dc3557f0a6e27595e1a72c33129ad3bec595", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267933, "uuid": "d50938b8-fe8e-44af-8b6a-07230a754767", "comment": "Malware payload (Amadey)", "value": "4eb383af22ffba3493e3ae8c5812c764e27a402b2fea61f2230a7f31650a7760202f5ddd48fe2799f617365114255fe5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267933, "uuid": "333cefd6-cf38-466a-8207-7fd39b30107b", "value": "T1F3840143A7E94073DCB627B018F706930E367DF55C7882AF2684A9591DB36C0A87277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267933, "uuid": "3f52988c-789c-4bf4-9e91-1a1a4331b039", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267933, "uuid": "cf5df4e3-2eeb-40c1-98f3-9e5d7b5c7602", "value": "6144:Kpy+bnr+op0yN90QEzksTLHBIoxvFznqrZatQxQqw5PgNpxCYqDNgOht541GvAY:HMrgy90emLHJvFzqrZavu061GvAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267933, "uuid": "aae8777e-6e34-4b5e-9e2e-863080b3110c", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267933, "uuid": "8566667b-d5be-457e-a3c7-30ab66518225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267933, "uuid": "2284340d-d900-4914-90fb-abf3fa9ad1c1", "value": "50934aaf7bdeea19404491b568fad850.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47940de-2ae7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1690288595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288595, "uuid": "e17e45d3-0b22-41e7-9d8c-8d2148df6bce", "comment": "Malware payload (AsyncRAT)", "value": "884af5e648b88c2bd7c7fa7601b4fbb8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288595, "uuid": "ff4a636a-6be6-41f1-b391-fe2046ab273b", "comment": "Malware payload (AsyncRAT)", "value": "7c38066be3852f96710448493f7a68ad4124dc58c6e96a984f44610252d7e2d8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288595, "uuid": "06e33d2f-eeba-4572-bc8e-e2fc7fd75425", "comment": "Malware payload (AsyncRAT)", "value": "d2b5c8e997be8fd3c6717898daa91a17a345baaf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288595, "uuid": "41e77b55-398a-44c0-9424-0f74a8d3ba14", "comment": "Malware payload (AsyncRAT)", "value": "cfe366f6f0cb9b3e56548abb8ae642c653b93603cbb78ac345e0a386aa6a23785ceb15c9844884f47d1742442d2f9e4c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288595, "uuid": "37a44dd5-5dd2-41bb-86b2-f43582825245", "value": "T106350212BF8147B2E5B2C6311939F980F13EFC393F2A5A0A739CF118563715191BEA66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288595, "uuid": "63b16483-e3f4-43f6-8280-40c1f11cb344", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288595, "uuid": "0a392478-a39b-4bb0-a0d7-8af61b7fb36e", "value": "24576:wNA3R5drXUDgBIySzO2sXDueDIHBymhY3BkM:p5KgWC2IyOgB7hY3BkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690288595, "uuid": "9f4fd02c-3220-4496-ac6a-8a720cf75a19", "value": 1142288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690288595, "uuid": "5900d98b-542e-4eb6-8707-3c8e830930d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288595, "uuid": "e5c42826-c10f-490a-9444-b6fed1bb4a16", "value": "Odeme_Plani.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "401342bd-2b37-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690322679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322679, "uuid": "ff02024b-9a13-4a9b-a4be-1cb677623e78", "comment": "Malware payload (Mirai)", "value": "f45c27d6898d13070e5d78b501675779", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322679, "uuid": "5fc83328-eab7-4975-bdf3-95d4c627a2b6", "comment": "Malware payload (Mirai)", "value": "7c43218a785b60f5d83596f55d7c1fe10cf9e5ee80a2d87799f93877fed48747", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322679, "uuid": "2c997f2d-9c1a-43f7-a2c8-8b10b0973cfd", "comment": "Malware payload (Mirai)", "value": "7dc0565e84701a7e91219910515820daa8fd6b7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322679, "uuid": "70116569-33ca-4d2e-b1ea-0676e8bcd7bc", "comment": "Malware payload (Mirai)", "value": "1a6b07b36b9cbb0681cfe0dbf537f26328745c0a8b63660b3aba690eb29bd398127c282fd1542f976dbaba9b46032859", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322679, "uuid": "e79c5abc-d8b6-47a4-b358-ed6aa23082a8", "value": "T161E2F160D241D8B9CDF15C77E67A028724DA1DFDD5F361A58B50837CFAD30821E3AAA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322679, "uuid": "8fdb12ea-4680-4272-a9ad-9a4c6fe48ce4", "value": "768:AaW16HYCGggLRxLrz/mbTqN8AX9SVUvH3UU:DW2YPZvz/yTqN8gcax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690322679, "uuid": "4174e851-ff40-4dcd-a7e3-e7c09c694455", "value": 34216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690322679, "uuid": "373aad4f-0726-4f20-b83a-3a81a9c09d79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322679, "uuid": "0ec6487b-e0eb-440d-ba55-62f75593308a", "value": "f45c27d6898d13070e5d78b501675779", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec369a7-2ae7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690288585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288585, "uuid": "f1ae1a4b-de7f-43f6-b1cf-361b941618f1", "comment": "Malware payload", "value": "d08b2451ffe5bdc3ab6e4415c2ee8a2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288585, "uuid": "cf4cc954-e0fa-44f8-ba68-bb81f4cbd6b7", "comment": "Malware payload", "value": "7cb697b9b5ee31b8a09f92b698e0fd4d34039c6326c38c14da1d1e8f28a1b3be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288585, "uuid": "d3395394-bfe4-4671-891f-45a6d840d03c", "comment": "Malware payload", "value": "3ca692c6980150eb63fded1b65e69c93de346ccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288585, "uuid": "b06e2821-b2c2-42ac-aa6c-1befa5ca9018", "comment": "Malware payload", "value": "70f09782d1ab2cfbb555c00b13f744ae7103594523c7d850755b38fb8dc8b287b1af2761314635ef13c9565da7dd1378", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288585, "uuid": "e1f411ca-8473-4cd7-b10b-ad2f7ef3f8ba", "value": "T134F2FFDD325072DFC897C072DEA81C74EA9478BB871B4607A05725AEEA2C997CF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288585, "uuid": "1a223768-7682-4ed1-835b-f4d055d03600", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288585, "uuid": "8e0263d8-330d-4fc3-bc55-c21cd7217a4c", "value": "384:PoWLwVt1YFH+Z0J6Y5hpMhANv7VE9cVfUzgpu8r83psrXSM:PoAwP1cH+Z0c6pMGFVcqfWEdr9rXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690288585, "uuid": "ec6385e8-f59c-45f1-bc16-e0b504e3468d", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690288585, "uuid": "79a9a90d-705b-4a43-a6b0-913b98e132b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288585, "uuid": "cdef5f41-c38a-4a51-806e-a4acb66422e0", "value": "99143.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2513ffd3-2ad5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690280543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280543, "uuid": "d0fb79bb-c676-45eb-ae37-36a44f304f91", "comment": "Malware payload (RedLineStealer)", "value": "4461f4d9ac8a8afef041b44acb9d45a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280543, "uuid": "d716ff36-444d-4951-a5ab-80a20ffd34a3", "comment": "Malware payload (RedLineStealer)", "value": "7cd2d724553208c7f0cdba33853fde8649615d218e5d7a50bae816df345c8413", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280543, "uuid": "60a37318-32db-4145-8548-f33b8b136bb9", "comment": "Malware payload (RedLineStealer)", "value": "4ab3fddda254ab200a2822656b8c188e4bff199a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280543, "uuid": "6da50686-a6dc-4cac-ab58-2d3d65ad89b5", "comment": "Malware payload (RedLineStealer)", "value": "a6af82ba97dcac3caa673b7d83ae9c665daee54d69e8e8ed790bf739a7401d4fb04b73ae3131ca0b50e2d7f9c1dc9480", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280543, "uuid": "8707c09e-8e94-4852-a266-54994a53c160", "value": "T100840212A7E94132DEB457B059FA03C31B3A7DA19A68932B2B55984E4CB3BC0F431777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280543, "uuid": "f80228b5-cf16-49b5-990f-9604cd5a23cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280543, "uuid": "aa94a197-2c33-420a-881a-2a1cbac595a0", "value": "6144:Kuy+bnr+up0yN90QE4mCsK/2wJMM8gk52NsiMsXfWv4RpQmBD5FlraJdF5:mMrSy90SHE6KfZsXRpPJrYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280543, "uuid": "47fe54ee-351b-4362-a41f-a06932684831", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280543, "uuid": "291a89a8-c407-4849-815c-11716da969b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280543, "uuid": "a341f449-8175-46af-b431-5cd770db37b0", "value": "7cd2d724553208c7f0cdba33853fde8649615d218e5d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a561d2e-2b0f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690305543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690305543, "uuid": "04040767-65ed-4d2d-ad4b-4a63010948d0", "comment": "Malware payload", "value": "c52b7b3a38ad1bd9658c22e8719945af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690305543, "uuid": "33ca0952-3922-46ba-a9cd-2174e874f958", "comment": "Malware payload", "value": "7ceb921307e2d82675bc2ce3a077b6bc2ebb1cd814d970f4b5aeb59268618605", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690305543, "uuid": "9a0ea16c-946e-4062-b176-418566375ee9", "comment": "Malware payload", "value": "ce020f8ba482a5297af260d2aa50c47a187c5b81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690305543, "uuid": "551ce4b8-af7a-4250-a429-4f0de073ed72", "comment": "Malware payload", "value": "22363b7d691c28bf86501eca11ea9319aa85f2d20d8e5646bac2b1c8e734d02583fad7b321bd30b09d73108611dcf2c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690305543, "uuid": "9da5c0d6-c6c7-4f1f-becc-556bfd03095a", "value": "T19CC411D843A85B71CB7D9DF401D5823F68A1E12F403DCF61DD99371CBE2227E8626A92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690305543, "uuid": "95dab07b-a5f4-41e5-9a34-34330d5719b8", "value": "12288:bIwt9ej2cNHF7pkC+uNOsCuwpL3CIz+uKKCuBUNm7PHq:bht9ejrc3pTIKZKg/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690305543, "uuid": "542dff36-b5f8-4c73-b049-340ee0573462", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690305543, "uuid": "94681d4f-d3a1-463c-aefe-cec647721ef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690305543, "uuid": "5849efee-7c85-4a02-92c9-b283edabf5fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5757f2-2aeb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290168, "uuid": "bc63b457-1ecc-4b08-b0ab-7fe220e593ed", "comment": "Malware payload (Amadey)", "value": "5e0fe972e74f36d4fe9cfba93b00c6d7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290168, "uuid": "6a6da915-bf64-4efd-9b68-e72401a81db7", "comment": "Malware payload (Amadey)", "value": "7dcb474c855458a501c58b929910f96071bc6bd92ec9ba5c5ababb6f640b0490", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290168, "uuid": "c80da0a9-c5ba-45ce-b5cd-4a361a998823", "comment": "Malware payload (Amadey)", "value": "72f2577227055b84a64c038b14b4fdba050bb118", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290168, "uuid": "63171e32-49cc-4180-bfcf-bc1bf93e4cd1", "comment": "Malware payload (Amadey)", "value": "a3003d486057db18fe5227309f17429f3f82412a70096fdf7ad857a2e67928669e2a080e6e90c0736c6be32d8eb65257", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290168, "uuid": "a589eb83-6a3d-44d4-ace0-8d02de3bb8b6", "value": "T17D2408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290168, "uuid": "d74094c8-84a0-4915-b415-86c0728256f9", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290168, "uuid": "e87a6cf2-a22c-4d41-a5aa-b4f0d7d1ca78", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290168, "uuid": "21c8fc4d-7ea1-4a16-81f2-7e60bb61e3ee", "value": 229514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290168, "uuid": "4645ec87-e89c-4bf7-91a6-baba99eb2b9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290168, "uuid": "67241898-7a9e-4951-b8d7-a8969374a468", "value": "5e0fe972e74f36d4fe9cfba93b00c6d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65d60b1-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690308704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308704, "uuid": "709a789b-9a6f-44c2-bf2f-1235080bd072", "comment": "Malware payload (AveMariaRAT)", "value": "8eb83d42597b7aeb8fd6bd96fe8faa6a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308704, "uuid": "61800d31-4452-4442-b489-e5724a3542fe", "comment": "Malware payload (AveMariaRAT)", "value": "7dfcf714491c4408935c56665596276ce537413f68280fde9db24217d1b1ddfc", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308704, "uuid": "5cbb5ae7-d901-4da3-9022-99afaef0f27a", "comment": "Malware payload (AveMariaRAT)", "value": "adb3818450fb4d484cd3a3bd150b9a784ff68a12", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308704, "uuid": "f06a1206-8bf6-4cef-895d-e95215fc2a2b", "comment": "Malware payload (AveMariaRAT)", "value": "2a21c232bdfbb673c29bba52b7e740f9e8fe161d00fae039879e141b84543aeddfad89d6511f628490a40043fba00d67", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308704, "uuid": "ecac0eeb-cf02-4c8d-877f-914742619eb9", "value": "T194C438023384CF21C51F15B6C8A7C2F81727BE00DD445BD776C9FF2A79B22AAAA51593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308704, "uuid": "c338c558-ea23-42b3-8e74-394c2577e813", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308704, "uuid": "f980faa4-cb48-45df-838a-bf64e6a43a96", "value": "3072:AfY/TU9fE9PEtu15FPIbd0RZAtwVcfwlax6zCw0Qd4kKy2EFFpX/7GwIDUgb3VEw:WYa6pFPKBY0xeLMWpXTGjUd4Aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308704, "uuid": "d346cb66-5afe-43f4-9982-9948f9d8e92c", "value": 570524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308704, "uuid": "15cf57fd-2e58-4bdc-aa04-eb891c7b7f41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308704, "uuid": "09eef606-47fb-4e9b-bd4a-1449209320e5", "value": "QUOTATION_JUL7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97eecda-2aef-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690292066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292066, "uuid": "7603fbc3-32d1-4b45-bd07-7ed5b85d5777", "comment": "Malware payload (AgentTesla)", "value": "4a6b0ff0bb130e567a16236f44026450", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292066, "uuid": "7eafe4cd-ef92-45c8-9ce2-8d964210749f", "comment": "Malware payload (AgentTesla)", "value": "7e6fb796d900dc6e1ca8e0b41f9a097851682c5308b5a077976cc2cda7b5e589", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292066, "uuid": "e2594134-b42a-4363-a78a-d4794dd2e2d3", "comment": "Malware payload (AgentTesla)", "value": "0a5cffb68ce64013a75705d25d21a62044e3c96e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292066, "uuid": "3a301126-c979-4bf2-b7e3-30751fbe0a38", "comment": "Malware payload (AgentTesla)", "value": "fb5da0aa401c52bfa00fa5659038a95df7bf4a8884bbc4b411f22333ee9f659f3b4d81c0032864822d8769c532f3e472", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292066, "uuid": "a70d7ac9-0f2c-4098-a999-d97b4f0a3be5", "value": "T19705F11176F59F67D1BA87F84021723013B9AEAD6439E3091EC774EE2971F804A22F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292066, "uuid": "1f8e4a8b-e93e-4a2d-8756-905fe33c284b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292066, "uuid": "a013a233-38a3-4751-bda7-415d847a4b5d", "value": "24576:ZxJRHIcTrGCSFZR8ARl/w+JDEgjpO0T6+Y:PPHIkrzSvmOw+Jogjo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690292066, "uuid": "6f10fa49-3b1c-439a-9e95-a59901faa1bf", "value": 820736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690292066, "uuid": "816dbef3-42e0-454c-97d3-e3c91669c0d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292066, "uuid": "783cad88-43ce-4b4d-940e-56969188e4a6", "value": "Proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23091153-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268514, "uuid": "ca69ad02-157d-40bc-8a11-44cc8cb1d7e2", "comment": "Malware payload (RedLineStealer)", "value": "a6656c85908757c4d37a3f442dde3fd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268514, "uuid": "a61a54c2-f55f-419b-a05d-1886cdd0153e", "comment": "Malware payload (RedLineStealer)", "value": "7edbf28c1d1264b024bd9725dc40a177f401b4e1f74f6d0e809441c41fc7fb1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268514, "uuid": "28356a92-4e67-4a17-a737-b6a508fc1e34", "comment": "Malware payload (RedLineStealer)", "value": "8b997f0b7e39a88928378fa7ad002305c6a5f103", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268514, "uuid": "ee7150be-d331-4396-ad8a-8d363d170b0c", "comment": "Malware payload (RedLineStealer)", "value": "a607e85fd6c2eb22ac856b965e93d66ae865e1e600fd9c7092cc72dd86cd78930851a62b50a1017eea4fc31307d7cbd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268514, "uuid": "de29fb4d-0233-409e-bc28-386953ebb3c8", "value": "T19B840113AAD85033E9752BB058F616D30B36BCE25D78871A2746E95E0C73B90E531B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268514, "uuid": "1accd7d1-f832-4ba7-8db0-b6bc9a6adbd5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268514, "uuid": "03411fbe-220c-4bba-b203-6c4cb648ebb2", "value": "12288:SMroy90HbGAqIxv8G4wgBYCt1YbnoyRbr:uyCxv8GOzcnbpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268514, "uuid": "6271c288-80d4-4839-a469-10f88298dbe9", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268514, "uuid": "18e551fa-3469-4304-bb76-32ef433e4187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268514, "uuid": "9b2704ae-61b4-4782-bd3c-72b884760a06", "value": "a6656c85908757c4d37a3f442dde3fd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0fea54-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690273956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273956, "uuid": "f5838d52-76e2-46de-870d-41f2fc2ff3f7", "comment": "Malware payload", "value": "aadad5a2487cb607b90729065e470cd6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273956, "uuid": "33924b26-55ea-4902-89d8-d0af13a5fda4", "comment": "Malware payload", "value": "7f44067c81e71456281a67a6ef07f9b2d0bb7e8b69dbda79753097af22175387", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273956, "uuid": "3d29437c-64bc-4c9a-bdba-f6808cfe1e55", "comment": "Malware payload", "value": "206f0d7163f2a8abf28f00faba54f7be98dccf74", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273956, "uuid": "dcad84aa-fb68-4f3e-88dc-43e681b27f23", "comment": "Malware payload", "value": "23a29ffe397ad9d76c8e77bbb7a3bc3087b0998afe9b34f007a49e2f4fa143dab78a152b200ffa7bb3c7a798dc9fee76", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273956, "uuid": "dd8e9302-bb11-4dc2-ba14-03da6309af5e", "value": "T1DF527E39CBC6443CCB9E157011EF492E41B59A0A8B9445F367950E0EECB4BEFE5261A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273956, "uuid": "d8d5b8a8-6c0c-4495-b91d-8c2d647ec318", "value": "52f024ddb1f7cd5149a1a787c5019446", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273956, "uuid": "5b280c68-265e-4d58-998b-6ee8d69ccd49", "value": "192:EMtTT/2vd6TBbxQtiT+Y6kfFbUmOxmHxbaPgqkE1Rl8T3zwbXjIws0:LZLkk9b+OxbV9wwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273956, "uuid": "b986d3b0-000e-4234-914e-3d6fed4be5a0", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273956, "uuid": "f1762dab-8535-4090-9cce-c3b5ef16d389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273956, "uuid": "b7132c70-8482-49f9-8397-94b65c583c05", "value": "SecuriteInfo.com.Win32.InjectorX-gen.4241.27765", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938071cc-2b14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690307786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307786, "uuid": "b4266576-8bf6-489b-bfc1-8861b89470ef", "comment": "Malware payload (Loki)", "value": "519b94d3f11103f279b8b13ce1d5b4bf", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "JUSTIFICANTE TRANSFERENCIA", "colour": "#B48B38", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307786, "uuid": "69f4aee2-d8da-4d9a-ab68-41b26b981d34", "comment": "Malware payload (Loki)", "value": "7f53ec50272d45111e4d1532bf879c4ea093fed94e5b8d3fa9b079e48349286e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "JUSTIFICANTE TRANSFERENCIA", "colour": "#B48B38", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307786, "uuid": "a1b27794-d910-4269-80ff-33da73a1b931", "comment": "Malware payload (Loki)", "value": "7425646dac7406b278830c76e33feebb21d6e55a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "JUSTIFICANTE TRANSFERENCIA", "colour": "#B48B38", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307786, "uuid": "c23f0b1f-a12c-4847-bb4c-0ccaab2f22e2", "comment": "Malware payload (Loki)", "value": "9669050df42419aff23edec585e4e3391a3c220e7d86fc3aa8a86de727835c195460a949f0ff1cf33f884eafb24b606e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "JUSTIFICANTE TRANSFERENCIA", "colour": "#B48B38", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307786, "uuid": "3e031c3d-5772-483b-b679-d0fbffd37ff4", "value": "T17523175AE78F0264CF411277171B0A8996BDB33EB35554B178AC533433EDC2E0666ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307786, "uuid": "3cb8747f-8c29-4af8-858e-f1b67366484e", "value": "768:BFx0XaIsnPRIa4fwJMHjFhd9G1tgbVGUUMioeGeZZfRJ157prbcYmuUlN:Bf0Xvx3EMHjTd9GreVqozcbH57prgYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307786, "uuid": "c416a645-5c7d-4e71-a52b-f4a61d347084", "value": 46677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307786, "uuid": "139d4168-7276-4053-89a6-75995a8a5514", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307786, "uuid": "0397c499-2f02-4ef5-91f5-ae883e40d47e", "value": "JUSTIFICANTE TRANSFERENCIA", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff4fd69-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268186, "uuid": "29bf93ec-6aff-4655-be48-f85222216564", "comment": "Malware payload (Amadey)", "value": "49edc9f70f407d34aa95236f28148ac7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268186, "uuid": "2f698637-2cb4-44bb-a3b9-211584f79231", "comment": "Malware payload (Amadey)", "value": "7f627a2d39c9367b93fb5547e59df5131e2960cc83bf53d752be6af6d59f1a8a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268186, "uuid": "81291622-7024-4780-93e6-40eb5ce9b1b3", "comment": "Malware payload (Amadey)", "value": "63686c91123a17a32ba92a9e48bd9fdb68d16759", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268186, "uuid": "467cb2d3-c7d7-4786-afd3-73c003e2fa3a", "comment": "Malware payload (Amadey)", "value": "f4fe46f74138a714d7057327ac76d6a32c3df13b678e2ae08c8d72dc7092e27a20090beac819c79ec0c74ea675a9b47d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268186, "uuid": "4cae85fd-1317-4f77-a11b-3960fc9586ed", "value": "T11284F193BBE88473C9F0177069F607C31F367C615974C36A3689A85A1CB2AC5A87137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268186, "uuid": "043f7c87-43c3-47cc-8de8-6d94210233fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268186, "uuid": "aaf40513-362e-4fce-9ac5-8cdeac377723", "value": "6144:K4y+bnr+Qp0yN90QEf1po+xC1YpHIXXxCD1SDiTm9TSeZ5jb07X3e0b7F8QM3JXn:gMrIy90Be1BBkSD6KuCbkeY7FAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268186, "uuid": "78e19072-b9a1-4a16-befe-abddf1e628e7", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268186, "uuid": "5ce5159d-b352-42a1-bc2c-3c20c1e30be9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268186, "uuid": "8999d6b9-3a48-4f2b-8089-0749b7e32817", "value": "49edc9f70f407d34aa95236f28148ac7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07161337-2b15-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690307980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307980, "uuid": "ab37fd81-eec3-40a8-b578-452d90956c42", "comment": "Malware payload", "value": "0da7ea3639d8728e3eb657661f73faee", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307980, "uuid": "5c70e1db-5d7d-4868-bbbb-8e7b9bfedf43", "comment": "Malware payload", "value": "7f73414d21980b495d97a9624c62e42e9fe12c98077ca9159fcf68a7b5bbca2b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307980, "uuid": "110f5e15-a8bb-4ca3-8ece-18dcda0d5c07", "comment": "Malware payload", "value": "8eafbb532cd932f20997b1d6052210dee04fc9b0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307980, "uuid": "b3a302ec-0e48-41f3-8cdd-4856a2221b77", "comment": "Malware payload", "value": "a1d3f783a30926cb5ed987d7c99087a8f9ca62fdfd9882a2735b47d69818dd4bc7d9bbf71f364eddcb56496cd17bdf84", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307980, "uuid": "7b78d078-c1e2-4f80-badf-c5ee38f38c61", "value": "T128D4E3113EDF10442673AF9A17E828A04B6F76718E39D44E249D064A47DBEC0EDB1F7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307980, "uuid": "39144034-baa6-4bd9-9a74-fbce6f02f590", "value": "3072:c5XNsn1+7HLDVZ/Mxzak2wxAjPAovA75adT7noJxZF/ltevgTB3coFBTyUVR1Zsx:Zn+jMxzakyozTyUVR1ZsMKhezyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307980, "uuid": "8d704870-3753-4484-867e-4e5b4336d6f4", "value": 638068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307980, "uuid": "795fbc4a-fa6f-491a-b421-dfc5045682f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307980, "uuid": "e292f101-b08f-4ce0-bee5-ea1d884aa23c", "value": "PO45768970RE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28a44df-2b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690307516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307516, "uuid": "ca756b7f-fd6f-4d68-87dc-fdff902a29b2", "comment": "Malware payload (SnakeKeylogger)", "value": "3a8404b6a309e451abfc627c6ff69d82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307516, "uuid": "827bafd4-ec4b-40b4-8b7a-8a1a35242942", "comment": "Malware payload (SnakeKeylogger)", "value": "803ff1d600266db6a364c2fba03b7a278407d98c4a37e4a0b0ce560d85696d17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307516, "uuid": "77b9899c-2549-4103-9f3e-093687a5c9a5", "comment": "Malware payload (SnakeKeylogger)", "value": "f9b2462110ef93099673f961309f996f355446bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307516, "uuid": "8d356a1b-27eb-423a-88a6-4ab5097abf67", "comment": "Malware payload (SnakeKeylogger)", "value": "7c2b57bdec57e2e44842778e89a58aba40747408137b5650c61ddd0ef4a71cbc9f02d3ed9429c482047c623d2144ebcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307516, "uuid": "1b0f3634-43a8-450a-ad8d-d9fc943c4b8d", "value": "T103F4F12576A9AF57C1BA87F85070723013FEADAE6435E3186DC370DA2971F408A62F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307516, "uuid": "15974a4b-0c29-437e-8131-64cffe0c2332", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307516, "uuid": "32bb62c9-ac99-46b9-80da-ed5145f82f2a", "value": "12288:tfgETi9YiIoFwIrG3XCCaEHsbHtGApaNB9wBwyfJuLsnGfMaTulQ0Adl6/7:BxG9HIcTrGCSqGA4NBOwypGf7TulrQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307516, "uuid": "22e111de-d408-4aaf-a31a-911a35f5bfe0", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307516, "uuid": "54ef4750-255d-4244-988f-20f883ac2427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307516, "uuid": "e6413d7f-764a-4333-96f8-cb7db671c7c2", "value": "placilo 06964.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca1dca8-2aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690269120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269120, "uuid": "52649231-fdc6-420f-8ec9-71fc806c0df6", "comment": "Malware payload (RedLineStealer)", "value": "92ec36afbde1a34b25621e806c71a035", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269120, "uuid": "74c1a02d-5100-46ac-a11b-7be108440487", "comment": "Malware payload (RedLineStealer)", "value": "80865416f197d46277bd874fe41e900dc75ef6475c46b09eb899d642be3ecf61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269120, "uuid": "70c010f3-3ef9-44c7-b82a-8c670fb588a9", "comment": "Malware payload (RedLineStealer)", "value": "4ec0f487f6d6809401657e675468f168bdb0f355", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269120, "uuid": "87aaae15-e58f-45e7-9bec-1286c844816c", "comment": "Malware payload (RedLineStealer)", "value": "425bb3fd905dd4ed081b83307bd9f7767b7083046a22414b3945d6ee40052b55c74292ffd16bd4e574ef5298c359e8a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269120, "uuid": "d6a551ea-3690-4270-b006-24f7ed35b97a", "value": "T18F840256EAE94433C8B527F068F206930B37BC911EB893172755A92B1DB32D0A47673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269120, "uuid": "a5ffb7cb-2849-443d-b617-adabfaa77fcf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269120, "uuid": "14773a01-5e81-48ff-bfda-0d17ab297f2b", "value": "6144:KCy+bnr+tp0yN90QEh3evKQEGcDzg0YLGJSVdBR82ngBZ+t4JDt1/oGu8QiVE4:iMrxy90HvGYdJSb7NngBYCJzjdVE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690269120, "uuid": "09119409-7ad7-4264-89b2-6c47708bffe5", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690269120, "uuid": "d70fe40e-7d2c-4f12-97f0-ebc4a0d0b06d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269120, "uuid": "e1e5c7d3-f6fd-4440-a7a6-57cb2cda1fc5", "value": "80865416f197d46277bd874fe41e900dc75ef6475c46b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc5716d-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268558, "uuid": "bda912db-d33b-4210-992b-cf2b0adc4ff2", "comment": "Malware payload (Amadey)", "value": "bf4773f1c77ed9feadbbc67fbc99898f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268558, "uuid": "4180485d-73e5-4bb2-bcbb-e88107ccd1c4", "comment": "Malware payload (Amadey)", "value": "80a6ab605cbab5f1e976ff87cef9f8b8cfdb3f37b7d859e10a9916be8eab38bd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268558, "uuid": "6643abfd-326c-421e-a79e-4e28c8144cb3", "comment": "Malware payload (Amadey)", "value": "f7d7e06d5f99fa60706319697f3cb403d4e66638", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268558, "uuid": "b013065e-0c77-4210-a067-969a77330c6d", "comment": "Malware payload (Amadey)", "value": "a58a30c5af91b5c3da40690d0ed82f6518fdbe06ddc41a48c7e1b85b103cfd5e3668cede96234f5122d45c17781fbc80", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268558, "uuid": "b10315b6-ffdf-4501-90f2-72f1ba91b63d", "value": "T19084F157A7E88173DC7927B018F603D30B3ABDA68875926B2346AD1E0C732D4A57173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268558, "uuid": "56e9ebae-20b8-4182-ae3a-41d45bba435d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268558, "uuid": "aff2ecf6-c941-4530-9db0-bbc18de9a2a6", "value": "6144:KIy+bnr+lp0yN90QEtqyBPIK9moUTtAFHjFloACtgoAx6Bve+Gjmror0I8a0lCi:MMrxy90ayBgK8/TtAP6Ax6le+8r0Yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268558, "uuid": "6dd3d7c5-f5c9-4275-a78f-82648bbf668e", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268558, "uuid": "05c48702-af98-4242-bb23-82adb16c7bc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268558, "uuid": "bf825dd3-9a9e-42fc-952e-822813f181e5", "value": "bf4773f1c77ed9feadbbc67fbc99898f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae97507-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268205, "uuid": "90f7d8bb-cfce-4feb-aa05-eb5c39fe7147", "comment": "Malware payload (RedLineStealer)", "value": "86b82c95bf1fffd1a44ffc3f19cc8da5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268205, "uuid": "607ed611-2120-4932-a92f-5ce44891d0ea", "comment": "Malware payload (RedLineStealer)", "value": "81590add9721fa4884507594dc82d17756123fe7fa711547c575c40ab9003042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268205, "uuid": "091819da-b1c4-4460-832d-e220cfdbb06c", "comment": "Malware payload (RedLineStealer)", "value": "10a5cb8bf897bf8320e482ffc25f88d88f491656", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268205, "uuid": "7bf968df-54ea-43bb-9100-08f2beaa2fcc", "comment": "Malware payload (RedLineStealer)", "value": "8c81c9524032a05f6481b501c84486a17de28fad5eaebd4d6c1861192c3d80c8ec3068decbfd5170c6b0641fec3ca2ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268205, "uuid": "bb7f4b8a-ae63-4218-af5d-bbe189f37080", "value": "T1CC84F192B7D84072D9B61BB068FA02D30B36BD625C74932B2745995E1CB26D4AC3273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268205, "uuid": "5541ed6b-e4dd-405e-b5f2-0c3fc66f6a2f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268205, "uuid": "7726a3b9-49bb-42f7-a8e9-9cf8b640bc8a", "value": "12288:eMrMy90Mhawj5VBR0zajajp+WgBYCQAQdAnyD:myxhxV16+1zCKyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268205, "uuid": "abc51613-1405-4e7b-8dde-bfd696fa9b4f", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268205, "uuid": "4ac0f9e9-acf8-4ec7-9934-1b942786c96f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268205, "uuid": "e5810688-4437-4ccc-913a-4f96ed21adaa", "value": "86b82c95bf1fffd1a44ffc3f19cc8da5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4280e74-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690267871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267871, "uuid": "18741917-3364-4949-ba18-761694459da3", "comment": "Malware payload (RedLineStealer)", "value": "177a2ed3955ac809eee2add9b203bbe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267871, "uuid": "58a955f6-fea0-4e13-be1e-8c0ccc273c67", "comment": "Malware payload (RedLineStealer)", "value": "81b746bbf8bff47a18e9869afbe50028f6c4b844f88f5eafa78dd2e5608760dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267871, "uuid": "e3f0628f-e0e4-4338-8326-4a3bea03d2dd", "comment": "Malware payload (RedLineStealer)", "value": "f5a764e7aa8712c7a24def919d9a79f71104d679", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267871, "uuid": "cde8eabb-66ce-4c45-a077-7af953f8d02e", "comment": "Malware payload (RedLineStealer)", "value": "9add29d55256a677db0414e1d6f8e46012661069d67fc767fe80a6659035df97f423e42dbfc21e2d19fb4d30f0d2a06a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267871, "uuid": "c05a174f-9a7d-4acb-87dd-5c384fb60b2c", "value": "T170840103ABF91032D97953B059F603C31B3ABDB19D38929A3785AD4E5DB3790983132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267871, "uuid": "b12d6438-0a4b-48ad-b812-a64a58c7271e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267871, "uuid": "c25219b0-d656-4505-9e8c-e944ef722c84", "value": "6144:K4y+bnr+Ep0yN90QE5yEkqGiLdMMKT3Syp7S4CYOFWXhTqYmlX0m+zdgIA3TYxqO:4MrIy90v+Tq4CYVXhTj5s3EyeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267871, "uuid": "7d04877b-10fa-4a4b-9f4d-b9a497aa37c0", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267871, "uuid": "6f8e0e0a-911b-4ba9-9a0f-1fa0f914c6c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267871, "uuid": "d194da8d-8af1-4c29-b6b3-4bd5205eef01", "value": "177a2ed3955ac809eee2add9b203bbe4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20456170-2ad5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690280535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280535, "uuid": "4fd45de8-604c-4b81-946c-da7efd823946", "comment": "Malware payload (RedLineStealer)", "value": "a5829875e4572567348e52a2a2bcf4d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280535, "uuid": "0e9cc7b5-e748-42bf-a9c2-8684accad80d", "comment": "Malware payload (RedLineStealer)", "value": "81d173ecfcff752ab35e9968a0d9dd3be45094de25e5f0b31a05ed3f0456f4c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280535, "uuid": "05530135-b714-4054-adcc-c11b2eccd3d4", "comment": "Malware payload (RedLineStealer)", "value": "b86102ca3f6a31b51f5af9e34d172efc6092cd2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280535, "uuid": "1314e22e-a1bb-4a13-93c3-a2e9c4d8f957", "comment": "Malware payload (RedLineStealer)", "value": "093545f974aa0856df5b54d67bc6d3090c3be1a57cb3d7b580499a70490efe45cb468e2d5ca2094905200acc0f5513ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280535, "uuid": "93b02e67-8aff-4fa3-b276-8849d497b644", "value": "T1C7840253A3E95536D9B427B018F603830E3ABCB0D978529B2789AD5F0DB3684E47173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280535, "uuid": "0883af13-90f1-4b5b-85f0-63e3b35b4b5a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280535, "uuid": "b11dfdff-c8a8-4972-92b5-4ec46dafd3d3", "value": "6144:KPy+bnr+bp0yN90QEldkUq8k9M3Lyp8G491xNSPEfgA/1bmLG/u5zmG:pMrjy90K/WmKRSPSXHk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280535, "uuid": "723d2847-c214-4055-87d4-348bfbddd495", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280535, "uuid": "52087b2c-79ae-46ca-9d21-82c930f006dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280535, "uuid": "d621ebec-1281-44b8-85d6-b29d30206eab", "value": "81d173ecfcff752ab35e9968a0d9dd3be45094de25e5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ec911e-2abb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1690269434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269434, "uuid": "3112c4f5-a91a-4107-98f8-4b43faff741f", "comment": "Malware payload (IcedID)", "value": "6fc02d29d7cdf865457adf4f32e70cbd", "object_relation": "md5", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269434, "uuid": "98ed01b2-d79c-449d-b198-06952468912f", "comment": "Malware payload (IcedID)", "value": "81f727c48ff93a829b40efa9c62b37113be526091e112e813b4e1997f9c33f85", "object_relation": "sha256", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269434, "uuid": "e0c43aed-f0cc-498f-b604-cab7e2abdcb5", "comment": "Malware payload (IcedID)", "value": "ba60d6bf03806ad346451e9f4f34c6060d4f4c89", "object_relation": "sha1", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269434, "uuid": "a263134d-b05c-4d6a-bed0-c4cd04dc5e46", "comment": "Malware payload (IcedID)", "value": "0b2e7e602130b5a66af1cf7f9ca3ccfbc8148c36485816c48429dc421adf929d6de8d3a2849ff18a70ddf32b452609f1", "object_relation": "sha3-384", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269434, "uuid": "1ef0a0ad-e2d3-4325-8648-d98b10cd4049", "value": "T154A425C6BA56F8F9CBF3C076E45123363D0DF9D144A09E724760C7BA6C24818A86EDB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269434, "uuid": "cb9aab9c-7309-431e-86bf-c75fbffc617c", "value": "06f25df4360c0ab9ee30cbac816de0f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269434, "uuid": "abe5525a-f78b-46c8-992a-f7a7ec19b509", "value": "6144:fWuzoM1ukesfTqAYVTuFOBTfh3SVOFJzlBSFHds79zAADpgSHK6Bdunly:f3zzukBCiFel3tFJz6DeDpgSHKUMnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690269434, "uuid": "8d7f6f3f-8d23-42cf-9bd2-513fbf9c1641", "value": 458416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690269434, "uuid": "eac51213-248a-4291-a221-2e7fcb1f4ab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269434, "uuid": "71cce189-3b6d-46f3-af44-5dd497fa1b4b", "value": "INV-Details-JUL2023(268).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b18be9e-2ab4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690266514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690266514, "uuid": "63c07b65-6157-4236-aea3-c21475cd2edf", "comment": "Malware payload", "value": "43ae4b8205cd33a709dd884885bf56d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690266514, "uuid": "92693dfb-8cfe-420f-84d0-ce456eb40ff0", "comment": "Malware payload", "value": "82cae4cc520c6731de1990cfe379aaeb1d05aaf48411fccde9708f2d7a0e776f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690266514, "uuid": "8f9e015e-a31a-4ea4-bc27-20018ff3f319", "comment": "Malware payload", "value": "6b9de93fdaed772182ff007d7c16088f69f00fec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690266514, "uuid": "75ba0acc-6d0f-4dd2-b2e4-ca469225c270", "comment": "Malware payload", "value": "387682d72a7f4ed5cea019cef97312c12a4ae9c087c4ff474439342295ccd8e9daa22d7a80224a17aa828eec638d6da3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690266514, "uuid": "33087136-3f68-4529-8b58-a5609806861a", "value": "T1DC76337AB0909EB9C6B12E765576D7358B2CEF4513208E6FF2980A58CD173D32C7E428", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690266514, "uuid": "ed66acdf-baf7-4c94-b522-8694ce081937", "value": "fa2936ff523bbe01bb11c81e10c9ad2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690266514, "uuid": "3e321859-49e6-4bcf-a768-5dd2f90ea9eb", "value": "98304:bH3Bu5MS4bjnI6F5Bqq/wbc/woPllMWHuMXkTZONq0d6NlPf9//KJ+F9YvURWdPv:TBuBM6oP1HdXfZ8bntw+zpUQB4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690266514, "uuid": "b0368871-be92-48f6-af4f-787cb9ec5815", "value": 7320239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690266514, "uuid": "00b01381-70db-4e47-b291-e7f2e209ed6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690266514, "uuid": "12b07662-ccf5-4641-bed9-bb84f99a0696", "value": "SecuriteInfo.com.FileRepMalware.13249.25948", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4ac662-2b18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690309658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309658, "uuid": "d88f6e40-d285-4cc0-a7ce-484fad5f220b", "comment": "Malware payload (RedLineStealer)", "value": "f79cce0873d10f1549bc738ff76dfa83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309658, "uuid": "d588536d-0903-4d58-aaec-7ac4e19f2dd8", "comment": "Malware payload (RedLineStealer)", "value": "82d87c2214a4337f9fe3975c0745d37b0e0f4b0a5771649d2ec50929ffbe28c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309658, "uuid": "e7d09199-1142-488b-98f8-ea04b3fe51fb", "comment": "Malware payload (RedLineStealer)", "value": "73f3d60da89c91af2538e183d267f0073c07f5e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309658, "uuid": "405cd2b6-6c78-4e96-821a-e5cce6e454a2", "comment": "Malware payload (RedLineStealer)", "value": "3977aac99afc48fbbd231e67fc395170dd4a089ebcb6768b4e880aa8e6583b3f86d3c1512ced74f26c5770fd861f67fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309658, "uuid": "64fa3f58-40e6-4142-9946-feb97e27b727", "value": "T12E840142B6EC9433E9B5237058F207830B367DA46D78976B2785968A0C737E4E53273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309658, "uuid": "ee8a0a8b-760b-4c89-bf68-5bf59094dfe4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309658, "uuid": "aa367ab4-8833-47b6-ac5c-58e42c3d7b78", "value": "6144:KTy+bnr+Op0yN90QEQMS0+O1Vpa6LavD6ZoSlajyLBrdXOgBZ+t4FDgisKqhbmsn:JMr6y90KMSAvyOZoTOLddegBYCFxiSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309658, "uuid": "b4b4286d-81fa-4aed-9eab-b282b7bdd594", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309658, "uuid": "dfcd5fec-6441-4772-974f-681fb7698324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309658, "uuid": "49424472-4d06-4fe3-94c2-00a89067e443", "value": "f79cce0873d10f1549bc738ff76dfa83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5412b9f-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268813, "uuid": "e78b0f5c-9dc4-46ef-b932-09364858c650", "comment": "Malware payload (Amadey)", "value": "c15a01cad79fc24c54866febe236144c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268813, "uuid": "cc93134e-5ff8-4928-95ed-9d37892264d7", "comment": "Malware payload (Amadey)", "value": "843beb28f99086f06032ad57e3e8fdf4d6585c72b669d5e10be0ce837c9e1be7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268813, "uuid": "a82927d0-820d-446d-8bdc-6109fb4f68af", "comment": "Malware payload (Amadey)", "value": "0cbdc80bf99b8a2da36b04fc06c583c29818f826", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268813, "uuid": "a8221b5b-5eef-45e1-88f1-900bc0e0b389", "comment": "Malware payload (Amadey)", "value": "e933cec1f9ed616780dbba546cf5afa4213f91f440ad033f32688d7bd7a62de600da6904a1fcf7790830835c82f08f23", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268813, "uuid": "9c8af5a7-4932-4d28-990f-12f99bb2697c", "value": "T18D2408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268813, "uuid": "42e294a3-c36c-4cf1-8781-c3032a6cedb3", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268813, "uuid": "af5a7700-de12-449d-bd17-2fda2d5926e3", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268813, "uuid": "e3f5bedb-6815-4f56-950f-189d3d3f96b6", "value": 229347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268813, "uuid": "e843a678-c396-47d5-a9f6-68b68c11f36a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268813, "uuid": "ea557b07-cf63-4ce7-8b30-4fede673108f", "value": "c15a01cad79fc24c54866febe236144c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5050e82-2b3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690325425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690325425, "uuid": "a2984645-86d6-4285-aad0-d34a084e924b", "comment": "Malware payload (RedLineStealer)", "value": "16f8ed24e657dc84472e9e044f8b229f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690325425, "uuid": "4db87007-b23e-4557-9ff8-2ab59fa68e70", "comment": "Malware payload (RedLineStealer)", "value": "84494f5352f09a6dcc79d05ca5b0f85624b7e58057173439bae00d97f3f61d71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690325425, "uuid": "fb144ebd-279d-4a7a-a1a5-1808c425a615", "comment": "Malware payload (RedLineStealer)", "value": "b1f689a4b6592efbb5efbe6c806f96034d175aeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690325425, "uuid": "37c5627f-d86f-472b-86a1-786aa3ec38f7", "comment": "Malware payload (RedLineStealer)", "value": "2e31064bc625e9331787f1732b6767bdbc9a242d98f003817e40529eb062b329238008c3190cfc8ce8df95b46b6483b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690325425, "uuid": "7671a012-19e2-450d-a217-44b6277dfc91", "value": "T1EA15C139B5EFF106E2F2FAB99BD42146469B6E1A3D0DA46434515385C132E01BE83F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690325425, "uuid": "c348aa67-f8db-4b9b-8e79-b10844e369a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690325425, "uuid": "1e40a846-9d5a-4f54-b495-e97212e082d4", "value": "12288:MZJm3IXwFsP4ajHRf3xdGcwnDzuGqPDqxzDMdTMqBAEYDB/KSskT9Sr2iNSppppd:MZJmYXrVfdcMwcTLPISj1gppppppp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690325425, "uuid": "28364a1e-46c6-4c27-8e3b-f15388df7a21", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690325425, "uuid": "2240d126-1d06-41e5-91ff-e1aeb7eb0a00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690325425, "uuid": "dbfea223-b804-4f42-89b2-d9932b29d1f3", "value": "16f8ed24e657dc84472e9e044f8b229f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4105dded-2b10-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1690305930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690305930, "uuid": "209713d1-eae6-4d51-a76f-4c1cff2ce3f1", "comment": "Malware payload (DCRat)", "value": "05d4d61815f869598238b29ac1f40f18", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690305930, "uuid": "3edf2ee2-2fdc-4061-bdd3-cd482180ec85", "comment": "Malware payload (DCRat)", "value": "84a4b5859260e95f36c814b9a9c8f2f0f10a9c7d2433c2b6b18447d9a8bde1e4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690305930, "uuid": "e9d92952-501c-4a06-874e-f19fd46e2440", "comment": "Malware payload (DCRat)", "value": "b43c3f5f19d1f7efacd853580ba06b005d6478ec", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690305930, "uuid": "01f79171-b779-471e-a0c9-addac7ce638f", "comment": "Malware payload (DCRat)", "value": "ab8b5194c58a25a44f2a6c12362d83b6fec1f6be4ae0045b461446b0293dc64eb8425f7d49af4499c0bf8f972a5afb91", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690305930, "uuid": "8e900c10-8463-488a-94b0-645ec19cdaeb", "value": "T14DF4C707AB4C0FBDDADC82B960D01E051592EE550FB9F4EFBEDB55C6EE30E1502A2588", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690305930, "uuid": "2259f943-ccf9-4e6b-bc71-8f118b949ab4", "value": "282b70dfcd69690287a4c8c1b3d92212", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690305930, "uuid": "ee72c6a7-5780-4eae-b227-b381def4917a", "value": "12288:1hIwcPE84eLXGZEPqGWk3+PGtqhd3Q5ScOzgfZ2m8aEqIUdNaveD94DBhAV:1mN/xWk30Oy3TcOM58aRDsAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690305930, "uuid": "bab35a4b-2256-48d1-ac5a-9b26df27579a", "value": 729712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690305930, "uuid": "975e3505-6bec-4f12-a39d-6c3a3f039548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690305930, "uuid": "dc41ea4f-06c1-44d4-ab06-57f51e8b13fd", "value": "05d4d61815f869598238b29ac1f40f18.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b1b2d1-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268832, "uuid": "9d698f5f-010f-490f-a72b-444ec5d51bcd", "comment": "Malware payload (RedLineStealer)", "value": "f59f01c2a2f8d59fb5985d62c12081d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268832, "uuid": "cd6a3a87-6150-43e1-aabc-74132aa49e0a", "comment": "Malware payload (RedLineStealer)", "value": "84bfe0627ea61685162cf5a337094cfe7f147a11c841fd9a099c7bb8bbde209b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268832, "uuid": "3e66f1ba-42f8-47a3-bc07-342b0211a493", "comment": "Malware payload (RedLineStealer)", "value": "e7825102bd901ffe4a8438e7843d68574262998f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268832, "uuid": "e0ce3c62-eb1f-4b2f-b69a-7331c1472adb", "comment": "Malware payload (RedLineStealer)", "value": "2679c2692a92413611371f3ec86a58f5f0cbb6ed2b53529b2f44373d21c3b58705fb75e8895bf183bd01565c56af7c23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268832, "uuid": "479e90ef-1aba-49de-8302-8115519d5cd4", "value": "T1F1B41212EBD9A032D9B41B706CFA03931B357DE19D78C76F2782995A0833694A63137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268832, "uuid": "f86bf680-42d5-4e65-b8ee-d77d28befda1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268832, "uuid": "e18bd936-e605-4dcb-8d3a-7ee22f4640f1", "value": "12288:EMrNy90qVPgr0vvfvqqLdZidywani44F:hysoXCqLdoPaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268832, "uuid": "40a16349-f52b-4708-9528-e347bcc7940c", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268832, "uuid": "dca076c5-2bc0-468b-9b90-915f455fb33c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268832, "uuid": "de235826-3c84-4168-b3f8-9359c58b4db6", "value": "f59f01c2a2f8d59fb5985d62c12081d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55204425-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690296944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296944, "uuid": "321ca6e2-9488-40b7-88dd-8b20f0f26799", "comment": "Malware payload (RedLineStealer)", "value": "7307cbc62c72068d3df3f43ca2f26f92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296944, "uuid": "2a55b4f4-4960-4003-ac1e-e91d13ca16c2", "comment": "Malware payload (RedLineStealer)", "value": "854686fe7733b66f0cb1fd49714e5126413f200bd8fe7c7dcc4e900e808a30cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296944, "uuid": "ddbfa467-e552-41d6-955b-fc1e03b2bcc2", "comment": "Malware payload (RedLineStealer)", "value": "685f16c82c7ca7c0764ec91f9bb1385658926d00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296944, "uuid": "b722ce48-9d68-437f-ad88-7c4e8df4b0cc", "comment": "Malware payload (RedLineStealer)", "value": "4a74908d9f1cc8a5df8bc63c7edf50f1985479d3fa89ac62057be40c6b2761fa853362e6f0e9ff0e1e039e26393e36a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296944, "uuid": "54187b13-297c-4636-a35f-f41aaea3bc4a", "value": "T15D74E025B6E0D072E6BB86301934C5611A7F7C732BB550CB33682B3E5EB06C1AA76356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296944, "uuid": "15b131fb-b652-4a8c-be2c-ec566d504c2c", "value": "41f54a8bceede5b7d9a3e6f46d43695b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296944, "uuid": "0ebcfda2-2c5a-4ffb-92c5-66837ed2a08a", "value": "6144:Ce59vMGmqM3pBs/4n/7rr27dYL6W+5pNZk6u+im1tZ4:X5RmqM3pO/4n/7rr88R+TNZG+im1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296944, "uuid": "0343a019-f26c-42a1-91cc-c62f2cf7de22", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296944, "uuid": "e6e0e16d-e5ff-46d4-80da-4c9eca85bc67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296944, "uuid": "01314083-f820-4647-9b3e-bfa1c98f9291", "value": "7307cbc62c72068d3df3f43ca2f26f92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb8fcae-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690308634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308634, "uuid": "7ddd1e56-6e71-435d-9814-14e48055e297", "comment": "Malware payload", "value": "eb299e7a54cebd104fd5de4a6d7fcba0", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308634, "uuid": "7bd60f51-f99b-483b-9701-1c566003b8c2", "comment": "Malware payload", "value": "85959522a96fe27d9ea05011819bf6daee32e80ebad09a759627d732ff3d1fe7", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308634, "uuid": "03e8fad1-7acd-40fb-aead-7516bd53c6f0", "comment": "Malware payload", "value": "2c7e4acfc5480ca78772e34be5c1c18b32c3ec9d", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308634, "uuid": "3900d9c8-1278-4674-949e-a6d99b0f86cd", "comment": "Malware payload", "value": "911f9ed7fedf9a1a3b53de609e17dca7cd11d227c8e2fc6e696e57b730783f8ee7eba39fe1f16b2f7a8f56de686d547a", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308634, "uuid": "39df370d-1dc6-4b3a-a326-792f9b70c08e", "value": "T17FF42340F9D8965FC40646701DAB33DB0AAFFC20AFD9B3472061FB5E18B5972A4629CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308634, "uuid": "cdcb72cf-0ed7-494c-a57c-f0e0b6a80303", "value": "12288:qOOZiRBC6uEk37SqPBC6uEk3qUu9VneG59ov+2U/zerfkZpzRAhVhsp9Pply+a+4:xw6sDw6sru9VX9lefUDAhVh09Ppg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308634, "uuid": "d6f23c11-d2b4-4718-9349-9ec0dc9e2ea0", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308634, "uuid": "fdf72fbc-1108-4c74-8192-0c1fca863082", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308634, "uuid": "2a5be294-6d71-4640-9419-a3642b591619", "value": "Pedidos.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac20eb5e-2aed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690291077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291077, "uuid": "e752edff-3ba6-43d7-9d89-70e2f8e8ed2f", "comment": "Malware payload", "value": "eaedd86f4210ea2a20a0eb113efe061f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291077, "uuid": "914e0ebc-b7ff-4deb-9524-3370f64ee7bc", "comment": "Malware payload", "value": "859787c13ea3c653aa6f01bb827f32e1cacf3a46926e4b434f7fc5faa4b53dfc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291077, "uuid": "f7df604b-3474-4ad1-808b-13e6804bf354", "comment": "Malware payload", "value": "f3573c23153a8cd9792600a7d56f08933ca2f0a2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291077, "uuid": "3341d6fd-3bc8-4673-8383-186da5109027", "comment": "Malware payload", "value": "8b070109d8dbf8f5055d4aae2f43d30c565eca8229ae997026544f363abce995bf0533410f4a12c3b71f9599357cb6e8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291077, "uuid": "653a8477-ceed-4d32-96cc-ef1a16a43ec0", "value": "T12E038D1DD52598A4D167D5BC90081DF2F29AD302E385B75F3DD0F2CDCA8988B4B6928C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291077, "uuid": "f97310ab-34d6-45ae-a5f1-71fcb5f20c92", "value": "768:6ljklej5O6GtH7lHyHWrFGr88pBj/U7yvSWElF:ojqaB8HDAdb/YyWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690291077, "uuid": "195bf233-4f1c-48e8-8e2e-9fd3a5c57d9c", "value": 38727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690291077, "uuid": "2a5ca387-1d86-4f40-b3ff-5ceec556d608", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291077, "uuid": "e0ee3047-8209-4c97-ab25-9aeded4f80e6", "value": "Bank Authorization Letter Aptiv - English.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c467ed8e-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690273938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273938, "uuid": "ce964ef3-7ce8-43c6-bf87-3f5fc1dc1068", "comment": "Malware payload", "value": "6086c01e744f306ce7988728fdae7691", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273938, "uuid": "d0c445b4-117e-488e-be74-8a09712bdc82", "comment": "Malware payload", "value": "85b5e910448577232337976005e37a7bb981d0806969b9d12dab8ba9ffcb94d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273938, "uuid": "4ee48c2f-d0e9-4dc1-98bc-69f90cdf0965", "comment": "Malware payload", "value": "8dd89a70b093d14bf440aafb79b8f698199782ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273938, "uuid": "a98376f9-8254-43f3-85ba-4746f15e5a58", "comment": "Malware payload", "value": "79d51106756c97814c1563e1ec2764cd942badf9be0321fc173acbea5b12c0950e6be007b0fe27a924c59456a1cd698e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273938, "uuid": "59ae2352-2f93-4c62-b038-1b89a5bffaa5", "value": "T144B54B73B744753FC46A0A3A4627F6689D3FABE125068C5B97F44D4CCE390502E3AA4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273938, "uuid": "256f619b-d26b-48a8-8427-73a02c3dbcd4", "value": "a6a147270aff725bb19edb907d502ecb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273938, "uuid": "f2c21cb9-4daf-4044-83cd-0951476dbd70", "value": "24576:bzwVdVkDkS75dJ33vgvKgUXwuvcx13mZTNCdDBsSpQCxtngh52PrFZgcaSAOz2:PKkJYmZED+SpQJ52zgj62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273938, "uuid": "afe3d2d1-17a4-4c84-bad6-1334f7e0e70b", "value": 2347008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273938, "uuid": "3925ddc8-94af-4eca-a847-75de165d2a19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273938, "uuid": "b9661ce5-fa83-482f-8f5a-1a4203a333e7", "value": "SecuriteInfo.com.Riskware.0040eff71.2399.8433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06c4ef5-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690273932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273932, "uuid": "63d8a8e8-2780-4c7f-b33f-541f67ba9e31", "comment": "Malware payload", "value": "005758206c916da69d52288726bc6bbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273932, "uuid": "02f61e48-65a0-40c7-82a4-7ca10cb4da44", "comment": "Malware payload", "value": "85c9ed8dee2c96794f159ce2b64dba238fd7c2470e12d9339ec71477ec1dd2be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273932, "uuid": "0bb46fec-190b-4bed-9e75-575f0f54ef85", "comment": "Malware payload", "value": "34caa668de0eaf405af665f2703681ee7cddf50f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273932, "uuid": "a38931ba-f261-46c1-be03-f3991a907bd8", "comment": "Malware payload", "value": "f758ddac16e9d22a4110a38f363c6bf97eda44fe883151909ba6078655ad3ca86957e8a4fddc4728a3130dc74e1f1521", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273932, "uuid": "3e472355-8962-4086-bcc0-1a6cc434a92b", "value": "T16DD211AE69584EB0D547E6720A9CF3A3967E5ABF1B0441A3FF3CA0E46930D2552350FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273932, "uuid": "4aedc13b-9a44-4a55-98a6-8f9ee8fbd492", "value": "3f9dc0d15e9e3051aa6a255f120e3a63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273932, "uuid": "c6c3e2f0-cc4b-48e1-9b6d-b4915ae5334b", "value": "192:Iy85qS6K6IpibpHTVh34fgzakgb2O+R4mHefjId7j95GwFMkjcPxGlrCGeDOo4:785qS69pP34fgYC+EP95LFm4NClDOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273932, "uuid": "0d2f3bb5-2cd8-4b08-9472-779cf28f0afb", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273932, "uuid": "6dec0a2f-88ff-48b3-90d8-e44109c4018b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273932, "uuid": "6336162d-19c7-4595-baaa-cb07f92f2aeb", "value": "SecuriteInfo.com.Gen.Trojan.Heur.10855.25285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08962b59-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690280066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280066, "uuid": "c5185619-8151-4f31-b61d-a5dae72ce632", "comment": "Malware payload (njrat)", "value": "a3816b9541296e5f0f675b0758740aa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280066, "uuid": "759b0d4d-d9c5-4270-9793-b65f1d22a862", "comment": "Malware payload (njrat)", "value": "85d94b63f241688d840e0d2aa58270b93eb019b908366e682c71edd533d86581", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280066, "uuid": "ba68afbb-46dc-44fc-8ebe-beb858844b0c", "comment": "Malware payload (njrat)", "value": "c0ee8c6ce5863c355364975695241e4d5f8f6da6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280066, "uuid": "0bc4150a-67ce-4935-8a80-4e064f122655", "comment": "Malware payload (njrat)", "value": "febb519cc906ba0c8301ce4d44df609237a8fb6fbadb87869c57edb345f7df6ef3306ba9fc35bde661d868130f7b8499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280066, "uuid": "f0460ecf-f4e8-4e0f-9687-ace347871cf0", "value": "T176634B4877958A15D2BD6E7804F256518730E60B6D03FB2E4CD120FBABB3EC54A42BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280066, "uuid": "4a4671d7-3d4b-4526-9777-b2d1753d7f78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280066, "uuid": "abc5711f-fc6d-4be0-b814-9cf457ccd030", "value": "1536:CZfwkvoN36taQviFw1BIGf6BnvbZfLteF3nLrB9z3neaF9bBS9vM:CZfwkvoN36taQviFCBxSBntfWl9zuaFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280066, "uuid": "8dad5b4b-4127-4357-b007-42eae3edc293", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280066, "uuid": "c9449c84-0ff9-4759-b7a3-fd4d49d4b990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280066, "uuid": "72db7b09-8f9c-453f-98cf-2ac27c6bfbe6", "value": "okblud.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c196ee99-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690273933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273933, "uuid": "ea1d0b13-73bf-4262-9477-457ead0402fe", "comment": "Malware payload", "value": "f8e72c89827e6ca788feb955f104dd28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273933, "uuid": "a880977c-2f64-4cae-8cc7-eba1a7230b85", "comment": "Malware payload", "value": "8623d68696fb748255ecbddc8d4f118eaa150e31137a4697736c97da64499c6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273933, "uuid": "dc5ad2bf-940c-4918-aac1-d798855161bd", "comment": "Malware payload", "value": "a4a2de042923e5fbb46f245a33234d7c9ebb0f5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273933, "uuid": "26c7d5a1-6258-4bf2-9c6e-7b8237f99749", "comment": "Malware payload", "value": "32f1dc3318c384accb14cd91ec14046a08224e36f9a7f99443ae0f5a5454fea04b49f1d991051a5e1f47efb681d5fbde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273933, "uuid": "b06b9fbf-f6d8-4e1b-9b72-ddcc098ca825", "value": "T16FF25B33B8D0D1B3D49690B108AC8742AF3B665153F1AC9748A8215BFF757E36D7A306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273933, "uuid": "a424c8f8-78fa-4a4a-8833-2697950c4978", "value": "384:d1tbGqal91C8pCo4iRWzxGL+ByqS97FCdXrYQ3VOVPNFIsShXo:rBPwe8pW3GL+BHS9cdX53VOVPNFIswo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273933, "uuid": "b77d16b5-ed37-48b9-b1ae-d5ec2aeb45d7", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273933, "uuid": "cf0dab94-94b1-456a-9cf3-c96d09152644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273933, "uuid": "d8e5cd40-64b5-4eab-816e-bf1be63028bb", "value": "SecuriteInfo.com.FileRepMalware.32115.13910", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66afd48e-2ab2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690265621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690265621, "uuid": "95468e92-4c6d-4099-9c3e-3d21cc41b14d", "comment": "Malware payload (Formbook)", "value": "03754fa7d639d85d262b51181879962d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690265621, "uuid": "3113118f-f3a8-4f06-aa6a-adf52239ba06", "comment": "Malware payload (Formbook)", "value": "866ca3e76f6fb1e345fa6159e2d9a56669b8d036c1a04ac950eb238a4b22187c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690265621, "uuid": "07c53d85-5fc3-45c0-a695-51e6981cc410", "comment": "Malware payload (Formbook)", "value": "b4bc65b6ed0f5b63cd05f0ea5fbd416764c1c731", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690265621, "uuid": "93dcaba7-60cb-4040-8407-0003700887b8", "comment": "Malware payload (Formbook)", "value": "37e267207b9670abb41694e3b1224b75ecf600039ec380589d6521ceb992797f2eb52d2e114fe245a9d6a1a8a4bd1a3c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690265621, "uuid": "b566f454-cdc5-48bc-86e6-d6b28ba44fb4", "value": "T115237C5AE78F02A4CF911376131B0E8996BDB22EB35155B1386C933433EDC3D4666ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690265621, "uuid": "a227d4bd-6d7e-415d-96bc-2642345fe74f", "value": "768:sFx0XaIsnPRIa4fwJMvC63Lz2ymwUYXM9Qi71WqFpu:sf0Xvx3EMvF3fbmwrc9Qisspu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690265621, "uuid": "62d8e60c-b049-4d29-969a-b1b45786f0b8", "value": 45695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690265621, "uuid": "7aab90c7-5f4e-473f-8bda-88e9bd6ba305", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690265621, "uuid": "0c8a147a-b6db-4cf0-9450-7b55fd82084f", "value": "03754fa7d639d85d262b51181879962d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654b9ac8-2afa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1690296542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296542, "uuid": "58c3bb20-f472-4038-91ff-4692f78790f1", "comment": "Malware payload (ModiLoader)", "value": "0d4b25a33c69e4443f28a43ae3b015c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296542, "uuid": "80727879-b2b7-4b81-9bab-4ecde7bdba7f", "comment": "Malware payload (ModiLoader)", "value": "869eb1b44b9d5e0ee5b99b1189edd21d706c58094387ba32ebf2aa45703a9c9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296542, "uuid": "e922c39f-0010-4785-85e4-1d7183d61943", "comment": "Malware payload (ModiLoader)", "value": "92267c25dc62805bdfff9497174bf91feec90f2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296542, "uuid": "ae289e15-b425-49d1-80e5-798fdc979419", "comment": "Malware payload (ModiLoader)", "value": "78f9a65b03489ea07b180e449885a20559030433a20f35e608b10602435e1ae145073a728b3b2d198c1e72bf79796907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296542, "uuid": "16fd1777-32a6-4222-acff-06d8c282e980", "value": "T1F575F119B2F04837D163593CAC0692DA946EFE253F39FC45AEF41C9C5F38A61392918B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296542, "uuid": "ea0095bf-2b32-4370-b48a-dde505f33d88", "value": "ea8d56a6b9f4ce307f716636038657d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296542, "uuid": "d72de4eb-84a5-4caa-b7d9-96be7babb3a9", "value": "24576:rbGHGrOrQ9gnMC6LO3cQoikKgti8PM2MCUrTDLwVIf2IOXkDtZ3NptsNbJZ:rbGWAJeDingti8P+TwSNO0n9vwbJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296542, "uuid": "bf40ef6e-bafc-4276-a359-6fa446c8e1fa", "value": 1595904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296542, "uuid": "08e7ef35-c55a-431f-a75e-387dfb843bab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296542, "uuid": "126e08b0-27fa-4e06-8921-6ce8b0dd5865", "value": "vadesi ge\u00e7mi\u015f fatura Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5245c094-2ae7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690288350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288350, "uuid": "9936d047-9f29-4843-9563-15c7307cd380", "comment": "Malware payload (RedLineStealer)", "value": "42100d8cc79d84bf043b30654601ff11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288350, "uuid": "59c05d07-2900-40ee-bd6f-a13eca24f1cc", "comment": "Malware payload (RedLineStealer)", "value": "870100c6ad8a6cffe9c6d33bf46a6c829a68722c2a724118c6a3c4e24dd68c6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288350, "uuid": "ed08efdb-1c2a-46d8-a3ef-c26891f59250", "comment": "Malware payload (RedLineStealer)", "value": "e197acf8c33851a5f5495753dba5236d4b3804f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288350, "uuid": "401b94a1-b40f-49e9-b170-ed83315fb89b", "comment": "Malware payload (RedLineStealer)", "value": "6e0a9a5845c2f51b0bbf8f06c50d64f7bf756881ccc3a8937c5825bad823eaf00543cf68f2a10d5ca449457b00eead3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288350, "uuid": "24045c24-5614-499b-84f2-322966983015", "value": "T1A2840212A7E48033D8791BB018F342D31F3A7DA15979836B3387995E1CB2694B97633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288350, "uuid": "a98646ed-82f9-4195-b5e8-8cdb5f96a42c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288350, "uuid": "1e0d65a9-9fe1-4e27-87b6-c8295fb0120f", "value": "6144:Kiy+bnr+np0yN90QERqqTiS8osWUULMWNd+ckJrFe1ZmafdlunX4Sc:aMr/y90euMCkJ5efgX43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690288350, "uuid": "5f0af12c-2c8b-42b9-8129-536cb3089417", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690288350, "uuid": "7a2a08f0-8147-4262-a29f-79b2255a40d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288350, "uuid": "58bb0928-354f-4a0f-873b-75ec0781c89b", "value": "870100c6ad8a6cffe9c6d33bf46a6c829a68722c2a724.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6491867-2ab4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Chaos)", "timestamp": 1690266694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690266694, "uuid": "d4b6a2e4-eab6-4fda-ac0f-b0aefdb231e4", "comment": "Malware payload (Chaos)", "value": "adb3dde4a25e596c16ced4cdfc6ff8dd", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690266694, "uuid": "2061db92-fd4e-4c19-a80f-69d403e0f05a", "comment": "Malware payload (Chaos)", "value": "8727091cbb89e5e31eeb2503ffaa242601c8840eee0973fd62fedf1b4b58ab44", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690266694, "uuid": "bf6ba73f-204e-43ff-86f1-9ba1704e085e", "comment": "Malware payload (Chaos)", "value": "7934e6bc9489933c0af8dfe7bdff482fc6759bdc", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690266694, "uuid": "ca27bd78-5f5e-4c8e-a223-b65c566367ce", "comment": "Malware payload (Chaos)", "value": "ee9d41c7bb450b1c1b7f29c0a9b2fdce85718da90806878bfb818c89ccc3ce6e40aad96ca511b010bb07e75cc3ec69ef", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690266694, "uuid": "32beebe4-2ab5-418b-bf9f-48fb57a5767e", "value": "T13325172429EA5019F373AE754BE4F5BEDA5EBF632702941920D00F4B3623989DD8273D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690266694, "uuid": "df42c4cb-9547-4ca4-87a6-e38111f053c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690266694, "uuid": "707751e0-d58f-4495-87cf-240da6c3832c", "value": "12288:vEPMLC814R2hig4tHkg2W+AU+R2TjsPvEpv8LpgUO4EP3SL98l0zmWHQuTwYzzjc:/ztQE1ov2AZ9HjkftWy3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690266694, "uuid": "f16f67c2-6ac0-4358-975a-6bc10888bc85", "value": 976384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690266694, "uuid": "339e93f6-9012-4fc1-8b9a-d0d86b451466", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690266694, "uuid": "7920666b-b67c-4e12-9bcf-704e34947a07", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61893291-2abd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690270336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270336, "uuid": "a496914e-d7ab-4d08-b7b4-3b55918db457", "comment": "Malware payload (RedLineStealer)", "value": "c1899dff1a38a86c97a7b0871aac1a55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270336, "uuid": "d7ad2af1-e8a6-422a-a005-f551e5c8b9dc", "comment": "Malware payload (RedLineStealer)", "value": "874ab17307cc7b51b90c6e2bfeb15fb2aba43a89ee9b70db6d2fa05c0c4b1221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270336, "uuid": "dff34344-e78b-48cd-8a66-55b3f011bf83", "comment": "Malware payload (RedLineStealer)", "value": "8b8914178658c5ee52a5b39e75eaec0dc5b47509", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270336, "uuid": "ed4d46f1-7231-4d74-adb2-677764a39e4b", "comment": "Malware payload (RedLineStealer)", "value": "003aca4216839c1318899353870621c62a2cfba920d8c881998b1b80ec1e76bc95b249c2a06fab78de4fb398fbdfd532", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270336, "uuid": "68800a6b-dea9-45a2-9c5d-cd74e0f72fa7", "value": "T179840253A7E49473D8B817B069FB02C30A397D925D7C935B3785A84A4CB3684A53273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270336, "uuid": "97a2532a-d02c-45eb-98c5-42c5150db60b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270336, "uuid": "07efe166-65ca-4758-b691-6cf1dd908c7c", "value": "6144:K1y+bnr+Mp0yN90QEXe9albd++/+rtySc51OaHIEsgBZ+t4YDC/UeOkN:XMrEy90q8bd/atySI5HIgBYCYWpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270336, "uuid": "abbc8aaf-8445-4227-a9d6-b53b091e0ccb", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270336, "uuid": "c1f22265-2d82-44fa-832b-1d686a11197e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270336, "uuid": "cf91ab04-e228-4d10-8fce-843a6b9f7ab8", "value": "874ab17307cc7b51b90c6e2bfeb15fb2aba43a89ee9b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9a2860-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690308661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308661, "uuid": "a47fa9c2-6aeb-45f3-b78f-0fa44b5db8ff", "comment": "Malware payload", "value": "dc852d72e109442b7c85a44aa6b48807", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308661, "uuid": "fabcfe26-79b2-4a38-9a11-8d9ae487de00", "comment": "Malware payload", "value": "87c61a44409b9b2e073d508f6e6732f0e20a5b31f3da8d7a7676ef945b0d9fb2", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308661, "uuid": "ec3ddfde-8d0a-44cb-a60d-61e75cfc43a4", "comment": "Malware payload", "value": "94ac874a18f4562c909e1040f3e5b1a2a42ac5e7", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308661, "uuid": "ed3f4b3c-d007-4bba-9634-c9f5455deda7", "comment": "Malware payload", "value": "cf192b621a9fd56756b06a3c0ff6fa4ee5c34da48e1ee4f34a131694868c5a213a54b4273bf9253b7e995a17f3171d3f", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308661, "uuid": "21514403-0d1c-4719-9250-1c7689ebed62", "value": "T1EEE4AE57F7C7FAB0E6BE827A86B1891C527774520260A78F674072896D23392493DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308661, "uuid": "9b66bfd4-f59c-4963-b6e7-d7a68bb262e2", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308661, "uuid": "8b40fa9d-8f9b-4898-a834-bcd715c87b35", "value": "12288:Qn/zDvGHAykHSzLW/4+8bzbBSreMdAhgFK/UqW+HgQZ+b:CzbGHAzHAjX1zcL+3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308661, "uuid": "4d52a482-5c19-4d20-b30b-5384abf36203", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308661, "uuid": "efd78bfd-1ff6-4c63-a83a-f587a7ccd0cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308661, "uuid": "cdfc350a-58e3-462f-a469-65a4a066c778", "value": "RFID Product Enq.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434a7ce8-2aef-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690291760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291760, "uuid": "94451c62-2686-4134-b4dd-95916f5b7148", "comment": "Malware payload (AgentTesla)", "value": "88546fdf59c345c522de5ab0f93d70ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291760, "uuid": "08206c50-ec56-4c34-a1db-b9d98af4db21", "comment": "Malware payload (AgentTesla)", "value": "882bbeb5c5706da87e906a768a4335ab9adf734ac4348e4cee02c35339b2afac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291760, "uuid": "fd2d6275-7223-4228-92e6-426fdceea628", "comment": "Malware payload (AgentTesla)", "value": "aaeb89aa31676630e1e7764526fb99091b353c37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291760, "uuid": "21492023-05e3-4a9e-a47f-4b2706b72df4", "comment": "Malware payload (AgentTesla)", "value": "134cc33a50d663907a49d6abcb35a5385b558a9bb229a0cf403902609e3f55f78db6573a90e3369d5e1fc3c95bdaf2e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291760, "uuid": "0bd6e447-c230-4188-a57d-2ce705a4dc3d", "value": "T1FD05F11176E99B53C1BA97F88030327013BEADAE7436D3195EC370DA1976F948A22F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291760, "uuid": "f266563c-8d37-481a-8c46-b3d3c6cdc324", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291760, "uuid": "1d072704-4247-4950-8cdd-1b9b50295252", "value": "24576:qxP5uHIcTrGCSUFPQFgT2FuZ3uU5ieasJYlQ:uMHIkrzSUFPmFyQerJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690291760, "uuid": "e50d5fcc-b625-4a6d-b36c-cc375fa53aff", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690291760, "uuid": "97969090-e197-441f-9e15-cdfbf1107522", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291760, "uuid": "14389300-de85-4b5a-bcc9-318226f0f07e", "value": "Sygnet Order 25-07-23__PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59d1297-2ab6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690267578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267578, "uuid": "be5478bd-fba1-444f-a9ec-ef2934ae9db5", "comment": "Malware payload (RedLineStealer)", "value": "22cb3b41ccdc1ddd086da1a0e2183b96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267578, "uuid": "23349a3a-b077-4397-9bf5-b2187318a4f6", "comment": "Malware payload (RedLineStealer)", "value": "8861cc8e71b957424f4ed3aa4e4ba787f78f4e5345251d162d530b1666e9c219", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267578, "uuid": "b5ef68c5-4b8f-4434-a922-e094745a1ea2", "comment": "Malware payload (RedLineStealer)", "value": "3d637a4fe0184ad5222c319c04abeb5d6c7b19ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267578, "uuid": "25595eb1-9835-49e0-9bee-e406cecc9bfb", "comment": "Malware payload (RedLineStealer)", "value": "a7b790d5094966a6e617f88e9e8b966d35a2dcc064724a3173dc9ca66a3ada45cc467e57cf37c1fc8de16fea861855c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267578, "uuid": "b672a190-2fa9-4c15-94e5-7f4a84a9fee5", "value": "T109840102A7D45073D9B62BB059FB01D31E3A7DE25C34836B3796A95F0872AC0A436777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267578, "uuid": "37795f73-1083-4e9b-b506-c3a718c572d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267578, "uuid": "1906a26f-7717-4c04-9879-036011f9ac10", "value": "6144:Kzy+bnr+vp0yN90QEKBz+DduBZRjhueYndF1Qn4UZV/0BqRiZRmk7kzF8D0fw:lMrHy90u65ERNWE4S/niZRmkeFq0fw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267578, "uuid": "01d5b535-c26c-471e-ad4e-8985c8117a5d", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267578, "uuid": "f6fca9bc-ab07-4d66-8cd8-a8771d4f2765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267578, "uuid": "019269b9-235c-4447-9250-0f5e82e70f90", "value": "22cb3b41ccdc1ddd086da1a0e2183b96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b439c18-2abe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690270755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270755, "uuid": "9ce5d20a-37f6-4a10-98d0-7d1c1e28f209", "comment": "Malware payload (Formbook)", "value": "abd50f177d6564fa9e38976e28cf952a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270755, "uuid": "1775c5a5-f223-45bd-a96b-936a8fb9ceba", "comment": "Malware payload (Formbook)", "value": "88e1a0082706350926875210147011b85f7f8e44a10aa7346b969f882efef4dc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270755, "uuid": "cef8f272-7049-4db1-a6f4-0b22da6dd5f9", "comment": "Malware payload (Formbook)", "value": "c3b74ea15e46348c3f61f4807f95db673c709f9b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270755, "uuid": "0c8393f8-5fd5-4854-b7e9-d0a9527f6f82", "comment": "Malware payload (Formbook)", "value": "fe10f1e1c41a21a53d8c8532bbe1769ba6324a9f5f0c14f9910cbe83e203ef7d7ffa312dcc3abb1db2f1c8024626112c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270755, "uuid": "068ccd77-98c2-4fc6-9f4e-323c64930625", "value": "T1C2C423B8D2C278E7585A08D9C2F8FB777E0361D013751E7427EB9C3D11A867BDA860A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270755, "uuid": "32271d9d-809d-4966-9ae0-79f9dff17bb9", "value": "12288:Sa+iYESzGoJg0Mc7iUlJzkzEAiRHzbc/rK37gMKQ+8S23Mc51rfMyqZYp:nHlSLu27PfkzERT8+sq+87Z1bMy6Yp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270755, "uuid": "d90369c7-1aa1-4abe-845c-e6cfce3f86e8", "value": 550758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270755, "uuid": "11594b23-ebdf-4360-b9d8-68002a351a2c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270755, "uuid": "004e2276-f3d9-40e8-925e-23411e2f857e", "value": "Re KIEFEL Packaging GmbH Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9fb5d3-2af9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690296259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296259, "uuid": "d5e906aa-3af9-4592-917b-cf7ebe612e63", "comment": "Malware payload", "value": "70db168ddd6f5a835bb12a8e6bef43df", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296259, "uuid": "e0cac4f0-9078-4b71-ab87-474e978a6d3d", "comment": "Malware payload", "value": "8924440d1045163e8aff5fa9aeaa5f4b5be88d7b6b82060c3b8d8d7314b22f20", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296259, "uuid": "f720f05c-f2a0-4a67-a3da-69dc5e3fccdd", "comment": "Malware payload", "value": "6c1d040df4b7747f594ab5350e9641e5015fb12d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296259, "uuid": "b444ad40-39bc-4849-b256-f8e7accaec93", "comment": "Malware payload", "value": "523c5ca36f343a34ff17747f7629e60472b7d44fa9123e6c3e98d9fc84d5653f721348a2d14e0f02a84b8783313ad582", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296259, "uuid": "8328a79a-b12c-481e-89d3-641a0d643620", "value": "T101B42211A3FD5508FAF73F846DB562A40E26BCA6EDB9D2AD1250105E8AB2F40DD70733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296259, "uuid": "87fd9023-188b-455e-9eb7-cdd630d032b2", "value": "3072:5z2CyVMap4d/JMaoa871Tpdr0zSVrILBjkzcgaYPE4bOXL83K8a/HmsDy:ttw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296259, "uuid": "35a31d60-1b45-4d1d-a469-339dfeb5fa0c", "value": 529954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296259, "uuid": "f4afccc5-58f6-4b5c-8e7e-0d14e7cb72dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296259, "uuid": "a0f0ed9d-6427-4328-b404-1179e65419e1", "value": "Notice_4958726.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9097352c-2aeb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690290172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290172, "uuid": "a77d99e2-27b5-4363-b974-f39b649ba349", "comment": "Malware payload (RedLineStealer)", "value": "9b301e641a66113013a35642716960f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290172, "uuid": "b9b775d1-535f-4fb7-97c5-28dd6b8b1ea7", "comment": "Malware payload (RedLineStealer)", "value": "8957e642c31e99b712276df15acb63599991b58862764dddf62da3fffb5ab0d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290172, "uuid": "f3c858d7-c7da-4ec9-a980-9f8e9bbf97ee", "comment": "Malware payload (RedLineStealer)", "value": "775e4c6b113e2d8e0803f49da66ea07bb14b14bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290172, "uuid": "eb3805b9-dfd7-454b-9e5f-e27151c6014d", "comment": "Malware payload (RedLineStealer)", "value": "ffb9449a60e817ffc6bda3f4c1650b26fb7315d5fceca436977aeb5a16d5c228ecfd2707b4d87d0a32c9b366e192f563", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290172, "uuid": "76d3b922-eed9-4c7d-9a3f-1d95246dd4a3", "value": "T196840212A7F54031D9B1277058F312D31F36BDB29868D36B2392A95E1CB3784A97273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290172, "uuid": "74189ef4-6311-4c8f-8175-8cb938072eda", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290172, "uuid": "ac7c92a1-fc1a-4386-9657-fa5ebd3a7b24", "value": "6144:Kzy+bnr+Op0yN90QEG2p4/IT6dv8Mbdiyg1EOTNnklHnmal+XqIOocGsKRpqz:RMrmy90v4EqVE1EOTNngHU6PoGmcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290172, "uuid": "bc2e8a9c-64a3-43ed-81ea-b8caa6dff299", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290172, "uuid": "042a194a-9820-4c65-9830-922cfb5cfb2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290172, "uuid": "3517b483-6c18-43b8-920e-ce143d7ed5d5", "value": "9b301e641a66113013a35642716960f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a0b44d-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268536, "uuid": "a9ab964f-0b69-4866-b8ab-b06f30fea688", "comment": "Malware payload (Amadey)", "value": "c4e1c2997494c1365d16c3949c8ae9e3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268536, "uuid": "c68cd67e-0dba-4ea2-83c7-b0f9d7bd15bc", "comment": "Malware payload (Amadey)", "value": "89b5fd447b90eb9b5c813e41d51a69f4217ba820410726d988eedecb9e501a76", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268536, "uuid": "cd276f29-2a62-406f-a92f-0c7b0ca2d69a", "comment": "Malware payload (Amadey)", "value": "157f00df322b9ceac4ca2727a5a6b1155dd87ed2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268536, "uuid": "fc60fe98-5837-41c9-b629-183ef2b266f2", "comment": "Malware payload (Amadey)", "value": "d02450f8eabaeac79785e17a4ea23127f1a7b1c1a1e36333944d0e3c03c5df421680dbec3ced87149471110ead8a6654", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268536, "uuid": "e079bf1e-172c-49e1-9188-cd084bdb4cc9", "value": "T1A484F103B7E85133D9BA2BB418F702830B367C619D7983AB2396699E0CB36C0557577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268536, "uuid": "e438be90-0f85-4c69-8c0d-4f48bc3a3b64", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268536, "uuid": "84465ffe-5544-4f12-a7fa-3b1ee3ad3059", "value": "6144:Kwy+bnr+Bp0yN90QEOCGRVWt765Os606Zt5SOVfMArWmwp13xfm5Cvzw:UMrNy90j8VZIquDSOnsm5IM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268536, "uuid": "08b4231b-5981-481b-9d09-3968a1c1fc1d", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268536, "uuid": "2084ce1a-9184-4c6b-b28b-6579645cc8ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268536, "uuid": "578e032e-7022-4b15-a4b6-5f8413b85a57", "value": "c4e1c2997494c1365d16c3949c8ae9e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16b35a4-2b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690307461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307461, "uuid": "c545f20c-9776-4930-810d-c063aa0c15df", "comment": "Malware payload (RemcosRAT)", "value": "fe23547f8db2e56792d230c81ce6743c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307461, "uuid": "8ebd6487-0e78-4f29-bad7-a01eeef69d1a", "comment": "Malware payload (RemcosRAT)", "value": "8a7703a7a13f95e6e58aac075b70bc322355e7f683e04824c17407a1881838cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307461, "uuid": "7e27add4-9d83-4931-a042-8859cdc1bd46", "comment": "Malware payload (RemcosRAT)", "value": "856c88968d28f38098ee5e8178f86d556293d90d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307461, "uuid": "2a811776-7f12-411d-bd31-f816b080ee62", "comment": "Malware payload (RemcosRAT)", "value": "bc9163c3b2c4b6940d70ee38b762a26ff8cefa9ee773329e64625557dd6c3d6429d110cb2078177c164ba776bc80db3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307461, "uuid": "f270cefd-fc76-4efd-b11f-278c598b83e9", "value": "T1A535022436B89F97C1BA47F88030623413F9AEAE6536E30D5DC670DB6875F808A61F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307461, "uuid": "88b9238c-85d1-424d-87a2-3c06fd376273", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307461, "uuid": "627b290a-f0dc-4100-85e4-a2336def860c", "value": "24576:rxtKHIcTrGCShlxeUlwfJPAsg7UTAm2D34WhCmD69oe7KNFe:tIHIkrzShCfFAtU8l4WCm4oZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307461, "uuid": "a3c1317e-16e2-4b58-9d72-033b1087aa67", "value": 1153024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307461, "uuid": "490adbf8-1566-47d5-b126-2beb5e9fd1cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307461, "uuid": "99556ca7-4f89-48ba-adc6-7c6f235ccdd6", "value": "fe23547f8db2e56792d230c81ce6743c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c508d8d7-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690282100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282100, "uuid": "e6ceaf65-2ee2-4681-b281-3eccb371a5e2", "comment": "Malware payload (AgentTesla)", "value": "2ea2de92d8d8acebb6efc0235e479bc0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282100, "uuid": "ae535c29-b548-494d-8dcd-be8eb123699c", "comment": "Malware payload (AgentTesla)", "value": "8a9134daa25d861d333adfea78e7243d2668d86dd35c18ec05593b9ad8f2a219", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282100, "uuid": "023cdb45-5094-43cc-a029-a253b041b558", "comment": "Malware payload (AgentTesla)", "value": "5533708482177093b463d45be4e67f194ab9069b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282100, "uuid": "bd45db2b-b584-41e2-81af-e3f266cab03b", "comment": "Malware payload (AgentTesla)", "value": "e8d2e72a1020d93241e55d5ebbf03e7d2c9990af7986a0efc6360031c9cfa5aba23110d0be0cafec1fc63f690a21baaa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282100, "uuid": "09decfe4-b713-4b3c-acac-d4831f95b683", "value": "T1D6D4235182AC1907D7DC67F0AB36F56487B26E421116C30C5E4FFEA172F7BC28362A69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282100, "uuid": "bba95995-5cb8-4b4e-9be9-c982649f33dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282100, "uuid": "1b596eee-691d-420d-961d-aaf499e6525a", "value": "12288:Yfb/WT4UkuZbphndhZKDqpdNKl5KdZQQafFuHTJpsOZTcPGFR+POS2:YfzW/ZbpRdhZN6Kawz7sQpR+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282100, "uuid": "3c727c7d-104f-4479-a693-73c71db6e1ca", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282100, "uuid": "90ea3a8a-be67-4201-a3c5-f4d55508de5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282100, "uuid": "6d3a0e9d-b691-4761-a760-d422afbf451b", "value": "Adjunto orden de 20El 17072023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e74449-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690282093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282093, "uuid": "b387eca8-63da-481f-8485-7451dbc0d010", "comment": "Malware payload (AgentTesla)", "value": "4f519e42baf208066358c1252ede8003", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282093, "uuid": "d3d469b4-95c8-4a1b-9e22-d1ef44ba905e", "comment": "Malware payload (AgentTesla)", "value": "8aa6ac0c0f3713689adb70d54ed8bc83f50616d01891314005d5366e43c4aef7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282093, "uuid": "6468c60c-a655-4d9f-8e47-0a9ecd939617", "comment": "Malware payload (AgentTesla)", "value": "76d18866f301eac7298bcdcc87cbc7ffc4a2acb5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282093, "uuid": "470adaf6-e368-4638-a3ea-406f8f7f0961", "comment": "Malware payload (AgentTesla)", "value": "8684dd6f1e6bfd6d4c7e23545de7f78aec605eb9819cda561e2d1be83cfe1ff3dda08b509ab66ec58663f76096fbdafc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282093, "uuid": "bc6c0ea4-837b-4c34-ae96-a72eed0595b7", "value": "T18BF32869A2895C61C35D4178F4B511C80AB2A107A6D7F76D0DBDACF53E0A3833E2FC66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282093, "uuid": "bcccbe4f-565f-47b3-af1c-953f3f8ebfb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282093, "uuid": "175f9c26-2408-4d63-8398-ce63a92c13e7", "value": "3072:uS6Hksdxox2MmYdE9zr4WPpmaeAc+u3sS1i3usX4tig:uSi1YuZppwh+u32usXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282093, "uuid": "15e9ab9a-66ca-488f-b4f7-ce029aa44d3a", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282093, "uuid": "6809b183-9754-428b-9d13-cc023f3f37cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282093, "uuid": "b0511b5a-c998-4645-9f58-24d6462969de", "value": "8aa6ac0c0f3713689adb70d54ed8bc83f50616d01891314005d5366e43c4aef7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b121ded-2abd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690270191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270191, "uuid": "6f87e0b9-3d33-40a1-af7a-2d549dd468f3", "comment": "Malware payload (Formbook)", "value": "4cf0690f0969fedc003860b4eaec926c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270191, "uuid": "041d144a-1d2f-42da-892f-205af239b6a2", "comment": "Malware payload (Formbook)", "value": "8b26c2a146a3552fb63571009f464069774231814d7c27982a8d46b94469743e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270191, "uuid": "7c7daf41-8ba6-49cd-a0ec-3c9c0aba7f61", "comment": "Malware payload (Formbook)", "value": "9a77bbdc9e02c1babc776a6fa73f7e7c83a9f21d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270191, "uuid": "ec218158-054a-4f8b-a883-ba5402e72ef8", "comment": "Malware payload (Formbook)", "value": "5c8a87dc0700095f683494bfb39dfdf1e9df55811a28376990671334a2509b4ad7b93513c325ad319e68c38b22a134a6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270191, "uuid": "f5f9efb6-4226-4f3b-984d-8953a2950a79", "value": "T14ED433B352349FCD7A3B4E2DB56291337669560DBBEFFB0AE517C84045AB6C1BA0C108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270191, "uuid": "4dbf1814-95b6-4005-9c15-f6435c66bf3b", "value": "12288:eBxZxCUHBbIJ/WhG01NsDHOCPFrybrzLLa9WsL3tj2zZUqlVZzP7tA/91vc0T3nZ:ef7NHe/R9DOEQLa9P92H7a/9Jc0znEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270191, "uuid": "ad6fec1e-bf04-4706-b280-06f90eb11a56", "value": 639860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270191, "uuid": "f9948f60-2fec-4811-884d-661be074824f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270191, "uuid": "83e50e4e-88cc-444c-97c5-126617618e62", "value": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u043b\u0430\u0442\u0435\u0436\u0430 - \u0438\u044e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4dfce9-2b43-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690328043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328043, "uuid": "281b71ea-c082-4f4a-88f1-7b78d6330a48", "comment": "Malware payload", "value": "c4c82675564cc237a76f48c36aea919d", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328043, "uuid": "2d2df0f1-772e-46c0-8751-6e7a5d0773c7", "comment": "Malware payload", "value": "8b57e96e90cd95fc2ba421204b482005fe41c28f506730b6148bcef8316a3201", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328043, "uuid": "61b3803a-573b-4864-bd2b-d542b26eb827", "comment": "Malware payload", "value": "9bc24e1c60a08a8f26e2d10ae49982da5b8ec6df", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328043, "uuid": "b168b20a-4b19-4401-a305-2fa3bc2b829e", "comment": "Malware payload", "value": "79e3ac6593d803b996cd760c1a16ac30fdef550114b439eae998bb17687df2e887add48f80fb548688894d443dee1bad", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328043, "uuid": "91c19c7c-137d-4fff-a5b6-1f0897f549d4", "value": "T186F2D7377D644939C8C3E33F34CB4756DAB0A4B2A732110F1689357D6B32685AA1EB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328043, "uuid": "0729abe8-f82f-46d8-89df-21a222a0f6ce", "value": "384:E2F9i9sCegTspa71cdXXeWpPDNmP5/2wLGhjwSgzpQiIiE1p+3WQjrn0x1+2+JJg:Xk9sCe/l6p694/q+2+3iSE/Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690328043, "uuid": "2ca9ec90-dedb-4591-8e84-06bc289ac6a4", "value": 36344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690328043, "uuid": "1beb5110-46d8-4c7b-85f6-9aeade27db20", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328043, "uuid": "6d86f730-d518-4023-996c-eaf2b789e64f", "value": "8b57e96e90cd95fc2ba421204b482005fe41c28f506730b6148bcef8316a3201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b50656-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690282094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282094, "uuid": "77c4c546-0915-4aa7-8b0e-116cf98cc65c", "comment": "Malware payload (AgentTesla)", "value": "dc92bd6bd0675373541b2b5e2569b54c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282094, "uuid": "f486ab86-0655-46b2-aaa7-3d9ce344d28d", "comment": "Malware payload (AgentTesla)", "value": "8b5d0256e791d798c930f8222b03609805f1bf08c2fb58cf8f777ee09c0e273b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282094, "uuid": "52f7cade-0e05-4bdf-8a6d-71fac2c1f374", "comment": "Malware payload (AgentTesla)", "value": "06c5a75f3aaff2ad8daac96cf1512a0c0d4e14cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282094, "uuid": "1ea8bb94-7dcc-42a7-bd83-5959612504c4", "comment": "Malware payload (AgentTesla)", "value": "e06146e28dafcc6d6759b9db3d6c108d64528cff34e43bcca27f4950e7d0a15d4a5b26c046c3f1eba8be5489cd9f1006", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282094, "uuid": "0c6cb5ed-c541-4d45-a978-23cd952fbb49", "value": "T1A934EC037E48EB11D6583D3B92DF6C2853F1A4C70673934BAF48AEA52A512576C6E33C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282094, "uuid": "3583cf3e-294c-4609-bfe5-4be7ad1bce42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282094, "uuid": "d66fbad7-d1ae-46de-b833-88563a8411bf", "value": "3072:DGDFGOVq+nlnCpp26tWb/MS5AnaVe+3YpmDgdySbQbryD:DiFFVqUlnCpc1bFFSUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282094, "uuid": "06cccc31-15d0-413b-9688-a74cfdc637a3", "value": 243200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282094, "uuid": "2e76f966-0436-40d0-a99f-ff3376de988d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282094, "uuid": "0df894d7-6566-469b-bb6d-e5e48b6fed5c", "value": "8b5d0256e791d798c930f8222b03609805f1bf08c2fb58cf8f777ee09c0e273b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e66080-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690273941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273941, "uuid": "e568c7b6-f0e9-425c-8d3f-c628a68e29b0", "comment": "Malware payload (Formbook)", "value": "adbf95708bd057a67b2d7f7cf65ccb82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273941, "uuid": "9c29a2bf-210f-42fd-b59f-6554dfeb5e72", "comment": "Malware payload (Formbook)", "value": "8c5c20763f5514325caf9fd4aa11531658fbf52200ba359f4aa3d4c7284c464d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273941, "uuid": "fa4e40c3-9ec0-4415-a97e-5993ec8f9399", "comment": "Malware payload (Formbook)", "value": "582dd0bb37572d7b30b9f9a04bfb8790720e95ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273941, "uuid": "a5746b6e-3e91-4904-9a28-afe9d176a2dd", "comment": "Malware payload (Formbook)", "value": "d32d31252121d2bcff5356d97b79c84b6f83e96852826ebb53524f6756f808796a104b8ad4f26af725c2b0ddc19ef575", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273941, "uuid": "5616e0a2-9c8d-44b1-b2a3-c0decf76f4e6", "value": "T16E05F12535A9AF57C17A87F94020323013FEAEDD743AD3096EC270DA69B5F408662F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273941, "uuid": "9036c42b-e4ba-4a9c-ac6b-5942f6f460ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273941, "uuid": "3085edfe-7b1b-40ed-9631-12b72470fcb3", "value": "24576:LxqUHIcTrGCS4unhWT6m3aAQs1CoLeF2A2F8L:N7HIkrzSRgnaAcVF2vE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273941, "uuid": "727b4497-3515-4b84-b240-7563a913c091", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273941, "uuid": "df16eda2-77ee-4c99-9bfd-dafed5afdab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273941, "uuid": "5b8ae990-eee4-42a2-b291-4845afe433dc", "value": "SecuriteInfo.com.Win32.PWSX-gen.32068.28178", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26bf2b20-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268520, "uuid": "79cae451-6700-4516-9828-e3d6cc88ea46", "comment": "Malware payload (Amadey)", "value": "c9b2a04aa3b564f980fcacf408f4fd65", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268520, "uuid": "bb6bda36-13de-4bed-ab7e-21f6667ff50b", "comment": "Malware payload (Amadey)", "value": "8c7f3e9f9c7e60cc63ba8731f75cd1861665688a1d35252d364a503e1094a818", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268520, "uuid": "0ba8daf7-254a-454f-9f25-1c0816ac1d2a", "comment": "Malware payload (Amadey)", "value": "3f50a0478640ddcf87dff235c12fdb27b6866dba", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268520, "uuid": "63a634d6-28cf-46a5-a640-0a2bc7081d05", "comment": "Malware payload (Amadey)", "value": "240a30fbf05f1e3a78e5668ed426c412905887366ace7a658c229c307aa6c77d02034dcccec9b446c5e9d733ee20886a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268520, "uuid": "e81cd6fe-7cfb-4203-b09a-0fa5e0b6c672", "value": "T1AD840203BBD99032DDB417B058F702930A397DB1AD78966B3742E45E0C726D0A972B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268520, "uuid": "a47d00f1-b55e-4421-9822-e0404eb57362", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268520, "uuid": "9a8d77e8-a717-455b-b72d-18c688f1e95e", "value": "12288:/MrYy9008xm+RzyBGqsgBYCJMNhAi3Yai:HyggzyHAiIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268520, "uuid": "9e302154-d047-4eb4-aea6-c159e1e13b3c", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268520, "uuid": "1a0ab62d-ff29-4a8d-9dad-a2dc89cedb69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268520, "uuid": "d38ceb3a-d28a-4589-a78c-c7511adc59ed", "value": "c9b2a04aa3b564f980fcacf408f4fd65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66736948-2abd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690270345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270345, "uuid": "963a1897-1126-41c7-89b2-b6ecac0eb4fa", "comment": "Malware payload (Loki)", "value": "8da6da10f5d173e6bb9d788cc98abe01", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270345, "uuid": "7d11d601-b37d-4fb4-a573-1c5994c5dbf0", "comment": "Malware payload (Loki)", "value": "8c8188ed560631ac6c2a6eeba5ad3ab289f7c99c3bfd2ffbd6a08b0e92b2f4d7", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270345, "uuid": "a7dc9b22-a667-4ba5-855a-bcaff2181586", "comment": "Malware payload (Loki)", "value": "9984792a905e6c4d0f8fa63aeccb61cde382bc7c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270345, "uuid": "33898221-8a1a-4cd8-983c-3640f9c44564", "comment": "Malware payload (Loki)", "value": "7e93d0da648fec231f0320b8a478fcf0274d7bf775d35de5a61a11ac44501a63d77cea7802e84f5f08442bb39883b273", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270345, "uuid": "38d76832-bfba-4fd9-ba3f-2e50c92e6949", "value": "T1C194230AAB62000BFC6DF48DE28ABB144914F7A11B0FBB96504873CD359753FDCA9AD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270345, "uuid": "ee6774be-be5d-4f93-b1d8-d1739b77f75c", "value": "12288:lqCW1y9r206dwYtG2uJxz7NAieAEHlBpCwFDH:lq311bw3BxzxYHjTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270345, "uuid": "038731fe-11cb-4e21-92bd-23fb1cb7ac92", "value": 443075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270345, "uuid": "a5bcfdb1-d5bd-42b4-bb8f-55bfa87a9092", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270345, "uuid": "31cba61d-0b88-495f-b9b9-377632d1b914", "value": "Quotation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67563096-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268199, "uuid": "6d17ff23-d60c-4f31-b318-0fd8f4c0a4c6", "comment": "Malware payload (RedLineStealer)", "value": "53de8a05b2b522ed35f6f34a6b597d20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268199, "uuid": "cbdb2262-77e1-41b1-a715-d83a3f3756d3", "comment": "Malware payload (RedLineStealer)", "value": "8d05372a505b73b058d2df7efe10fa5ae21b374ab5b92f6b2fd6bb03aefe3aa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268199, "uuid": "196f4f25-c6f9-4c80-8038-291474c1bb62", "comment": "Malware payload (RedLineStealer)", "value": "63e55667fe0d63446eb0d0be52cf267e6e27a122", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268199, "uuid": "e7e4e19c-c995-4d7d-8f28-6cf4b7bd06ce", "comment": "Malware payload (RedLineStealer)", "value": "92514886ef8ab95c0411da3810f8c1f24b8ec85eed1238f927a49889c692af4f56931f91b65f40b0c38e30f88ac904cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268199, "uuid": "446d08c3-3742-4976-92d8-13707027b3a4", "value": "T159B40207E6DD4236E9B6177015FB02D70B3ABCA18E38529F6756A86B0CB3384E571336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268199, "uuid": "e8827e0b-2415-4b00-9e7a-264ee606eced", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268199, "uuid": "813659bf-54ef-4c0a-9464-e5a7022f0392", "value": "12288:1Mrry90f1CllIfYhPuqv+Eiba58Q2Ehms5IaqN+:KyGCygdiLQxmov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268199, "uuid": "5101ce9f-1f8c-4d50-9cfb-b20988a06744", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268199, "uuid": "906b9bab-25ce-47f7-9991-d622aec244f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268199, "uuid": "892150c2-0e38-4920-b95f-a1cc3e528f3d", "value": "53de8a05b2b522ed35f6f34a6b597d20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d9c06b-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690280294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280294, "uuid": "d5e05877-4b26-4478-a14f-0ea988e26e81", "comment": "Malware payload (Amadey)", "value": "76720b16252903cbb9881db4d112a5c7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280294, "uuid": "d49bba2f-45ef-4ef4-904a-986d09442767", "comment": "Malware payload (Amadey)", "value": "8d08d8fcfba6bbbbbdb88dcbb21aa6d8d9f22fe9f0be7427be45a6ebac538e16", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280294, "uuid": "e175e513-6390-4642-83a3-a40d089676d9", "comment": "Malware payload (Amadey)", "value": "67bed2cb9d36d956976762c5ed7fc27e5d14a1c1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280294, "uuid": "48084845-dc6a-458f-9eea-8ec4e90eb282", "comment": "Malware payload (Amadey)", "value": "24236500759a7efb0f060578b1aece0ebb173c44ff021d20f1985394af152d845e180274634d9e88447626a85be0a89d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280294, "uuid": "663b2e51-68ad-4710-acdf-6ec012976e91", "value": "T131840213E6E98433CDB0177058F603830F367DA69AB8436B3B96985A1D736C0A63577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280294, "uuid": "f416cfba-16b5-490b-9a06-afad7b64da9e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280294, "uuid": "718e36dd-8546-448f-a779-bbde283fbcd8", "value": "6144:Kqy+bnr+7p0yN90QEhrcu70/yFEtq7EADWexpWGE4b6TEFPrATNN5kDQy+H:qMrry90zYu7UYWe/nlb3r8NnnFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280294, "uuid": "ab31f843-fa84-43b4-bf75-364c86bda99e", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280294, "uuid": "74c856bd-9867-43ee-aab7-15b8b9adcae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280294, "uuid": "f3f12acf-fa88-4886-be07-ef04749905c2", "value": "76720b16252903cbb9881db4d112a5c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97d80bd-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268846, "uuid": "a4f26032-a9f1-4b72-be58-0fea07c2663f", "comment": "Malware payload (Amadey)", "value": "e7ce28b744b2f8ac7374d33568e3976d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268846, "uuid": "c321bd09-7d14-42f1-8302-70f716bd8e91", "comment": "Malware payload (Amadey)", "value": "8dbeb38d86b096c4c23e22a0aacba5375509da8649f6afd8fba3e71712318d8b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268846, "uuid": "bbd9fb5f-bbe3-4e1f-9f56-674986ee2c42", "comment": "Malware payload (Amadey)", "value": "e2267e4b0d72aa36b6104bede938aec9fbe7f1f8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268846, "uuid": "210f1781-e4c6-4c68-b8ac-8ed96b28b8cc", "comment": "Malware payload (Amadey)", "value": "a4c1fa05dc78af9bbe872e740c9396ffe83d6c25d8f0593228ab3d03ed58509d427415ec366882b016895702b08b9f34", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268846, "uuid": "3b310d67-e59a-41b7-a1e7-00fe430ea6ce", "value": "T16E2408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268846, "uuid": "b6fdb81e-4660-48f9-8dbe-e3f6cf83f908", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268846, "uuid": "85759456-eb2f-4195-86ca-3d45cb7045c3", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268846, "uuid": "d9e4a390-7c2e-4e8b-84e7-9f53107559f5", "value": 229312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268846, "uuid": "4f999ef3-c606-44f3-9e3d-430286321e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268846, "uuid": "f2d5ba06-0dbc-4934-8b6f-f60f680a2115", "value": "e7ce28b744b2f8ac7374d33568e3976d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37aca1d5-2b37-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690322665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322665, "uuid": "d3003a6d-5714-4b61-ab4d-27cf2860cbe6", "comment": "Malware payload (Mirai)", "value": "7ace875f8f47a2ee3950fc51598097c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322665, "uuid": "ac2a44ba-1208-4125-bc5d-0b4706feacab", "comment": "Malware payload (Mirai)", "value": "8e11f3e515b1d34d9401425ae6e31e3bca4e2628002ddf41aa0f384c99686d76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322665, "uuid": "b7de71a2-f62f-4f15-9bec-254a8abc8f41", "comment": "Malware payload (Mirai)", "value": "b0ebdbb490f6185e377d07122162a9bc176ee885", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322665, "uuid": "8a51471f-beb3-4d23-8042-883e73f5405a", "comment": "Malware payload (Mirai)", "value": "1eef4dc86a54feb2e1c46e20b8e43071891075425381ac6a887b7782b7f05e515308243243ae79aa58ab49c464caacda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322665, "uuid": "04d834d9-a8e7-47c9-acf3-d12b2a082408", "value": "T17EE2D008E10ADF84E6BE7DB89DE162D173B98FA927F469301B526F32EA3525137107C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322665, "uuid": "6ad96c56-9386-45d9-87b4-0bb4513d1ac5", "value": "768:BjZw3BtzBmP4xKn9tYmVE5nnV+w1cAm5EdHjIR4uVcqgw0RTWX/:1K3Btdw4En9tYmVE3+w1fm5EdDIR4u+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690322665, "uuid": "5415cbfa-0d30-4c08-9303-b955d6dd9947", "value": 33240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690322665, "uuid": "4a76aef3-017e-49c5-9971-fb5d9c946587", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322665, "uuid": "c561f30d-9429-4bbc-acfb-900118028d8c", "value": "7ace875f8f47a2ee3950fc51598097c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c5f8ac-2ab6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690267278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267278, "uuid": "8959ce4c-c12e-4f2d-a438-862782233cb6", "comment": "Malware payload (Formbook)", "value": "785cd607539d8903ffcd1c6846ec9016", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267278, "uuid": "d7172021-91e5-4291-8ccc-a8a85c2bcfb4", "comment": "Malware payload (Formbook)", "value": "8e16e5a2e8da8e98b9caa9c492cd7fa65c4845102a8687309c4b40a921c91f11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267278, "uuid": "ede54e10-5404-4b4d-b2b8-dfd6b06e2490", "comment": "Malware payload (Formbook)", "value": "0f004fe8f83329756c72d7ef7971c768654e6cf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267278, "uuid": "5fd93f6d-e63e-45cb-aff7-d42e311901d9", "comment": "Malware payload (Formbook)", "value": "cbd50fa8f0f24b18f785258bfb880eddbca1700d038d71b6520cb28c572dce829c162319048b90f517b4ac74700d257f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267278, "uuid": "0c5f9a7d-4325-435d-be61-c36b8b04e003", "value": "T1BEC4231936BD47B9EEE717F26860855187B3AC2B9F30C71A6EE575C3084A74143A232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267278, "uuid": "d6ff5606-3a48-43be-919b-e8e25fdce125", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267278, "uuid": "5c19e0f5-2710-419f-9f3b-e94cf4c50a55", "value": "12288:yIqOf6/zrkBH6RZY4cagVJnogRxWm46VpjOgn2P543e:cMOzgUZY4cJYZqjOUgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267278, "uuid": "796e8573-9449-4f21-9acc-12435821257d", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267278, "uuid": "2f1eba7e-2bb9-46af-9d4a-e2a92b6524ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267278, "uuid": "575068bd-db96-4304-a895-e236346b40a4", "value": "TT copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f02dca-2b14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (jRAT)", "timestamp": 1690307955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307955, "uuid": "d3d309c8-3e53-41a6-a1a0-aaf031fb6dbc", "comment": "Malware payload (jRAT)", "value": "c6c3233b37d7c06b1b7be8b027a4e893", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307955, "uuid": "ce630aa4-e292-4468-bc54-e8c0d3a7ec51", "comment": "Malware payload (jRAT)", "value": "8ebb2c7ba5c532670fd309dd5e0f8b7fbb7bda9925239012d6741c5ac681552a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307955, "uuid": "ce738c1e-47b5-4191-9e28-b503d7b88e77", "comment": "Malware payload (jRAT)", "value": "1932b1bade060e9833621f6245a620ad2e68bfdb", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307955, "uuid": "a2f2684b-e8a0-4001-b779-6c125314072f", "comment": "Malware payload (jRAT)", "value": "eb276fbc3bb32c9ddc2d66a00cc17c4dee1b78ea7925a4fd39a4795c3daf4ddf7999531cafb647132501d128e5680614", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307955, "uuid": "0b1f994b-ab88-4b4b-b84b-b7004a6ace22", "value": "T18463127FDC83C338EA396338841C5ADDD1D4026C1037AB6A9EB38DE7E15195BA919CE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307955, "uuid": "b5cda497-5a85-410c-9f43-74381ac48a59", "value": "1536:m4uKxjVlwxfh9s/qJ1OeBxmwAzrzJHneCJnuxQ1fnYCg7:SYlyoA1OKxmjHeynoQ1Vg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307955, "uuid": "587ccd5d-ce7d-4d67-ba28-fc4dfea0c460", "value": 69041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307955, "uuid": "5b2ee6ae-c243-4bb4-8031-aa09030f3204", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307955, "uuid": "8486e42c-723b-4c6c-b33c-e62819eb2260", "value": "PUR100515020.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3558695-2ac2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690272728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690272728, "uuid": "052fbed7-4b50-4a94-9ba8-c5242bbb4a8a", "comment": "Malware payload (RedLineStealer)", "value": "e9a2a6902dee62274bec096e6cdf8875", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690272728, "uuid": "92dbb854-ce08-4dcc-99b7-fdfde27a21b9", "comment": "Malware payload (RedLineStealer)", "value": "8f971e100ccb4e3fc87f91b5d3568a8365a00bfa89660b51cc504a1655da644c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690272728, "uuid": "dcfe4a0b-4717-46c6-8a92-e6fbafc09506", "comment": "Malware payload (RedLineStealer)", "value": "4fbcd152acd333add7170adce27c9cb24130a4ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690272728, "uuid": "bf0105b1-8f92-4af2-b689-6ca2e62fe6a1", "comment": "Malware payload (RedLineStealer)", "value": "0ead2d4cfc59758a2eab3049d7a019dc7afe644fe0151d8bfced54a673af921cadaaeb6285f372ebff78443dc5f49e14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690272728, "uuid": "395fd0a4-02c9-4466-824a-4056f051463f", "value": "T1FC840212E7D85433D9B527B458FB02D70B353CA26D78872F1746A99A1CB26C4B83273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690272728, "uuid": "7e0e46fd-565e-40eb-9d42-c5bc58c252b0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690272728, "uuid": "8ed4d35c-3d6c-4417-b80b-ffcf8c5fca2d", "value": "12288:iMroy90mtOK9tz6SFAdi3D1gBYC3Iy++pV:GyftOKXPF7uz7++3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690272728, "uuid": "24b4431a-2353-4539-aedc-db6497368e6a", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690272728, "uuid": "da4ab36e-09ff-4f31-9f16-fc3f47a71178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690272728, "uuid": "47472a49-2b9c-45d1-8f77-4a81a8bb796c", "value": "8f971e100ccb4e3fc87f91b5d3568a8365a00bfa89660.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220933a8-2a96-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690253479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690253479, "uuid": "7b7bfa9f-4685-4329-b085-658415d189d8", "comment": "Malware payload", "value": "110f4ca21df50ff579d001176d43bbb7", "object_relation": "md5", "Tag": [ { "name": "Meta", "colour": "#E698A6", "exportable": true, "hide_tag": false }, { "name": "threads", "colour": "#4B2288", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690253479, "uuid": "c75db47d-c1e0-471b-ba34-9b28ac75721e", "comment": "Malware payload", "value": "903280bce317d42a7df26fb8287bcc5ddc28c920e7a47666afe6eef663634ee4", "object_relation": "sha256", "Tag": [ { "name": "Meta", "colour": "#E698A6", "exportable": true, "hide_tag": false }, { "name": "threads", "colour": "#4B2288", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690253479, "uuid": "17301c39-5b1b-46fc-920e-0c634ed1ee06", "comment": "Malware payload", "value": "108c0ee1678fa7bee4bf51249ae303867617b661", "object_relation": "sha1", "Tag": [ { "name": "Meta", "colour": "#E698A6", "exportable": true, "hide_tag": false }, { "name": "threads", "colour": "#4B2288", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690253479, "uuid": "4362ebe5-c7c8-4afc-b150-675be280a8a7", "comment": "Malware payload", "value": "ab676bad681c2ce9d4918a0b1080bbc928d92a6d9962feddb6c4334fbf42e900ca22061a5e7bc186fb34552d0bf452b9", "object_relation": "sha3-384", "Tag": [ { "name": "Meta", "colour": "#E698A6", "exportable": true, "hide_tag": false }, { "name": "threads", "colour": "#4B2288", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690253479, "uuid": "64f3b6fa-3407-4245-9018-9b6ecbac081d", "value": "T1DC6633DA6A507F5D87D37FFA6612B604CB2AAF4623A48D2FF497494C180B3C12C8F495", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690253479, "uuid": "bfe18915-8ce5-4fd1-9887-da084f242ecb", "value": "98304:loR5Vj8FbJpId3ZlqMsmC1O3RPuiFReH+qLzPYt8aZSxUNpBXuJXL/cp9OWRby61:loRLwc6O33TCR8ToIBEXjWQYAbHlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690253479, "uuid": "d4ff43d3-146f-443f-a6fc-343775e8f6a2", "value": 7118878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690253479, "uuid": "1a0ee37b-5755-49ae-b52e-80016e24a5f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690253479, "uuid": "9bd8bbab-7aaa-4120-ae8e-fadc79581c21", "value": "Threads.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a43486-2aef-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690292058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292058, "uuid": "2163fe25-2d5b-4572-95b7-4d0042d4f1bd", "comment": "Malware payload (AgentTesla)", "value": "77e4a953c11522721a21741cf373df90", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292058, "uuid": "5b89cb16-96ac-4b9e-ba21-9b0ae171502c", "comment": "Malware payload (AgentTesla)", "value": "9044b767e0da345c0195ed90ef2b8c6eb5d23ca86276d9309ceae4d49844e010", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292058, "uuid": "b7f7e25c-7d0c-404d-8f96-d4aa16c1684f", "comment": "Malware payload (AgentTesla)", "value": "214a4f8a89c7773a586123a88081b32507c70b82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292058, "uuid": "e7a201f9-437a-4e8a-8a27-416c45081ad9", "comment": "Malware payload (AgentTesla)", "value": "c3f05cfde1f09ab45a364f612c847a6ba2fca3ebc881fb8029076a9c6e411fc9da44ac3ad9fa6125ffad9d99c8380206", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292058, "uuid": "cb9b3eb6-b1a2-41ab-979a-07b8cc49996f", "value": "T143E4334436B3E191386F4A226245C23B9AFFB3641EF599F6C0C9DCBA4D23059B579834", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292058, "uuid": "1d02ecc3-a8c6-4e67-b274-441eb0d3a148", "value": "12288:K+i4yfoa9XmmS5fzU+J5uXmOfk0ie76lHIGR/wAxPZRMCXEQlee/zEsajNhcMR1Y:u5oaImShFYXdQjR/wwzXEUQLeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690292058, "uuid": "a28388e2-f4b9-493a-8bcf-65ac3f87c7f8", "value": 701733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690292058, "uuid": "a32525dc-3002-451d-809b-63dcf17972a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292058, "uuid": "01b9de36-17d5-454a-9977-df4867ba8b18", "value": "Proforma invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca7e234-2b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690307506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307506, "uuid": "599fe435-e285-4261-95e8-329ca58f7435", "comment": "Malware payload (SnakeKeylogger)", "value": "20c4f5e6c53705ecfdb43c406adb31c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307506, "uuid": "19a3673e-2c11-4729-8914-8c4257648c9f", "comment": "Malware payload (SnakeKeylogger)", "value": "906b10a035d409738dd260f471b2bc40dec386c5558dcbfd3c41c244b867d672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307506, "uuid": "ee9342d5-4e3f-43b9-9e0b-92f2d4c9a567", "comment": "Malware payload (SnakeKeylogger)", "value": "ffe3844f21dd52e4fbe3fee5b67e9d57cf9e8859", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307506, "uuid": "7b437546-f39a-47be-835b-4b726a6cf341", "comment": "Malware payload (SnakeKeylogger)", "value": "73bf50c3b5f4dfcfad546ca087dc7b3ba58bb4cf36d59ecbd4f920a3e72c69594cce3ec8265c250f72de17e0fb86af24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307506, "uuid": "dbb909c7-0b71-43b1-8060-fcee26010600", "value": "T1F3D3291D2BF89800F5FF8A7705B15122C776BC42192BCE1D5AC2F5192A7D7908E1AFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307506, "uuid": "adab8ff5-7356-460d-bcf3-087084d61872", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307506, "uuid": "ba8d9342-047f-4389-bcf8-a9d932a3aa15", "value": "1536:jOOYzPuJnPW8fCuQBCaaMFlBg0QTOYb/zwpOXTepiOWBeTjg0Kcl:jOOYz21uqCuQBC2Yb7howBeTjgbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307506, "uuid": "8f15940b-d886-4287-ae32-02e5a685cb4e", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307506, "uuid": "0153110c-3649-4257-a714-c1e272ec61c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307506, "uuid": "8a63c86c-01e3-46a1-b7ba-949505898795", "value": "20c4f5e6c53705ecfdb43c406adb31c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666cd421-2b14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690307711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307711, "uuid": "973c8e46-51ea-4f47-929e-dd75f1cd59ac", "comment": "Malware payload (GuLoader)", "value": "cd8bafbe22a50eb3b052b8c14faa4ab9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307711, "uuid": "7cd241b7-613d-4d8a-b38c-cb4d93ec67f8", "comment": "Malware payload (GuLoader)", "value": "909842fc11f726568caceac27de46ea00589d6ff5f2fee956f9e9cc206d4bcbf", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307711, "uuid": "b5ac181c-b953-4469-87d1-db6fe184515d", "comment": "Malware payload (GuLoader)", "value": "f1ac69b9f67feeaad4a13e8051fc000909530a03", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307711, "uuid": "7e7a74f3-4244-44d1-90dd-ccf9c8780db5", "comment": "Malware payload (GuLoader)", "value": "a66d8b5f2ab9c01ff5e8f5cd6e1c093fda9ddc591068a0346db5cd588e62073ff7027c6583ad61afcf8c04a9e934e239", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307711, "uuid": "4611c839-800c-48c0-836b-90367ec8a934", "value": "T1E675F103A8059F87C41C87F47D7319D98F2A7F05E895A9D710123F9B3AB2B62594BB0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307711, "uuid": "4ed29a40-b4cc-451e-bb9f-9d9caaeacb54", "value": "24576:8fu9VNZylw6VZOZyJw6VqViNhuuvvt13oqVUbXQwNgZffsLMy5wHxr:8fuPR6VZYF6VCiNhv3tRMXXNhLr58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307711, "uuid": "35d50188-d7cc-40e3-a78a-fad94be2b6c3", "value": 1623040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307711, "uuid": "3b14fded-171b-45da-9bd3-a10246ea8a60", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307711, "uuid": "17724817-abc6-44df-9199-d2026cd97619", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08426d01-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690308412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308412, "uuid": "8411e817-7fb7-4bb2-aeef-7e9fbd10bc33", "comment": "Malware payload (Formbook)", "value": "410dec2d786b542c67397ab8cc7ecaf3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308412, "uuid": "fa86a74d-cb2d-4a4c-80dd-3129201427cb", "comment": "Malware payload (Formbook)", "value": "9202b35448e653781c1e8d04a5f1266e40116832675be9b096034f4e0861c78c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308412, "uuid": "34800661-a2b2-4319-9edc-bca5ba0987a1", "comment": "Malware payload (Formbook)", "value": "a9476ce40e333110eed445baa50dbf521e67cc68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308412, "uuid": "5f029c1f-b92a-4df3-887a-6b47c27e2a98", "comment": "Malware payload (Formbook)", "value": "405bee1a7e79279f0edff1650ff4943a3275d33413f61b7dc732a9e3d956f0ac084eb3c194311a97f0c006a956f51cbe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308412, "uuid": "4f7d5c8b-de08-41e5-a059-ae418355c44c", "value": "T1A3D4120233DC970AD4FDA3BE595188594FF0FE9B8061E3042F9C48DA9E2A7608664F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308412, "uuid": "70bc1124-3597-4655-b462-70823fc36b6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308412, "uuid": "59b6eeeb-e45c-4c64-9a12-57e52bd4abb8", "value": "12288:QXPZnHKseMuZOGDF63CfEntCqpl6h9qWELhIvKjoD:EahDDFQC56rC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308412, "uuid": "e8713830-3533-45b8-bece-97046d6b4524", "value": 616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308412, "uuid": "deae54af-547a-4f94-8968-21f63db55e8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308412, "uuid": "390dcc18-b1dc-4d94-99b8-235273b132f0", "value": "410dec2d786b542c67397ab8cc7ecaf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e81a9d0-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690280290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280290, "uuid": "71c670eb-38db-41d0-923f-b302341e6f10", "comment": "Malware payload (RedLineStealer)", "value": "488d9f58e874a4e5e7ab44fb88794e79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280290, "uuid": "85383a4f-6252-409f-bc04-35cb5f49a25c", "comment": "Malware payload (RedLineStealer)", "value": "936128c4e0afc788605c5adbf90043f44883e4f4adc382da6b081b937b635b5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280290, "uuid": "c507d1c8-0daa-454a-bb5d-7e3d80506aa2", "comment": "Malware payload (RedLineStealer)", "value": "6e2210d082d625e8b9917febc409f057eaa1268b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280290, "uuid": "56577546-50cd-4e49-a1d2-0b5dac646157", "comment": "Malware payload (RedLineStealer)", "value": "56b8fbc8dea4b9c05b940abdf0179ec643a0e2e29d284a10d4685e1c11804ee64e3ffc747daf82053958658509114791", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280290, "uuid": "d54ead81-cc96-4031-9c55-79bfb3781834", "value": "T101840212F7E99472DAB617705CF701931A35BDE19C78C26F2682995F0DB2AC0983233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280290, "uuid": "7a610d3b-8f66-4694-8361-c24e470e36aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280290, "uuid": "2db8d7d2-7b9d-47cd-912e-2cf90461811f", "value": "6144:KLy+bnr+6p0yN90QEMUeOWJHwveCG4j6xgsBGG4IXC1SOR3JD8T:1Mr2y90Aqvn3sBGcyoOR5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280290, "uuid": "a590bd98-ba48-4bd6-8755-8d96af87e0dc", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280290, "uuid": "8e5fd9c7-9e5d-4737-ab49-106601a4a01e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280290, "uuid": "8f59abc5-007c-4a75-a993-9d6adfdc3d79", "value": "488d9f58e874a4e5e7ab44fb88794e79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5441de-2ad1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690279028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690279028, "uuid": "677f7cfc-5415-4aaf-9b80-1654f8b99900", "comment": "Malware payload (RedLineStealer)", "value": "96fe39b028061aa056be0ab08d6ebf81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690279028, "uuid": "7455a699-f237-4192-bfb5-3ca77c3d3ddc", "comment": "Malware payload (RedLineStealer)", "value": "9382dab9699f8790159e3132be9f37ec3290eb7449ea4db219c163ae817643df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690279028, "uuid": "2153d831-2d94-4dce-a3dd-ee3d373d8918", "comment": "Malware payload (RedLineStealer)", "value": "1c766d886e595877cb3aa7d7632b3cdf1c80fb1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690279028, "uuid": "9b921300-aa64-43eb-a9a7-293adf52dca0", "comment": "Malware payload (RedLineStealer)", "value": "d3dc80ffc62cf0351b254bd31f4afe2a2f862017caf43d1b827e07f4238c0f5ce4491a3caea60fdc2f89b8388fd936b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690279028, "uuid": "b8dac942-5d2c-4f99-b5dc-9d9f30ec56eb", "value": "T196840103A6D88073E9B927B05CF703830B367DA16D78836B2345799A0DB2AD4657277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690279028, "uuid": "cf861024-51da-433c-a6f9-629580395629", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690279028, "uuid": "5d39a0c4-fbf8-4c6e-ae16-0ce645cfcb36", "value": "12288:7Mrny90Ctbb2dDx8jTdgBYCJwEAD6y6R:UyTt24jT2zcuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690279028, "uuid": "87bd8d80-865a-4430-a0e4-6305c1802dd9", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690279028, "uuid": "b48a5813-7351-40f2-a715-2cd0f6e01e14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690279028, "uuid": "0df36954-ea5b-4e39-9d06-19f32ff9f5ba", "value": "96fe39b028061aa056be0ab08d6ebf81.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f9b0f1-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690267935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267935, "uuid": "6a777b3c-6ad8-4632-b107-6cf94399f95f", "comment": "Malware payload (RedLineStealer)", "value": "6425df8b04c4c68a6c0abca744eeff5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267935, "uuid": "bc8f338d-5b4f-4038-8aed-545e53576dfc", "comment": "Malware payload (RedLineStealer)", "value": "93e4f2bba5c215ea0f3a8894b7557a92261c7d7fc50fddfc86eb8f87b81aaf4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267935, "uuid": "b2e4d16d-ef68-4fec-a204-9df40878b2e4", "comment": "Malware payload (RedLineStealer)", "value": "b1c07bb3c619980d31f14a6a6b34fc8a8e9f08bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267935, "uuid": "b2af99fa-b8fa-447b-9cc7-236776056e66", "comment": "Malware payload (RedLineStealer)", "value": "e04c06a09d5d11196e44550fbc820ef32dbcbd53bd02e9d815b66c45fda753f4d2cba8253e18599a27e6de4316379adc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267935, "uuid": "58a92cdd-9d09-4408-8630-08065933f453", "value": "T18984F142B7D84033D8FA277098F603D30B367CA15D38936F3395A98E59726D0A87676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267935, "uuid": "85649efa-7045-49db-93c1-f52cb62aeb1a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267935, "uuid": "6c6d1a6f-57ab-4047-a823-a73e50f70d54", "value": "6144:KLy+bnr+fp0yN90QErsJE12Xl/+lxYV1eDfkKJ3WKy+JG9lm/fTnUNXu:1MrPy906J/XllTYWJ+Mzm3DUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267935, "uuid": "a848143a-13ff-4e5a-8b1c-54af97a9b291", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267935, "uuid": "af0944ac-ec4a-4d01-8459-3cc7f40ac44f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267935, "uuid": "cff399d6-d444-4372-b4f3-24fd2f59e500", "value": "6425df8b04c4c68a6c0abca744eeff5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0147c7-2aee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690291533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291533, "uuid": "a3b0da06-6bdc-43d5-b392-a4589935599e", "comment": "Malware payload (Formbook)", "value": "34d2a61191e947db22c0762e0ad502e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291533, "uuid": "a405dd6f-8c39-430b-b621-f6a567f9b2d9", "comment": "Malware payload (Formbook)", "value": "9442fbb4a8b6fff536bf913966cf56849bd7808397a8426ce01fbe1c0577a2ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291533, "uuid": "8709f470-01ad-4ce8-acbf-b0c2559db204", "comment": "Malware payload (Formbook)", "value": "8565a20de215bc151424f38fe0631d509dd0f696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291533, "uuid": "ef47715f-e4c8-4228-bc15-98d24ba5a708", "comment": "Malware payload (Formbook)", "value": "2c20eb0b292e28a0094efa7248d34bd309424ac61b0da05a078b913ed4f9064803f04ab2b3204ae890569a0e18ebe36c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291533, "uuid": "205b7b65-c0de-422c-abe1-9cb85c695873", "value": "T1F944F1EC3A1172DFC92BC476DDA42CA4EAA0B077431F4563E42765AD9E4E887CF051B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291533, "uuid": "0779ef40-6a99-404f-9dfd-2aa4198a2b1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291533, "uuid": "b31d68cb-ec22-4a61-a930-6641bf88228f", "value": "6144:EPr1wvPXluX50zFlPWpk91F8b5xgcAb+DpjDTTu:Ej1wv/8eFBWpIL8b5xxAadTTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690291533, "uuid": "9f00a106-a87e-4978-8fae-6e183cc4da8e", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690291533, "uuid": "adc66d1d-4666-476e-b758-420a30dbd51e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291533, "uuid": "e0452d97-c1a2-4030-a7b6-7a498233dd32", "value": "PO_8776363636.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e5f79a-2b45-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690328730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328730, "uuid": "8154cf4c-81c0-4620-90c1-4b1a432186c5", "comment": "Malware payload (Amadey)", "value": "7096c63e6818f27662b42b29ceeb012f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328730, "uuid": "b7bf2c82-51c1-46b7-8a95-06f88437edea", "comment": "Malware payload (Amadey)", "value": "948121ac4dee105d2b85dd66b78faa95d9f2af18f7c4ac4eeac4d14a1ead2c14", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328730, "uuid": "2f9bb538-b94e-4264-8f4e-007450777c10", "comment": "Malware payload (Amadey)", "value": "85e6a61f0faa59fd232916dae1b0acd928b5f60b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328730, "uuid": "d29d5f1c-76a7-4625-afbd-1b6766d2e4b4", "comment": "Malware payload (Amadey)", "value": "f7a354958dda8a82a90b1eeb0065b7c15b1ae7d012ed65421c5adb772a4610cbde12be573ae5dffc97d108ef959dfe5d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328730, "uuid": "8b873b06-3eb9-4088-8b2c-29020cd5ac4b", "value": "T193840247A7D88072D8B52BB058F207931A367C62ADB8536E3385995E0CB32C4F57276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328730, "uuid": "9a4083d9-4256-4446-bb3d-26bf62701cc1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328730, "uuid": "f0811851-21e6-4070-9b6d-5915e3725014", "value": "6144:K4y+bnr+ip0yN90QEr1pgk2LflrNOE5LP9JNQYvYMn3F1CUSgBZ+t4zD6Oxwr3ZK:oMr6y90N1oLflZqYtiUSgBYCz2uwtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690328730, "uuid": "6d4b968c-0f60-4160-ac1c-c12ef3fda74c", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690328730, "uuid": "3673663e-d974-43de-b4ca-e8e8c6bd9bc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328730, "uuid": "ccf6083d-9e39-4fd3-a5a5-1b1c9827bfba", "value": "7096c63e6818f27662b42b29ceeb012f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488ae1d6-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290481, "uuid": "85f31aeb-3c92-44d1-924d-c438260c63a5", "comment": "Malware payload (Amadey)", "value": "461495696b3bc239375462703cf7c6ae", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290481, "uuid": "4925c62c-137c-4685-b1f1-300e62e83575", "comment": "Malware payload (Amadey)", "value": "94de3135cded2a7e686586779a5c5768be9f5879b46825d0a2925c02ea93dd9f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290481, "uuid": "fe90345a-c082-45b9-a5e4-79dea11dcd9b", "comment": "Malware payload (Amadey)", "value": "e041a880d1e2af90d99be8e45cf3253395708109", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290481, "uuid": "4a172220-b4b5-4022-ac1e-ed38b33001fd", "comment": "Malware payload (Amadey)", "value": "f2764f9868aa2debc6cf56c1d5145a5910fc2bc297c96d24569ae98d0958ad3f0a65dd70bfc22155fd54a591a9d2cb94", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290481, "uuid": "7669b7db-448d-48bf-9a8d-593194d679ea", "value": "T146B4125BA7E88032C8B417706DFA07931E367DE24D78636B1749591E1CB33E4A87272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290481, "uuid": "4f16d914-8706-40e7-b8e0-6e5939a4755e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290481, "uuid": "79e12d17-72e1-4101-8ae9-fe32dac1dae7", "value": "12288:5Mrny90XJuElb3CTHuhR4BZaJ994XmGYScM/BSOQjg:OybBUJ994XZvcuSOQjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290481, "uuid": "109c2d11-078f-4773-b400-d663fdd49b4f", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290481, "uuid": "2cac3d6d-3917-40e5-a477-d5bed2f38d5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290481, "uuid": "f11bd5b8-1d8d-42c9-8efd-4c5faf9c2355", "value": "461495696b3bc239375462703cf7c6ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d1a84c-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690296967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296967, "uuid": "075b11a5-1752-47bb-aea6-106fc3f8365b", "comment": "Malware payload (RedLineStealer)", "value": "1a93c96e614b7456ac9f59b46681c08e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296967, "uuid": "26b7e467-5096-4a0a-ac0f-e0eaa2eb495d", "comment": "Malware payload (RedLineStealer)", "value": "94fd8c6743ce281893cebfe79b1077848b604922a7ce877ec9ae38cdbd19eef9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296967, "uuid": "66376cd9-378e-4147-b860-0360c564fa3a", "comment": "Malware payload (RedLineStealer)", "value": "3c66aed8baca7a2c05b7eed3b5b5a925f9105dc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296967, "uuid": "74ef792f-47f9-41df-a62d-3a06df61381d", "comment": "Malware payload (RedLineStealer)", "value": "768b5e55d3dc1fa63460e19c3c5ff182d3f094b8b3895050e43d4ccf800d479e95521bfd5fea9572adae14d0ae7896f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296967, "uuid": "51f14c4c-d25e-4196-a806-2b1917875625", "value": "T15F44CF2232E1C072D16796304A71C6A25E7B7C325BB584CF33642A7E2FB07D15BB53A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296967, "uuid": "89041ac3-b8cf-4d20-b106-cb24aa7d62f3", "value": "325ed12d4ca9489275d8c828d6bdf65e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296967, "uuid": "2fa6cefc-b480-4366-84a6-fc9458fafaaf", "value": "3072:jz07u0t/zExACatDQXz5LXtSa5Zwh1DV8YICqIAQWKvdJD:07ZtrEKCatEdn21h1Dq7KL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296967, "uuid": "ad07c230-43a6-45cc-b349-653405ef70c7", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296967, "uuid": "37c8dbd0-9e28-4232-a6ea-c1eca558e97f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296967, "uuid": "5ac5b7c2-86ef-4c8f-a1cd-1256d0315690", "value": "1a93c96e614b7456ac9f59b46681c08e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ea1d26-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268215, "uuid": "0733cb69-4e6f-4030-8199-44d08bccafb0", "comment": "Malware payload (RedLineStealer)", "value": "3ad2573480380304cdad1500293e8366", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268215, "uuid": "7c411e7e-6ce2-4365-a60c-6b67052ac326", "comment": "Malware payload (RedLineStealer)", "value": "954783c09aff8ec2ebc0ac47f77d4bf4d2d2d1f8070747519d250f64ca8e5436", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268215, "uuid": "eed80c76-ff70-48cd-9bd3-78291f20058a", "comment": "Malware payload (RedLineStealer)", "value": "ff3fefc0102fa162dfbb1b3fa50da3154890a6d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268215, "uuid": "9eca0771-bd99-4a72-8325-396ac7ee59fe", "comment": "Malware payload (RedLineStealer)", "value": "8d3599be285d801d2698009af10b94b206118a6448756f0b192ca0aeb7c702001b2e420b902d2b50bea8a73cc9424a94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268215, "uuid": "7c72c534-bfff-4922-a1d7-087312885652", "value": "T1E3840202A6D98432EDB427B058F703D30B3ABD525D78836B2A81ED5E0C736D1A93577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268215, "uuid": "5b07e3b2-8908-4788-a571-5522c16e9912", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268215, "uuid": "85fc9105-205d-443a-b027-55309c759730", "value": "12288:MMr0y90gt6jo3+40obwd1ZgBYCPJRBWA:4yxth3+dAwdIzcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268215, "uuid": "310000b1-6dc5-4c67-a35c-0bb7c0c0f746", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268215, "uuid": "5e554524-95e4-4ae6-9504-221a310bf523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268215, "uuid": "f587ee58-0181-4f54-9596-ea4da36e95a9", "value": "3ad2573480380304cdad1500293e8366.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6517f817-2b14-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690307709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307709, "uuid": "440bb5a7-9cdc-48d1-a8a6-908ad5664778", "comment": "Malware payload", "value": "550cbce46f6edb9a39bfd9b6a03230d7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307709, "uuid": "dff6b835-01dc-498b-b204-4811e8c3e4cb", "comment": "Malware payload", "value": "9565470139355ff3b808f93f463ef99fa4b330a76060bf958eef148da19fdcd6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307709, "uuid": "3ff3b574-8b52-45e3-b2ff-4aa44c544dab", "comment": "Malware payload", "value": "a12600c83096fae5be0f3af886ec492ff65adcb5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307709, "uuid": "faae15a8-d0e0-442b-8634-a89d2a477123", "comment": "Malware payload", "value": "6fa77cd65f16d99d1e009c70261b4437f62ea70c0a6f823b7960970577e55aca6641a17bfbd11a8a387aac36b7424f3f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307709, "uuid": "c17a4f1e-07a8-4fab-8714-c153659f0c8e", "value": "T171B3746FE621BF56E0695278457385D32129FEA9EF1022AB919F3E0C38F31707B90B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307709, "uuid": "dd92000b-f18a-4e57-ba02-57d430f4193b", "value": "1536:QJVItR3JVJJkyJJvFtSVnvrrIfME28e5mb7EpjrpDe3dDTP:u0RoZrrvfpITP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307709, "uuid": "998d893c-28bc-4ef5-8ce3-264a6b414f15", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307709, "uuid": "376010e4-5fe1-414b-91c6-e51d568d1056", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307709, "uuid": "ca12efe7-2f4d-41e9-bce4-1d80e471f25e", "value": "\u041f\u0440\u043e\u0438\u0437\u0432-\u0439 \u0442\u0440\u0430\u0432\u043c\u0430\u0442\u0438\u0437\u043c \u0437\u0430 6 \u043c\u0435\u0441. 2023\u0433..doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e11a3b-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690282125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282125, "uuid": "67e4e2c9-89db-47bf-9602-bfd3511323c0", "comment": "Malware payload (AgentTesla)", "value": "f0cf6f4891e24941bb2cca8d0856a4aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282125, "uuid": "e2ad9641-7a99-44c9-a422-4269dcc345bc", "comment": "Malware payload (AgentTesla)", "value": "957758ea63cd71d5a15ad21c1efe0c4a4c36a4fd9d83a24fcaa25b0e9ece3945", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282125, "uuid": "4339fb06-f437-4008-bd1e-5ae6f5807102", "comment": "Malware payload (AgentTesla)", "value": "1724b2b28f8f691f4238eaf443018addf7e06b0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282125, "uuid": "3858cf6f-e022-41a1-91df-3fb2ec03630b", "comment": "Malware payload (AgentTesla)", "value": "63098b3a9853e760eb34d46518ff98a53a4603e47f18af85adc643593061d394e13ad81a4fdad73e6eaeddd1d491174b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282125, "uuid": "38cb0f89-e5a8-4ce3-84c5-e65aacbe68df", "value": "T1F7156ED1F15088DAED5B0AF1BD2BA53014977E9CA4A4810C599EBB1B76F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282125, "uuid": "3d44cf1b-fcd4-45e4-bb2a-a9120f11565b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282125, "uuid": "64f60c03-eccf-4501-9ff0-e97346547fc4", "value": "12288:/S6ln+flo/XciMvajVSVUBtMyxdU3AsBUvLoBFSWwOtEBH:6TdCjEajIVU5U39BUDoBFSQtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282125, "uuid": "37674649-f240-44c5-b426-756d3b7f76e0", "value": 942080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282125, "uuid": "298edb65-b2f2-46e0-86a1-a2123a0911a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282125, "uuid": "ad102b17-9a2c-400a-b3eb-4ff5efbebfbd", "value": "purchase order !1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98fd1c25-2ad6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690281167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281167, "uuid": "02ecbe0f-8058-4aac-a617-b1c72532898e", "comment": "Malware payload (Formbook)", "value": "09a60f5008364c4ea7122478e550a2d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281167, "uuid": "8ed068cf-8115-4bb1-84f0-9942e89c4bd9", "comment": "Malware payload (Formbook)", "value": "95bffddb091c2b221f1395a4a4cf1dbf4a3ad29638a503b7cc85848a45198e06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281167, "uuid": "076faa83-3b5f-493d-9ecc-8018600577a3", "comment": "Malware payload (Formbook)", "value": "14f83588e4c9408da72a6df0b77d6b30c33f5f11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281167, "uuid": "8cb4701f-c58e-4ee1-99ee-5bbb43baaecb", "comment": "Malware payload (Formbook)", "value": "50dd6407202cc142f3c10a6243385727956ced97f194f66c5742408ba2030927812b5e8aca053e1a631c2a9d1c7be66d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281167, "uuid": "fb3ed685-3aa6-4365-bd5f-d2c7141d1378", "value": "T19F15AD9625A49FC6C0694FF844602D3413AA5EC82C28EA254DB530DF1937B8FB5F1EB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281167, "uuid": "6391dbc1-042d-446a-b89f-16b232d8e2ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281167, "uuid": "4beed047-57b6-408c-8826-001137c70e3d", "value": "24576:XxkUHIcTrGCSGwiI2s2qZYTmO0hZ8P7QI5deH2Rah3:BhHIkrzSviIVGTIozpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690281167, "uuid": "0129485f-30fc-4842-bdda-cf8e65bd4b68", "value": 908288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690281167, "uuid": "19d7b695-eb72-46cc-a725-73e53af2d938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281167, "uuid": "3631bedf-52aa-4f97-993d-207f7d0a704d", "value": "SecuriteInfo.com.Win32.PWSX-gen.6654.20448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08fc437-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690290655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290655, "uuid": "5f62dd36-e8c2-49e6-8d32-3073325c389a", "comment": "Malware payload", "value": "e37ad7487d33813f38f24217be3375cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290655, "uuid": "aded2b9e-2460-41dc-9fb1-587ce0c33450", "comment": "Malware payload", "value": "9608083031f3a6085c9d06e39a728c106688b48c6b9a8a9683eaa2ce264c9b09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290655, "uuid": "927be66a-0067-44b5-bb0f-bb1a63f67218", "comment": "Malware payload", "value": "538f0449ecb2c5cd60a7f56d62b381820339b136", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290655, "uuid": "8d81fed0-7092-414a-9c42-6b4cfc56f301", "comment": "Malware payload", "value": "6ea525fd6e84b9780039d05fc2e9dff659a0f8efae30631a87fb570643202f77f87d4bd04477c8d1773a5f6a4c9fbc80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290655, "uuid": "c94587fc-85f4-44ed-b285-7a8671f314b0", "value": "T15D234C1776A0C032D4A22A3049B4C2625B7F79734AB5C68B7B9416BD4FF13D0DE293A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290655, "uuid": "bdc035d3-e600-4510-9cf6-fefb320ea606", "value": "721327552a5b9cce703a49792318ffef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290655, "uuid": "24fa65a7-f119-4c1f-b6ee-6d501ea80298", "value": "768:t/CVJskqLVcxFPTdReM/yflqqgWo9hK7S4BrPMNKPkxiEDcVnXg14mVxIVr:FSskqRaLReMVqgWqWvdPZPtRX4JIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290655, "uuid": "0263d7e8-bded-463a-a305-ae6bbbbff4ec", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290655, "uuid": "c84fa1a5-4198-4a4b-a782-bea887d4e531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290655, "uuid": "5c4d57d8-c171-448e-8c3b-125e13ff3a53", "value": "ose00000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68c1715-2b0d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Zyklon)", "timestamp": 1690304919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690304919, "uuid": "3404cfc0-0806-402c-b764-5c28182f6920", "comment": "Malware payload (Zyklon)", "value": "c793f342fb899717cfdd61f28fbe8aea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690304919, "uuid": "8b7878e1-c793-4d26-b0cb-b10011c86d30", "comment": "Malware payload (Zyklon)", "value": "965535f395581fa0c9b2e96caddab283f516fbc7bddbc1c8ae0148272726aa23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690304919, "uuid": "83f9bbf9-3637-47b5-9c3c-f37136abdade", "comment": "Malware payload (Zyklon)", "value": "c17aced39bea6c1dcff358184fd067e944ef7fe3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690304919, "uuid": "99d58778-873f-47d2-9055-053b20468636", "comment": "Malware payload (Zyklon)", "value": "cfeba37fe17d21f5981de421a47248f3a27713fa2a47b8aad5ad3b459c36ea271764725ab7a39cb1cd5a72086fe34bef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690304919, "uuid": "03a86727-2dd1-4ccb-9589-b5b9bffbeaf6", "value": "T10685C2157AC28DB6DD5E02F1D36209AC4F63EC62A711C09B25537AE9B63EF039C4B163", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690304919, "uuid": "1f285fd8-dbce-401d-9e9c-7a65ab4a433a", "value": "24576:jJtsUhtUFW/TbilwQcHHlDDDBS8rZ8LJpeO2h:j4UhtWWbbilCl9S8rZ8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690304919, "uuid": "fe4edfaf-2d08-4a1b-9133-debbf1c24284", "value": 1837056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690304919, "uuid": "0e1f3cbb-1ee4-4eaa-9f30-b67e320845cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690304919, "uuid": "da98b828-5af6-42dd-91f7-d2e3ba9fef81", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b51a61-2b37-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690322638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322638, "uuid": "4aadd097-87b9-4696-b679-a4bb2af40f4d", "comment": "Malware payload (Mirai)", "value": "c6ded285bab3d7c06596614e0fc85634", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322638, "uuid": "b18154fe-59f5-4af0-805c-c3d858080374", "comment": "Malware payload (Mirai)", "value": "968e5bfed18837d6f61dc9fec2c8606ed0f23f49fa9a0ab7f95327c82fa26ffc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322638, "uuid": "13570fe0-0ea8-49a1-b74b-34b9663f9fb6", "comment": "Malware payload (Mirai)", "value": "903a7f35e76f061337544d22bf6c30eafce6cc0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322638, "uuid": "b3ba875c-7de7-4078-aaa1-89ea5d621304", "comment": "Malware payload (Mirai)", "value": "6f293338f3abd02f412dfbacecc85e9e87490ba20efd334815c6b7452d6c5b6d7481fe75754e20ddb71159af177a720e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322638, "uuid": "c7d22a79-7ecd-49df-8ab8-20a5b734dd8c", "value": "T14D03F1B19180CE93CDA20476F4DD5FD1F4120ABCEE8879981D1413A87E92CEB17DA8C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322638, "uuid": "8f7dfe21-02eb-4667-bb9f-f26960b38809", "value": "768:VifmbSGUBm3fHIO0rNaidm0lZ+t4tPuVeBl2kJYxgBvTvq3UINQ:J9ghemZ+atW+/SAMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690322638, "uuid": "249e5691-f315-47e0-81e0-5c610b106611", "value": 38592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690322638, "uuid": "d49216c6-2838-430d-a4a0-5514cb5deffc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322638, "uuid": "4a988aea-83de-44ca-ba25-b97182b8b77a", "value": "c6ded285bab3d7c06596614e0fc85634", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd85cdb8-2b21-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690313548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690313548, "uuid": "e532ce0f-b2c0-4a3a-b45f-1dad8d1f7175", "comment": "Malware payload (AgentTesla)", "value": "4cd45321ecc5c1739b7d4cac5ece81c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690313548, "uuid": "2839d7f9-12d9-4a2a-a937-8f7026a982d8", "comment": "Malware payload (AgentTesla)", "value": "96ab76c69460cc8d8a255ff6ba2fa73091856c0730aeab47cdffa43ab8249c12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690313548, "uuid": "76cc2a8d-9656-4fe5-88fe-234150255e0f", "comment": "Malware payload (AgentTesla)", "value": "3a8cbcc3d9d247bba75db7b648b54dd82b8eedfe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690313548, "uuid": "6ee91091-acb6-46d2-98ab-4c10e32aec69", "comment": "Malware payload (AgentTesla)", "value": "1af0c4b2a2d0e89f3374f2f890127292e29296a2d2fb65cc49dcb84517f216ad0bf2a38d234508caf8fb4ba3fd712e92", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690313548, "uuid": "1b3934ea-b7ab-45b6-a300-ec713b351813", "value": "T1EAE4135A6E894D5BD12E2FB914207BF862AEAFF53031D7D71C56F18EE965F08C290103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690313548, "uuid": "cd84b2d1-14a8-4138-9194-ee1845a6c856", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690313548, "uuid": "2ac7cf66-7585-476c-8824-845f68baea13", "value": "12288:kYiIoFwIrG3XCCaQ2mXrLr90l0H44v9QOC4aCbR8rD:kHIcTrGCwPX/r90l0H44jhhSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690313548, "uuid": "02b7bf2c-2634-478f-8409-a13afe8f3974", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690313548, "uuid": "b39432b1-689a-4765-a494-4e11b4a5fa9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690313548, "uuid": "ce578862-d95b-4631-b5b8-2d01a25056a4", "value": "SecuriteInfo.com.Trojan.PackedNET.738.7348.32738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49cfd7d5-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290483, "uuid": "52dd980e-fa77-4c71-921c-67ea091bbb77", "comment": "Malware payload (Amadey)", "value": "e6484eb76e7b1031d5c935ab0f34812c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290483, "uuid": "b714258a-661a-45e9-a7a7-127d28750d3f", "comment": "Malware payload (Amadey)", "value": "9784620e8d2cdcd0a326d75893617bf7ec2c2b39a8028db701ba4af2a8d5d45b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290483, "uuid": "e61f187a-a158-4b93-b98e-05fa6ee1dc68", "comment": "Malware payload (Amadey)", "value": "abf0a6fa91626da64e8868fbf9b0ca183607e010", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290483, "uuid": "f5be70da-589a-4ccf-b0bf-daafb2c6dec5", "comment": "Malware payload (Amadey)", "value": "1938251578339cee344c6c5c32be5612e1fa73c107103a89bec6e19f1e163f77e841bd64c212082091f05e372fbf1061", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290483, "uuid": "944388e7-fd17-4840-955a-15d0a8be562b", "value": "T1A72408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290483, "uuid": "d1693506-293e-400e-8e33-6fcc31a7c1b4", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290483, "uuid": "abf9e90a-7a8b-4834-be01-b19b852d6d7e", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290483, "uuid": "8130947e-1afa-46b9-a150-af059f61333f", "value": 229579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290483, "uuid": "43e69252-541e-481d-b2e6-6c1ccdd1c8a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290483, "uuid": "444ae57f-9688-41f0-89a9-d05dee385a10", "value": "e6484eb76e7b1031d5c935ab0f34812c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54029415-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1690296942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296942, "uuid": "ebb52159-d149-4e50-8ab3-3dbd48d6da5b", "comment": "Malware payload (Smoke Loader)", "value": "15bc3c78c9d1a9980e49ad7407cce4d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296942, "uuid": "10da7a63-75c5-406f-bea8-e504a69ec759", "comment": "Malware payload (Smoke Loader)", "value": "97b506fc2932eea2f2c26b499240d4b91f3e1e38e15a631f03328f12a3e91e1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296942, "uuid": "485812d1-5c41-4af9-8321-311591bd7601", "comment": "Malware payload (Smoke Loader)", "value": "2753d6e3386811a5fc75cac7a6e33f2e98bc8d83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296942, "uuid": "9606cf15-19a3-4b94-87cf-d1509fb4e574", "comment": "Malware payload (Smoke Loader)", "value": "351fd8943f0b7607098ae4b46fc202c0932ccfaf3edd5022bc8111da2ba97b836f5f45c7ce5555e1e83cf7ce30a17a72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296942, "uuid": "7aa9f412-711d-402b-8901-cf4c0cf8bac9", "value": "T18864F70792B17C55E9178B728E2EC3F8361EF6508F497B662219AF2B14713B6D273710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296942, "uuid": "1a5ac44e-74b8-4687-9a15-ad2c1dc1d226", "value": "6dd6b46f56344bac3e06d5c8db854c3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296942, "uuid": "0f8a550a-a030-4005-9c52-b587058a2b54", "value": "6144:p2V/LI22oWiyZLvoIHgC7tLYbfeU7N1pT2L:QV/01iy5vE4LWBNPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296942, "uuid": "3fad7974-fb71-4c65-be07-50128a1734cc", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296942, "uuid": "d2bb854d-6c2f-4bde-9bbb-27ad00ae0581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296942, "uuid": "ad408c4b-3619-4ea1-8349-25cf74106ac2", "value": "15bc3c78c9d1a9980e49ad7407cce4d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e6f4e1-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690308673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308673, "uuid": "ef3bec9e-3553-48e8-8052-cc65b0d51bdc", "comment": "Malware payload", "value": "b3da431b3d8c5c8680024b81ce71bd85", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308673, "uuid": "ab437d47-fbc8-4496-b0a4-2e873bba4430", "comment": "Malware payload", "value": "97df4938eff3cfd9060bc97c2ca1568f3e4c63f4aae0cdfe264fbabd5a153685", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308673, "uuid": "30b2cad0-c391-48e9-81a7-22eea1be678e", "comment": "Malware payload", "value": "f411c14e7857e7af445f42f851d6ffdec4a082f7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308673, "uuid": "9363700b-a5b8-4f28-93e9-440369393864", "comment": "Malware payload", "value": "0808452e23b288360835ba344881c23c106903108c57806b9bd6d2851492fd202c4b40b04ca77206f38e2f1cdc862c5e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308673, "uuid": "56728344-6bb4-4c47-8a08-52b572a8dac2", "value": "T1A1035C5AE78F02A4CF511277171B0A899ABDB23EF35455A1386C833433DDC3E4666ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308673, "uuid": "9132853f-6e15-4be6-840a-173a3dac26d0", "value": "768:+Fx0XaIsnPRIa4fwJMPYpHbiRepMHUXIvk8:+f0Xvx3EMPmOGMHW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308673, "uuid": "75ed7f99-6cbb-443f-ba7d-a19dfbc674d9", "value": 41034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308673, "uuid": "d3aa30c2-70c9-49bf-a950-b64b3b723298", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308673, "uuid": "ad8ab543-45ab-4fb2-b507-629e778e7f9e", "value": "b3da431b3d8c5c8680024b81ce71bd85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79554a4d-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268229, "uuid": "b54754a5-3302-438f-b260-e8e28b391c17", "comment": "Malware payload (RedLineStealer)", "value": "809457a190898c3ae16e5ce21fecdcbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268229, "uuid": "b126c514-f84c-484f-ab40-e32ac2ae1af9", "comment": "Malware payload (RedLineStealer)", "value": "9804e545d90777ee1ad26ab56f61c3eab559a0875ab0974e7f7f0f21fb96ca98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268229, "uuid": "6e4e7063-3802-42f2-a014-5e446d459373", "comment": "Malware payload (RedLineStealer)", "value": "6aea5a3e1136b53b0e59a67ee2ebbc4064995104", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268229, "uuid": "bd080175-c00a-46f7-b2a7-29c826673ad1", "comment": "Malware payload (RedLineStealer)", "value": "460a63559139fd28dad551da0696c99bc5a80ad3dc43efe40c9213a3726f08f7998122b9ce878fbb553c63a32c5dbfbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268229, "uuid": "106eca4b-4c00-443f-b2b2-5f63281ca6ea", "value": "T1CEB40212A6D89037DCB52B7058F603930F3EBC955D7883AB2795A56E0CF3A8095317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268229, "uuid": "48967bcb-6c70-42b7-886b-faa2db194faf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268229, "uuid": "631c48aa-bce7-4aeb-abd0-bf3ec1a329a1", "value": "12288:bMrry90l7XlUkN9Y81FvZvKZe1cEQW8IH:8yW7XZ+EKlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268229, "uuid": "25988dba-cf0c-4140-bbad-fcedec54b087", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268229, "uuid": "d75458e8-1ebe-47fc-ba4a-d4f57a4d6550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268229, "uuid": "7d153d25-9286-4e58-9a79-c28545ab3468", "value": "809457a190898c3ae16e5ce21fecdcbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fbe174-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690267904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267904, "uuid": "a2e4ffad-4f18-496e-9792-63731f273d50", "comment": "Malware payload (Amadey)", "value": "37e89bf784fdafca8a34e5516e7a559b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267904, "uuid": "4ddc4338-f5b0-4110-a15a-72fa9ccaf398", "comment": "Malware payload (Amadey)", "value": "983d84806c690cb49e442799e9440165d2d7aad64c48f0d6eff5c9757a79b987", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267904, "uuid": "bc0a9110-2d4c-4890-8892-ac4505ac0e55", "comment": "Malware payload (Amadey)", "value": "644231c49980951a57c951d5088b32bb93ab8f74", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267904, "uuid": "784f232c-1e0a-4f00-a8d1-0e617172b1a3", "comment": "Malware payload (Amadey)", "value": "2d4469e6c56cc8fe42e8a2b481719c4ccf55a988f23bb1eb02ca537bbadd42772392e84a676878050ab66fb327d7da67", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267904, "uuid": "3fcf4552-7956-4264-84ac-f4b04ecf7cd2", "value": "T161840217B7D99036DDB527F41CFA02C31B36BDA1897893662341A94E0CB3794A87273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267904, "uuid": "8590bde1-ab11-478e-b927-2779709a8a8f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267904, "uuid": "795a9bb5-8373-4344-a032-a1c9395071be", "value": "6144:Kry+bnr+Wp0yN90QE+N5XbIdrM3aNQZdLdYV2vpWqGHm7ivdEgh02LMnrg:lMryy90q5cDQaYvRGjEA9LMnrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267904, "uuid": "d8184728-f4a6-44f2-9c26-a034de54c548", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267904, "uuid": "78dc2802-f881-41e1-90e4-1d78bb109a6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267904, "uuid": "f4a6defd-9135-437a-b9ae-45892a17dae4", "value": "37e89bf784fdafca8a34e5516e7a559b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce621923-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690282115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282115, "uuid": "02ecdafb-af2a-4e2f-b6bb-b2cbdb09cfcd", "comment": "Malware payload (GuLoader)", "value": "710d3961938a0b2ace93dd5bea9408d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282115, "uuid": "aeb6f98e-76c7-4b5b-aa58-5ab9b05d1203", "comment": "Malware payload (GuLoader)", "value": "9a8466d0d0fdaf37995d7fc81e6360ec29823bfdd3888d441fb7727bb7560071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282115, "uuid": "7aefa799-8b9b-4e62-80ab-7beba60f65b2", "comment": "Malware payload (GuLoader)", "value": "526de8a5b90b50f370e24c6421f8ab69e02ece15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282115, "uuid": "b07a8a97-fbcf-4d6a-936e-110aadd72800", "comment": "Malware payload (GuLoader)", "value": "b9cf09d4db92ce7088c3aa80fadc8b03a96d5a92db8fee011519a344b673623afbcef492b61abd5b720cf74231645915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282115, "uuid": "ea85b169-ac46-4c52-8320-74e9ce48b071", "value": "T1D3745B49F763ECE9FA660279257158263F819C1E60D9295C228DFB263C36313409BDFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282115, "uuid": "dadca178-0762-4926-8458-7a6932c6a335", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282115, "uuid": "8ad01204-6641-4341-b54d-4d4bd60ce357", "value": "3072:pRD+3q3NxPTNunP7w2pvpKSJb7B5aFA8uJttju/d8V56FHjZ1rHu0ZmY0jOj2JSQ:Hwq3NpAuc7B5am8X8najvHuaUjO3hx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282115, "uuid": "a15bf483-8519-4f5c-8101-3ddda29b87de", "value": 345899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282115, "uuid": "71b41f38-0b87-4e04-bcb4-81afa8d0d9e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282115, "uuid": "37795409-c5e7-4c10-b49a-4a13a62e0a57", "value": "NEW_INQUIRY#475848_LEAN_TES_PRODUCTS_AND _SERVICES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0da3293-2aea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690289824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289824, "uuid": "bd09e40a-e1ee-4126-b36b-353342d67387", "comment": "Malware payload (AgentTesla)", "value": "7673383712fa18c538dcd767c3dab10c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289824, "uuid": "258ffd77-d68d-4bf0-9be8-e663b59c7a68", "comment": "Malware payload (AgentTesla)", "value": "9ac450469f799b251dcce509fdfc745181abeaf21f02d1495056f53f4c93e517", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289824, "uuid": "5fa8b56a-6fae-4104-a85f-d0043f06aa93", "comment": "Malware payload (AgentTesla)", "value": "646c3614587b0ee092871303e34417fa67b0120b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289824, "uuid": "c1e65e4f-3c24-4609-a3e0-ef2042faf455", "comment": "Malware payload (AgentTesla)", "value": "4e7149d8fc80bedaba3230cc9e36f83346b73795607d8ffb6ce2ffd7548d97fcbf970a88c2a3b452dd0eb9d478a33cf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289824, "uuid": "bcb2f46d-9c36-48a9-9147-e14e80ac3323", "value": "T1A5D4F1112DDF5008A5776D8A1BF478A48F3F76712F3AC05E3049460A0BD7EA0EDA5F6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289824, "uuid": "60487fe3-6f08-413d-924e-113becbd4079", "value": "12288:RMxzakfvO0n33Y3iE1RVps8qh783h83h83h83h83h83683h83h83h83h83h83l8c:RMxzakFYy22222l22222622222A2222j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690289824, "uuid": "75070edb-5a6d-41e0-8537-2372c7a3a847", "value": 630668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690289824, "uuid": "5dd3f224-7af6-4a20-a7c2-db2da59362a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289824, "uuid": "be89004c-f411-48ae-a219-7e3e81525cea", "value": "kwen.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56452b65-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690296946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296946, "uuid": "0aef8242-5e9d-4655-ad59-a8b226e2802e", "comment": "Malware payload (Amadey)", "value": "8dc25bec84b1e9a0f066569b83885663", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296946, "uuid": "38c926b6-5ba5-4dae-ad2f-77516f29624d", "comment": "Malware payload (Amadey)", "value": "9acdb2c2e1ba0406d040511947b7d3d4afc0fd98ae2cf915917985ded865f03c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296946, "uuid": "b77ab813-57ad-4a69-979c-321d9a9f65a4", "comment": "Malware payload (Amadey)", "value": "197ba7e06d47cb70b7e5cbd43209a670bd63d16e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296946, "uuid": "0f5145a9-1f46-45af-9384-e715363c3c96", "comment": "Malware payload (Amadey)", "value": "593ca88c2af94c0f15a12c12adbf321298e9721ee39c3455f9274daf190ef192aa6d73f42ef2fec2972c8b9ec567ac32", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296946, "uuid": "9600f4eb-cd91-4ad0-83fc-c94ca1b134fa", "value": "T13B64198793B17C50E917CB72AE1EE3F8761EF6508F493BA622196F2B14B11B2D173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296946, "uuid": "943ba8cd-b682-46c9-b916-00ac65d40555", "value": "020eb28774c582d508abf5443eb41b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296946, "uuid": "313ae8a7-f992-42b3-b4e6-afba5bbdb417", "value": "3072:f+akVllOxLNAnVWNXhFqLO9+x/ryyK2HuteGr85gp1hhbzFpT2:UlOxLCnMNDqYa/rlK2Hu1pLh1pT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296946, "uuid": "639ff7c9-68b9-4da0-b0d5-801a203bdf4a", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296946, "uuid": "0c55c625-5acc-4da5-aa86-3e4eb69ff898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296946, "uuid": "e6ee1fd2-35b7-44f7-a8be-b7709fa6b9aa", "value": "8dc25bec84b1e9a0f066569b83885663.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc0a8cc-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290459, "uuid": "4b2c0cd5-45c4-4891-9634-77758e14b006", "comment": "Malware payload (Amadey)", "value": "557b6fef781e9b0558595bbcadd8b3db", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290459, "uuid": "8539acc5-51c5-40d2-8961-9d6eb2dad1be", "comment": "Malware payload (Amadey)", "value": "9b4b3b05f2f765ad4062a350c128b28e301046acde42e47ae8b231b5f2b0f7c9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290459, "uuid": "33206bf7-dd50-4315-b411-7deb5fa0ab00", "comment": "Malware payload (Amadey)", "value": "76ccaa2fa99e5ea7f3fd9d2f01495ee03831a06e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290459, "uuid": "fdf4364b-2c1c-492a-9125-4bafeebdd36e", "comment": "Malware payload (Amadey)", "value": "657345478d37d8c5c614c08efda783b6811fceb0bf68b943f6793b1653870c70bc52d993ea9a1bf5bb8ebdd1b7293f46", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290459, "uuid": "28982566-941b-4437-a5e9-361cf9e713bb", "value": "T13784F143B7EC9472D9B517F058FA03830B36BCA5997582AB2346AC1E4CB36C0997573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290459, "uuid": "09ab2e23-8800-4e45-8a1b-45cb618ccd25", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290459, "uuid": "7e300d56-e3b9-4f77-9622-d2875e766481", "value": "6144:K3y+bnr+Zp0yN90QEO1/oRsVppHv3FfkB+8QveEljmfUX53R8a0lCZ:BMrVy90awRsp3hkB+8IeEPX53n0YZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290459, "uuid": "b2d97299-fa8b-46f9-80cc-144858d6b88c", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290459, "uuid": "a3013cec-e8c4-4091-9752-4fe64f4164bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290459, "uuid": "5b940687-3ace-4bcc-9150-ee649fda2d01", "value": "557b6fef781e9b0558595bbcadd8b3db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdf4f4d-2aa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (VectorStealer)", "timestamp": 1690258220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258220, "uuid": "ab579af6-67d6-4751-b188-ad907342f8c8", "comment": "Malware payload (VectorStealer)", "value": "9c573e6468810fa95c48c5ff366ec0b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258220, "uuid": "9bf6f523-50b0-404c-bc87-45fd2e0ba593", "comment": "Malware payload (VectorStealer)", "value": "9c080a6c3f222fa3409962b716432e674ab1191f8e3376df025912203b7d25fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258220, "uuid": "daa1d393-12ff-482d-bc56-0df128d116ac", "comment": "Malware payload (VectorStealer)", "value": "0ba6b073b99822b5c0587ea9a933cfb9add35511", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258220, "uuid": "88be9fa0-b64b-4d6f-83c5-019ba89c0b30", "comment": "Malware payload (VectorStealer)", "value": "3b89b74e21247c31b543eecb8c563c7eb266a354f13bfec98e6d16c02b552fd6ca59895ed35929581072ad40fead6464", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258220, "uuid": "a9baf57a-e7a8-48ab-a953-9cab6f3c9984", "value": "T1A0A5D0E42EA8D9A3F3C4987485B4E7BB8579647E0E534101E4BFB6EDF718BB86C15200", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258220, "uuid": "1f5ed087-7f22-415a-8f24-fdd30586d6a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258220, "uuid": "57e3c804-57bb-4b9e-a6ec-fd3d4561d22c", "value": "24576:b1+FEtvLL0LoqXeHR1E5fTi001NjwL9Xi7eCWDYyl:b1YUHqsRG5f0jwmeCWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258220, "uuid": "7d49dfd5-af77-4781-802c-325e25a63da2", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258220, "uuid": "96ca9358-ff0a-4bdd-8569-a6a5c3ddad54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258220, "uuid": "5494f10f-c174-4de1-8017-4834e12e50ea", "value": "9c573e6468810fa95c48c5ff366ec0b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7a0c95-2b37-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690322646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322646, "uuid": "e26f7e0e-01d2-4c59-89f5-b1d76ceb03ca", "comment": "Malware payload (Mirai)", "value": "848261230e3c2877fcbbaf4ff3fd9a5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322646, "uuid": "04758534-3d04-428c-a977-19fdfd8f8c7f", "comment": "Malware payload (Mirai)", "value": "9c31ff6d41cfed57b5932be29dcb59049fd36713d0afaea3340ce88b7b8c1910", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322646, "uuid": "173262d6-d089-4a19-9f6e-7d70d04c7999", "comment": "Malware payload (Mirai)", "value": "e1455a19bbe5e4d7fa6315a1a4605d9314b922f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322646, "uuid": "6bbf17a4-d5c9-460d-b335-9680a432a5c8", "comment": "Malware payload (Mirai)", "value": "18077a85fc80fc432513e9cdeaacba99a3370d254e69cfb8d6207e6a461e9307cb520d7cee290470691fa3d98e8b2411", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322646, "uuid": "461077f8-d156-482b-8cd9-9e559f628488", "value": "T139F2F1E146DB62C1C17502BEBB5EFD080511AA1925CDF72B9B1EBC6B65B1F18A82C342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322646, "uuid": "116c5b76-be4b-4533-ae8a-fc679b02d8ad", "value": "768:ZypBA4Mc0CURkPcKtMWrcKifFsSUvgF+tD5LCuWnbcuyD7UiyqqT:UpBHwHpgvjitsSmgF+Ngznouy8Zqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690322646, "uuid": "e1f39998-0631-49ac-89ea-a406602d5903", "value": 34428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690322646, "uuid": "576a44b8-eb0e-41ca-92cb-1a11e5e8255c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322646, "uuid": "a288dec9-49f8-4808-88f1-82ecc2c670d5", "value": "848261230e3c2877fcbbaf4ff3fd9a5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c3c5ab-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690296952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296952, "uuid": "d5fcb208-72e0-4d27-8cb4-06c747378e25", "comment": "Malware payload (RedLineStealer)", "value": "f93a1a3e78a4218e5d426d6ea40f4149", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296952, "uuid": "19659824-534f-471f-aa8d-e00fad370a60", "comment": "Malware payload (RedLineStealer)", "value": "9c33c0c4d40467e3738099d615717165646ad52d21c9680b11ae8488880e5a46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296952, "uuid": "b3c4f9f7-c760-417c-85da-093991cf9d6f", "comment": "Malware payload (RedLineStealer)", "value": "8d8c646dc8213e826032bd7c8437f0cb73e027b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296952, "uuid": "65a63271-9484-4467-8ca1-b30dd52fe5e0", "comment": "Malware payload (RedLineStealer)", "value": "18efbd6bfb9e989a08f77b6e0d0ea779dec4188db9f2717c5468b36b38d1177acd11d3ec779ffc5bc46ffe60a2c9d30c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296952, "uuid": "8edd22be-02e2-4702-8f95-b2b1fa442e99", "value": "T1F1843A07D2E17C58E92ECB729E1EC3E8763EF5508E4977A62239AF2B14711B2D163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296952, "uuid": "93c9cf76-f68b-4291-b77c-c792dfae0fc6", "value": "6dd6b46f56344bac3e06d5c8db854c3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296952, "uuid": "0a6bec77-00a8-4cb4-a284-877c75911a6a", "value": "6144:mE2J0NLiGLUqECezCkMnXfRFTHTmNJK1X71A1pT2:j2J0NmQgH2RmNJoeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296952, "uuid": "93176cd1-5f6e-460f-a90f-2808411e940f", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296952, "uuid": "9676ae0f-7e5c-448c-ab6b-d50049fbc507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296952, "uuid": "2beb3a4b-c58c-4187-8c1d-3a4fcb949deb", "value": "f93a1a3e78a4218e5d426d6ea40f4149.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f200bc7b-2ade-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690284752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690284752, "uuid": "41d34970-a432-4f2f-b185-f6a669be21fb", "comment": "Malware payload (RedLineStealer)", "value": "943b9e604404eca1f1e8d1f9625c203c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690284752, "uuid": "f97a43ad-5011-42a2-918d-aa985cafe2b5", "comment": "Malware payload (RedLineStealer)", "value": "9c3cca94aa032a7315d06ccc2beb478d0d774abffdc097ed085077c0a66bb764", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690284752, "uuid": "75e8de36-5aa6-45fa-8fe1-f0d15eb11555", "comment": "Malware payload (RedLineStealer)", "value": "f8b0d493e9c6765630af3b3460f16272f000e573", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690284752, "uuid": "1d95e14d-efce-426d-a0c5-6ce4c550d616", "comment": "Malware payload (RedLineStealer)", "value": "76db0c5c800a6f9c2224aaac31ba9e0b80ea971b069ad24deb6c61bc8c6cea1831e207cbf07e6bd8fb6a8f93eed445f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690284752, "uuid": "d794be83-490e-4c68-8ab7-e697f823ef64", "value": "T1AD840143A6D8A033D5B127B0A8FA03D30E367C625978936F1795A94B1CB35D4B97233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690284752, "uuid": "2570b5db-693d-4079-894c-c0ee448458be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690284752, "uuid": "e4a49273-8f7a-495f-9f8e-2bfbfa4cc693", "value": "6144:K5y+bnr+Cp0yN90QEB7yvuwDGTEdnDvvHzPy7JRYgBZ+t4GDbJ5+7jU0vW:bMrGy9077slqTEdD0JRYgBYCGm7AYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690284752, "uuid": "041c4d9f-c511-4a3d-afbd-78aa16bc85e3", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690284752, "uuid": "99c85002-7f20-425f-a3ab-403be5b4e7ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690284752, "uuid": "6259cc33-b3b5-4aef-90d3-5f503c6f7e2d", "value": "9c3cca94aa032a7315d06ccc2beb478d0d774abffdc09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613abe14-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268188, "uuid": "8208f703-daff-4355-85fe-63b9d51b4cff", "comment": "Malware payload (RedLineStealer)", "value": "0179fa62c15cc96b35e1450e7384dcae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268188, "uuid": "6f064c6b-10db-4372-b0a3-0f4d5432e1e6", "comment": "Malware payload (RedLineStealer)", "value": "9c48ac832a3da6ee2280b7151181c9b0e6bbf0ec0a7d83505b1b460def2e886e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268188, "uuid": "223db756-55f4-46a8-bdfd-8cb9324727cc", "comment": "Malware payload (RedLineStealer)", "value": "e2dac4f0836c007490ce1a8d26019a817034aea7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268188, "uuid": "2e6d97f7-9e63-4832-a41e-7bcd859c7737", "comment": "Malware payload (RedLineStealer)", "value": "b515804df0f4a1c24f901f551df5b7bbee716d7a2201be028f2d5edbbeed90a78dabdd192c1c6979c46aa8bb1764a7fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268188, "uuid": "dcc87184-a5df-48b3-9f5a-e0f78cc4999a", "value": "T172840153E7DD9032DCB527B068FA02830A3ABC529D79835B2746A95B0D736D0B53633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268188, "uuid": "bc9cc47c-d216-41bb-8a09-6a5d8a4a044e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268188, "uuid": "f71bf1cf-606d-49e9-8b5f-6e6dfbbf0657", "value": "12288:JMrMy90QK1pulks2s3WgBYCoTSecL270n:9yE1xqz/eciIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268188, "uuid": "b0f233b0-37dd-458d-9a39-7bd30cd393ea", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268188, "uuid": "4b79245a-067e-4729-a4ca-dff539372e8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268188, "uuid": "c064e065-2b74-4c0b-9a4b-18fc19ca0dd4", "value": "0179fa62c15cc96b35e1450e7384dcae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6af7c08-2b18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690309537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309537, "uuid": "a3c196e6-cf9d-485c-a445-be5f44c20b86", "comment": "Malware payload (Formbook)", "value": "4f19076e48936394ec0a525e03c5b317", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309537, "uuid": "9ab58e0b-d201-49eb-a627-ec1bb6f11aa3", "comment": "Malware payload (Formbook)", "value": "9cd1b016ff9416679f96b8047284684816dc8dc5c61d698f2ff69a3d200477ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309537, "uuid": "73a864ee-13d8-432e-b350-c7a0465d1c14", "comment": "Malware payload (Formbook)", "value": "0f9b27c7ab5437a033e4b033ba9b771380e4ceb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309537, "uuid": "bc2d4960-0b31-45d7-bf96-036384025644", "comment": "Malware payload (Formbook)", "value": "adddbcd326578361d209869ac66dc36d95940670c53f0c9f90a8b7eda8af53aaa11e28623bda77cf7f28f51f6704aaef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309537, "uuid": "0fc22bca-9c8b-4b93-9706-308ef75c800d", "value": "T1A6D4132022EC8526C93D6FFE3C50A1850BB17D5F6262FB485F9858D98E31B245BB1B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309537, "uuid": "c58c4d37-2475-4818-8d83-4158d43fea22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309537, "uuid": "ee4f0657-1ef5-49fa-9271-e28cfdddf18a", "value": "12288:bXPZXoGozUq8nmFi+n6yMbOPzHThy37Y7/wu92i80SfyRp:pLGUqsyD6yMbO3hy3Ejw50Sfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309537, "uuid": "dfe0f42f-11d7-49dd-885a-f64faa7ac749", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309537, "uuid": "4a5ba10d-53ea-4ca1-9c59-b3da499b0289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309537, "uuid": "d9582e38-542b-452f-9ff5-e0f939dc4faf", "value": "4f19076e48936394ec0a525e03c5b317.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f17c5cc-2aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690268963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268963, "uuid": "6d51776f-33f2-4df0-a23c-7c70a9a44e84", "comment": "Malware payload", "value": "e9da8fcc903ac65fe5b366c41a7c002a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268963, "uuid": "07d9ebb9-985f-4148-9fb7-aa8f633f394a", "comment": "Malware payload", "value": "9cdca4cb9c868a3749d9175929c3a2b5e1609068eda9d6c4ccdfdec9908b53ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268963, "uuid": "0675c1d2-2f1c-4c84-8767-f6c98ed4f2a6", "comment": "Malware payload", "value": "3dd5ad0ffe1a41b136eeb48f34de5ee2e679e56c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268963, "uuid": "fd4b4cdb-dca7-4a8d-b464-d78dcb600aba", "comment": "Malware payload", "value": "3cdaf9e5f321d33072fddff553a7be38160027cf0780e1ce24a9e2581b8e2da2aa93ba830f8a763161e171d1a55e3a73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268963, "uuid": "6a0caa86-d069-431c-921e-c3e0df398082", "value": "T1FEA68D87B8924653C6E4263BACBE40D433675EB9978B63566D00FE3C3ABE19C1E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268963, "uuid": "8cc642a0-fe48-42ea-bad8-cc0abab81ca0", "value": "98304:wKTLSQw9mbofjcbdhjZZwOWzyw2Y6XNAVOAKjOv1GTk:wKTxwMMj8dBZ2OWexYgCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268963, "uuid": "9e7fac95-52eb-4ad4-838a-e5438116d2fa", "value": 9525631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268963, "uuid": "550c2bd6-6980-4d31-a34f-7104449f58cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268963, "uuid": "0f178a9f-0fe1-4ab6-b6ce-3eb79bb6d829", "value": "e9da8fcc903ac65fe5b366c41a7c002a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41f6f55-2aea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690289829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289829, "uuid": "f285278d-bfa0-415f-9615-7db8922515a2", "comment": "Malware payload (Formbook)", "value": "9a2373fdaefc0e0a82e22c8905e441d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289829, "uuid": "f593f206-7f6e-457c-bd50-84fefe323fc1", "comment": "Malware payload (Formbook)", "value": "9cfa472702dbedc0f87b0e594d3c8ace16e1c9952d8d7e44be8aa9114b214c45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289829, "uuid": "8aa44e63-9449-4db5-99c6-417fcd53d24c", "comment": "Malware payload (Formbook)", "value": "0ab46138dfb3be4893e125e90c67dbaaec20c410", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289829, "uuid": "ee8c1ba7-ce59-4cb1-86c1-0dd0d557604d", "comment": "Malware payload (Formbook)", "value": "2b414327ea30544d71bc25c898cd7b7c9fc13f3e17ba126a18f0821b35b8a23f3ed0e8045b15beec3493b6f0e8cf7923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289829, "uuid": "1d633fcc-f8e7-4a4a-99f7-9d02287ac3e7", "value": "T13A05F12176A9AF53D5BA87F84430723013FEADAE7435E3092EC670DA2971F804A25F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289829, "uuid": "a64895ab-04b8-429a-95a5-b01abe654b72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289829, "uuid": "e747357f-b98c-461b-a725-c158a5a38516", "value": "12288:OfgETKvYiIoFwIrG3XCCaEHsbHa0IWSTAFTaSCt98tbraSZbaiUNO1/FFql5xqEE:AxWvHIcTrGCSx0wTR29uWbeOxvqBqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690289829, "uuid": "e8def017-1d6c-4c92-8f80-1328f911b834", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690289829, "uuid": "49bd67b5-6a76-432e-9ba1-bf864b1e2dc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289829, "uuid": "c6c89060-be1e-4cd1-ae2e-9da2256e100d", "value": "secdukaszx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c289e030-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690282096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282096, "uuid": "1a9d4961-34c9-4e8e-840b-511f2603e48b", "comment": "Malware payload (DarkCloud)", "value": "787ece3ea1a38a8c132fbdb2ed6b441e", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282096, "uuid": "c8121e97-4a84-4082-9271-3ba9be3a9c50", "comment": "Malware payload (DarkCloud)", "value": "9d16f030796c701a2fc2481bf376df82914d34581547795b81154e3f249f1549", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282096, "uuid": "ea65af46-242d-43da-a4fd-f5335b24eea5", "comment": "Malware payload (DarkCloud)", "value": "6f3fa7332fad1615571a8f08e18ac658fe2ab739", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282096, "uuid": "625d96e2-f7de-4e39-93f3-89b5fbc73add", "comment": "Malware payload (DarkCloud)", "value": "c80d68a18a39b03708800e3b0ae47010569eee83a7835830a359d6fbad94a555476f2c48e1f2ee91520a332ed2f872a7", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282096, "uuid": "0490aa03-72db-4af0-8e40-9c225b10aebb", "value": "T10F942B17EA34642EE153C8B0EAD4925BA8256D762188E817F7C16F0932355D3F8F1B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282096, "uuid": "66cf90d7-d379-40cc-8422-0e334c814119", "value": "31e0d72c3d1d9c2e87bd259235c4a085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282096, "uuid": "0db1c0c9-e23d-41ff-a90b-22e23d6dc4b6", "value": "12288:dgUZoS6pzRHzTT6pzSiaZPv9qjcjYKkJj6GmZU:dgUZczHZZPv9qjSYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282096, "uuid": "ef95f4d1-891e-4fb5-80af-ec2bce9797aa", "value": 430592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282096, "uuid": "52aa9434-169f-4ad5-8d87-a390f24a14f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282096, "uuid": "abfa65ad-c1f7-4706-bcac-b0d9eddeb83d", "value": "9d16f030796c701a2fc2481bf376df82914d34581547795b81154e3f249f1549", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e390bf-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690280246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280246, "uuid": "ed667c04-a3e8-49cb-ad1b-117e10aa05fc", "comment": "Malware payload (Amadey)", "value": "a7ab6b3767a2159af363ace3e6a5448d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280246, "uuid": "2d6669f8-4bc3-4a5b-b086-ee7d2d4a8961", "comment": "Malware payload (Amadey)", "value": "9d786ccb9cfa1fb027035e67bda7bc67538381eea216a063f4a83c8862a67d17", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280246, "uuid": "4bdeba16-dec0-4337-9ced-0dd3b524ef4d", "comment": "Malware payload (Amadey)", "value": "82b7ea7115bea29069ecb8440fa692531f164d01", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280246, "uuid": "bf4b7202-c554-4abe-82c6-bbabb16a4fa6", "comment": "Malware payload (Amadey)", "value": "ab5f0621dba7d54b85b20cca89bda008989037213f2ffe8b837ac65b021774d04d4b41a3638a402b368771a173315bcc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280246, "uuid": "58d19cd7-b3d0-4187-ac4d-2bdca717a9a6", "value": "T19A840213E2E94432DDB56BB05CF703D30B36BDA15978936B3386994A0DB1A90E93173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280246, "uuid": "e7f00b56-6347-4f60-96c3-6a8b2828e984", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280246, "uuid": "d8ce2410-6d21-474e-9c66-497a9f367640", "value": "6144:Ksy+bnr+lp0yN90QETlq/PQMfwQMKBLH/EmwNaW1phqCQy4dhmG1o9yClqd:EMr5y90tlq/2QM2LMmcZvh3msyMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280246, "uuid": "4740d581-f56d-4c46-b048-e76550eae60d", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280246, "uuid": "92077746-a67e-4ba8-8229-c8fac0cd266f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280246, "uuid": "a6c3db05-cfcd-41e9-91db-5cd31a2ed8f1", "value": "a7ab6b3767a2159af363ace3e6a5448d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc74cde8-2b1c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690311318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690311318, "uuid": "56f28303-7949-4ab1-8876-70a86102d649", "comment": "Malware payload (Loki)", "value": "e8393cbddec270668b16af2c2e265018", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690311318, "uuid": "e3e37be3-ef01-4c71-acbb-cd8b30d13249", "comment": "Malware payload (Loki)", "value": "9da0280fd940aedf3abbfabacfeb3a285ffedbc74f7ab677d6900ba6fec4c691", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690311318, "uuid": "dde46101-a0f5-4290-a71e-2842a0fe1251", "comment": "Malware payload (Loki)", "value": "00859064e88b48c0c657741acd0e6787c2dab6ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690311318, "uuid": "11062548-1308-4673-b11b-ccbb430258f3", "comment": "Malware payload (Loki)", "value": "3cbc2477475572f16e6ba206618047e20c9dfdb561dc487c44b99fc90727584b46a4ea4a43bb9db67899be2f7bf7911d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690311318, "uuid": "dd39a9a9-39d8-4d41-ac0a-ac505d45d6d4", "value": "T1B4F2FEDD326072DFC857C4729EA81D74EBA0787B871B4207902725AEEA6C997CF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690311318, "uuid": "6e7f30b5-4688-4111-b873-d465f4882753", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690311318, "uuid": "32261b65-a781-4aa3-860b-32c63daa591b", "value": "384:cWV1IR/7HOx2jtEPQTb4XjYgBHKNv7hIyCDF6PpS8D835srXSM:zV1g/7ucpQQThgBqF0W1drXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690311318, "uuid": "1dc01b94-8598-4646-b9aa-052b15a91f16", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690311318, "uuid": "9335aa53-ad4d-4efd-8abd-f4c5e52753fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690311318, "uuid": "48ff8395-46b1-4387-b73a-03acaf8a45d4", "value": "e8393cbddec270668b16af2c2e265018", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d90a04-2ab6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690267392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267392, "uuid": "f87d3575-82c5-447e-b664-0f6b1ad193f1", "comment": "Malware payload", "value": "886990e58c796befcb2eba5184e9be55", "object_relation": "md5", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267392, "uuid": "7f1891a2-0e73-456a-8843-55dab59c8cc5", "comment": "Malware payload", "value": "9e1de76583871447344da895e399f3feb8921566fb281239f762dcd9b85cbab0", "object_relation": "sha256", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267392, "uuid": "364ac07a-0f2c-4bf1-bc50-33a931e7271e", "comment": "Malware payload", "value": "a665ef6164fef03355c3036991e797cf59364fb7", "object_relation": "sha1", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267392, "uuid": "f931c097-5a3c-45be-9b7b-2d2b0103983a", "comment": "Malware payload", "value": "10e8393bf46914f479dd134380080afbf2d5542dc918515aed164a3050e61e2444c1e5816d1d05065462a43f4225dabe", "object_relation": "sha3-384", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267392, "uuid": "84ab8be5-30a6-458d-b46a-626b0d73262e", "value": "T18046334BB8CB1F32D12A47B5709F57CA9E684E040B47162763FB728438F37147AB859A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267392, "uuid": "13de7051-beac-4bc5-9024-706101e130c4", "value": "98304:i9WMy2eOSmUNQiveS0nGRehMc6zEmktLFt7s365qqXxHw+v+y3hfHDdu7gQDB:i9WMyLOiv4GRemc6zEVtBt7Q65qqXxQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267392, "uuid": "d5e58c4f-83c4-46c2-9668-7952338fe0e7", "value": 5881344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267392, "uuid": "6ac51314-6a3d-4641-b0f8-67e36ae68122", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267392, "uuid": "e994eb76-bc79-412f-9010-0be7248a976c", "value": "Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c411339a-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690267925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267925, "uuid": "970308eb-b4c9-4469-9def-5bd72a833d70", "comment": "Malware payload (RedLineStealer)", "value": "274408e90b12d66d2efb2fca7d017a2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267925, "uuid": "94166c33-26ed-4930-b474-808760f5ac7f", "comment": "Malware payload (RedLineStealer)", "value": "9e45d1d9661c3106e7e72c4d718e80ea392f32c7154b4362116adcb07607a447", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267925, "uuid": "9e69d1e1-e404-4c8b-8136-3bec77d13cdf", "comment": "Malware payload (RedLineStealer)", "value": "6e74059b0a9d10648dacde44d7581f4cc3ec90f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267925, "uuid": "e1041227-0803-49ea-bd30-1fd893c23d02", "comment": "Malware payload (RedLineStealer)", "value": "8b36bf201d8f86f426ef136b14935231082343486e7fcd82c48dec0d97dd2e52b7ec63e1637ebd550129996a676f1917", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267925, "uuid": "7bdb338a-f287-4f0e-beeb-abb439e0b6c0", "value": "T187840242BBDC4472E8B52BB058F613C30A3ABD9159B9831B2781BD5E0C737D1A93176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267925, "uuid": "851e0cb6-a02c-4910-95ca-514811091771", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267925, "uuid": "7d9dcb1d-f7d0-4e32-8c1f-19646bbbaf43", "value": "6144:Kdy+bnr+Vp0yN90QE7TbcOZEjyPfszVZXr28PaLI3U8BclCyiu+2ciR6EP:7MrZy90tUOfszVZbBkI3fWx7+mcEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267925, "uuid": "12e576a6-76b3-4a42-a826-4ab2918fdcd7", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267925, "uuid": "41a33c5b-ee1a-4264-9987-fd558fb2c558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267925, "uuid": "f10f98d1-f358-4083-9b2f-dc629f3f4b4a", "value": "274408e90b12d66d2efb2fca7d017a2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c62f63-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690308574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308574, "uuid": "ac0b3d85-a7c6-4406-afe4-e491b6358e37", "comment": "Malware payload (Formbook)", "value": "965624767cfeac24adedd12fda3022fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308574, "uuid": "6f2e82c9-b1e2-4291-9de5-a2202a2d5546", "comment": "Malware payload (Formbook)", "value": "9e6e021c6deed0f7538b92df6a47667f2c52919628fa4886c6948860720f9214", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308574, "uuid": "9834b91d-53b5-462e-b2dd-168e8330ba9c", "comment": "Malware payload (Formbook)", "value": "dfa60635e893303254611b91130532f756714b95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308574, "uuid": "9629b2b1-2718-4e8c-8c25-dcc937326db6", "comment": "Malware payload (Formbook)", "value": "c1c734f90ca87eb9dd3d5b7dfe890fda14e35d580a16da1011577d657fc6d081a41b62f6f398aa349eac2b74f1224237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308574, "uuid": "5f81fd1b-2bf9-4854-aa9e-1a3b238204e3", "value": "T1A9D412D73198F6D6C4BBEBB92910B25287FD9B679323F3690E8852D518057200B73B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308574, "uuid": "b229f3ad-6d4f-4093-bc95-a2eb022386c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308574, "uuid": "84593506-0aee-4037-96dd-e3b122db32e6", "value": "12288:+XPZVfNyyf7SLOwdykx6MC46A12PuA1gMRXoQX91rZgaiMBvg:QZjnwVN311A1vXo89jWMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308574, "uuid": "41d4c131-bcb7-422e-94df-7f5cdff10170", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308574, "uuid": "cd30c3d3-cda0-4c93-a85c-762b5cb9676f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308574, "uuid": "2efe0bb8-6eb9-4551-afaf-9e06e659b7cb", "value": "Hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985114c7-2ad6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690281166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281166, "uuid": "61a39682-6ba9-41fa-a5bd-e593b144542c", "comment": "Malware payload (Loki)", "value": "1b29cfed64d530eafb6ce93a632e20d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281166, "uuid": "5318aef5-a42a-4c0c-8e63-48dd46abd568", "comment": "Malware payload (Loki)", "value": "9e87a118ff99af8fa1ae32be359992f8872d632ee4e838e27d5b5137fef34cfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281166, "uuid": "fe344325-0600-40bf-90d0-7d016993287b", "comment": "Malware payload (Loki)", "value": "382e86c09e6b52a647588fcb27c715d5ee45ee70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281166, "uuid": "beec88c9-de59-4f57-b95e-01aa84b4fd53", "comment": "Malware payload (Loki)", "value": "1668871ad5b405c941f839cbbb431ef89835b251390e66e9d4c73ac0adf15ac96977d9868fc57e5bdf9bf982b55e351a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281166, "uuid": "039c1154-f9ed-4b6f-bf0a-e0f5704a30e0", "value": "T109F4F12136B99F97C5BA47F84030323413FAAEAE6039D3195EC374DA1976F408626F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281166, "uuid": "05d06652-d1c3-45af-9b5e-e932dbf913cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281166, "uuid": "cad437a5-9530-4249-a2f3-960b92e2228e", "value": "12288:kfgETCrYiIoFwIrG3XCCaEHsbHGcEFeXMajf9sbh7Iaw/fWKG:Sx2rHIcTrGCS8zMaj6Fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690281166, "uuid": "acdd051f-5de0-4b1f-aa53-7dbf218c574d", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690281166, "uuid": "e67825ef-d2a7-4820-a947-0ec75e4b6bf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281166, "uuid": "94d74408-eeae-4f83-84bb-1bdb3634c3df", "value": "SecuriteInfo.com.Win32.PWSX-gen.14556.26418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d550029d-2b1c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690311333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690311333, "uuid": "1f3514b4-47fc-400e-a2aa-fd49c2d894fb", "comment": "Malware payload (Formbook)", "value": "99566b51018706a1b36b1440dc9b9d23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690311333, "uuid": "f60432cd-1030-4825-8c8c-c54ab9703f72", "comment": "Malware payload (Formbook)", "value": "9e9af76a8585a7b99a59f042f64a711aaa8f9bfb68a4040ca522147470d6b6de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690311333, "uuid": "daf366e6-083a-47f1-bf30-a48dee694944", "comment": "Malware payload (Formbook)", "value": "df25bf12f7936ce32148f0bdd94a96cb45d3e39e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690311333, "uuid": "49d0fa35-1d28-45b3-b265-e5254523c5a4", "comment": "Malware payload (Formbook)", "value": "246ca186f785771a52cc507864dc705f84de23b10fe6d3decadd93f3720ca2a6e92c375086fbaa38725354d223978852", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690311333, "uuid": "0481c36e-9b18-4040-938b-e685c1f972f0", "value": "T10BD4222063DC9717C6BEBBF92950850107F2B94F6612F74D6FDC68EE0E293604A58B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690311333, "uuid": "9da19efc-9cd4-4b31-b65a-67f513f67893", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690311333, "uuid": "d9f80481-aab8-460f-bdd9-217e4c71f510", "value": "12288:oXPZX69htaigyxmUz34rftmYOedhTLOIQbe/NVdCmLnqJvrRc:caXaomUzoxm/vIQa/n46nq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690311333, "uuid": "3bef5740-1746-40c2-a38e-6db6bbbc1768", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690311333, "uuid": "8d4a7213-3e89-4fe5-acfc-d6134745eaf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690311333, "uuid": "ebb4b662-ee7e-41fc-b8a9-211249259174", "value": "99566b51018706a1b36b1440dc9b9d23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a284d41-2b26-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690315529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690315529, "uuid": "a6300d14-11da-436e-b161-4114dd24eded", "comment": "Malware payload (njrat)", "value": "19970b5a9d7bae248c8bddcbb827be0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690315529, "uuid": "dd1a0975-b8db-42ee-b55e-3c08eeafb1c2", "comment": "Malware payload (njrat)", "value": "9ea9105dc7520a44468e69cb9f739a2f030816a673f9f5d89485f43b3b0f5877", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690315529, "uuid": "472fd668-1c16-496c-bad2-dbcbc72a1b51", "comment": "Malware payload (njrat)", "value": "6777ded67317388692d80f173d07359dbfaf1260", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690315529, "uuid": "cd28d048-75a5-422f-abde-9b691193808b", "comment": "Malware payload (njrat)", "value": "4c04bc7be62de8ea9031d50b4c36e17ac30d5f81053772e1b465810c433149d9bfb1492dd7d8b9b3754f8d171cf9093a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690315529, "uuid": "1242a985-7f2f-48d3-8e95-c4b49e103b22", "value": "T14E34F77E76448F11CF983671C0DB912447E2E9D26232FB8B3E5836B94912376ED493CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690315529, "uuid": "958b4e3e-398f-4d61-a52d-1ce1598eca7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690315529, "uuid": "e0c2d346-1c6f-400d-be39-35096b1b2421", "value": "6144:KSvCVHIlHiFXUU5bj/Y4V9vKdrqst6dpePtN0:oSeUSSqpUPX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690315529, "uuid": "13c6d38f-8f50-48cb-99a8-0df71bc4996a", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690315529, "uuid": "32492462-7a46-4b5e-b697-da846608d751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690315529, "uuid": "869dad9d-7333-48f1-a736-b0cfb3852c33", "value": "19970b5a9d7bae248c8bddcbb827be0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463d0ca4-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690290477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290477, "uuid": "851c8ed2-3bf5-4445-85f0-bbf3cda52e4c", "comment": "Malware payload (RedLineStealer)", "value": "88b49d450e32c95a1efb3500dce33bf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290477, "uuid": "39e391d3-1d69-440a-bddd-d6375cd086c8", "comment": "Malware payload (RedLineStealer)", "value": "9ee42f756020db7a2f4386a8739737792a931a068c38d368a3024af9f84effb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290477, "uuid": "71bf74a5-b2a8-43b9-9cbe-d54a1a2e328b", "comment": "Malware payload (RedLineStealer)", "value": "3cdaa7ecbc929b38edc4feb8c224bfe4f1e82a44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290477, "uuid": "1c018a11-0947-4b14-ae38-c73eed8c2d3b", "comment": "Malware payload (RedLineStealer)", "value": "f371e7f4af04af6cd7ddca633ff399978362ef3ba83ea68d680c46a27cf5b5f254351bdcb8003c02428ce1e554150efc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290477, "uuid": "3577f1f3-9b39-4a06-add1-c2c5110b94cd", "value": "T131840113EBD99132D971277058FA03930A36BC61AD78836F270299AE1D736D4B532B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290477, "uuid": "3e1450d8-4d93-4a62-894f-2c25c2ef6ed1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290477, "uuid": "905f6128-f846-4f84-86a5-ea2575123025", "value": "6144:K5y+bnr+8p0yN90QEys4k9eyHu7GcUqztgpvlIJxgBZ+t4YDCuEOW3hl:DMrcy904s4k0yOSoOP4xgBYCYkfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290477, "uuid": "b88d2587-7ef5-4a09-a09c-0d19abb18340", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290477, "uuid": "dae33650-721d-4fd5-a9c5-30ea58b67055", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290477, "uuid": "aea25d81-d8ec-49b6-b88c-70b2d0921477", "value": "88b49d450e32c95a1efb3500dce33bf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2c5945-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690267883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267883, "uuid": "8aeaaacd-01f3-43e8-ad3f-c9c3ad515971", "comment": "Malware payload (RedLineStealer)", "value": "1f48c37983c8cd6860720db93044a4c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267883, "uuid": "4283904e-e64d-4b1b-a439-d87b46959b64", "comment": "Malware payload (RedLineStealer)", "value": "9f1a717948c323c01d4b2ef9ed4e5b369faf64bd5582f1fb3719ff5a8c32c601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267883, "uuid": "b50f092f-0c09-40ef-9046-1bdec8ffa4e8", "comment": "Malware payload (RedLineStealer)", "value": "5324c5a326e15b25bceb6877e7122167e1c89de2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267883, "uuid": "480c3b4e-d772-453e-a90d-7187b24397ec", "comment": "Malware payload (RedLineStealer)", "value": "1f91079b345e1a7a9e8ca79fa3ceff5525a95e3380d5968cc6d054a9a8339ffe5c8296fd1a48357388179ea73bab52a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267883, "uuid": "de4f01e2-2266-4279-b09c-7f8d9fb11841", "value": "T146B40151A3D88032EAF027B058F617930B3ABDA2AC789B7B27455C5A1C732C87436777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267883, "uuid": "f88af290-c877-457c-8c9d-182f9f3a7cb4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267883, "uuid": "b0a42a73-4e20-4da2-b3f1-c98f038942cd", "value": "12288:MMrdy90TH7in7wKlUU/5TOrL55jOjG4WIba6g0:5y+bwwKtQrt5jqK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267883, "uuid": "30fcf776-258f-46c3-a7b6-b9e7859600cf", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267883, "uuid": "40ec88b0-832c-4ca8-aa62-90d89d300c14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267883, "uuid": "7ab9d47f-794c-4cb1-90aa-d019f77d7568", "value": "1f48c37983c8cd6860720db93044a4c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73797464-2b14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690307733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307733, "uuid": "f96a43b7-bfe0-4b51-9e7b-ef4c2b2f1fb0", "comment": "Malware payload (Formbook)", "value": "3c3a1f40d4ac1b08dafb83506c45b052", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307733, "uuid": "e04fd781-e0a4-4a58-8d36-41312528c33d", "comment": "Malware payload (Formbook)", "value": "9f2e2b6321a4231e6b43ace7b2479751c8735c0428c9f85cfdec532e5a358d30", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307733, "uuid": "a62d4018-140a-4ac9-a8c3-599660e2853a", "comment": "Malware payload (Formbook)", "value": "b0a281a568abff58f6b9d950a84c3b7f64367fc2", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307733, "uuid": "ead9fd95-c01a-489a-b9b8-4fe725d228df", "comment": "Malware payload (Formbook)", "value": "d06f29e4a61650bfd018509dae4c0ec03a1e7d00b94549c9bc574b3d58fb8122b68f0d9b6b9cec361536c8b1b0a1098b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307733, "uuid": "6cbee626-e082-4072-8745-4724bb0f9d8f", "value": "T17A75F153A8149F83C50C83F8BE631DD90F1B6F09E895ADDF04123F9B3A76B62594A24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307733, "uuid": "e30a111e-a886-4d0a-8aa2-1ab5b3344ad8", "value": "24576:f7u9VNZylw6V4OZy1w6VqViNhuuvvtw3oqVUbXQwNgZffsLMy5w3x:f7uPR6V4Y56VCiNhv3tcMXXNhLr5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307733, "uuid": "73e1bec8-5779-4bdf-8774-b35618217993", "value": 1622528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307733, "uuid": "71878e18-e264-4520-b3d8-c8c5bac2c8af", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307733, "uuid": "aa77052a-23cd-4232-b0b0-2bb740b49854", "value": "Shipping Document.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6044d06-2ae7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690288597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288597, "uuid": "1d96ab98-739c-4ec8-ba50-3a122783962d", "comment": "Malware payload (AgentTesla)", "value": "1769c7f67a239c6aff4edbabed98a3e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288597, "uuid": "1eed8ef4-3a1e-4b81-82a7-0c672120d32c", "comment": "Malware payload (AgentTesla)", "value": "9f9eda715bac5b9f3d10d8a72152db87dcfa2cd943f34edc3f504a348123b494", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288597, "uuid": "0b8e8e2d-c627-4aff-a0d3-33fa4df286a5", "comment": "Malware payload (AgentTesla)", "value": "e2edac1feec6b447dedfcc0f4927788c4ad4f074", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288597, "uuid": "52ac0ce6-77fc-4a2d-83a8-acf65c464cdd", "comment": "Malware payload (AgentTesla)", "value": "4b24538d969c133a2cee11f3c2ede0cad677c2338db76bf26e88d3b560722894536e69c03a21db851e97342e67be8d35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288597, "uuid": "43add82d-4283-4875-9906-3ba45547e493", "value": "T1EA45ED9D321072DFC857C0729EA82D64EA64787A531B4207B06F22AEEF5C997CF150F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288597, "uuid": "f981e092-2542-4d69-99a4-4cbc42f721a9", "value": "384:G/053WwsXhShnHl+JtBU9wE6GNv7SCqySzT54srkGj+/PSd835srXSM:o0IP2nF+JtC9T9FSCqySJXQO+/EdrXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690288597, "uuid": "1e5bc2db-561a-491c-b445-baa596f6f486", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690288597, "uuid": "76d47967-ce66-4631-bc1f-514f1e35ddbe", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288597, "uuid": "799d88ff-23d1-4f7a-bd1a-bd0f2b4eccba", "value": "PO-image5329_1.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc4da2f-2b37-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690322672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322672, "uuid": "ab295e3a-c9a2-4078-9e27-bfb73e47f658", "comment": "Malware payload (Mirai)", "value": "a148399e000a1b8f47f580b3983f2ec7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322672, "uuid": "0a1f6fce-e5a3-4068-84e2-6ff9248a94ac", "comment": "Malware payload (Mirai)", "value": "9fbd4dc33cbab9da7e999634c0ef500c68433467087b29d0e6cf693557935c32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322672, "uuid": "47266f09-a5ff-4a8d-beea-89fdfa2d937f", "comment": "Malware payload (Mirai)", "value": "98f59b41b97ad5e06c2a4e4050dc31bb35935920", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322672, "uuid": "088d5233-bd4b-477a-a938-99be25e12961", "comment": "Malware payload (Mirai)", "value": "b4bb7e026681bd8fffde34cd2bb9999d9bf1ee4aac1a7ba610b8041a008c0c8e5a2f570b5f01513a89fbc12874ce8730", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322672, "uuid": "5d989969-5e39-4c99-8edf-825eb29779f5", "value": "T176D2E121D21820B6C2902577C95DE2A68B1F5DF0C5D2717FB31487B9AF96C14BEF82E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322672, "uuid": "c68fbaad-be04-4ee5-880a-e3ec047cbb6f", "value": "768:n9b0aSk60E3xO1FI+jBkyItAwzIRnJ6/tNJkHPOpSIa1iv83UO7:DSknEhsFI+jWyItN+nJoNJkWcW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690322672, "uuid": "b8a31a1c-88b2-4b8c-a55c-70883b47e104", "value": 30260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690322672, "uuid": "17e950f2-dfe0-4414-ab4f-9d4351a22dbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322672, "uuid": "01c69433-a2f7-45b6-ade2-d44a9ed668f7", "value": "a148399e000a1b8f47f580b3983f2ec7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc57f567-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690267939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267939, "uuid": "8322a6b8-c56d-40c4-bb28-3c4c08622120", "comment": "Malware payload (Amadey)", "value": "74d28c0a9041b55fb468b9506e43ea8b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267939, "uuid": "dd532ba6-41af-4c1d-afe6-2b78cc71e6d3", "comment": "Malware payload (Amadey)", "value": "9feb147c5b1a2ddf4344295ebdb3b874b265dc2f218012fff199fae03b34aa64", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267939, "uuid": "b10b1246-45c2-46bf-b007-592738e1ac92", "comment": "Malware payload (Amadey)", "value": "b1f84d694b134e89e2790395b12a8569e4aa156e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267939, "uuid": "d5d689db-df11-4fde-8512-213ed47ad571", "comment": "Malware payload (Amadey)", "value": "294fdbc575c5d6bf553d435d7e5b156f8b43ab9c14554b260c3d289937538726b501b259172e5e41449a0fa8688b9aad", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267939, "uuid": "983324ea-48fa-422a-bf61-bc346f48f3d4", "value": "T128840112ABD88533D8F52BB05CFA07C30A3A7CA19D74C26B2356E95D0C726C5A1727B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267939, "uuid": "e8cc58f8-f254-43f1-9c98-b5f9d56c7a9d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267939, "uuid": "a65271b4-e63b-48b4-9911-4f944d7cdf78", "value": "6144:Kwy+bnr+hp0yN90QEjYvDju5aOMnEu6yXe7CliBR7CAJr7qJpeDad34Du4ss:MMrNy90wKa56yO7CQJCfp6aFIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267939, "uuid": "fbaa53f1-cfc9-4ea8-94bd-34eecc1d093f", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267939, "uuid": "476b601b-f9dd-4765-98ed-64d0e20c4b81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267939, "uuid": "81b73a19-1176-465e-be5c-194a6fef9eba", "value": "74d28c0a9041b55fb468b9506e43ea8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0086db-2ab4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690266512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690266512, "uuid": "eb63df18-12f3-4df4-b394-ad339bbeed1e", "comment": "Malware payload (Formbook)", "value": "69d9d64735ed1e0b944f13f76039f88c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690266512, "uuid": "a7c8d300-41e6-43d6-b1d6-4f35ca5c1974", "comment": "Malware payload (Formbook)", "value": "a03b8ae8131346298ef50cbd942d49bd024b8ac225467f960682600fc8ec1df4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690266512, "uuid": "ec992445-363c-4899-bfb8-76bcf3ee0264", "comment": "Malware payload (Formbook)", "value": "3ef863e4b67c17f80b60cfbbab4b9e35cc8e72f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690266512, "uuid": "450d9458-c8d3-4063-9b96-0b33cd617a17", "comment": "Malware payload (Formbook)", "value": "49d420c6bc311fb6ca3cbe77eeced10abffbd49ea237a91a82a3b8f83613a6b422f5ae703f93f63a79d1e02d96d691e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690266512, "uuid": "f7106055-0b7f-43b7-9890-ce47bfd33895", "value": "T176C423042F7D9B57E9FFABB8086658C18AF1F9263E21DA061D4070FB166A71C07D291F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690266512, "uuid": "fa84f359-5874-49f2-99b0-1b6581be437f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690266512, "uuid": "d9122dd9-3e18-4d17-a8b8-e494eddb92f5", "value": "12288:cFqOf6/zrkBHsKanqgMx0HppO7fxTUApj2H/8vMR:FMOzgpRgMOfOlMHUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690266512, "uuid": "d89d921d-7a7f-48ae-8f39-f335c83adb73", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690266512, "uuid": "51f1f93c-0270-4a60-8cd4-d2e5ccefebf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690266512, "uuid": "0ad88404-aa61-48e5-8df3-5c5e3731c883", "value": "SecuriteInfo.com.Win32.PWSX-gen.13195.29257", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7e40bd-2abc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1690270011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270011, "uuid": "e71e7fec-f7f2-478b-92de-e8c74afc3cfc", "comment": "Malware payload (IcedID)", "value": "6ce6b8752f3c6d8655b0b05b1bec282f", "object_relation": "md5", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270011, "uuid": "65848ff5-6412-48d8-a8ba-183ed173b064", "comment": "Malware payload (IcedID)", "value": "a07a7e40ff88008ef3a3150aa45733e2ca380508c1165ec75fc2bf52cc9a9d3c", "object_relation": "sha256", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270011, "uuid": "3e34a97a-f390-4e90-9f54-3ce502d12535", "comment": "Malware payload (IcedID)", "value": "59c7dfb8fe3e29c0e4398ddf9d3a46905e61e893", "object_relation": "sha1", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270011, "uuid": "0046b6b6-66da-4140-b5e3-b10bd3f84496", "comment": "Malware payload (IcedID)", "value": "4e26de6824051b38a4a60c2da7aeb2ae57d97b90262ead99f79c78a3b3fc1a398e90c1b62351051714015937b3a76c1a", "object_relation": "sha3-384", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270011, "uuid": "59b50ee4-b4f4-4da5-adab-fceb1d1962d8", "value": "T1ECA426C6BA56F8F9CBF3C076E45123363D0DF9D144A09E724761C3BA6C24818A86EDB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270011, "uuid": "34106ec6-8eee-4f8b-a1af-69c0d038254e", "value": "06f25df4360c0ab9ee30cbac816de0f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270011, "uuid": "a4354fce-6404-4201-ad91-ba29fc27f2a1", "value": "6144:5Wuz1M1ukesfTqAYVTuFOBTfh3SVOFJzlBSFHds79zAADpgSHK6Bdungc:53zOukBCiFel3tFJz6DeDpgSHKUMnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270011, "uuid": "96ec0fc0-efa7-43e2-9ced-b07ebd2ffa61", "value": 458416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270011, "uuid": "80be0935-ab9d-4158-b5f8-630dd31f564b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270011, "uuid": "a617b533-2d4e-40bf-837d-8d6566333a56", "value": "INV-Details-JUL2023(179).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5800a963-2b45-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690328732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328732, "uuid": "a88d3cb3-0e70-4e5a-affb-a0d20438d50a", "comment": "Malware payload (RedLineStealer)", "value": "820211ed4c6cd34d4dc34bfbb0d95f63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328732, "uuid": "40ce931d-4218-4655-b85f-4801f2eefab3", "comment": "Malware payload (RedLineStealer)", "value": "a122596a1b2fdb48c8bcc238c55830c0aa24d2960aa4f2928409346d490c0a51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328732, "uuid": "cf20d909-5782-4066-85e2-dd8a45067326", "comment": "Malware payload (RedLineStealer)", "value": "aea04cc000967d0b24712615cb091e48169398f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328732, "uuid": "8ad7fed0-1b8b-4886-ac06-8c3d2d23c19c", "comment": "Malware payload (RedLineStealer)", "value": "49b87992d07aa8bc941a7c1ab91e31af3348bcba6881c636d8f8034dd113c0ad250aa6060a0a0607094acbc393cfc7c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328732, "uuid": "e4627391-0e40-4b12-bac9-4c2b09b440ce", "value": "T13E840212F7E58433E8B51B705CF603930B36BCA1A974836B27A9985E0DB36D1A47137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328732, "uuid": "1e90f587-1e29-4459-b669-c36de6e5c445", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328732, "uuid": "0ea2368e-b175-4f99-9755-9b310ee854dd", "value": "6144:Kiy+bnr+Ip0yN90QEMHU0tasTj5gVL+KGpXUUZY118NUWdNZ4domqxjxZyNmAA:qMrAy90WTj5gVUU1A/kCjxAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690328732, "uuid": "ffb4c1f0-7744-463c-a54c-fa42ab6a0f25", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690328732, "uuid": "d5bbaca1-094d-425f-a6be-7208b029f4d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328732, "uuid": "fee463e0-05cd-4b1f-8781-7898b4012bb1", "value": "820211ed4c6cd34d4dc34bfbb0d95f63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ffeaca-2a81-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1690244487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690244487, "uuid": "6f2f219f-38b9-4bd5-9318-2f08a5d7d7ed", "comment": "Malware payload (RecordBreaker)", "value": "decb6b072792c51317a6cf0eb3901a20", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4545", "colour": "#2247E6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690244487, "uuid": "14e87d04-c0fe-42a0-b7f1-44690b74aaae", "comment": "Malware payload (RecordBreaker)", "value": "a131311155f5e2dfb80163fa8ce7111606a64fad47b7ed19d0bfb765000b4bbe", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4545", "colour": "#2247E6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690244487, "uuid": "e2012aed-2c05-46bc-8e22-d0303a93f5d4", "comment": "Malware payload (RecordBreaker)", "value": "5ed7e8dc2ee1ab2e5908505d295820e99cb2cc42", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4545", "colour": "#2247E6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690244487, "uuid": "a4f9bb06-754e-4d33-b37b-fcf92eada357", "comment": "Malware payload (RecordBreaker)", "value": "0b7e085d5b617d28135e62558e2cfbd3e04266ce2d5d2c4c16d7f3864e09355b601b22c31778af1178982ea85836249b", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-4545", "colour": "#2247E6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690244487, "uuid": "18fa3b47-38bf-4665-9c65-dd25bff61c98", "value": "T1C337333BCE5EE650B0A9498D3AD429C274FA04758AE5F3D8709767F2A8EB4145BDCF00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690244487, "uuid": "78107955-3ad9-4c74-ad66-ffe9fac58f96", "value": "393216:M8zMDQ97wtr+6QsO42WDu4Z0rNyo4W52+zKGJGD3jYrf1aTHkII:dzcwstr+F42WDu4ZmqzMrf1aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690244487, "uuid": "4b76b37c-0590-4d27-9c3f-845b6012120d", "value": 22716094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690244487, "uuid": "e173d3c4-d62c-48da-802a-38c9309b5278", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690244487, "uuid": "80298fe1-0fe6-4148-9564-2afb31e818f1", "value": "!T@-#Setup-Pa$SW0rd-4545.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cdf271f-2abe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690270704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270704, "uuid": "7a825441-eb69-4a65-bbc8-185dd812e0fb", "comment": "Malware payload (Loki)", "value": "a29883088acbdc4ab6efb24d23259487", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270704, "uuid": "b0c97c37-7c17-4520-881d-bf135b112d4f", "comment": "Malware payload (Loki)", "value": "a1cefc6f00b214c8d1e9c99f37f8a60e832066e768f5bddbec23e880e9a2a283", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270704, "uuid": "a79a84ba-e362-44b0-ba3c-767d27aea908", "comment": "Malware payload (Loki)", "value": "22eb9d650fd36de257a78a10752131d1f08eb785", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270704, "uuid": "b108db3d-f737-45ae-a720-48d2fff4b820", "comment": "Malware payload (Loki)", "value": "075b8f1984d47f897d18aa645bdd290a7f44649ddeb8e26091ceb01e44fe986ff85f6a7cb048360badd9c53f255ff2a7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270704, "uuid": "c9a5e1c9-b7a1-4791-b3ba-2e4fc156b4a0", "value": "T141C423EF460020D38BDF6C6839DC61A277E5E65DA35B45E476326F0A321E9C1B40D3BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270704, "uuid": "a5fce22f-74c2-473f-9737-fb589e406f6b", "value": "12288:opz3A/ba5eZEV/4wzhcqpzvak8JInYbp77kOUU0OnvkLiE5kqc0CBPAJgV2aX:8YueKF4wrp+kB2pD0M0ADZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270704, "uuid": "ae1cb45e-94f0-4ab4-833e-efc8b2b255be", "value": 549567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270704, "uuid": "d3aab6fe-836f-44d2-8461-3bf78e9cc5ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270704, "uuid": "c55472e5-da49-41d7-b3ee-72b65cb0f543", "value": "PO#13046.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9fd749-2ad5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690280556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280556, "uuid": "095f4f9b-c2ba-4af6-8b30-c0783f781ec0", "comment": "Malware payload (Amadey)", "value": "d4890ddadb9a81c4438a8e501d11e48a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280556, "uuid": "df51a2fe-59b0-4cad-a9cc-40aa18446220", "comment": "Malware payload (Amadey)", "value": "a256bcd911bd466bc24fa94bc1a6b02ebe1a4072461c9492d109bfd1a6159d6a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280556, "uuid": "aa2d0c9f-464b-4e13-be95-14f5d086d081", "comment": "Malware payload (Amadey)", "value": "bb7715adfb42ddae5a7a91ae8f265df9e099080f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280556, "uuid": "2b6b838e-951f-40c7-8f81-f2e58cae07df", "comment": "Malware payload (Amadey)", "value": "761b4c422eac6e62f0f8c42ef505af0eb321fffff15e6a30840e0afd967a92dd516ed4cda7320542b62dbe2bba03c212", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280556, "uuid": "c9d3e9ac-52e1-4f73-a84a-7fbbec0ae52f", "value": "T1092408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280556, "uuid": "2f30ce9e-6dbc-4c28-9611-54acf14465b6", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280556, "uuid": "441a64a4-d8b8-4ca3-940e-eeb3499bff06", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280556, "uuid": "fcf5c54c-1820-4049-94a7-0d032eeae1f1", "value": 229457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280556, "uuid": "e1791f6c-4165-472a-bcce-215de291e61f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280556, "uuid": "399957e7-a80d-4ab1-8cb2-830c4db27d8f", "value": "d4890ddadb9a81c4438a8e501d11e48a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645192ad-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690296970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296970, "uuid": "7066e732-62e7-4984-b217-e89f4a907e8c", "comment": "Malware payload (AveMariaRAT)", "value": "10ddbf5dbed45aaabc4e3dd62cf344a9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296970, "uuid": "d9e975b6-7164-44fa-be00-26f47af744cf", "comment": "Malware payload (AveMariaRAT)", "value": "a353487493238df8b80d02160ce8ab8391e99e228fb9403082c732f7c5e2a639", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296970, "uuid": "d1018584-fb95-4fa5-9aaa-5b91816f4252", "comment": "Malware payload (AveMariaRAT)", "value": "dfc62c2d93a32a3061f8eb0c76caf5ac04675b2c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296970, "uuid": "35332704-5f3b-4704-9c3b-173f7e123137", "comment": "Malware payload (AveMariaRAT)", "value": "7cd545399527289ef88f93e32b73e62eb50f064aa6121428e573bfdcacfc1fd9a32245fbf53aeb0f0bde41155b65778c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296970, "uuid": "1409911e-8cbd-415b-9fff-8e140fff1fda", "value": "T17375F119B190483BD063597CAC0693D9D56EFE613B21EC49BEF42C9C6F38A717C2624B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296970, "uuid": "60494ec9-964d-44f0-b293-540bc997a76d", "value": "ea8d56a6b9f4ce307f716636038657d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296970, "uuid": "3037eeb9-3e15-4072-93be-912113a499ba", "value": "24576:hbGHGrOrQ9gnMC6LO3cQoikKgti8PM2MCUrTDLwVIf2IOXkDtZ3NptsfbJZX3:hbGWAJeDingti8P+TwSNO0n9vCbJZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296970, "uuid": "fd8db980-a2c1-4e98-a8a2-ebcaaf2d9a5e", "value": 1670656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296970, "uuid": "9a00f1e3-6357-40b5-a2ef-570ce6ad468e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296970, "uuid": "3cfbee65-9dfa-4afc-9a72-459650fbf147", "value": "RFQ IBUMIE BVNGEN61523 dt.25-7-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101a0c37-2aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690258603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258603, "uuid": "d1cadbb6-2041-4953-a4e4-92b0f09fd2cd", "comment": "Malware payload (RedLineStealer)", "value": "92899ca104e6ac22954956977522eebb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258603, "uuid": "d30595e8-05f9-4991-9462-0ea2efb51240", "comment": "Malware payload (RedLineStealer)", "value": "a3a5623bd0649f324b19c882ff48f76fe7aa674352d2f470ed35313cfb7ea92a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258603, "uuid": "834b6e74-4885-44c4-b088-0c52889d4b55", "comment": "Malware payload (RedLineStealer)", "value": "89eabd97ea7285f1038a6966194bbea1b97a97b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258603, "uuid": "cbfc5424-dd89-4833-8f4e-cf35a01ab5f6", "comment": "Malware payload (RedLineStealer)", "value": "0c375a5dd126adac23b186db4cef3cc5ebb4b75e59059a4998241d203aee00d80a190559975be94bcabe3c46fea4ccba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258603, "uuid": "3f8aef60-6ef4-422e-93e3-50ef6e67342a", "value": "T183A544841FB30452BC308667C8D3741AED2EEAB7C45866A62655B31CCE23FC86B7D61D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258603, "uuid": "b1de19f6-f033-4566-aa84-a0050313c346", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258603, "uuid": "bb76e1cd-be27-48a9-98e3-91db913e0e8d", "value": "6144:39/bSahcEmWfxHd4zIlry42KrdABnd7gYbShZWCFK:oahwWf34wrNrSBd0CShZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258603, "uuid": "3b58cd19-4d76-48a9-b740-714cbb436051", "value": 2246144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258603, "uuid": "8ea9e4a3-ebda-4869-8c8d-67be116a2b7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258603, "uuid": "8789f320-3bac-4d0e-8f4d-ee73f91626ae", "value": "92899ca104e6ac22954956977522eebb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8452463-2ad0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690278723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278723, "uuid": "6700fb6a-b351-4680-a910-5c3b3dcfda67", "comment": "Malware payload (RedLineStealer)", "value": "579078c497c0a9222edab1b01ebd2d13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278723, "uuid": "56b3c5be-74a4-4b42-b4f8-9186ffba2902", "comment": "Malware payload (RedLineStealer)", "value": "a4af4c5d30929565eff40599db8115b2fc68016d371924fdaab3b9d0ea4a7ef3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278723, "uuid": "ed3f753a-88c5-4b4e-bb1c-2c4585838b93", "comment": "Malware payload (RedLineStealer)", "value": "aa5a8ff03d3f5228e94f9dafb23e70c12d03b907", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278723, "uuid": "fe4bfec0-e47b-487b-80a0-fb3fe6dbabed", "comment": "Malware payload (RedLineStealer)", "value": "385193784d194fba1d5c74e93d48226f79a56e0ea3b6ee05e1af371ab01c39a981b659d6ce31168b5be9dabb68fd9d9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690278723, "uuid": "dc5d34b3-87e6-4a84-aa88-0f8c2af9fdc6", "value": "T1F1840213A7D89073D5B567B018FA02C31B36BCB18D39936B3285A95E0DB3784A53277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690278723, "uuid": "d0ec6d66-68fc-4030-bba0-6014d7d94c01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690278723, "uuid": "e125c63c-b66d-4fa8-bb7e-627e9679a002", "value": "6144:Kvy+bnr+cp0yN90QEWNVgSGK+9gZMfLFvHnHjHNm0mfNuRY51rVr:VMrQy90QNYKPMxHnDHjW1rp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690278723, "uuid": "f2f86e65-0ee0-4ed2-b126-b36426b17d7a", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690278723, "uuid": "7716e321-9606-4c9a-878d-c43ef934febd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690278723, "uuid": "4aecca4b-edb2-4b2e-b088-b4ba1167ec97", "value": "579078c497c0a9222edab1b01ebd2d13.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace4c1ee-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690308688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308688, "uuid": "7c2c23ef-f393-4a8a-85d1-d34ad7507d8a", "comment": "Malware payload (SnakeKeylogger)", "value": "7cc7ab3986748b1ad8c8ca64f5bbdba3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308688, "uuid": "82643e40-f131-46a1-8de4-322ccbb459f7", "comment": "Malware payload (SnakeKeylogger)", "value": "a572db3e3faa3e4ec6f6df3460267b074b0ed24ddaeb80a84f2b839e136e1066", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308688, "uuid": "6abda9d2-4546-4f10-8286-5f1218319cee", "comment": "Malware payload (SnakeKeylogger)", "value": "9cb59e395f7a987db6832b2760ece2d09254331c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308688, "uuid": "e638a94a-789d-4649-8f3f-b5b4c162e466", "comment": "Malware payload (SnakeKeylogger)", "value": "fa6ef50c81727eefbe1be5a2278f2721c3fc34efac96fb9c50e1105c502cac4da1856dd1bf1586da8ab86df628dac428", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308688, "uuid": "577081c2-9817-4fb3-a78d-12c39ccccc92", "value": "T12FA2D406B6DE5335C249DB3BD767818103609E0258B3C75F7B4E13075872BABDA4BA8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308688, "uuid": "966990f9-a99d-49cd-8281-2112a72c9fa2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308688, "uuid": "48647618-c8d2-4e3c-95fb-266f249c1b79", "value": "384:T3K3YoRIr5alzViGpoYSm0vE5kYC5Gh5B:uIdFalp5BSq5kF5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308688, "uuid": "6587de6d-da3c-4603-94fc-3ebea7f74277", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308688, "uuid": "47b135b2-0923-473c-972c-2134a4341d45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308688, "uuid": "69eaf535-50fb-4144-85ad-a53341bb6acd", "value": "Oowypt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e48208-2aeb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690290211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290211, "uuid": "91346a6b-a6bd-4780-a2a8-0e7b464fbb47", "comment": "Malware payload (RedLineStealer)", "value": "55ef83b99d92d4897d91dbbfd8d6421e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290211, "uuid": "2a0d73c1-026e-47d9-9af5-c364bdd0a370", "comment": "Malware payload (RedLineStealer)", "value": "a60ffc54f3bcf15614ce6d47429fe56911155d86de572b49f4790744e043575f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290211, "uuid": "f68df3ce-de55-4d00-aae5-98a1a2a9c9d2", "comment": "Malware payload (RedLineStealer)", "value": "cb30f81e3bb57c2112bfddbdc27e581488cf126b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290211, "uuid": "13f210a6-9e55-4517-b3c7-f04e8a926edc", "comment": "Malware payload (RedLineStealer)", "value": "be5c7ee4ebaeda8372fde3ad9d5bfa0b924fdb09688114eb3290b7b0f75a46304ab21f80f294c928e583bf4f1c65a619", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290211, "uuid": "8a7a3127-3c12-4831-9f6f-f1e7f4e8053a", "value": "T11A840253B3E85173D9F12BB458F602D30B357DB19978872F334AA98E0CB2581A63537A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290211, "uuid": "6fb34cae-bb19-487a-a7f0-7583621b1056", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290211, "uuid": "cb121404-6593-4962-8818-9b6d356ff89d", "value": "6144:Kfy+bnr+zp0yN90QES4AmorYxg5bH0aXsj6t91NKCZXgKIkGqq0iWt:NMrby90sBVY+5o2H/VjGqdlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290211, "uuid": "0407a895-1a3d-4d95-b841-e3c77080a2a7", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290211, "uuid": "f2b51a47-5916-4e91-9570-203bce3e928b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290211, "uuid": "3b60afd7-9736-47a9-9d8b-a38a9ec1d8e4", "value": "55ef83b99d92d4897d91dbbfd8d6421e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1b536e-2abe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690270812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270812, "uuid": "710d5efa-d65c-4182-b406-4a497b8c2307", "comment": "Malware payload (AgentTesla)", "value": "3af6109a71ef6b916ec1af7125dbbbbd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270812, "uuid": "28efba10-9e1b-484b-a413-dc2ebd5769fe", "comment": "Malware payload (AgentTesla)", "value": "a641e8bafd27fb1423a65ca1a22338297173deeb3fab7931a36383f317221b95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270812, "uuid": "1aeed93d-b3f4-4429-9ba1-51072b7fe580", "comment": "Malware payload (AgentTesla)", "value": "90c1d93bee95c3ed78f2cfcdaf7da1a0ada09599", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270812, "uuid": "942693bd-38c1-4064-b9af-8256e2465007", "comment": "Malware payload (AgentTesla)", "value": "39c4a69c07a4d1d6eeb2349de847b706748e7f8e46108a6839648ca5d62bfa2755152ea9db45aea8c8b4ab628efbd2de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270812, "uuid": "8073098b-22cc-4282-b4f8-cbe01a051e43", "value": "T199C4231077AC9F96E7FA8BB468A249AA03B3FC7B2614DB2E3D4550DE034570047A357B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270812, "uuid": "942ce887-e92e-49c3-ba4b-465c5a2a6000", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270812, "uuid": "d2e492ce-b9f8-461f-99c3-da2975189bb8", "value": "12288:nF0lPmV1Jriz59YY0XTZ0lGCIgJ7890xjMo9Pjof7qOf6/zrkBH6R:Gpmxs59iYtIy789/o9MfOMOzgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270812, "uuid": "ea27e436-239a-42a7-abdd-a9abe85c567b", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270812, "uuid": "b2fe0b9a-a433-4947-b768-ea739a9c0aa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270812, "uuid": "7c918016-73b4-4dfd-a737-bcdf53a330bd", "value": "Remittance Appilication form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8cade2b-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690267879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267879, "uuid": "f7e4c89d-47d2-4c0b-a2be-e8174402837f", "comment": "Malware payload (RedLineStealer)", "value": "23a248dca75b1279af17ec20c3fef9f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267879, "uuid": "1b6d8b23-4579-417a-be8c-cc9cf1d4e0ab", "comment": "Malware payload (RedLineStealer)", "value": "a65bbeacb8d8b1c313b78f6a2271c7d422e9a24d1fec755609559f09d7a45cc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267879, "uuid": "d49cb7f2-1a43-4948-aedf-88433c362881", "comment": "Malware payload (RedLineStealer)", "value": "f995a5611bbbc51895272aec815446ceb5610330", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267879, "uuid": "b46783af-e395-4e3a-a97d-a7b88fc0c0f2", "comment": "Malware payload (RedLineStealer)", "value": "013cfb2dfc2a14def76bf1c2a0de68affdc2e970022af91d0ac742f63bb9ab220b803c01edb4f2ef2b22fdd1bbb3d94d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267879, "uuid": "7e6b716d-4484-462d-9ce6-6a087a1262c5", "value": "T149B41242EBDC8436ED752BB05DFA03830B32BCA15979876B2385AD4B0C722D5753277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267879, "uuid": "6effe5b0-623e-4784-9def-fdedc05dad78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267879, "uuid": "feb4bca7-ee53-466f-a07d-c9a8742eb5d8", "value": "12288:kMrVy90Ao09aObTBf4wGgINuTUfWZ9to9rLinIOhJQ8q:xyeiTBLGduTMWZ9to9rL+pdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267879, "uuid": "2a161343-def4-42d3-833e-d785378fda84", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267879, "uuid": "ee124337-6f8e-4f58-91e3-a81b85c17b71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267879, "uuid": "9de0a437-62c3-4b16-98f1-daf52a574810", "value": "23a248dca75b1279af17ec20c3fef9f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584322ae-2af3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690293514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690293514, "uuid": "3b01c4c4-6f62-4088-94cc-46081eba9221", "comment": "Malware payload (GuLoader)", "value": "db891aecc32f2fde30f77e91b3c16c7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690293514, "uuid": "6e59b185-2db1-4008-bfd7-577014a22a22", "comment": "Malware payload (GuLoader)", "value": "a65d60a0e83a78f2a7c81f0b867a727dccdaafc47485e7c5196563d9dcfe6328", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690293514, "uuid": "6d36811c-1c60-4b1f-b62b-c43e8eb4c9a2", "comment": "Malware payload (GuLoader)", "value": "d3530ca6a23dfef0bc21669b8eec294d39f43b7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690293514, "uuid": "ba792a47-3a37-4c05-bfa9-273f1de30a17", "comment": "Malware payload (GuLoader)", "value": "3f791a226e05d71d7f6c36b2f0e7fdcef9fe64adc018a9e6937a745574d16947018918fed2aa9119ae7d2e87a0cb37b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690293514, "uuid": "ab091c5f-e397-4174-88c7-4f32aa3e7d2e", "value": "T1658412A1B922C1ABC65142B12832D9BB6FE39F15D9580F1B63493F4F793C7D2848F612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690293514, "uuid": "9ee884e4-3352-464d-ac66-e64d03053f7d", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690293514, "uuid": "9946ec7f-9b4a-466d-9647-2ffbda5f545d", "value": "6144:zMm4CC4ksM11D7OZirD3UHQlOGCIiX4S3kBg9FrOnIJw1HTnpO/unR4dj:zMwxks01OssGCIiISUBg9wV7k/6RYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690293514, "uuid": "e16410c1-d07d-4bb7-b31d-f02ee3b86343", "value": 384420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690293514, "uuid": "35c76ae1-6c95-4476-8a3e-23a70c23126d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690293514, "uuid": "c2fcc179-ce6e-48f5-8d22-871f272d0645", "value": "Pagos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39634360-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690290455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290455, "uuid": "6162623a-c79d-470b-98c6-c8ac6f2da14b", "comment": "Malware payload (RedLineStealer)", "value": "d1436ca71d812255b290bf1d0ba2891e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290455, "uuid": "b38de607-8271-483c-aec2-6e8bf9a88d16", "comment": "Malware payload (RedLineStealer)", "value": "a69906e9f9d47783ac47a69e24f0c3e19a495afe5ee2eee160b5d654d99abee6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290455, "uuid": "2be0cf49-cfeb-45e9-bbc2-e0f6e504e5ee", "comment": "Malware payload (RedLineStealer)", "value": "eb0965932956292653d49a48bc1862baf60b5166", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290455, "uuid": "c8022b52-eef1-4ec0-ae9c-b2f6cda0394e", "comment": "Malware payload (RedLineStealer)", "value": "4382f552aab8582c237c8a5d22300095df6237bd650020061fed5a73d7d9bcd9b150fe491d2db23a994546213b4ca35c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290455, "uuid": "68548371-a406-4319-bbf0-ff7997f32af4", "value": "T134B40207AAE88576D9B6277058F702D71F36BCA05E34925A3789B91F0CB25D0293273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290455, "uuid": "a7534b7e-e9f6-4b97-a802-e78f7e607b5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290455, "uuid": "64f3079a-b9a6-4a9d-ab33-c529db77147f", "value": "12288:LMr+y900H5gf2YQNatZ2rG5DhOlCC+535r:ZyjR2tAiHECCUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290455, "uuid": "a5f85c55-652e-42b3-9a30-24b415b0a57d", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290455, "uuid": "3e32fa50-1dcb-434f-8759-c7e34324c4f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290455, "uuid": "8e9a0185-b9b5-4b72-9347-91eb9da4055f", "value": "d1436ca71d812255b290bf1d0ba2891e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b0a2c9-2a81-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690244540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690244540, "uuid": "47516a14-1f0d-412c-b277-3204c21f4a83", "comment": "Malware payload (Formbook)", "value": "e4627eb3505310c570be11e513dd5b25", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690244540, "uuid": "40b96226-4169-47b5-a5c0-4aee64065e44", "comment": "Malware payload (Formbook)", "value": "a70d966b7185e677a6eb170d4904502b44a0bc97f0b51398c77d9151ff3a7ed5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690244540, "uuid": "46d8bf0c-dba5-450c-8b0b-a1f80384c66d", "comment": "Malware payload (Formbook)", "value": "da1d68fae64851044bf2fbcbd69ca5b9c86811aa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690244540, "uuid": "b20af2c5-a087-42ea-b2ee-fe4241eebf96", "comment": "Malware payload (Formbook)", "value": "8835ace1f1dfa86fde275a67f7091dcd5d64739ff01f1bd1bdfb9d3c3069ff5abd83918184608f6faa1bc6624a32c3d4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690244540, "uuid": "0dcf2005-cdf1-4df1-a589-2b460ef72588", "value": "T1F044971059DB658CB1733F675BAEB6A90F6BF6A21B3B915D2404030B9B53E04CF91B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690244540, "uuid": "2a68d2a3-60f6-4791-b7a7-7bc1d5410f14", "value": "6144:pN++++dN++++uN++++RN++++sN++++QN++++ON++++0N++++EN++++XN++++UN+u:pN++++dN++++uN++++RN++++sN++++Q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690244540, "uuid": "2646724a-6225-4027-bc63-f997988c09d2", "value": 260724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690244540, "uuid": "6edbaaf9-d8e8-4f26-a3ad-cf34cb7c5bb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690244540, "uuid": "b3e51906-264d-4a7a-85b0-129ba291e46a", "value": "d41ef25166336ce39207e4581f37d0058ce6e5e6412b6d9fc3d3d5ac2dbfa039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35d7b6f-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690282097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282097, "uuid": "e0715fa7-a6f9-4bc0-bb48-be7ba0247bea", "comment": "Malware payload (DarkCloud)", "value": "603d856398611228f191bc13e0d438c2", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282097, "uuid": "d2bd2e24-c1b3-4f50-9dd0-9e5cdab077d7", "comment": "Malware payload (DarkCloud)", "value": "a71b0b0e0e49841af019b02c4d50194c0aa55b768fb0dcd3d7e0fdc461b02122", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282097, "uuid": "04dabdc2-68b8-4c78-9cb5-af37100e4a74", "comment": "Malware payload (DarkCloud)", "value": "2e91ee613282e4b82d1895486050bc5bc474d8a0", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282097, "uuid": "771a65b7-c916-419b-bd59-c76bbf4aa65d", "comment": "Malware payload (DarkCloud)", "value": "319588cc0802b4dae8c77faa5a5c2dbbda89ab75cc146dd684c5ed0dbcef91e8f4df59b21c292bb8d38e8bdbc06229d8", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282097, "uuid": "f531c05c-22a6-43e5-aaeb-62185a0ddbe8", "value": "T1BFA40826E660602EF093C8F0E6E5A2676814BD771288A817F3915F4931365F7B8F172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282097, "uuid": "d06cacb3-4daf-4a3d-9a03-9983e51bd6a4", "value": "829c6527a0c555fb4836135cfd531918", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282097, "uuid": "62d4a5b9-e9ec-4b36-9219-1cc5a1e88808", "value": "12288:+aG88NqWx3CMj21piSU+FfUZ6DWnejYKkJj6GmZU:kNSTU+FfUZEugYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282097, "uuid": "6bfce72a-503f-4cfa-b98e-ceacfd8ff22e", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282097, "uuid": "0c02a4ab-eb88-41b6-a2d7-eb6c2ac2c03e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282097, "uuid": "1f4bd75f-9b60-4a63-b250-cfbf3659966c", "value": "a71b0b0e0e49841af019b02c4d50194c0aa55b768fb0dcd3d7e0fdc461b02122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c17c7e-2b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690307364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307364, "uuid": "b5b7e9db-9de0-4725-b3b4-df06267a91c2", "comment": "Malware payload (RemcosRAT)", "value": "7bdfa8d2916be007978a858a33f49c12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307364, "uuid": "686d918a-03cc-40fd-8703-fe9b47ff75c3", "comment": "Malware payload (RemcosRAT)", "value": "a780671fb8843df86eb6d9a17080a3dfe3caffc2a7ab3d19f5f60025f4e064bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307364, "uuid": "32dbdcf1-4235-4a32-97a9-85ae0410e0c7", "comment": "Malware payload (RemcosRAT)", "value": "fdda951b220ab4479edc836042195f322a39257b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307364, "uuid": "2d6f542d-2d8a-40e9-a213-e93c008a8d32", "comment": "Malware payload (RemcosRAT)", "value": "b963d88e5eb81776ad01582ccec64b4557cece778cefb87ad4e03f1b7c21c3eddad86471c033980819b193043f8a93ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307364, "uuid": "7fc17e46-6caf-47b7-a44b-c95656bf3545", "value": "T1ADA4BF02BAC1C072D57651300D2AF775DAF9BD20183A457BB3DA1D9BFD70190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307364, "uuid": "dd5dc840-0182-498b-b8e3-61405a4e6a73", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307364, "uuid": "b6d089fa-dbf8-4702-afc1-7089850ee1ce", "value": "12288:BRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/Zf2QDU:Bx7cyF2eSsewS8W47eZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307364, "uuid": "edf85df0-d350-41ee-b6c9-c8d8fba3d2a4", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307364, "uuid": "06ee3d7c-c024-4d0d-ac99-0839b22df2b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307364, "uuid": "a0a08205-48f3-476e-85c5-d459a16511d4", "value": "xJtYxySK09bP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0837683-2b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690307513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307513, "uuid": "79f75b5f-9527-4f3b-8c4d-b930eeb31fdf", "comment": "Malware payload (SnakeKeylogger)", "value": "362ce33879ae9cabeffde18bbf2ae40a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307513, "uuid": "55266f9a-73ff-406d-8816-0f41f3ea9288", "comment": "Malware payload (SnakeKeylogger)", "value": "a7a10aebe867812c0c19a5b092f9e29e5f1ec350a9f00f204f96a062a8dfddb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307513, "uuid": "f65a00b1-d7ca-4128-8b61-f3f1dc696b8f", "comment": "Malware payload (SnakeKeylogger)", "value": "7855429846709ba945c1760dbe07fc12bb660aaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307513, "uuid": "f97857cb-92b6-4b1c-a0c9-a91dbb4056b1", "comment": "Malware payload (SnakeKeylogger)", "value": "9a6a6138c821f0d3406762fe79e93219e311f6ec8b9d6e194a6087c4b1efdfcfad90591120636af220f03ef513e5ba13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307513, "uuid": "7859ef13-ad4a-4adf-ac58-72a4834c3ffc", "value": "T131F4F12136B8AF57C1BA93F88020723413F9AD9E7535E3096EC370DA6971F848A61F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307513, "uuid": "e9cc3185-5156-40d5-a36a-75cc36e7e4f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307513, "uuid": "8bca2668-faf2-4dd1-8fe5-fb637160cf45", "value": "12288:VfgETSnbYiIoFwIrG3XCCaEHsbHyDxr0SlsyfQ4VpwYNWgjceq1TJ:ZxebHIcTrGCSXDB3mj4IYNLjce8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307513, "uuid": "35703e9d-44d6-4fd9-8ac3-63d7b4cb725b", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307513, "uuid": "fd71d419-2d51-4fa7-9694-a9c29ffebd7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307513, "uuid": "01c3ff99-25b1-4be7-8c4e-7a110e48888d", "value": "Purcahse Order.pdf.z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d939df5b-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268819, "uuid": "01096dec-5c82-47d7-a926-7522f1b6522c", "comment": "Malware payload (Amadey)", "value": "cc2368022b9915a05b49c372257ddd5f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268819, "uuid": "fc8d3666-3a66-41ae-93e9-7d5d3eb8ddb5", "comment": "Malware payload (Amadey)", "value": "a855c20a42ce98c7a2d8350459a71d00fb7915500216f704d04bcf7b1e0c5be7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268819, "uuid": "e588d591-2b2f-4461-be5a-690ef23d4a54", "comment": "Malware payload (Amadey)", "value": "dffde2bb63c34c2dc8f392a6e4e04bde0acc3acd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268819, "uuid": "0e2fe4bb-ffef-44cd-99dd-540b6016615d", "comment": "Malware payload (Amadey)", "value": "581d486a23ecec1f3099203f07ca55dbd4a7ad5456dc1dc5919ae2688fbac0a83a3e81ac184e5f49e1898161179cf022", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268819, "uuid": "c770c753-0800-49e5-ad6c-9e7f2489fc31", "value": "T1922408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268819, "uuid": "2689a813-955a-4cb0-8eb9-c80bb54d6473", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268819, "uuid": "fca59a7f-50e3-4502-8073-b92aa8d55172", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268819, "uuid": "5c36ba23-7bda-40e9-b631-c4cd0146a9e6", "value": 229280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268819, "uuid": "7fe9b0d0-d570-4a52-a098-9ce9ec33b6de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268819, "uuid": "ab9cd8e9-565c-48dd-a6ab-d89a6f1e705c", "value": "cc2368022b9915a05b49c372257ddd5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17da36e-2b44-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690328426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328426, "uuid": "8b56d036-c0db-47c2-a267-9089d07559ed", "comment": "Malware payload (RedLineStealer)", "value": "e94ab0db47a163c452da0febd24f8ec2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328426, "uuid": "35530632-532d-4dfc-886c-1cb241836d9b", "comment": "Malware payload (RedLineStealer)", "value": "a85b8341d1594f4ec7d0aaf1cb367c0fe92ecd1914666107d1ed720d2bb7a1a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328426, "uuid": "95318d16-8103-4905-a10c-7d41e2234b2f", "comment": "Malware payload (RedLineStealer)", "value": "f7aefbf919980191ae03622274319b7e4cea8c00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328426, "uuid": "389b3175-edaf-4620-a6e2-145cb039081f", "comment": "Malware payload (RedLineStealer)", "value": "eb150cec3c0cb7479f427fe7c8231370c96fa328cc1458a79472ef9062c080858931d296fce34ddccfa8b51ec04d9d2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328426, "uuid": "93b598b2-2330-409e-b4ab-fa7ecf00388c", "value": "T1D5258C6078818071ECE320BA06EFF625456DE0F90F2A46C77AC767DED6246C06A377D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328426, "uuid": "d33ec703-545c-468e-873b-547ec5175eaa", "value": "804a3a181935154bc979712eeaeaaa91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328426, "uuid": "47d44901-21f1-48b7-901e-fb1893527e38", "value": "12288:l/iSVgls0dtzvB2ELOMw6IFntnskIP4PHLFksgOSlrRdNYf/NBuHtQR/WZFwd6xq:FzVglzdtzvB2E6LAWLFkW4rRofFtaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690328426, "uuid": "08fc8d82-3d42-4d98-bcc7-ed3411501298", "value": 1035264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690328426, "uuid": "2cbfabfb-8856-4a1e-8d9d-5d2012e00dcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328426, "uuid": "884f8d2b-aec4-4613-a892-8691ace2c44c", "value": "e94ab0db47a163c452da0febd24f8ec2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fe6afd-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690267881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267881, "uuid": "645bf7c0-e4b2-4a2c-b301-c4e76c9373c9", "comment": "Malware payload (Amadey)", "value": "440893c2f14fc87d90a4978b0508e4a9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267881, "uuid": "43f79660-4448-4690-b1c2-2331fb81fb76", "comment": "Malware payload (Amadey)", "value": "a87c6d3d255244029b2ecfbad316ab4d8b3053be29c7bcdc7dbdfe00b4d3a19c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267881, "uuid": "a2011bc2-360d-43aa-b584-98637f69c61e", "comment": "Malware payload (Amadey)", "value": "6a30a43ddfb7b8f0c1eaf62c5488b02e23596bbb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267881, "uuid": "b19e3353-d76f-4c93-82a7-a821cf975477", "comment": "Malware payload (Amadey)", "value": "59c77679606860ff34c7a5a2de8f0d936debde39444c41c8a2ddccadfe380f69ae350d44c09c418f0324a87275f86e33", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267881, "uuid": "fd30142e-dee8-4857-bca4-cb8d6a3a83f1", "value": "T114840102A7F98172D9B627F058F613D30B39BD624D7893672399985E0D73AD0E83076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267881, "uuid": "cfb22cf9-63d1-47f7-9f79-fcc11b73f73e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267881, "uuid": "ee167fff-8e47-4945-90d0-fd2b6f25d763", "value": "12288:aMrmy90qichmE6ixV26e+D0cM0s23kjoR:4ydic3dV26eVcMFakjoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267881, "uuid": "17f3c5f7-8688-41ca-a559-7a09e937936c", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267881, "uuid": "b5b0fb60-30ae-41bc-b4d9-6cc21254b70d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267881, "uuid": "d9173fc1-3018-4ad1-a6ae-dc3148cf8efc", "value": "440893c2f14fc87d90a4978b0508e4a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d95423-2ab6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690267416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267416, "uuid": "d9977dec-db43-4a17-ac19-6a9e27ca1e51", "comment": "Malware payload", "value": "84afa25c375c507992fca84a80feee6d", "object_relation": "md5", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "pw-999", "colour": "#5DEE89", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267416, "uuid": "67cbde44-ca1f-4c12-bb9f-8dc60bccacec", "comment": "Malware payload", "value": "a90bd1f97a15372c2df1c68bcfefc6999b0eb88100542f6ab42847a2062640ca", "object_relation": "sha256", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "pw-999", "colour": "#5DEE89", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267416, "uuid": "948920fc-3f38-4900-9001-34547e48d0d0", "comment": "Malware payload", "value": "6f77a8c3b456c81408df80e5e53487601cf4f571", "object_relation": "sha1", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "pw-999", "colour": "#5DEE89", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267416, "uuid": "d214ae37-b111-439b-9e13-926886a7f480", "comment": "Malware payload", "value": "8dafda5d3008bfa9a81fcd49aa67dc7d85f5d0913910713f3fe3dbc18380e262d01d5d722cf731480297b27f7b87e3f0", "object_relation": "sha3-384", "Tag": [ { "name": "GoogleAi", "colour": "#068399", "exportable": true, "hide_tag": false }, { "name": "pw-999", "colour": "#5DEE89", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267416, "uuid": "cf8961e1-474a-475f-8d48-be707af318af", "value": "T1674633BF93C6EE96B0BC08E430FB41751B869DAFDB12C057616D3720BA8C959857C827", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267416, "uuid": "131112bc-7475-4689-9e19-c36c84eb2d17", "value": "98304:jrPOx23hkfF3vfxhpdhk7RaYmgUr6oQxeQQm9OfqPI0Gt:PPOxihkZR/d65O7nqw0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267416, "uuid": "03e3cf3b-ac8e-4bf1-8480-90ab91aaa985", "value": 5687361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267416, "uuid": "6fb74c79-ed38-4936-aedf-337dd3310deb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267416, "uuid": "cf9551c6-38dc-4a26-9bb0-6971b4cd7dab", "value": "Setup-GoogleAI-13-7.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3988c39-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690273937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273937, "uuid": "9cb19998-2874-48d1-a149-276c440b6f9b", "comment": "Malware payload", "value": "bea4f9f93541056127d5059143fcd299", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273937, "uuid": "4dfd97cd-590b-462c-b09a-beb53a66d54d", "comment": "Malware payload", "value": "a93dd75ecfd3521250e54d3972d94d7c642ca950732ced89350303fe3efa1162", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273937, "uuid": "9dafbe40-c8f2-42ed-9839-56d634c00165", "comment": "Malware payload", "value": "1dd25c61d8c512c6ae67b66b74aa3c93242bfaf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273937, "uuid": "326dc70c-f21e-44b0-9652-3102caa9d1c0", "comment": "Malware payload", "value": "fddcc2ca0e0d0b9e34fc252560d835c13579b105456d466133abe663c37a476750425a85eb425376eb2e005338c3ea59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273937, "uuid": "3c966bf9-f1ea-4f10-86f4-711fd842e7a4", "value": "T137647C3076E0C072E8D351FA4AECE67506ADB8B0479554C77AC60BFE9A2A3E0573534B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273937, "uuid": "9066fad9-70c1-4ad3-bd6f-d3b049a24241", "value": "a88b38854037741ac047ab33d36d931b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273937, "uuid": "902f8f3a-d7c1-46a0-8aab-e7d71de8b2eb", "value": "3072:bjCj7icx87WqLqYujgtfCAhl4IP/vUjIfrXxc6+a6/WhGSOKT1vtikIUzXWcv:Kj7/nqLkU9CYl4o79uqGNKT1lXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273937, "uuid": "0bbe9a22-e72d-47a3-b471-2b7c13f55b5b", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273937, "uuid": "0a7d7c58-c075-4e33-b312-e73e06ad9548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273937, "uuid": "88b7ec27-ad59-4e7b-bebe-7271f1e1c690", "value": "SecuriteInfo.com.Trojan.Win32.Meterpreter.23100.23444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8cfe7d-2b19-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690309840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309840, "uuid": "f7c2713c-e9c2-4b39-baec-1493e9be6a89", "comment": "Malware payload", "value": "12a85fcd6ec9c946ef0b0ae4f22ea5db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309840, "uuid": "8d6c3a4c-86cb-4ee4-8084-28ca073ac7e5", "comment": "Malware payload", "value": "a9552744891d3362e4ff2d5f7d734f88c0bdb38e2a792b2489b44f07105710c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309840, "uuid": "07025314-8013-47f0-bfc4-98737705891f", "comment": "Malware payload", "value": "c04d80b8e764a6b9e507506961611b49e6b96399", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309840, "uuid": "0c76b6ca-060a-44d7-9fda-513fa4eb2f6a", "comment": "Malware payload", "value": "54b3734ab26aee38f22664e137638707c4054fb0e3ee232b7ca714374314f6bcce7686e0d09d2b1161e68c70899c8a22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309840, "uuid": "110067e9-eaa2-4b60-92ce-597af13dbd74", "value": "T125C4DE2724863555D841DCBBEF10C2FDDAEB5EB725E2B916C00AC907E23B96CDB04279", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309840, "uuid": "0cd28ce3-5960-4f4f-a10a-ae72849dbad7", "value": "12288:N0MxW0RIYq97twXvy2eeGsnN4bf+RYKL20PrfewoIxzNm7PHv:aMZC7t0KdeGsneCL20DBZg/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309840, "uuid": "30ce842c-1488-495d-8791-773ad337d3ed", "value": 553472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309840, "uuid": "2dbfbb8d-c9b7-4eb9-8577-8db325d42604", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309840, "uuid": "adf044f6-df1b-47c7-b211-7d5a22473ab7", "value": "12a85fcd6ec9c946ef0b0ae4f22ea5db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7aa15b-2acd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1690277205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277205, "uuid": "b12ce9f8-651c-4bf6-9294-a32620521465", "comment": "Malware payload (QuasarRAT)", "value": "68459c40c0a1c9eaca41d76c094aae40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake Opera", "colour": "#A6C8E5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277205, "uuid": "04a6cff7-8136-48e8-8d4f-9415aeb3376b", "comment": "Malware payload (QuasarRAT)", "value": "aa18400f1aa2fef6c2a5a50965981a3d668e052ce8ac851a8bd145cac1ee2ace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake Opera", "colour": "#A6C8E5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277205, "uuid": "26f507b0-8d1a-4e36-90d8-fbb268cd8b4e", "comment": "Malware payload (QuasarRAT)", "value": "e8a8c76f9911b79feee2314e5945424204596f70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake Opera", "colour": "#A6C8E5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277205, "uuid": "24217cbd-d311-440a-9a58-e35f15093345", "comment": "Malware payload (QuasarRAT)", "value": "8bd0535e93375f66233c14356e62180408668211b1bc09972579b29beb320c53be460d430c7ed0793e59bac6aeb90066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fake Opera", "colour": "#A6C8E5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690277205, "uuid": "8878400b-ae8d-4e13-8cce-65d24c82a23d", "value": "T10056BF1037F85E22E17BE27795B0441667F0FC2AB3A3EB1B2191767E1CA374059427AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690277205, "uuid": "a9e6738e-1cb9-4d93-ac82-3c14e7e7fca6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690277205, "uuid": "2b7663c8-1202-4666-be24-d2d51c5abfd9", "value": "98304:yGh5ziNlRUaub+MPDrc/c+NmXnKyFrsqCDHj92AYawl1WPOl6NVLkJ0xWCaaMF:y3NlqaubXgUCqCTBjxbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690277205, "uuid": "02867fa1-b22f-4c6b-b1e6-b055c94483f9", "value": 6351872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690277205, "uuid": "60025a1b-6333-4d79-bf4e-5c93846b00b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690277205, "uuid": "fa158a50-b31e-4d61-8c6d-64a0a56e3889", "value": "OperaSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8ba77a-2b19-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690309713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309713, "uuid": "abed0a26-f546-479a-9d3b-6587551ce5c2", "comment": "Malware payload (AgentTesla)", "value": "e61e99f7da7e3662512daeef10e40d8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309713, "uuid": "a2235bc6-0a97-471d-addd-294b083dd08c", "comment": "Malware payload (AgentTesla)", "value": "aa20731e5adf5003b9fae77ddb9cf1284f0089aaf435f63a92bc2b17e6e1048b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309713, "uuid": "fd3fc9d4-edc7-4d5b-b96e-265ba5028989", "comment": "Malware payload (AgentTesla)", "value": "056f93c2d28c326c9f4d8220af8eafe547701db8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309713, "uuid": "252ea266-d448-4111-8ffa-aa466f847c87", "comment": "Malware payload (AgentTesla)", "value": "354b16499e0d976c5d67816c0fe8445d55e5291dc1be825d8c0b1fb8a91f76f9b0dc3c10636c4177db4296b08a7bf42a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309713, "uuid": "0caca33b-cfc6-4b35-bc21-1ab8f36d2d11", "value": "T11705F11576A9AF67C1BA57F84020323413FEADAE6435E34D6DC370CA1875F848A62F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309713, "uuid": "aea62669-3037-4cce-a5a8-a6ed1810676c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309713, "uuid": "d84defba-3361-432a-a86d-26f8b75c8dff", "value": "24576:Jxh7HIcTrGCSJUekAH9I/xGwDIghbYH36:fZHIkrzSJ98/gERWX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309713, "uuid": "0ce36879-0bcb-4d51-9bb7-b52351ff5076", "value": 822784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309713, "uuid": "74c5db0a-c77f-4286-a08e-66c6baac9ca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309713, "uuid": "8c406438-a78b-460b-b523-01cbce3bb04a", "value": "e61e99f7da7e3662512daeef10e40d8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1dbdddc-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690273961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273961, "uuid": "f03bebc1-513e-4d19-b5f8-e173dc62d628", "comment": "Malware payload", "value": "80bc167dc4a7ac36887072e4bd6a7d07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273961, "uuid": "f1df6601-6cf5-42fe-a1f7-7460f6c12a2d", "comment": "Malware payload", "value": "aa5749509d394ba62ed76f3dc1d3d6b9d2d5390e33f039ab30f84e4ae4a75601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273961, "uuid": "4f598dca-efad-492b-8618-33c920ffb3ba", "comment": "Malware payload", "value": "fc5f454dd0fe82bddaac1d9c714e1857ff8fd995", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273961, "uuid": "4c02be50-4d5b-477e-80c7-dfe5c9603b8a", "comment": "Malware payload", "value": "a84f10d14a962b31fd6f6d1eebc6e215a72bccaaaa1b403d982a10a1cc6d36bcbc4f4d959fd8f31d3324bc3e1ed2c8b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273961, "uuid": "ff6f8251-9628-49c1-a91d-777cbb0f91d0", "value": "T14FB54B73B744753FC46A0A3A4627F6689D3FABE125068C5B97F44D4CCE290502E3EA4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273961, "uuid": "4129e82a-d588-4bbc-b631-25e9a7d22e1b", "value": "a6a147270aff725bb19edb907d502ecb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273961, "uuid": "e7e4a3e0-6628-40a2-82e4-f92122217982", "value": "24576:3zwVdVkDkS75dJ33vgvKgUXwuvcx13mZTNCdDBsSpQCxtngh52PgFZgcaSAOzL:DKkJYmZED+SpQJ52qgj6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273961, "uuid": "7e19cc22-8319-42c2-abf8-4ad9bae13b70", "value": 2345472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273961, "uuid": "56fe39e0-dc7f-408f-bf1e-d1db9a39fc4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273961, "uuid": "ffa793d5-240f-41e2-b8a9-412675957e4f", "value": "SecuriteInfo.com.W32.PossibleThreat.24812.30765", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42f8095-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690282098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282098, "uuid": "d4efdc97-de10-40d6-b77a-0c4c07f84d2f", "comment": "Malware payload (DarkCloud)", "value": "0f85c2405e0551f5c06a7017e33ac06b", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282098, "uuid": "b35c521d-925f-4b60-b2ce-0274aebded75", "comment": "Malware payload (DarkCloud)", "value": "aa5c1f95c403a035f8eebcc9c23b7421633d41e0a254ad859173a3763bc7d433", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282098, "uuid": "688436e6-a3ef-40a8-bcaa-0107419a7e58", "comment": "Malware payload (DarkCloud)", "value": "649fbb28b8da9323867d865880fdbc0f10610596", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282098, "uuid": "9d3a3b10-d858-4593-b779-d33624f98442", "comment": "Malware payload (DarkCloud)", "value": "4ba5aa95b4b1d6206f0cfd92519fdbd99a1a498df14e6a4f5e6c21327e42fef1cfb2b61ddc9f7f05f52a36c3e0e15cd5", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282098, "uuid": "74911d40-f2fa-4361-bdfe-cbfc08081ede", "value": "T18CA40826E660602EF093C8F0E6E5A2676814BD771288A817F3915F4931365F7B8F172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282098, "uuid": "4bdeefea-13c8-4be5-b67b-acab387e2552", "value": "829c6527a0c555fb4836135cfd531918", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282098, "uuid": "723f65de-563a-489b-9df2-5d39b61be4cd", "value": "12288:XaG88NqWx3CMj21piSU+FfUZ6DWnejYKkJj6GmZU:fNSTU+FfUZEugYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282098, "uuid": "081c0f1a-93ed-471e-b0d1-ff2d9388b032", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282098, "uuid": "66f404b0-c514-4de3-b000-aedcb6427187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282098, "uuid": "206950f2-94e4-4785-8b24-6a9923d9e49e", "value": "aa5c1f95c403a035f8eebcc9c23b7421633d41e0a254ad859173a3763bc7d433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d1c223-2abd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690270552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270552, "uuid": "926a4ec2-e51b-41b4-b557-cb165e835d8d", "comment": "Malware payload (AgentTesla)", "value": "209d05e1bea4668144e8e0d1b4639d31", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270552, "uuid": "dfcfacb2-04c2-4cba-8ea0-5b2a4042d37e", "comment": "Malware payload (AgentTesla)", "value": "aa5eee10bc3ef5df140db90115eb0e7830f9946df1281bc7e5a2e9dddc0e5262", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270552, "uuid": "8e0bfcc1-a7c1-47dc-beb3-5209e03e27d2", "comment": "Malware payload (AgentTesla)", "value": "01c770e620262d3ccc5dbeb208dc7c4814ce488e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270552, "uuid": "23434683-d27d-4078-8f2e-c1f052e33baf", "comment": "Malware payload (AgentTesla)", "value": "d34116565144adbe36f057712d438834e8321ebeef8973a0b276f270f0e555d458bc7f163be9690216bdfde298f667a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270552, "uuid": "f96e1737-db38-487c-a90e-80f6f0a8b841", "value": "T1384423F0E4923E0CE32E27A91AEF7D464CF10F6D73B366D1487E059AA8A6476903C5C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270552, "uuid": "baf32bac-1721-4ed8-8e93-9a4c115ae765", "value": "6144:27sUxTD262+I9DiVLY2r6HG05CUZtIZHaYEVCfX5LgL4LFLBM:HwD262+I9Di5Tr2L5CUTIZqCv6L4LFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270552, "uuid": "bbc42fec-a80e-4a10-9ff3-e4fdf49de745", "value": 257055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270552, "uuid": "71ff20e6-c9d7-4518-9c93-1fe2ae393c42", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270552, "uuid": "4ca7cd40-ee64-4690-9b8a-fafd6030e729", "value": "QUOTE PR009583.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17d2377-2ae7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690288590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288590, "uuid": "ec47f6f4-511c-4788-9637-d6946440a358", "comment": "Malware payload (AgentTesla)", "value": "3f939f0815bd9191fec619eac27c9db7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288590, "uuid": "16be38f5-7d51-4676-bb0e-d2741bfaa746", "comment": "Malware payload (AgentTesla)", "value": "ab1144d8fcde912bc3e50f59f24eeb6fc6fb37cb5c20f194e41075e1baadb261", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288590, "uuid": "58bad8af-9165-47e4-b316-de86528876d8", "comment": "Malware payload (AgentTesla)", "value": "d01b01bfdfd84ecc565e20a4d011f42cf95dd7ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288590, "uuid": "5acf1b86-454d-455f-802c-b6823e45e19f", "comment": "Malware payload (AgentTesla)", "value": "d9e2d83984c0d160054fbcd984836153ca4afd69f59beb02bf23152116bb268c558a43f55d22563945e52f1c409b983e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288590, "uuid": "1fca6519-a394-4a0f-9adf-dd369ea32d45", "value": "T19505F721DE6B6646D0DB523392B36D0F42F1BD193664E9D93F89308836B5A0CFA53E31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288590, "uuid": "3249971e-1762-4de7-8881-1f9948f9f2ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288590, "uuid": "eaa34235-ad33-42ed-af28-24fbc1128a05", "value": "12288:XCbniNS+bM5s388VyfzBJZvgP/kfLihQ3h0HsiRJhCd2nk5EL:Eik+bWssD7QmOIhGsoCd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690288590, "uuid": "aaf5080b-0d1b-4b6e-85e8-5c4e98f6db5d", "value": 820736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690288590, "uuid": "8ad999aa-c58d-422f-99d9-ac96c1639bcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288590, "uuid": "a88b7da5-6a5d-4a08-8fa2-1f0ccbd82b52", "value": "MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd57c62-2b46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690329331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690329331, "uuid": "fdc60de8-0d32-4241-88f2-f838fca8c186", "comment": "Malware payload (Amadey)", "value": "005ea818e3d23dd6a28450d497a63e83", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690329331, "uuid": "c688a44a-e9fa-443d-9b76-6903c09f8b20", "comment": "Malware payload (Amadey)", "value": "ab596ac1dcb546e6e5895d09ba24444f53f1b7afd3fdcfe598738ffb6e4040fd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690329331, "uuid": "3e43b1fc-0ea0-49b6-9d68-95821c46a4da", "comment": "Malware payload (Amadey)", "value": "a1ab0d2514743067be50e3744db340c534f2ae18", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690329331, "uuid": "8b2406a9-4849-49d7-a6ca-ba8ff2c05aa9", "comment": "Malware payload (Amadey)", "value": "9ad429297313be0eccad6b84643c0cf4f03e43081e7ff7fd1c69aae80afdadaa66416cb30f92011fa51babbd1ae5f6ce", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690329331, "uuid": "fddc7a1c-6abf-4b2d-aa99-35fedfc4e71c", "value": "T125840113ABD84573D8B117B02CFB03930A357D954E7893AA3385A99E1C726C5A83277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690329331, "uuid": "228a4f55-e4f5-4eb1-b16b-b5419e040cbb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690329331, "uuid": "d13112e1-9837-45e1-aae6-bf706fb1736e", "value": "6144:KSy+bnr+ep0yN90QEMovWpkW6nZNTQ1IF02XwkS09ToKE6TRd/tcNJDGxt5w:eMrGy90SovWC0hh09TNdgcnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690329331, "uuid": "8d16f671-7ab6-41ad-9e7d-8b4c92b63572", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690329331, "uuid": "6fbe90f6-544a-4350-9cbd-0b2dd58d1035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690329331, "uuid": "8cbf560e-efad-4a5d-be82-e9e5dbc58a51", "value": "005ea818e3d23dd6a28450d497a63e83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24c8b71-2b1c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690311328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690311328, "uuid": "d250fa80-6073-4e0e-8a6d-1c020fbb5890", "comment": "Malware payload (Formbook)", "value": "22866422e864635234b55a5d84fae10c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690311328, "uuid": "b6d05ab5-acc3-4f8e-adde-20f80f26067d", "comment": "Malware payload (Formbook)", "value": "ab81345f141fa4d777d142a4f8367c53e9840897bc2b4c3299a4f6696a46296d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690311328, "uuid": "61c374ce-8b60-4c5a-907a-238ca5a2c1bd", "comment": "Malware payload (Formbook)", "value": "0dee5060c1b50486575d29ecb02e1bc27a72d51d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690311328, "uuid": "610b33b0-ca03-4d66-8a0b-a071364efd65", "comment": "Malware payload (Formbook)", "value": "e6838cdebe32d5750d4cd4dce52d946bddbd839fc2ef3d1592a106e825b34f869278d3524919c21d6632c2fb12e95f60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690311328, "uuid": "1c7bad08-866d-44e7-8b1d-03789f424934", "value": "T119440280AFB9DE63C5224372443B96A12AB58C3759504A036750FB6EB9B32C25F4F763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690311328, "uuid": "7de87bca-a773-4702-bd59-1e931e697b11", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690311328, "uuid": "0d3171b0-51df-473c-9f96-d012ccb2c6dc", "value": "6144:gYa6nprGpvOubvUthOXdcxzvqIC1KSm5L2JeF8/Uc:gYtodTbvC/NSm5L2JeKUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690311328, "uuid": "ea2b39ab-597e-4658-b23c-23fe56a69bf7", "value": 258576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690311328, "uuid": "6c42d25a-15bf-49c4-8b7b-01aafccaca31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690311328, "uuid": "0ea72752-d37f-4f9e-8250-dabd4dbaf13f", "value": "22866422e864635234b55a5d84fae10c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2837b82-2ae7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690288592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288592, "uuid": "98472860-38d9-40b6-a4fa-de796139a0ee", "comment": "Malware payload (AgentTesla)", "value": "e9d05a60972cbe2f921438874797ba04", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288592, "uuid": "de7733af-2946-4e56-a472-b729bdafd701", "comment": "Malware payload (AgentTesla)", "value": "ac3f55ff17ed03f0c72560467e0950c4d74d2b9a1940b4b2da04fb02b7ad6152", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288592, "uuid": "c2489335-2c04-43ed-9973-b12ea2aa40b3", "comment": "Malware payload (AgentTesla)", "value": "3392c7cfbfcf5883dfa90e7404525950385465ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288592, "uuid": "6fcbe943-bd37-41be-80fb-4a3c73b190a8", "comment": "Malware payload (AgentTesla)", "value": "0a8fa87660fb10a88b0797cd31a6b25d4a9d9e10a12614e6429a411dbef839b13d14f44023e0b2e594dc0597931a2943", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288592, "uuid": "21e12034-acb5-4c42-b8e2-c24af32f8a52", "value": "T182B43375ADF2CB7B2950E4B7255D8F7DA4E303ABC6CE168B8E38E51155D2212E83C036", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288592, "uuid": "ec4e0705-e60d-4c07-ae17-898ece3330b7", "value": "12288:UqL3DFb94NcnvUMjjx1LvQ6Z2/eJJdQ8N07/A:UmFZ4NKvUMrlc/eJI8N0/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690288592, "uuid": "2a94948a-2266-4015-bcb6-f745dcd8a2ed", "value": 497561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690288592, "uuid": "e5be829f-9049-4679-8020-27ef230b5014", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288592, "uuid": "6f140a8d-dd0a-4a1a-b8d4-d2df61d49d0c", "value": "MT103.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7224b033-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690308589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308589, "uuid": "0c10c522-78e6-4e2a-8b34-f83f8446c5c4", "comment": "Malware payload (Formbook)", "value": "7057fc3823b808479efd9a29ab4b66ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308589, "uuid": "0b49fe6d-c095-48b2-acd8-dfcfae331dda", "comment": "Malware payload (Formbook)", "value": "ac5c103386769730b707147b6b9161061e1f3eb0e360095826cac29609ff6d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308589, "uuid": "391e7262-accb-4c13-9b35-4d23feb37d91", "comment": "Malware payload (Formbook)", "value": "b252f1adacdf219f0f0c437d01d77e9c6a259164", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308589, "uuid": "948ddd08-7f2c-414b-b8ea-49e873b6d552", "comment": "Malware payload (Formbook)", "value": "51546d95120dc0ac942bde20265bc05391578f8c3271e7c9a9899ffd7274a1ad5a0bf482e72deb0a7e8e3765f36cb9aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308589, "uuid": "0959eb64-7da4-4244-85ae-94cbac8c7458", "value": "T1D015E01136A99F63C57B4FF8022B2AF0C3BAAB9A6735D3085DC670DA1571B4C463DA13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308589, "uuid": "c157e0ee-5c24-4039-9883-4d671f81cb0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308589, "uuid": "e085753c-e0b1-4d60-b48c-911a69021b46", "value": "24576:NxtnHIcTrGCSiGRG+xJA7HpoA1C5WzTfq+5UvMGCIomTOs:LRHIkrzSjG+xJA7HpH1C5WzTfq+5UvM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308589, "uuid": "66819ad3-4c17-4a97-96e5-f148c31c11ec", "value": 881664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308589, "uuid": "f0f0604e-3dbf-44ab-a52f-ebef9852fa26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308589, "uuid": "79ee95d0-6161-4cab-b8f3-17db86143cec", "value": "hesaphareketi-00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a07b73-2b0b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1690304012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690304012, "uuid": "03cc45a7-a350-4288-aaf5-eece410bbbb3", "comment": "Malware payload (Vidar)", "value": "69751141261b33ad9a58cd79449acea4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690304012, "uuid": "bef667df-c42f-4e8b-9d92-cf802deea6d2", "comment": "Malware payload (Vidar)", "value": "adf7784684473f38bd5a1f9787d7c755072bbb165cb6901896f0902facd272d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690304012, "uuid": "e00eb6c1-ab6b-4380-a88a-221b28752826", "comment": "Malware payload (Vidar)", "value": "5ddc29cfe0cb5762d4c43e443cfb2b8339b4e0ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690304012, "uuid": "0e1327cd-d06b-4f59-9a59-f9803d16b529", "comment": "Malware payload (Vidar)", "value": "61f65bf1f77dcdba50be215b279eee5ff90366fbed869aa0395787185d7b607f1641974a0d1d10606473d53f02162520", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690304012, "uuid": "1a47bd79-a81a-490b-951f-e6235ef02a3d", "value": "T1A5669F62684D4B3FE8E5B07EAAA3885363F1BF443134EDD5C4E4EE572C4F1A0792914A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690304012, "uuid": "b0fa909f-4511-4889-8257-8c2250b5e219", "value": "f1bd124d6dc8328b4493810e4f472e47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690304012, "uuid": "1d72bcc9-0046-444e-b435-ea5633083455", "value": "49152:ReN61DKS4P3eC8997XTc0UtqPLtWAVv9couP+i0u8:IN61GS4feB9nzUQ9VFcyiF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690304012, "uuid": "06e92f67-3c70-4986-8445-ddec3c92a3c7", "value": 6608848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690304012, "uuid": "f000d6f4-ba63-430b-9636-1049b19ee4f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690304012, "uuid": "823a8193-70a5-4378-9786-5a14d4918164", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c75a4f-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690280254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280254, "uuid": "23ef8422-54ce-4690-9500-7a42e4536542", "comment": "Malware payload (RedLineStealer)", "value": "c86448855850e884f83a0bb479f42e21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280254, "uuid": "9dd47c7d-a8d8-4009-9384-250e1f49c188", "comment": "Malware payload (RedLineStealer)", "value": "af3abce52d153228bfc6b631d43f74c0c0446e04f68163b85811ddd49ad349eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280254, "uuid": "83d052d6-0b20-44a7-9b14-3616329b47ae", "comment": "Malware payload (RedLineStealer)", "value": "c39a29f693d47136424a40e67dc724bcfb3eef7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280254, "uuid": "72c11d46-98e6-4140-8508-9b9e156eb578", "comment": "Malware payload (RedLineStealer)", "value": "12b17ee0027e7c30793c67ce31dcfc2706bc9e8c3bce9e12004c04229414659365ea2daf6bdd76a420b9476bf65dc8a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280254, "uuid": "26d48807-238f-4903-af64-7e585094ea3f", "value": "T11D840113A7DD5023E8B61B7054FB03C31A32BD921979872B2785E95E0CB2AD195B273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280254, "uuid": "1de88664-b19a-465c-9607-5ed5257e33e1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280254, "uuid": "d5b170c8-95d7-4b22-bf7b-b42f30a60402", "value": "12288:9Mrsy90yy7szYMuJrs1rLhPSgBYCKqvLvRrQ:ty27szYheVzVxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280254, "uuid": "0875c0eb-1064-42fb-9c7e-a5e123a8140c", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280254, "uuid": "2c06c953-7451-4041-8358-51d05f51e65b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280254, "uuid": "99a2eb73-56e5-487d-9288-73e0c1296ef1", "value": "c86448855850e884f83a0bb479f42e21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e7d886-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690308539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308539, "uuid": "3de46cd7-2f7b-4ec6-9293-a97cc645794f", "comment": "Malware payload (Loki)", "value": "f9987d5055ea005a51fe8ac834728a1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308539, "uuid": "bf7fce28-ada1-4e94-b4b5-7bdd8ed92034", "comment": "Malware payload (Loki)", "value": "af4bdead217cfc83478637fe18f218c3eee2f6e7c0005f0cde43cd7af1031114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308539, "uuid": "3c6c6fbf-dc27-42f5-a868-f56add93c437", "comment": "Malware payload (Loki)", "value": "8aac6d6c463b7e0f2b52a2f48c6676315c40f11d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308539, "uuid": "101e16cd-2ac1-418b-a393-92bfcdd02a6b", "comment": "Malware payload (Loki)", "value": "0b0efd0dffe9f1cf737b3ea686fc193aa077f3f87abe45e741947a914548ec906028ed7313d73ba7e50559be7bc51f40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308539, "uuid": "ae46cb3d-f7f8-4224-b6bb-692ef4f6d637", "value": "T1DEC412A2AED4DE93D6162BF5046173F526BECFF23920D7870D87B1DCE871BA85660102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308539, "uuid": "e8eca8e9-cdeb-41b3-8891-256a0d2d27cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308539, "uuid": "f37c5904-4f1e-4e1c-80fd-155d963b4ff0", "value": "12288:+YiIoFwIrG3XCCaTGtu824CsgTwHFI5mEhP3RrDzxnkv5/:+HIcTrGCANVFlO/3NDzRkx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308539, "uuid": "f818ec98-b17d-4b4e-888a-d844329e57b0", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308539, "uuid": "4e3cf44d-e956-48b0-99eb-c59eeda68063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308539, "uuid": "54e0bfc9-73f6-4c2d-8f01-aaec92931c1d", "value": "MaerskLine Invoice_K22TSI71481.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c95a70-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1690296915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296915, "uuid": "6b91fd8c-2427-488f-8eae-922633c02031", "comment": "Malware payload (DCRat)", "value": "0eb354c0e70accc43377ca1cf15975f6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296915, "uuid": "d829f698-8e42-4847-883f-4c8129a3c7a7", "comment": "Malware payload (DCRat)", "value": "af5e28fe88fbb4392ef658ecd2dfdcaccb25734bfff693fa6aca6b03565d0ab8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296915, "uuid": "18ef2dd2-f829-49e2-9f31-0510af45425c", "comment": "Malware payload (DCRat)", "value": "846a7110b75d3ee07ef959c2d0f465a6ce7237e6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296915, "uuid": "0f76d561-c78c-49bb-b310-2b393374f968", "comment": "Malware payload (DCRat)", "value": "b9a5e2367ac44e1827e0a415b6ba9984c7afe19710674b146876357d288a2141cd0e0a71f73216f1e4d6382c650947d3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296915, "uuid": "e61024bc-359a-4d5a-8315-427119abe079", "value": "T13265339635AD299CF7F68B3AB485E98037D2162CFD87F9E415A0ED31D4053DF12826C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296915, "uuid": "886627f4-f617-4f7a-91c2-8bc1104cd452", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296915, "uuid": "7eb26686-f318-48ef-9218-8215c1421e46", "value": "24576:iWfax5kYfSgsXOi92S0h61AriJYxzO62wOMonZziX8jWOe6Yk3LWTBmckWFBC:3f1XOi51Ari2NAymiX8jWVXFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296915, "uuid": "9a214420-4fc2-40a7-87a7-ebf8758b615b", "value": 1492480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296915, "uuid": "4e337381-6b9c-46d3-88d0-d511e0a1528a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296915, "uuid": "a1081b61-7153-4f81-8c57-0130942f3417", "value": "0eb354c0e70accc43377ca1cf15975f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffaffccd-2a9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690257287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257287, "uuid": "5ee52cda-e299-4300-a0ae-67b629a5bb12", "comment": "Malware payload (AgentTesla)", "value": "dd2d413bc603305444c816d1cf84e2b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257287, "uuid": "3a11a312-ed48-48bd-a626-d3b9a26166a3", "comment": "Malware payload (AgentTesla)", "value": "af5ff2701cca14cba66a68ba693c09f4af809c61cee52dbc6a6a2bfa19fdc1f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257287, "uuid": "99192cc6-9530-4e07-8966-ab8e58ed2699", "comment": "Malware payload (AgentTesla)", "value": "0854642a8b42eb02ba98a583838b20bc25f12f3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257287, "uuid": "5d5097a2-261d-44f4-88a4-dc18e2d10bd4", "comment": "Malware payload (AgentTesla)", "value": "dc2001830a10d587419065defcc3285d797aa7807bb90efabb32cc7c8defc9fc2bdf73c45d1f8e4e08ed509f584dc454", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257287, "uuid": "aa91b339-0deb-4ac2-b2d6-057091680567", "value": "T110D413905A998627C1E81BB10B60EF9553F8EFCE2812F65C6F82BCC6F01B7050365A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257287, "uuid": "4a86b204-d3cb-41db-875f-853157a74d22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257287, "uuid": "5cfab659-7cba-4a81-bf5c-74defe04d3d8", "value": "12288:2PYPfY76agwFYVYVTO+1L78FkX5h+6mtuhg4f1pdc94bl:2PYPg2aFO+p0kX5jR7d7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690257287, "uuid": "be6f5cad-167f-422b-bd5c-344beb81c95a", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690257287, "uuid": "b18b6158-61e6-4d69-b1ae-b68e2c6958c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257287, "uuid": "5ceeb128-6125-46f3-a4b9-0176e4bf6610", "value": "dd2d413bc603305444c816d1cf84e2b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8648e063-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690308623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308623, "uuid": "c0312b10-7ece-468c-a5b3-10a4e236219e", "comment": "Malware payload (GuLoader)", "value": "63b42e06c431ff0c91dda1c3e3bdabec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308623, "uuid": "0ee4cd38-07ef-4d61-8ad1-ab5857fb586c", "comment": "Malware payload (GuLoader)", "value": "b09ed41c3a0e1a98d0035de279a32fa7e08e3eba69190b2cbf5f977301e58100", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308623, "uuid": "dcf40be3-c1b3-4d84-9881-d539655755d7", "comment": "Malware payload (GuLoader)", "value": "b9af371000b4e4553e173ea04e51ae480e706fae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308623, "uuid": "0e552a17-6c60-4e7e-be8c-20ecfda9ce81", "comment": "Malware payload (GuLoader)", "value": "232200128f59d838be28285449b952b1feccef0757c68533a1636fdde42b42e19d3cb6e22d116008eb7de410ae8e91df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308623, "uuid": "92df754a-0b1a-4d59-8e99-a187178ca5b3", "value": "T12E1412677BD0E4B3C97B47300B3BAF62BFB88A4611449B17578069477A22DB2472F193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308623, "uuid": "8aae5f08-1b7a-4c49-909e-5e6150c0fe63", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308623, "uuid": "35b2d4e8-d965-4c3c-9e99-8db61da992c7", "value": "3072:nwDijpS4DbYcr8buJJxTkfQ/+vcB6LypIqWTfZEgdWPSeIJ3yY73zemkYr:nFPeoJxTsO5IyiqWTgG3y0DeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308623, "uuid": "adc08e72-1116-4207-a0bb-eae5127b786f", "value": 193176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308623, "uuid": "5c4d01d2-4821-406e-9205-4078771b97d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308623, "uuid": "c6ebfe82-5b26-4e7a-825a-14721c493369", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7789f45c-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690280252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280252, "uuid": "ed31deed-5b27-40d0-af9c-cc9633b8fbcf", "comment": "Malware payload (RedLineStealer)", "value": "e0919e29f2ac1410bbdcb21da7213132", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280252, "uuid": "b1baa2c5-c5d0-4659-8dae-01982bedec36", "comment": "Malware payload (RedLineStealer)", "value": "b0c37ecaad4eea0845fb09db3299130500249190e4e0809ac453fb07e5835155", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280252, "uuid": "01b90fef-5396-4fcd-a771-1cc940ec62f6", "comment": "Malware payload (RedLineStealer)", "value": "9746c130a61bd96a0561a7a26d1c53f30a265653", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280252, "uuid": "e16c1aff-b084-4828-9b77-a5a243331b53", "comment": "Malware payload (RedLineStealer)", "value": "d77760505eafe5959275f5f0c5ce689ce051ae221e19834d9c5863052cf9b9b022e1c765567d5b867f3c18ff05454263", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280252, "uuid": "76703091-5a74-4be9-80ce-e147f89ea3d1", "value": "T149840106B7D44033D9B927705CF603930A36BCA25D34836F3B9A995F1CB26D8A47672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280252, "uuid": "d08980ee-e77a-484f-824a-289b263121c4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280252, "uuid": "1bf107eb-92b2-49c6-b959-0461b12323dc", "value": "12288:cMr+y907kX0+1hRVW1UB3O2NgBYCnsSLsvJ:SyYkX0+1M1UR9GzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280252, "uuid": "eabf87b7-fb6c-4086-839f-d92169f69dbf", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280252, "uuid": "bcd0bee9-0c73-4d52-9618-e8e51d7bac3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280252, "uuid": "a5b35425-ea4b-47d9-bf94-79458be149aa", "value": "e0919e29f2ac1410bbdcb21da7213132.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56259933-2ace-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1690277619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277619, "uuid": "c9450846-417e-4dc6-9757-077c2dbd10fc", "comment": "Malware payload (StrelaStealer)", "value": "3872561182374f9199b847d89f5603b4", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277619, "uuid": "0b82877a-ab32-41f0-b37e-2b4794940131", "comment": "Malware payload (StrelaStealer)", "value": "b1158abb46deac8f35fabb5bb045cf1f915c0e5fb7d968bc3baa4f30ecc26d00", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277619, "uuid": "ec210d72-5280-49cf-9863-a94d6e292a65", "comment": "Malware payload (StrelaStealer)", "value": "0a3c7cd2575c88349d3dc3e289734fe34f690935", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277619, "uuid": "799c45c1-9494-44dc-a8cf-c73b2e0184c4", "comment": "Malware payload (StrelaStealer)", "value": "8db40b769a100ef231ddf496c482dd5ce7059b227a3f55a9b80b8cdf50e3a3be41318ddcf5908f3356b3391dced2fbd2", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690277619, "uuid": "06bd9c97-c851-4c55-bcb4-6bb829d50058", "value": "T135949E7638D73BDB8F311D1CA68EB1B26C9C776760A95B06266C061A5782078CFE0D3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690277619, "uuid": "d34d23bb-c0a9-470b-af64-067716515a6a", "value": "6144:kumZunPKkY8ANff1BslgFJ2QNecAenljMXUG/3wbYi8QOw:YZunRY8AR1EgFJ5oOljNQwWQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690277619, "uuid": "ad632eeb-a718-4469-9035-60607c8df5d0", "value": 410720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690277619, "uuid": "1817c3e1-80f6-4c7c-9093-6a0dd5e45c29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690277619, "uuid": "66295e67-6274-483c-814e-114233bf15b8", "value": "PDF956701926650.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f9495f-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268252, "uuid": "2efc8102-d399-4b29-977c-9df4c710456f", "comment": "Malware payload (Amadey)", "value": "79816314c10ddc850f0c6065a3086cd0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268252, "uuid": "d5c7e029-4d64-4fc0-ac7b-eaf76f631126", "comment": "Malware payload (Amadey)", "value": "b1364240bee2ebfe26a0d9122cec825b8a3df9bbe2f32554c07ddf02382e7b05", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268252, "uuid": "8d6a731a-ee25-4e20-bcd6-d705d7bfad7d", "comment": "Malware payload (Amadey)", "value": "514555f7979b23b3485172854856714686b9a26b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268252, "uuid": "b458fe40-5a50-414f-8a00-f45c9d47edd9", "comment": "Malware payload (Amadey)", "value": "616bd5a9409edc7a7c1f2b962d2b3e8ecc2110224f9866ba823ffe937c8a8297fd11d03127483d2fdd1fe2fbb6bfe543", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268252, "uuid": "bce568a3-4321-406e-923e-d0f822abfffc", "value": "T191840112A7E99133E8B46BB418F603D30A367CA19974D7B73786A95E0C732C1A43177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268252, "uuid": "ea981ea1-cdbb-4b90-a574-3e1c821027fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268252, "uuid": "6083120d-1d54-4c79-8d8a-bf00b26761a8", "value": "6144:KBy+bnr+9p0yN90QEmIunlHr6xEF2k5nonKfaNA96/pQMD5DteE5f2qA5dXxw:bMr1y90swiXonKsf/p1hec2qAdBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268252, "uuid": "23dae450-b068-4f01-9dfb-2685f5999f62", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268252, "uuid": "5d2a11b1-56f6-4284-96ce-45bd444eb287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268252, "uuid": "4281e810-63f5-4957-9bb6-fd44abb905de", "value": "79816314c10ddc850f0c6065a3086cd0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db10962b-2af0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690292445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292445, "uuid": "56eed6d1-3e96-43cd-b28c-88eeb8e56743", "comment": "Malware payload (RedLineStealer)", "value": "6aec7eec029fad443619c1ba9af47150", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292445, "uuid": "e36bd44f-c147-47fc-beb3-57644f0c4781", "comment": "Malware payload (RedLineStealer)", "value": "b21eeeeb69d9d6be49fcb0352e813c082d255d1824e4a2c32b3387a3809947d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292445, "uuid": "0026a890-4310-4562-a75f-8d053a2b93df", "comment": "Malware payload (RedLineStealer)", "value": "89890224d7d2edfd8f8e31a34065a922080109e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292445, "uuid": "eb4d8b14-7aa6-46c1-8371-de2d6b8870d2", "comment": "Malware payload (RedLineStealer)", "value": "b27f7ace32d6cf592180e46d4f84fedeaf6940fc7d8091eb28b77e3cd88f127731cb9ef3391e42ce7172ab9909bcd0ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292445, "uuid": "4a3b935c-de26-48ee-bf49-6224a5d20b1b", "value": "T1D3840152F7E88472E8B11BB098F613D30A36BCA1AD74535B3395A95E0CB36D0A871737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292445, "uuid": "dfa071fa-e93d-41fa-ad13-5481a776fb1d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292445, "uuid": "d4c559f5-f264-45a9-9444-9212e1312280", "value": "6144:Kry+bnr+5p0yN90QEAVfXqlP5btwDhQz+OA45T5tdo8LPz:xMrly904vqlWhiA4Z5t6gPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690292445, "uuid": "19532492-481c-4df3-bffd-5f2dd01a55bc", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690292445, "uuid": "35603afe-99f2-4b69-a797-20c8c95e2762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292445, "uuid": "6ea3cfc3-edc5-418d-abc8-d9052f8e26dc", "value": "b21eeeeb69d9d6be49fcb0352e813c082d255d1824e4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7b9c2c-2afa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690296390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296390, "uuid": "4328734a-3b34-4a36-80e1-979fb43be8aa", "comment": "Malware payload (AgentTesla)", "value": "841324388d9a01a451aaf6d30f60f7e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296390, "uuid": "44932b51-b69b-4133-aa27-474a3fbb4573", "comment": "Malware payload (AgentTesla)", "value": "b226a85b8821593522c97ef77d924a2a2fd57fafdf2b251e19fd603853b835f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296390, "uuid": "24f84434-48ad-4a4e-8749-d02ec7c4c0f9", "comment": "Malware payload (AgentTesla)", "value": "f1ba60b6bcbdf157b1679aea1b90921fef3cc7c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296390, "uuid": "c1e410b7-77f2-424b-a0a8-2651fc7a56f8", "comment": "Malware payload (AgentTesla)", "value": "5fe229be2efaa268c86330302f2202bcdb6478d5bd2280c783d940c95a0532e9b23b92cde956e5c1ae3e18afa3e9be13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296390, "uuid": "60ebcce3-50aa-44ab-bebf-5e00cea5bd3d", "value": "T103D413FE72A8BD17C1AA89B94042514C37F1F293313AF7899DAC54F29A5B3B16240663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296390, "uuid": "40c9230c-2816-4b25-9539-17049de1c02d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296390, "uuid": "9d2da251-f003-4617-b195-000886a44c92", "value": "12288:JM20Jh5Eix9yYQTmasmilD39o//1BDalzPjVe5svqvttg5J6YcS1D:IJXX9yPilu/dBGFV6O6e5Aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296390, "uuid": "3c9ceecf-b6eb-4b14-a5d3-d1e08be20aba", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296390, "uuid": "74591016-6ace-4c02-9473-63b4fe30e88b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296390, "uuid": "1c1355ad-73fb-4707-bf0f-6ab6b638602c", "value": "PLT20230402-0332.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a83b16-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690280244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280244, "uuid": "fa760bfa-a52b-4e11-b0a3-92d6902747e2", "comment": "Malware payload (RedLineStealer)", "value": "5970294c81f998fe3421fbba4d76cd80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280244, "uuid": "9d574aa3-4455-4ed4-b777-b8bd2f4f19ce", "comment": "Malware payload (RedLineStealer)", "value": "b288ce41725aeeeb2d59aa01a47aead6a21bfa4c4b0815c9e7a4d9bfc8c1b36c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280244, "uuid": "426ed768-b9f3-4abc-aa2d-a61a2cf3f400", "comment": "Malware payload (RedLineStealer)", "value": "ebabf98570fcbb93afc5157a80e6c74a1577c8e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280244, "uuid": "635e8386-d79d-4f0b-8294-ec39de26b8ce", "comment": "Malware payload (RedLineStealer)", "value": "60d02468e480be04e95ad03021856664797a2bed43ba6f737025db17718216566c42b58f935415b2d2bc6292a2d18398", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280244, "uuid": "1f982921-df82-4301-89c4-5092ff5ba759", "value": "T126840243A7D98073ECB6177068FA06D30B36BDA21C74936B2691595E4CF3AC4A93533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280244, "uuid": "2a3c8acf-5baa-480d-b511-ceb8c10b8804", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280244, "uuid": "39da3333-c29d-4fa4-8221-3f867cb10853", "value": "6144:KGy+bnr+Kp0yN90QE1HsSyjdTEWN+AOewoReoFicsNgix3WcgBZ+t4nDs1rpUCCL:6MrGy90Psl58fewrowx3ngBYCnoppe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280244, "uuid": "ad1db287-35e6-40a4-a596-7b1ca9b6c06d", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280244, "uuid": "af40e684-34d1-4911-86ca-062dce4c8b1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280244, "uuid": "1c001565-a6ec-4795-8597-e29491ac55ec", "value": "5970294c81f998fe3421fbba4d76cd80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65de5ecb-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1690296972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296972, "uuid": "f594a89e-7e86-44dc-bf7e-da7f590cb978", "comment": "Malware payload (RecordBreaker)", "value": "4874d8e7281badc14331f523cb93126b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296972, "uuid": "34d9e9e3-81de-4438-bfea-b518eff7cf07", "comment": "Malware payload (RecordBreaker)", "value": "b2ca4bc32b5c1da452e804fbc78c1b5f7e09791dba1cc52af4a497ec000326b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296972, "uuid": "bc4bca38-cc33-457f-b4f7-23e8f526d964", "comment": "Malware payload (RecordBreaker)", "value": "73c3842f6070289aa076ed4f73e202f7b781a76b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296972, "uuid": "b10a2bd3-456f-436c-b728-4ef51f6b7407", "comment": "Malware payload (RecordBreaker)", "value": "c8d128c3850318217e6e4cfda4b90e69aea581e862a5b98d04ab4670705a71d5164dac690744fd5412d27f81ec4556ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296972, "uuid": "ef8edae7-a009-46ae-95c4-58cd0946ea2e", "value": "T1F256233321518185D6F4883D893BEEF071F64E198A06587AB8FBBDC6A835AD0F617D43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296972, "uuid": "2da1782a-c2f0-4ceb-ae32-ee3493e93c1c", "value": "d94db63cb1c770dd5bc2d9e990bfacb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296972, "uuid": "b02fc180-286d-4312-be0c-9b052e56a04a", "value": "98304:kXvW7zH+QX2nH/WRpsXP5pKUKqx1C9f+n6Re01KVG2KS+BqE9XdjldhFSSME+5ab:2W7zNwunsf5pzKqxwh46RBFSgjjb+SMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296972, "uuid": "752660d7-3966-4348-a398-3e58e3412adb", "value": 6164480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296972, "uuid": "f074d521-cc04-44e6-97ed-9f12acf07700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296972, "uuid": "7456073c-e20c-4a10-ac0e-2fd3d3139ee2", "value": "PreUpdatedSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af79cd78-2abc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690270038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270038, "uuid": "143a557b-fcd2-4d3a-9523-27b5496cacec", "comment": "Malware payload (AgentTesla)", "value": "7f35b911f9250b27c8e5717f987413a6", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270038, "uuid": "b0db04d7-2202-4aab-a6d7-852355db3303", "comment": "Malware payload (AgentTesla)", "value": "b3422be8036dd475d2079a54e83ed054fe0d9547b926b06f5ca45d25f3b70d64", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270038, "uuid": "dd278ff7-b238-44b6-80c2-58b6ac091ef3", "comment": "Malware payload (AgentTesla)", "value": "9e6b5e53fa1f6465406df386538f27d66f25f6d4", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270038, "uuid": "40b34f9a-a971-4e6f-bd38-db7e206dc5cb", "comment": "Malware payload (AgentTesla)", "value": "83eee579b90cf7cf67d1944d353bf6c446af4e83f1c142547ea822714d00c340f8d1771fa4cfebfc9781e6b371ed8034", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270038, "uuid": "a97f1104-178e-46c1-9318-a8451f704e61", "value": "T1C7C423761F15013E730A9160E03BE2CCB3F6AF01BF5A531A70C6A8D4DF6B641EA44E99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270038, "uuid": "1ec49e51-7608-408f-aadf-a76486730cd3", "value": "12288:8TVm1TD3Co35mYSZK7Ldqa9kG9zmI7KkOZij8Q0xtIWUjlWjpvzqMgJfg:8xGXrDzXdt9FzmI1OZzpUpEvzqMgJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270038, "uuid": "98189845-7148-4b5d-ab6e-6a8348829eec", "value": 565425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270038, "uuid": "3576dd25-4024-4e5d-8fc7-dc4a87154ae9", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270038, "uuid": "230fa88e-b28b-4527-85b8-854bf0d043fd", "value": "CSID 270883.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfee993e-2b1c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690311324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690311324, "uuid": "f12d81ea-9382-4174-8cc2-0c3d5306180e", "comment": "Malware payload (Formbook)", "value": "66a020cc3acbd4f1badbff616662ce02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690311324, "uuid": "cfe22b71-a343-4b0f-aa6c-78fa735237fe", "comment": "Malware payload (Formbook)", "value": "b36dee6691e5fe4f8caabfe5602e16b6a287f98aa3a13df2deedad15e31aec32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690311324, "uuid": "672d4f12-0088-4919-9e38-a727e19e7647", "comment": "Malware payload (Formbook)", "value": "33e90a06dd87a925bb86b1198f67c41a60ecd168", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690311324, "uuid": "b1654449-5e68-446c-bec0-950541702812", "comment": "Malware payload (Formbook)", "value": "f9a3c0c87726825bc036b9fed6100d700f47dd87c5b80e0c6a08695acdbec92f92d56fcd3062c92850f0a2ee8be6fd40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690311324, "uuid": "5cff1cc1-18a9-4c24-9731-f9f79a4b234a", "value": "T1D084AD53DEF06AB6D1EF417244E2A708C1398972D401598EEB607E6F0CE7981DEDA70B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690311324, "uuid": "8c72c000-8666-4e45-af3d-7a245b551a30", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690311324, "uuid": "1ffa39f1-8839-4fe8-a915-1d95c8c0283c", "value": "6144:ryIIW3gq6qMsKF8W8YI1DpMWlUDCbjNDw9b5kZNgNsJZTpFZK:rv6qMHCW8YaVMWnb5DsyNgNsJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690311324, "uuid": "873b4adf-4a74-493f-8b6a-7ca44e5fec0f", "value": 378824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690311324, "uuid": "232f27c1-ed77-4ae2-af48-58193ffd59a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690311324, "uuid": "046429cb-ac89-4d41-9be2-7c440853efe6", "value": "66a020cc3acbd4f1badbff616662ce02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79226a6-2ae7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690288600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288600, "uuid": "cd68ee8c-f529-4d8f-b0c5-8c295048fcca", "comment": "Malware payload (GuLoader)", "value": "da48908a7aa684e10884a009ca95a01a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288600, "uuid": "d14e4676-e040-40f1-b92b-e6e141ab4d80", "comment": "Malware payload (GuLoader)", "value": "b5490460c53d27ef419898a98959bec49deb3ac3c3a8a23d63ce7dabe00af32e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288600, "uuid": "688d96f8-9c5f-4fdd-822d-5bb64dfd150f", "comment": "Malware payload (GuLoader)", "value": "63eec2d7f2cbfdbc77a7c0192c4ad941d7bac6e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288600, "uuid": "57f49b19-e56b-4765-aa49-728eb7ea96d1", "comment": "Malware payload (GuLoader)", "value": "6fe0a436ec83dd12aef543b068dbf7fd2a103a723a876822fbd75a04f332b4ae7690006cbd20c14152d1d6aacb902839", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288600, "uuid": "fab829dd-f09b-4bea-a362-326c51f165f7", "value": "T1AE04025726C1C4B3CA0B87710B366A2BEFF9D621625A6B475B406B8F7E13652C32F1C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288600, "uuid": "66f0ca7e-2999-48c0-992c-8fba7368a9a8", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288600, "uuid": "c6695b99-437f-4eb8-8819-3ddc20a95f09", "value": "3072:nwDijpS4DbYcr8b6cYXrNrHgq7+rAIKsE7bDFn3Chc3zqbbEEXydFwgX+MBoMIJY:nFPe6jlFfrV3C6DY0wBMBoT3y0rNeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690288600, "uuid": "c2e03039-51a7-4ab9-b26c-e85b68a7977a", "value": 189216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690288600, "uuid": "5decb5ef-e260-48fa-8399-c98c8fe2d4b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288600, "uuid": "6209e9f7-05b9-434c-a96b-e4b20c3d4064", "value": "PURCHASE ORDER #0881177252023.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da83212e-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268821, "uuid": "ad925cb2-ec2b-4c69-9e2a-1e5222af79eb", "comment": "Malware payload (RedLineStealer)", "value": "a1260fe0b845d15f3be66e20b1484539", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268821, "uuid": "8e4061c8-83ee-4ff9-bec6-08041314f1c8", "comment": "Malware payload (RedLineStealer)", "value": "b5cd7d69c79a6bb86851db97ac6877631b2b5d50575a706f267f302d6ac9a037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268821, "uuid": "e56cdc75-9135-4769-a698-e59338215d89", "comment": "Malware payload (RedLineStealer)", "value": "e53e37b62aac4001cb7dd850b99d1e386f0b67af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268821, "uuid": "c2a02edc-da4f-438c-be49-c81ecc12f7db", "comment": "Malware payload (RedLineStealer)", "value": "6ce484c5eb90f2a7e929ae756f7f16f085236370d08d263bfda5307437e9f29899e445c5239a57e0497a332333381663", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268821, "uuid": "257507a4-65cc-459d-9230-2045049685b6", "value": "T17EB40213E6EC8476D8B16BB05CF743C31B35BD649D64939E2686A81E0C326C4A93277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268821, "uuid": "6bb03202-07e4-4e78-8114-a11e1daaf131", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268821, "uuid": "d144a22b-bcf9-441e-b386-eff4728b2d94", "value": "12288:LMrvy90d64GXm/EOVB2jKyYFAgbJc6gF3ikP:cyyBGXHG4jKxmgI8kP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268821, "uuid": "e477e3a4-6d59-4e57-bcf2-408277dc09a6", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268821, "uuid": "47875c6a-1d54-4e42-b5d3-9dda9d2fe0fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268821, "uuid": "6dc76ff6-2021-418b-87fe-3c2a11e43257", "value": "a1260fe0b845d15f3be66e20b1484539.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781dea67-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268227, "uuid": "08f715e7-ff3d-4c46-8af3-018087505cf7", "comment": "Malware payload (Amadey)", "value": "61e916ab9a8291dfc86abd174222a80b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268227, "uuid": "cab55d3a-e7cd-487c-a9b6-21e814b694f3", "comment": "Malware payload (Amadey)", "value": "b5d13d27e75694ee09d6f3e1ef85fae00d4eba4fc0303a675ff71ebd6be5ef12", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268227, "uuid": "bf436126-99b6-4cb3-85bf-e1e532295dbd", "comment": "Malware payload (Amadey)", "value": "c0986f84c43494fba4b4b1b0834443fed6640512", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268227, "uuid": "ba292719-684b-49a3-bf2e-6de7faf51a56", "comment": "Malware payload (Amadey)", "value": "c9202fc4a488ac2b777666c8c3b1c491bc33b550d2047f3b680a8b434990c3133e07c5e5e840d79da6b20818bbe6feab", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268227, "uuid": "f468c0be-892f-43a9-a2d9-f460c5cd35fc", "value": "T18A2408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268227, "uuid": "d049d89e-c0b3-4e11-a8b2-4d52d5957746", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268227, "uuid": "cf7f8bb2-45c5-4415-8e86-24d469817fb2", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268227, "uuid": "7b60d619-1aca-4747-8bba-d41547d15c6d", "value": 229404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268227, "uuid": "0ea604a0-21c7-493d-bcdd-b5e119c20fa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268227, "uuid": "a7b8f575-047c-4134-899f-327265870e9b", "value": "61e916ab9a8291dfc86abd174222a80b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6534bb8-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690273968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273968, "uuid": "0a4730c4-6146-43a4-8efe-8258badca5a5", "comment": "Malware payload", "value": "fac2114473c00a746b649351ca282d5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273968, "uuid": "67ef96c0-5946-43ff-8e91-f0cfd06428ba", "comment": "Malware payload", "value": "b64231db9fe366199a1cb7ffc3561add162f67827c9ad73e16d397436d73df71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273968, "uuid": "7f23188f-416e-45da-bf1f-fe8910c973c3", "comment": "Malware payload", "value": "177188bc5b5dc068db31a5a9e9183e6cca8fa1ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273968, "uuid": "a9f58bc5-9412-4364-b6a9-ace388f1a58a", "comment": "Malware payload", "value": "23d3fff58e3723caab38a71d33b31326f38765eb8315c57dd4340a033a33783b59383239e50957a9754b54f92208d373", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273968, "uuid": "cddc2438-89a0-4853-9ac5-025ec34ca722", "value": "T162B53B73B744753FC46A093A4627F6689D3FABE129068C5B97F44D4CCE390502E3AA4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273968, "uuid": "4ba5a9f0-8131-449a-852a-2f29c8657b88", "value": "a6a147270aff725bb19edb907d502ecb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273968, "uuid": "84a8b177-bcc7-472f-96ac-1fc428b661f1", "value": "24576:2zwVdVkDkS75dJ33vgvKgUXwuvcx13mZTNCdDBsSpQCxtngh52P3FZgcaSAOza:0KkJYmZED+SpQJ52vgj6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273968, "uuid": "420e86ac-7acd-4ad3-82c8-00f4f9680226", "value": 2348544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273968, "uuid": "a6f4c89d-5759-4a43-948e-3ecb4eae78b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273968, "uuid": "11995f9b-e52a-4cb4-93f9-bf2c1dd94047", "value": "SecuriteInfo.com.W32.PossibleThreat.23236.9304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae340a0-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690273949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273949, "uuid": "cf1073a0-9717-4a75-b9bd-6feee7ea9e13", "comment": "Malware payload", "value": "0ccaaa3e1f0692a88836188f9cd1e245", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273949, "uuid": "bf80a151-c9d8-43e6-a78f-1c6ceca94a9d", "comment": "Malware payload", "value": "b6b543ec17c92ce9adba04a0ef74d9dc86efd873427801bb1b87fda4d0ca09d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273949, "uuid": "d3c88075-1217-4f9e-bed8-b48d820d234c", "comment": "Malware payload", "value": "a299c025440a3db234fc1f7353cce2e1774dcdaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273949, "uuid": "513b1bdb-4313-4765-8791-74c5758c7c24", "comment": "Malware payload", "value": "fd244119db0aa05f3cf580e98b47b14c7334ffd80b78a213ec25aafa1f0c3d34a504f740159dea2be941b0e33f667a2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273949, "uuid": "14e00111-835d-43fe-b0d4-5a2c518454da", "value": "T17E94C71232794AA5D15F003F0DA2C66AB378BD279D13AF3797A6BB6D59333408D2163C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273949, "uuid": "50d62529-b013-4ded-a4ea-65e62c584143", "value": "2cc0e0895bb85c9d29d6e0653cd167e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273949, "uuid": "7e98ec79-ec9b-4e73-8541-e0d80d1517a2", "value": "6144:t7mH/4dZEuAwOgZaxcND830LSpPGCJ39pSl2kPXXM:t7meZEuAwZkxcNNLmPYPX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273949, "uuid": "a47d0604-335e-4a91-b620-93e97c197efc", "value": 438272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273949, "uuid": "69660d69-2acc-419b-9659-ab544daa6b20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273949, "uuid": "18886d65-f708-4d11-8f24-91ebb9e74551", "value": "SecuriteInfo.com.W32.Locky.N.gen.Eldorado.3701.2525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d588ab21-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1690273967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273967, "uuid": "7a1c07bd-2b71-499b-bc56-cba88b3ffbb6", "comment": "Malware payload (AZORult)", "value": "874eb8e4dad55ec9a5bfcf4511715748", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273967, "uuid": "9d8996b7-639c-4150-ae92-ffb4d09f5c8c", "comment": "Malware payload (AZORult)", "value": "b79e5faf691d2c68d8c0ac318e97a10e1b6b151be3909acc14db5e9a5055b350", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273967, "uuid": "f2aea14f-2455-4fb2-a078-b1ae0d92dd93", "comment": "Malware payload (AZORult)", "value": "c6be247bb5492a815bd13c914549906ff8d5114b", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273967, "uuid": "992c7524-9b56-44bc-b8b4-28f09613e75c", "comment": "Malware payload (AZORult)", "value": "574fb76fb233bd4cf7baaae7dffa349a1692ba3864f89a88eec045c3ab257288dae76cf80f2fc7ad495a0050572ea30c", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273967, "uuid": "98217214-5bcf-46b0-8456-f79dc70e0feb", "value": "T178864B22628CB026C0661A3B4D2FF696643A7E742F25DD2B3B982B4C4E7DF41F615707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273967, "uuid": "d8a069e6-a87d-4146-b8ba-dca45f35b622", "value": "1c3dd32535aee3c5a539d7ac497c828f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273967, "uuid": "da1b7820-ad8b-48f1-9532-e4691ff0d195", "value": "98304:QGWgXhhd8ZfG8rWhlpN6VPSM5vANyXyWvw5TYxrSrmitVpt1ULwno6:QvgxhBmPSM5o1lGqmitVrI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273967, "uuid": "5c94e322-3df4-4362-b2fb-7ca4c67d5198", "value": 8281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273967, "uuid": "f3e4e229-04e5-4066-8c91-3a1c355d150c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273967, "uuid": "0c3df9da-5123-4428-9303-8cbc4f1745b3", "value": "SecuriteInfo.com.Trojan.Inject.16336.3646", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04dd3c9c-2aea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690289508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289508, "uuid": "26c9a719-a074-4e49-b093-4538ed761a44", "comment": "Malware payload (Formbook)", "value": "c35e983405fbf5c365c10a14f93c612b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289508, "uuid": "489812f9-d42e-4266-9a66-032c1bd961db", "comment": "Malware payload (Formbook)", "value": "b7c28ee7487d4a6069c19f375f37600121ba2442181e4d533622f37abafec6d9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289508, "uuid": "84c10e01-89ab-43ac-ac81-4290f2b1f521", "comment": "Malware payload (Formbook)", "value": "277adc0169fa4b51b6dd93e3013f84e8d2d03fc2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289508, "uuid": "148e6856-03f3-4579-a527-d2068aa5913b", "comment": "Malware payload (Formbook)", "value": "6fa9fb48b2bfe15fbdfc422efb2eb6173de1b19df606c8bdccbabc90d7731c9be814fd62bb603225fbb0be045e403a6f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289508, "uuid": "693f805e-36a6-4ff9-a81b-633edbfe780d", "value": "T1DB328D3544C4387DD306907540E8B204FBAC7083ABADBA0EBA71A516C77519E770B386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289508, "uuid": "c47575e5-8bee-4ecd-82c4-c1cfe65a2d96", "value": "192:bya0N4LpTW8eARgZVPCK44AG9xXSJ+Ej7xJY3KwUKwXRWY3cWeUsH6:byX4LpTW8eANK4499xXSJf7xJY3EEY3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690289508, "uuid": "7b9a2ca7-725c-4768-aeb4-48c5dc252dc3", "value": 11086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690289508, "uuid": "fd7bf6bb-e979-4722-92a5-637be407eb9c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289508, "uuid": "040893f0-6ccc-44e0-baf6-1c978e2b1752", "value": "new price list.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e249d6-2aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690258578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258578, "uuid": "f43f6859-0de8-4904-a448-2a9f40784754", "comment": "Malware payload (AgentTesla)", "value": "9804be6aa92c865acb4f1500c74cbff6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258578, "uuid": "388db9e8-e29a-4331-8314-6cfe909091ca", "comment": "Malware payload (AgentTesla)", "value": "b7fecd14973a81f76b9460cfab01c2ef9a6bf722e02dc58c9049121bb3601e38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258578, "uuid": "b158daa5-604f-46f0-a8dc-d33c8bd4fde6", "comment": "Malware payload (AgentTesla)", "value": "52097cd8bf26bb403c7e889a2114829db4ffd220", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258578, "uuid": "257b4bc9-9d89-49b9-b13e-4328036c4c9f", "comment": "Malware payload (AgentTesla)", "value": "95e279098b002ab506037b9cf1b19d580d6712428b78d32c22c1623bb630fe9085589eda76c17de3708819e8cc098520", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258578, "uuid": "9b421423-a1c7-4dd3-9532-9f2e02a7f1c8", "value": "T17E94FA381D034770E07F52B8E64B7D0B3611EBAB6060DA1176B63E1B3B5A257B4F6368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258578, "uuid": "4d30b7aa-653d-45c9-934e-82bd8425fd79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258578, "uuid": "4b014658-2cef-40f5-81c6-e387b4d094e5", "value": "6144:5LbDVZT85c2TcGSAlOSJYmlkfFw3+8+I3Dfv+mdQzHAb:5DbThuSJSJflk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258578, "uuid": "94ed303b-8e93-4c67-b31a-8383d40dd00b", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258578, "uuid": "c4cfc9cd-4ee8-4e6b-81cc-faae9e53340c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258578, "uuid": "edf09675-db2d-45bf-b152-91040b313394", "value": "9804be6aa92c865acb4f1500c74cbff6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4204f8-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290465, "uuid": "e88dbed2-e5c6-4980-9383-b48ac46e7fd6", "comment": "Malware payload (Amadey)", "value": "c461ad93c386805d731218cd483bdb23", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290465, "uuid": "de7e2ad2-41c7-4275-b3a7-cc39ba79b31f", "comment": "Malware payload (Amadey)", "value": "b924f00bc95b03ee3c3cdf8ca8a8cc456728f7663f8fe253271ebbb0539cded2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290465, "uuid": "385811aa-44f9-41a5-accd-24a84c4b09f0", "comment": "Malware payload (Amadey)", "value": "8be1c90ec9947f54d17f14a20bc7981abfae3613", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290465, "uuid": "6cfbdb23-f6e2-448f-9bc9-c25fb1dbbfcd", "comment": "Malware payload (Amadey)", "value": "79a6489e3115be189f9b6527a5d76922afcabc5f7cdc0cafda74d918bb59bc6d1c5594d49f30da55deb22890492ed9b5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290465, "uuid": "6b8ed656-26a0-40db-8c9b-02ecc10f2a3f", "value": "T1932408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290465, "uuid": "4ae6bed8-8524-40e0-876c-8308e363677d", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290465, "uuid": "e81d74af-2f96-4bbe-915a-8f19d3e34789", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290465, "uuid": "961ba5c6-a107-49a8-8976-dfcc05a3d7db", "value": 229552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290465, "uuid": "7813682b-62b4-4c8b-be87-1f592cb42531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290465, "uuid": "0a0f6fe4-deed-475a-acc7-9cf16a636a5d", "value": "c461ad93c386805d731218cd483bdb23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc97b79f-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690273952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273952, "uuid": "e3603f51-cc60-4439-96a3-b99c3d6b7756", "comment": "Malware payload", "value": "359ce13d9f92cb1b6bc604358e0d54ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273952, "uuid": "4d86ee34-d5e0-41bf-b55e-bb1395647f05", "comment": "Malware payload", "value": "b9a3ecc33e079248cd10842b2a258ff59404d3c08df70c76b2ca377a479ca411", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273952, "uuid": "3496a8b9-9805-421b-8cea-0a77b1d5caca", "comment": "Malware payload", "value": "037a8481603b25ece2554c0b81f2e006efe8ca65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273952, "uuid": "5b000c68-66bc-494f-8025-c4ae68b14ec5", "comment": "Malware payload", "value": "fd576498e7aecb589b284bcb51f69099fbaba586d9051507a04a9f030834acb643ebec7e039a347104ee48865d88b14f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273952, "uuid": "b399e9b6-e1f3-4057-94e9-1bdcab690423", "value": "T148B54B73B744753FC46A093A4627F6689D3FABE129068C5B97F44D4CCE390502E3AA4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273952, "uuid": "4c8a4c3d-b90c-4458-b6f7-dad88dafb435", "value": "a6a147270aff725bb19edb907d502ecb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273952, "uuid": "264bd6f4-5fb8-46da-b3e2-93e5f565047c", "value": "24576:yzwVdVkDkS75dJ33vgvKgUXwuvcx13mZTNCdDBsSpQCxtngh52P3FZgcaSAOza:oKkJYmZED+SpQJ52vgj6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273952, "uuid": "1221a25e-2469-43bd-9383-ec4b69842b10", "value": 2348544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273952, "uuid": "8b5b52a4-e9b2-4f98-9b6c-70cd4a170add", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273952, "uuid": "801741a0-120c-4981-b8bd-e555a9f75de5", "value": "SecuriteInfo.com.Adware.Vigua.15266.3376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61306012-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690296965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296965, "uuid": "dc477bd3-88c3-497b-bcc3-548561a70611", "comment": "Malware payload (RedLineStealer)", "value": "91014f983c7b3df3d754e66e8be70c34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296965, "uuid": "b66f3a21-8de8-495e-bd49-4413399b8f45", "comment": "Malware payload (RedLineStealer)", "value": "b9bfb4fd6cf1eee9be468fe072ad55f3cab74c277aa6e982dbc1aa77c9eb9d72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296965, "uuid": "a064c7c3-6d44-4db6-bfb6-631e6a3746a4", "comment": "Malware payload (RedLineStealer)", "value": "b5e41d3c4ab33092546147c1c4dc2f5a1bf2a8d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296965, "uuid": "ecaefe0c-afa1-4f61-8f7b-ce40013a772e", "comment": "Malware payload (RedLineStealer)", "value": "8ee7e7d008ba406b66a43660f78e9cb8303465229bc592937e7cbc711bc0b0f955ba0a9569907aec917e0c9a37b242ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296965, "uuid": "fa1a9af6-750d-41a3-962d-5caa7feb8209", "value": "T1A274E02236E0D032D5A756301534C5656E7BBC72ABB584CB33A82B3DAE713C16F7A346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296965, "uuid": "188cf69f-4b68-4d14-94e3-22a5295247a4", "value": "41f54a8bceede5b7d9a3e6f46d43695b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296965, "uuid": "7ca197a3-5e2c-4cb2-8be1-76c2cb75243e", "value": "6144:Jy2FvfI1CwDP9+st97DLNB/OLl1a7r4IT/ZsB2uOH:s25g1CwDZtJDhBIeXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296965, "uuid": "67a346fc-cedb-47c5-9dfe-8082148ea31c", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296965, "uuid": "2ef0e4b2-b2d4-4450-88cc-c56b2f4b8678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296965, "uuid": "62fa513b-e4bb-4baa-8df2-5f32f4f1a2bf", "value": "91014f983c7b3df3d754e66e8be70c34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ffcf00a-2afd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690297687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297687, "uuid": "973af2fe-e295-4ac4-a22a-dde3b47554a8", "comment": "Malware payload (AgentTesla)", "value": "9ce43a732d8ebabb4a9f09943ac30b92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297687, "uuid": "c6462eef-30b1-4690-8cbc-6f06c1412029", "comment": "Malware payload (AgentTesla)", "value": "b9deb6a16b7a932cb83812155907b37be7968ab717ad9d6964afd3d64c6f686d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297687, "uuid": "933b32a9-25b5-473d-9003-ec4e8f9af37f", "comment": "Malware payload (AgentTesla)", "value": "20e204f1ae5bf1a4529710c2b729e5f98be97a6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297687, "uuid": "0d718843-d12f-45b1-a7f5-59f9dad45050", "comment": "Malware payload (AgentTesla)", "value": "26f443213dbfa5ff648010ee2457e188c5cb25ff7f88be508975219e67ebe43e6b558151437af2611bf1e50fada3a628", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297687, "uuid": "92a6ba2a-c86a-42a2-9676-b1442b065780", "value": "T15DE423C8A5DB7EF6F29870940C63DCDBC4E371E951508863D370AB9E3A638C95D69C28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297687, "uuid": "efd553c7-ed8b-4385-9814-e48651768420", "value": "12288:jTKwrpRLNIDDCZmBET+GPDh4Fk1R76WptpmIdegOrDHf09hyXP6+/:jTKo5EWZoMbPNPeWptpmIdcf/+hy/6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690297687, "uuid": "4b531cab-663b-4964-b92a-fef162d89e91", "value": 664906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690297687, "uuid": "64755701-44b3-4e7a-aaf0-c7bb8677f69a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297687, "uuid": "a8d6b9f9-a832-45a5-8943-5f21a11d6d8b", "value": "nITEM ORDER 384774FHHFFJ-4847FF8FN.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3bf1ab-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690273948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273948, "uuid": "af8c3932-4bab-4bc0-a8fa-fe2ea8d1a7d6", "comment": "Malware payload", "value": "82f45d97a4b10d7d6d2cf38b10d060b5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273948, "uuid": "97e9a505-95d5-441f-ab41-35d3aabd7fb4", "comment": "Malware payload", "value": "b9e4bf93c7e16c9e4f9e643f59256547c16fc7309f0e417155b6eb33d9aed70b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273948, "uuid": "8ca10425-ea0e-45dd-b7d3-9ede734d54e6", "comment": "Malware payload", "value": "7626ed26ffeacad21b1679f1e07c1f1cbd8e62a0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273948, "uuid": "cb92ff2e-aecd-46f5-a0fe-4ef1dde29a23", "comment": "Malware payload", "value": "6fdc691a56b0cb500fde7695c7e60161811c2e4a00de253f113a1e75c26f25f7482a435de194839578577fbf89321d05", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273948, "uuid": "246349b6-a71e-495c-b0bd-4447cb7d40be", "value": "T13F435C2162A142FEEB65A53570A72776933977510362C4CFEF36FF285E22126F12D30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273948, "uuid": "ee5f595c-cfa1-40bf-a206-90188669e455", "value": "8fa92390158c809a6cf9ef412d9c0795", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273948, "uuid": "b1a012a2-ae50-4286-9b26-d701686e0931", "value": "1536:zD4WhCSeYpxyK5kMAXGVat6BmXPvcJFKUn0H2r:zk3SeYry6kMsGV4643cJFKij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273948, "uuid": "771c3b16-932c-4b18-81c2-112153f4d3fb", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273948, "uuid": "c7fab653-c1e9-4b5a-8e48-36f5a183136f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273948, "uuid": "b0df4dc5-0778-4b9c-ba63-87aff4d5b130", "value": "SecuriteInfo.com.Trojan-Downloader.Win32.Small.16106.16093", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cfa8479-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290461, "uuid": "4aecc47e-7c31-4ad9-a8a3-a4e1228e73ef", "comment": "Malware payload (Amadey)", "value": "cd47243b765b668e833597676454196e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290461, "uuid": "ab138b0a-6adc-4fd4-a156-1698e0e87c33", "comment": "Malware payload (Amadey)", "value": "ba001711c022bf7d05631e57a93fd470559cceae16f78f2451582c8ff0e57ab6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290461, "uuid": "b53f6680-86b1-4d27-80f1-69ae2c6873b1", "comment": "Malware payload (Amadey)", "value": "f666c73c1cee6886fcdb07559b88717a72c1ba66", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290461, "uuid": "8e727aa4-2d45-45c8-99da-9fed2bdc5b06", "comment": "Malware payload (Amadey)", "value": "8c442577629e76da138e19eaff70d5d863a91f7178bf4c45e93fd020b482f49eddce5a4a705cf2e00ed1908c420958b5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290461, "uuid": "511fe166-6de9-45ea-b7bd-593065dbd9d9", "value": "T1B7840113EAE95073D8B4137058FB03930B367DA15974877B275AA95A1CB36C0AA7133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290461, "uuid": "ea23a5b6-d423-49bb-a61e-e7b7bb1e56c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290461, "uuid": "33441ccc-7df9-47c9-b8b0-25427afb229c", "value": "6144:Kvy+bnr+yp0yN90QEhSGyF4tv9hWiuiiGc4gBZ+t4+DADIffmuzq7Me:dMr2y90VDNVg4gBYC+KIHPwMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290461, "uuid": "c9a21fb0-5f7e-4a43-b406-21ce295fc70f", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290461, "uuid": "d1cb33f5-3f10-4aca-8886-af3f274d7ec9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290461, "uuid": "1df9c671-1a9f-45b4-855e-9e1524ca3a6e", "value": "cd47243b765b668e833597676454196e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c6957f-2acf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690278054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278054, "uuid": "d5bbfa71-bac3-47bd-a223-c50d6772fcf9", "comment": "Malware payload (AgentTesla)", "value": "0189de6d48b4b384c15008587f19a253", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278054, "uuid": "2ca13c2b-5e6c-428f-9ae0-10da75d4d3da", "comment": "Malware payload (AgentTesla)", "value": "ba2ca0c5ba29b90d2ce55292293642c9f6b3b931381db8221d529452d04a5189", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278054, "uuid": "ce4addf2-f406-4c04-959a-2d0fca898cfb", "comment": "Malware payload (AgentTesla)", "value": "96c6a75bbfb442fe85768c5238088e6fea43f95a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690278054, "uuid": "8fac3695-b4f1-4335-8776-5a5c6eb352d0", "comment": "Malware payload (AgentTesla)", "value": "011e17a412171adb93676954ab9b1c0dd1d5f85f20f21906198f8cfb6bd00b8ac90c50833df4841610040f575d969bf8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690278054, "uuid": "c75e97ac-bb3f-40dc-81f0-bd3174a1ceb8", "value": "T11505F12135F99B97C5BA93F84020323013F9AEDE7536E3496EC670DA2971F848662F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690278054, "uuid": "cfe69eeb-ebd7-4991-a34b-c01acae9122d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690278054, "uuid": "d98f0837-7024-447e-b5b3-536bce82c0e6", "value": "24576:UxmfHIcTrGCSHu+TF0v81xsaRJEgklwvMO:kIHIkrzSHFTFfxPDTqwUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690278054, "uuid": "66c712e5-06ec-4b21-9d84-746efcebb846", "value": 820736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690278054, "uuid": "28ab2a0a-5b4d-47f3-9cce-34a780448190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690278054, "uuid": "f850d41a-c274-4aee-a9ab-5c354ef95042", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f35804-2aa0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690257862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257862, "uuid": "9e27ee48-869c-4bbe-ae1d-6d9305f319ac", "comment": "Malware payload (AgentTesla)", "value": "7561b44d45254e3faf0c81218ac75ade", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257862, "uuid": "a0c8295a-01bd-46af-ab0c-0e20baca55c0", "comment": "Malware payload (AgentTesla)", "value": "ba519e6832804d25ebdd7d18ec62bdf3e68f18f8fbd9b90f9701509938cb28d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257862, "uuid": "759448ee-db7b-4c34-99a7-c405afef63d1", "comment": "Malware payload (AgentTesla)", "value": "08cdf1b9b99be52da846b9630305872ba808344c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257862, "uuid": "eb7e1ca5-7197-4584-b983-fe79223db7da", "comment": "Malware payload (AgentTesla)", "value": "7901e1eac2edc230739c06eafd4e63677442daacff9c997f697e0e447859abb970d00dac73554e119c6e38c45e6fecb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257862, "uuid": "ad73a2f8-a407-4f21-9a95-23246f3744c1", "value": "T1A3D4E0A63A14DDD7C416673D48F5E6124A28BFA63C91D70FB124B77FBB33B481806A84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257862, "uuid": "7c343b1c-416f-4933-bf4d-6518640f50e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257862, "uuid": "93907a01-cf24-4bb9-b07b-4db04d067a60", "value": "6144:6E1YbTMY0hPzDzjYaZq51nAIup9HwxttLacFESNzxEpoSU6ygAwn/AtWYJy3UBX3:6E1fd/YH51n9up92tG94VoAly+BO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690257862, "uuid": "f87c086b-365d-4863-a409-d21448a0f2ec", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690257862, "uuid": "8f1d54a4-9677-4409-bc1a-af772352d0f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257862, "uuid": "b54e9825-4902-4eef-98ea-8b3008356b01", "value": "7561b44d45254e3faf0c81218ac75ade", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d0e842-2aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690258584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258584, "uuid": "cfa446d9-c4bd-43b3-ba84-7d71a19bd6cc", "comment": "Malware payload (AgentTesla)", "value": "8a48751128696d14264571ce0251f9ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258584, "uuid": "66e9679e-c0e3-45c4-9ce6-02b0764b58a1", "comment": "Malware payload (AgentTesla)", "value": "ba68d6ff7dd15612510cf1a904864dce45288c0dcdd91a4a0ee9c4094826abe0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258584, "uuid": "6c62ad13-fd33-46cc-a6ad-cfdde84b6059", "comment": "Malware payload (AgentTesla)", "value": "67aa87c0c60247b26c01c4393410023d045b2407", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258584, "uuid": "b5f6b966-0513-4cac-be26-0c09c02179bc", "comment": "Malware payload (AgentTesla)", "value": "d476987c14159f544494be389f873fab1a2b23228929a75b07a448cf56bace32b95194a85c860791500425a54fcc265b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258584, "uuid": "4bf30546-dee4-4ecb-b8f5-4e46fe23f3ee", "value": "T1FA941B382D524730E07F56B4E65B3E1B3614FAAB6460D62531F63E0B3B5A217B4F2329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258584, "uuid": "d7626654-6979-497f-90c5-a4c79028a451", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258584, "uuid": "9e66afde-c38f-4d22-a42f-44317be94a7c", "value": "6144:dbExbF46zW3R/cnhplcp4L3uADoTrCoFt3+8+I3Dfv+mdQzHAbl:SxbFZz0RUnu4aADerCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258584, "uuid": "6dc53ad8-f702-4f2b-8e2a-0d6ab595183f", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258584, "uuid": "44d14cc1-c7f2-4cd0-a217-49517212b860", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258584, "uuid": "a2b94a4b-0dbe-4027-99ae-111ef17e6eaf", "value": "8a48751128696d14264571ce0251f9ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79feebda-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690280256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280256, "uuid": "4007a41c-6eb4-4508-b422-f8e48a9f6b0e", "comment": "Malware payload (RedLineStealer)", "value": "c83cd32cad67213ca21d0d6364f2440f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280256, "uuid": "efa0cefb-5eae-490c-9cef-79dfc30b0fe7", "comment": "Malware payload (RedLineStealer)", "value": "babe2bac544203762a76125e6b592106f506b056d4d23f1b565156419c12e0ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280256, "uuid": "a10dd4d8-5f14-45d6-a0f6-02e1da8670d0", "comment": "Malware payload (RedLineStealer)", "value": "0478b6587a63a51b4c2f7ed792ecf441936c3b21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280256, "uuid": "e1ce6b1b-21df-47c7-9bd5-a33b2a2a5c1c", "comment": "Malware payload (RedLineStealer)", "value": "8cf09f280ee866e09a2a980505190c45390dbf46fe3499ba40ec2eba25dc9510f878ead2a3c00a3d35cf2bf0f2fa9e0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280256, "uuid": "395a5fa6-3a44-4d1a-8402-ac6463386597", "value": "T187840247ABE84032C9B527B058F207C30B36BCE65D78936B2346995B5C736C4A97272F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280256, "uuid": "8b557fa1-dc7e-4331-bf35-2fdbd23060df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280256, "uuid": "448db0b3-d0eb-43a7-a8ab-c234fe069bbe", "value": "12288:UMrqy90w4X0+1hRveK5bQPRwxgBYCaoEb3x:WyUX0+1rLZQPRwaz83x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280256, "uuid": "1a3ff949-c348-4abc-9996-e8b1fa91caa1", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280256, "uuid": "dce8be06-be0c-4d2e-a3d0-bbf4c967d1fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280256, "uuid": "f89ee536-ccfa-4bb4-84ab-3ce234d8f5a5", "value": "c83cd32cad67213ca21d0d6364f2440f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4ea0fd-2ad5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690280558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280558, "uuid": "49068470-bd49-4518-8f61-c5eee1ad2a99", "comment": "Malware payload (Amadey)", "value": "f38a8575f981bebc60569093c73b0b73", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280558, "uuid": "aad0b8e3-38f6-400a-9b69-1c28121abe71", "comment": "Malware payload (Amadey)", "value": "bac0708d7f4315ffe3b2fb0d9b18639251e8d4d6b26c67190801b4ab1a567cc8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280558, "uuid": "1690ac17-761d-4ce4-bb19-8b9b0dae610f", "comment": "Malware payload (Amadey)", "value": "5e0aa66744a499913386d818c86d4ffc45ad225d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280558, "uuid": "b0aaec4c-2fc3-45af-bc6a-4294d25b4ed5", "comment": "Malware payload (Amadey)", "value": "f8e3ab762d361461aec89a37d04074ea1ce5e854eaf545450cd3e9ed36af291c6dd4ec9b3cbad54c8cfbd1a067d727f8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280558, "uuid": "0f0d22d6-015d-4916-880a-e650a95de2ff", "value": "T1EDB40256FAE48072DCB92B705CF702C30B397CA56970836B67C9969A1DB36C0A17533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280558, "uuid": "937cbce0-988f-4872-84dc-13f66d41e557", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280558, "uuid": "1b7a98a5-571c-4e2e-b3e0-f8188f4a3d55", "value": "12288:tMr7y90KyKMl97BdatgLy1Emo12WNGrvV6UIaJYOZN:6y/y7td3Oam81YrvV6U1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280558, "uuid": "ecdfd87d-49f3-41b8-b502-70b4b8040a44", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280558, "uuid": "589529bb-fce0-45aa-9b7e-317dc3416489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280558, "uuid": "24be1930-515b-45a2-8aec-32bce7ec6e04", "value": "f38a8575f981bebc60569093c73b0b73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d405d139-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268810, "uuid": "275d9a96-dd92-4bf9-92c6-9f4ff0594b26", "comment": "Malware payload (Amadey)", "value": "9ec4d75fe4cc7e43663c01a17bdb847f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268810, "uuid": "417a1e5a-1a1a-4d8e-b595-ab05861f31e8", "comment": "Malware payload (Amadey)", "value": "bb1f61a719c251eb12a90190b48c7a25732961927f3324a074b38f1940944cba", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268810, "uuid": "4d108440-3bfc-456f-80ec-fe379245304b", "comment": "Malware payload (Amadey)", "value": "c1e75db35aa5ef4e8bc649443b4e1484d211d97b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268810, "uuid": "5142cffd-eb1d-440c-82dc-619c28ec51f0", "comment": "Malware payload (Amadey)", "value": "7613497f870a2228da52c2530862b1c0180889aed5d1767e7d061a331bac965bf9c2c3a3c2c359b97580378cd469e628", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268810, "uuid": "d32b7881-f8a7-4b29-b1d0-6fec0fc7ab5e", "value": "T10C840212A7E95032E9B15BB058F702D3173ABDA19978937B3349B94E0CB36D0A53173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268810, "uuid": "5bed89cb-a886-4ee9-96fb-c8b0e10d20a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268810, "uuid": "70b3fbb0-9fca-4879-a612-4683f66eba8c", "value": "6144:KBy+bnr+Cp0yN90QEExz4SodoMJmZE9kuXdv4Rp0mhHYDCP9naFLL:/MrCy90K0wZykuXEpnYC9nA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268810, "uuid": "fbcfb0b2-c61a-47fd-a4bd-1cece3a70aac", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268810, "uuid": "26cefb6c-2243-41f1-8ce0-f1e301825c36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268810, "uuid": "4c2eefd3-69fe-49ed-9f18-88842653806e", "value": "9ec4d75fe4cc7e43663c01a17bdb847f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45964d7d-2b02-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690299925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690299925, "uuid": "f0b0a617-064f-4dfb-a253-9fe9172104b1", "comment": "Malware payload (RedLineStealer)", "value": "6120ac154ed1b9712d404c2fee602d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690299925, "uuid": "d781eed2-6fab-45d2-a003-a84b6ff395b9", "comment": "Malware payload (RedLineStealer)", "value": "bb696af20e02f6f4660a104edc8595ca570e643b800d641d83b673b986f6e84d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690299925, "uuid": "4f376c66-c40d-424c-ae5d-0faa77a283ae", "comment": "Malware payload (RedLineStealer)", "value": "a9c1d422c53dac4d78534b8c130f8c27b11ffda0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690299925, "uuid": "74bd90a3-8eca-4c68-83b3-8e9db2ffb806", "comment": "Malware payload (RedLineStealer)", "value": "4a66b41fc5d0b2054823fd10cfee23f4b6c53de2bb2c4dfe5d43414114ddba4093e9924ebdd37b071d9fad16b745968d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690299925, "uuid": "462daedf-cb69-4495-9b5f-3b70fe381d2a", "value": "T1A244CF2276E0D072D0A395305970C5A12F7B787267B885CF37582A3E2E70BD1AB79397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690299925, "uuid": "adab3acc-01cd-4e4f-8068-b6e42ff0b862", "value": "1c187c5419584098cd104bb53d369d28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690299925, "uuid": "735e3f9f-be41-4280-b99a-c3d019585142", "value": "3072:3PfZ88sy8tgVvEJOv2ikAjb36kEPGR0lnrvTy4Q38j8W:HSFyegVMJO2KSTO0lnrby45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690299925, "uuid": "cafc52f5-e259-4e32-8b35-3a28b6f413d3", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690299925, "uuid": "5c3b2779-aec7-4a59-9b8b-060b2c5f5a1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690299925, "uuid": "77568e29-6d42-4b29-abdc-4818be53b14c", "value": "6120ac154ed1b9712d404c2fee602d1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d69ec49-2aa0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1690257847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257847, "uuid": "0b711648-9ebd-4162-baf3-7b8f0bf067b8", "comment": "Malware payload (XWorm)", "value": "10fe0b13b93aefec13e66efdfcc27f5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257847, "uuid": "5836b75b-8fb7-4b94-94be-a85e7e310062", "comment": "Malware payload (XWorm)", "value": "bbdc4cc5d4a78207b98c8280527ba09d6466614075da1ee5c3e3f97eb498cae6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257847, "uuid": "c9d66e7e-2aba-4dbd-aa03-3eec6faba7d2", "comment": "Malware payload (XWorm)", "value": "ac5178071739d4c996de952f4ce1f5c21827d115", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257847, "uuid": "93735494-2e45-4ec5-af5c-5fb06ce1c6d0", "comment": "Malware payload (XWorm)", "value": "8ad75488eb6db3dd423297b79e9f77e900029c65502b02f902c52c708266449f2859bc68b905128117fe5301ce79bcd3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257847, "uuid": "262da5fc-feef-4b63-b4b9-a7ea05dad3ad", "value": "T162F45AA3E759199FF0A674FA4C12FC75162B9E208624CB19168B260ECFB731394F251F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257847, "uuid": "3fa1bf5d-c829-4dc4-b778-d67452ce70a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257847, "uuid": "ac0d1035-8ed3-4ec2-8df4-1d1bedbbf9ed", "value": "12288:IFPuY0PSzWUAPSzWUIeRNq0tnJGqSEyavoMUCVZ:QPuldUmdUnRRwqFroM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690257847, "uuid": "0008edfd-2c82-41ee-8f99-e9e2977f59c7", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690257847, "uuid": "29980e3c-0921-4d25-baa4-42d77dce8248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257847, "uuid": "af82a92a-21a4-4bab-aa0a-73cc8f7f175f", "value": "10fe0b13b93aefec13e66efdfcc27f5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "facdc573-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690268446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268446, "uuid": "2fd4a648-6bcf-4289-952b-43c97524f4ae", "comment": "Malware payload", "value": "ade5357ea198c4fd987db20d82384ac2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268446, "uuid": "3ab3ebd3-6a0d-4099-b42e-01b01644c5a9", "comment": "Malware payload", "value": "bc0f024f22e48f1ea03fefdf48f9a1bf5375a53960308cb30783a91b3963fe55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268446, "uuid": "76f2a2a5-d429-486c-a225-6dcf85415157", "comment": "Malware payload", "value": "2ff8ee5473a7d4868087a004cd9e8bd39be3cb32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268446, "uuid": "ae845f35-15eb-4b0a-bd18-ef12c842c8eb", "comment": "Malware payload", "value": "69208e2cb4d8bad86c2417389b583e97ecb22db8e562ec43c2f457f195b5f22340453459aee412fd3195ab0e38963190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268446, "uuid": "304d8b11-27bb-4013-bfc0-e1fba79b9941", "value": "T1EE64F81B82B17C51ED17DB729E1EC3E87E0EF6508F497B6622199F2B84B11B2F163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268446, "uuid": "d3776b3c-d84c-4451-bfd4-c83433d3449e", "value": "288497572d529233d7fe65807fe0c26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268446, "uuid": "1b6ec426-fd20-41e3-b7e6-74fe88243c06", "value": "6144:7nKeWLjZw5YEGNlSFcBcA2nCGZLrG1ETj:7KeW3ZTE6vKAOLrGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268446, "uuid": "c23c0b86-097c-423b-8e0c-efc8d3c8318f", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268446, "uuid": "6121442e-e076-409d-ad89-3b06c9635428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268446, "uuid": "45bbcc9c-0ca1-40d8-816f-68262e3ef061", "value": "ade5357ea198c4fd987db20d82384ac2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb96db93-2afc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690297546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297546, "uuid": "732b190a-dfca-41d8-b680-0f096546c913", "comment": "Malware payload", "value": "d17bce2bc8bd1ecd1fbe990a06b27178", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297546, "uuid": "8498269d-622a-464d-8a2c-fa1ea111d025", "comment": "Malware payload", "value": "bc98f98ea32dee104414f7a7602ff7d0a2f013f16427e8095e25803dced23b05", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297546, "uuid": "c1051bb6-10e5-4698-922b-46220eea1e55", "comment": "Malware payload", "value": "84afa93ddcb1b76ee75964d295ba7ed9085daedf", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297546, "uuid": "5d35b23d-7dce-4485-8730-580742cf5f38", "comment": "Malware payload", "value": "782cc13b65726a90f71d34ff8ff66daf18346f34fc720dd82200e459169199dd5be75034dc9267f9e62943bc9852ab23", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297546, "uuid": "eb93611e-ec72-462a-8cf7-e4ce90e397d5", "value": "T14EF4234078D4663EC88286303F3B62EB454EFC106BD8F587127677661576A7E61233ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297546, "uuid": "09b6796d-d333-4e7e-8f03-0a190700f05a", "value": "12288:gOZibBC6uEkX7HqPBC6uEkwqUu9Vneo5WdP2CfcRBL8Hjm7vl4SukyF3hk67DgEG:2w6sOw6sOu9VydP2Cfm8Hy1hohWETLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690297546, "uuid": "ae487495-31ae-452e-a1f8-8cb232dbdd59", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690297546, "uuid": "0fc044f3-91b8-429d-811b-9f0c8a4d5d1f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297546, "uuid": "f7d759e8-161f-4efa-9bf1-48baa4e4f499", "value": "comprobante.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406d7c4f-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290467, "uuid": "64a56dc5-0b4b-40ca-b45d-a965c6e449f5", "comment": "Malware payload (Amadey)", "value": "737d4ca1444a8b37b46f42875e518787", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290467, "uuid": "dd93b644-c8b9-41c8-8880-e0b8065d87ac", "comment": "Malware payload (Amadey)", "value": "bd89f4b987e4e8cc7525b72546e690d2864966d802fd77bc37e81b52b4516446", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290467, "uuid": "28dbe3c7-31f3-4d91-9518-3691a9f08e56", "comment": "Malware payload (Amadey)", "value": "d88ff3a8f01b06fb6f1e0d455758154f1940ea88", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290467, "uuid": "f885d757-f1d7-4ebd-bfe7-b058a114ae11", "comment": "Malware payload (Amadey)", "value": "881b62f8451559c7d9b221b575d852173fc1fa42258ecf10f5404ce37bd295eb5f5c645ef5c67bcfcd5441645c2379db", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290467, "uuid": "3353b88c-1568-40f0-97a7-14df1ba5724f", "value": "T1E2B41212E7D94073CCBA27B01CF607D31E3A3CA2AE78439F6355895A1CB2691A53177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290467, "uuid": "3a680a65-cb2a-4c20-92f7-00990569dbcb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290467, "uuid": "c30693a4-55b7-43c0-be4a-3c5aa2f39a99", "value": "12288:fMrry90i0xGHCkgMmnz0zashnlYgTr4zQxWj1Z:kyp0gikgMm0zascqr4UxWj1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290467, "uuid": "b1e3a259-7723-4ba9-8a4a-0b6a088da127", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290467, "uuid": "706597e5-d275-4ecd-9fc1-f8eaa07df19f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290467, "uuid": "cff614ea-95b7-4061-aa32-41eb71e37557", "value": "737d4ca1444a8b37b46f42875e518787.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b929b4b0-2abf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690271342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271342, "uuid": "b8c59b04-a254-407c-bbd2-1387f731e264", "comment": "Malware payload", "value": "16c86dc754159962f724b63508563cd4", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271342, "uuid": "e485a445-5da8-4522-82fd-250d6a644931", "comment": "Malware payload", "value": "bdfe26c46506f0b521cd53a6b81a075b8354c87007c22549afea86f7a3f8ef33", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271342, "uuid": "ebd1d2f1-521d-415d-9f9e-b9ef70b1daec", "comment": "Malware payload", "value": "d8d33c52dc22381ef960beec4cfd5b0467eaf652", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271342, "uuid": "c07ed619-e13b-434e-af75-6c34160fffef", "comment": "Malware payload", "value": "85aa051fcc476478d51dba1b338225afbaac272111ada1788562763b05d10e13f462b42895b70ec48e15ae42ff728d2e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690271342, "uuid": "ad9803b1-4d7a-45eb-a826-ddf2876bbd2d", "value": "T166036D5AE78F02A48F5112B3571A0A889AFDB33EB35155B1389C933433EDC3D42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690271342, "uuid": "c2acb24a-f3d9-42c3-a2f9-d1f954698c9c", "value": "768:0Fx0XaIsnPRIa4fwJM0QuFf5thkzqS4mPPOV:0f0Xvx3EM0QuFf36ztPOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690271342, "uuid": "e52a26db-e477-4285-8156-bb5f1fde04f7", "value": 38858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690271342, "uuid": "2dd5d7e9-b80b-47c3-9f8c-eb98f46b0859", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690271342, "uuid": "e4afd4c4-2de3-4349-878e-4c94c118c84f", "value": "16c86dc754159962f724b63508563cd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614fb0b7-2a9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690257022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257022, "uuid": "819fbc49-0ad4-454c-bc26-8656159898ac", "comment": "Malware payload (RedLineStealer)", "value": "bca2197eefdb2e06f4b9cf01f1d3e291", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257022, "uuid": "06fe5a67-6251-43bd-9073-862e23753690", "comment": "Malware payload (RedLineStealer)", "value": "bf86954b47a7fdca4dc480c1ff5690f568119fab3fac0ab669f3785a823eb758", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257022, "uuid": "3fda5b0c-0a4b-4f11-bd6b-171bc81e1fbc", "comment": "Malware payload (RedLineStealer)", "value": "7acaf21860434670e75e215390cf7190ac83e94f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257022, "uuid": "614a80a3-5acd-404a-a9ec-47b1aec7b45e", "comment": "Malware payload (RedLineStealer)", "value": "6bf7d0fdad706382e797fc40e49355101af972685ee052cc660b61ecda5a04cddb43ec4576e85dca6d8bdd04430358fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257022, "uuid": "af45f2b5-9b99-4e4c-a21f-54ef871d4c57", "value": "T125459D6438D1452DDEA110BC8AECB12801ADECA4C723F6FBF7D49ADA97209D1F735186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257022, "uuid": "a3c44462-676e-4604-ad15-60f78232b5fc", "value": "99618c39aafbf01419fbcd53cea0e110", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257022, "uuid": "8f348cf3-5cb7-408e-a773-5e7a9dcf29ab", "value": "24576:xAWhpIoa5PMZ6AgQuUmNxX7oMn7PXWYwk0:85PMZ6uutf7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690257022, "uuid": "9e7aedcd-bd40-4fb4-9fe1-b1c09af5bb1f", "value": 1208832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690257022, "uuid": "a43d0b6d-d90b-4595-a4af-d22f60de37b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257022, "uuid": "12c8a815-5ffe-45b4-af7b-141768145fdb", "value": "bca2197eefdb2e06f4b9cf01f1d3e291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5401d69-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690267927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267927, "uuid": "5a82e74b-b4bc-4cf9-9a31-38c039255949", "comment": "Malware payload (Amadey)", "value": "1ad8dd46e81d01cb48bae9910d656948", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267927, "uuid": "46849ab2-d389-44fc-9e04-4b6b7b419dd8", "comment": "Malware payload (Amadey)", "value": "bf98ff554f9ea137c1e45ac5f5b955790479523552c5b7d0c9e2a77cb87a5eaa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267927, "uuid": "3206ba95-030f-4aed-beef-471729ad6f92", "comment": "Malware payload (Amadey)", "value": "5560c880d322c229b81d59dcf0227110a1650739", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267927, "uuid": "47c5e6f9-90d3-4e0a-a037-247e5a424a19", "comment": "Malware payload (Amadey)", "value": "19d1e4b171c59e405a56ca4d46689bce4e17af75e78a19ef552503cebc09bc37b29d50bfd36638df069bc3ed384f7e4a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267927, "uuid": "620c0405-5559-43a9-a5f3-0446060a7da8", "value": "T1AF84F113FAD84472DDB61B7118F707C31A36BDA48838833B2746995E1CB26D0A93677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267927, "uuid": "f7041447-e0ad-471e-b861-a4968e594560", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267927, "uuid": "14a24912-05e7-44ca-91d8-8291acc757e5", "value": "6144:KNy+bnr+Jp0yN90QER8Dd5NA55t5Zh554OaGNringmZE49DgikME9:LMrhy90QBEt5ZfqRcin5E498ikf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267927, "uuid": "f35b3d73-743e-4d6e-8f50-6113734f98b8", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267927, "uuid": "42ff63b2-6f92-4446-bb9e-a9a8486564b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267927, "uuid": "304fbb31-a3ad-450c-bb57-b96508f76bd0", "value": "1ad8dd46e81d01cb48bae9910d656948.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661ea60e-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268197, "uuid": "63d2047f-8ebf-45b2-bc6a-4828dc62bb9d", "comment": "Malware payload (Amadey)", "value": "4529e87ac6a6ee8044834b459dec08dd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268197, "uuid": "58f68252-9593-4c69-b21c-904bed37a6ef", "comment": "Malware payload (Amadey)", "value": "c2b8fde66ae3a859814849675c5863c5634911e8fe4415e41d64d0b19f949912", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268197, "uuid": "c68dfee0-8d27-4aaa-8f3c-9605671f79b5", "comment": "Malware payload (Amadey)", "value": "1cf28f7bcfb01b46b906fcb020bb11967e5b5838", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268197, "uuid": "8ea77ad3-aef1-487e-a8b9-b8fbc6372b54", "comment": "Malware payload (Amadey)", "value": "fb1eda98071f3d3e4fe655ee2ff159ca9d9b86e4505d0d2fb8aad8a082e442607c45844bf1e5ffcdefe8e44b5c532e60", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268197, "uuid": "7e4c78da-51ba-4ae7-a725-7cbb7666d8be", "value": "T18B840103A7D59033ECB557B018F602930B367CA79DB5931B3745A99A0CB2BC4A83673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268197, "uuid": "1262bd53-848b-42a3-9f15-a39c64b4fbbd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268197, "uuid": "8194a7df-a437-4522-8012-8a561206a619", "value": "6144:Kny+bnr+yp0yN90QEVG7piVhKQsZR/LU/J8qWf786gBZ+t45Dtcf9n:dMrmy90bIUjKQ+RY6fA6gBYC5Bcf9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268197, "uuid": "e4a105bd-415c-40fe-a94e-c27d7ff0e48a", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268197, "uuid": "bdf28cf1-e606-4a6e-aa05-ab10a43b69cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268197, "uuid": "35db83ff-264a-41f6-bb3e-6c9293c2cd3f", "value": "4529e87ac6a6ee8044834b459dec08dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3072bb-2abd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690270304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270304, "uuid": "5cdbc531-2c68-42a7-b289-fb9a05b4a759", "comment": "Malware payload (Loki)", "value": "adbb755dbb4f9bd58c121990dd06d43a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270304, "uuid": "b69d81ca-c39b-4132-86d6-2364c5d3b44c", "comment": "Malware payload (Loki)", "value": "c2f5994e24f8cbd4f5c679459330b57288e1ac8e6af4456a36beb4b8033240a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270304, "uuid": "8c779302-7d63-46d6-aff9-789053ea8464", "comment": "Malware payload (Loki)", "value": "3c939bb6600b8d8349a0ec1e3ecdbbb6f1fd763c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270304, "uuid": "8c559d21-5d73-4868-94bb-a53384bb55cd", "comment": "Malware payload (Loki)", "value": "3d163d0e7fecb118a5a625ba74eaf783e323f56ff2bff73651ee1b6543192b91475751674e29447bd6afe8ec2b57b21e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270304, "uuid": "e925adee-1d9e-4089-920d-52f8c2328750", "value": "T143A422583FBDDF68C8EF6BF579A05D4243B1AC1EAE21D61B6E9230C20D537004662B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270304, "uuid": "ecd4f078-3e73-4b85-9d23-fa5ea2900955", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270304, "uuid": "d6d602fc-67ae-4074-8c02-5d41591a1ef0", "value": "12288:gaqOf6/zrkBH6RgXupS2OujsQ7Tmd8HkT8:MMOzgUgXupvjv7C1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270304, "uuid": "4f172785-ba0d-4239-bddb-d531f77217ca", "value": 465920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270304, "uuid": "520b85b1-9fc2-4d70-b04b-49a2ac9964e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270304, "uuid": "4d78f933-d0f6-4ccd-8298-5bbc1bebd02f", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd689b1b-2abc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690270115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270115, "uuid": "97caf285-6f2d-4bbb-bac3-14c94403d120", "comment": "Malware payload (AgentTesla)", "value": "1a89bdd8effc2c87191432a6f49b54f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270115, "uuid": "b563f478-2efe-454c-b077-d830195f2b1d", "comment": "Malware payload (AgentTesla)", "value": "c3ab80eb5917d2447152aa4ff835e5b7bcced3a708404cb9a7424976b5c462d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270115, "uuid": "e76d3146-1206-49ac-acc5-a02ba1157efc", "comment": "Malware payload (AgentTesla)", "value": "51cc953f86a9006c5741e86f6f067a5552bf3bf1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270115, "uuid": "a2c64786-992e-485e-bcd9-7f0792255f13", "comment": "Malware payload (AgentTesla)", "value": "84d7f8dc6d01405b8e26a28f2ee3525da90e0db1415db0680e649ee3bba4e2dab2e6f6bec5b07ada7527d939227cc5a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270115, "uuid": "c835234d-8e7c-4e65-9265-74963610aa24", "value": "T19DF423B1B591D08F772820ACDE05ED5F8215896C47B902ACFB5E58D4938E857A0FC8FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270115, "uuid": "e44eebe8-a5f9-4052-be95-0d6b2690b3e8", "value": "12288:Amd3pewj8mKUBrXmCDt3kO/vYEBZgGapO/xHOgjptiuM09bJDO3Yw4:A88wj8m5BbmCNkzUBUGvVtJM09bMYw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270115, "uuid": "81f35239-d965-46da-92a7-a2239ef0efdb", "value": 735135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270115, "uuid": "6c9b982b-1891-4e8d-9542-36d0d695f4e0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270115, "uuid": "b673449c-d00e-4f3e-92e3-df65f354c1f4", "value": "Documents.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5959df-2aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690268984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268984, "uuid": "9aabff77-ac92-444d-ac76-6034cacca3e7", "comment": "Malware payload", "value": "31a403d69aa72f37c7e51d15746ea9de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268984, "uuid": "243e2f58-46f9-4e05-9f15-125f115d0ce8", "comment": "Malware payload", "value": "c3d60da19acb6c0f81b559c383b1b9aec1769c388634fe377342fcc155e0eb35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268984, "uuid": "71ca4538-0ceb-4bc1-bfc4-8e8f20f9b602", "comment": "Malware payload", "value": "eeaf899266f64a1a3a01569f6fc278727e2bf4a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268984, "uuid": "3761e8a4-5c36-4511-912a-54a354cb6da5", "comment": "Malware payload", "value": "2673c9ab381d751aea502a02e65e8eb75db33cc5323e0a4964621cdad75325adee7ccaedd82eb3ca49ac4eb5bad5a6f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268984, "uuid": "80b770d1-2412-4851-9427-ff3fddcec9db", "value": "T120A64C19BC842BAAC46C8F7485F68A6123745D044AE15B352664FEECBCB62387F47CDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268984, "uuid": "b74c32cb-3bb6-481e-8c6a-56338977924a", "value": "49152:yAjE4criWSH/iAOteGNJi4lR7z0QMwaThrdUSou5NeH++71/r5WFFb+NZaZIn/Qw:HtKRpx8v+eGnIU3RLUtjH5cFSRROOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268984, "uuid": "8da53e46-7de8-4621-8df2-b7c11c0c2445", "value": 10264446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268984, "uuid": "794bf32e-0cd5-4a0d-bab0-8beb65bf3f54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268984, "uuid": "bf3b86b9-6aaf-4f8e-abdb-ac9d0816a8d4", "value": "31a403d69aa72f37c7e51d15746ea9de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06d47e2-2ace-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1690277824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277824, "uuid": "6ada9841-f6ad-4297-b46a-f352bfa8aaad", "comment": "Malware payload (StrelaStealer)", "value": "200ba5b5bc4ed835338eea210d5b56c5", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277824, "uuid": "6f640b97-afb7-40d0-bea1-59b67f912b6a", "comment": "Malware payload (StrelaStealer)", "value": "c3da4585720e86d892d8bc9881f37549d91df5112ae04a1932fd051884332f3a", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277824, "uuid": "ac6051b3-faef-4407-9ec0-3c0cd28e1e06", "comment": "Malware payload (StrelaStealer)", "value": "73a93f37288c09dff35d6c520e813624899056ef", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690277824, "uuid": "47a1e836-4c79-460a-84fd-96817b114957", "comment": "Malware payload (StrelaStealer)", "value": "7dfa70aab9f663138f10be67078f08148e19a6994aed599d3e517f6fe314d34f896332382476f36608ede30f388bc127", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690277824, "uuid": "d965799f-e41f-4e56-8686-68080df5ca0e", "value": "T10E448DAE28DB5D4BFE618C342FF8F7A1877B34B98752C3F245E8A03019214E29C56527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690277824, "uuid": "cf7b0095-d27e-4404-945b-63d255d007ea", "value": "fcfbe5457e76d2ac347d7db113c0ca3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690277824, "uuid": "14c02f03-6524-466c-9faa-f85c857b618c", "value": "6144:jtJwgjhk0JMUkf7rNc6SIvahAu2JvassGwekaa5TKED:j4gjadUkft3S0sAu2JMTekaahKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690277824, "uuid": "15ff2d1e-2e81-463b-8728-5e83548de248", "value": 259253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690277824, "uuid": "a9f0008b-72ef-4878-b59e-e85a5abffb62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690277824, "uuid": "f9edbd63-d4b1-4191-bb38-9231a9dd0b64", "value": "fegqftymkpgnousjmzfdgsrjpzbbtnwfrveroxnfthvwvibzez.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d752cc0-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690308608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308608, "uuid": "79efb5c1-4459-449f-ba4c-a6a4d6a2bc8f", "comment": "Malware payload (Formbook)", "value": "be484ea385b875c568e8098c2fe0f017", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308608, "uuid": "0c896361-1c28-47c9-94ee-1ae9579c92f8", "comment": "Malware payload (Formbook)", "value": "c4333322e47f6528c43a77936dea4bcf9230a3ec68c527d931d3c1c8f6232baf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308608, "uuid": "ac273eeb-c433-49be-9dff-51c254a583f0", "comment": "Malware payload (Formbook)", "value": "c728a99875934c219dae9db7038ec5462a5083b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308608, "uuid": "7c5abce3-8cd9-4e56-977a-55b0e04ffb8c", "comment": "Malware payload (Formbook)", "value": "0051f64f985c764f3cb34f8da2b08c9569c0ea75687c1f1a43a2c196fdc609dbaaa108eeaffe8289391569da3894524c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308608, "uuid": "e9cbe8d1-a560-47bc-85f7-6c6a3c21ec8a", "value": "T10105F12136B99FA7C1BA47F94030723413FEAE9E6039E3096DC670CA2975F448A61F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308608, "uuid": "aab1d1be-62d7-43eb-a363-e328ab688610", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308608, "uuid": "1a1445ba-6883-486e-a9db-81d4a4addf8e", "value": "12288:QfgETniYiIoFwIrG3XCCaEHsbHxs77V0utLYdSNAOy1+SF8JW6rYmSNIl8YiK0b:exDiHIcTrGCS77hlmeJy1Sw6rYmpl87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308608, "uuid": "09698d2c-d2e4-4d15-9bba-5d3d5e86bfee", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308608, "uuid": "49e84768-07af-47ce-bf50-f31489deba32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308608, "uuid": "9aea46d8-20f6-4e29-b576-e2bf511f028f", "value": "Banka odemesi havale bilgileri_25072023 TL9755000080.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69bbb9e6-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268203, "uuid": "dadfdbda-3e85-480b-ba59-553b3d6e8ea8", "comment": "Malware payload (RedLineStealer)", "value": "674a3e6b5e4c066fb406c8899a4b2165", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268203, "uuid": "ae629916-2252-48e7-83a8-664e5b45bdd5", "comment": "Malware payload (RedLineStealer)", "value": "c4adcf588e2d536a2dcccb0d6837fd7d80552a067934be5e001cfebb393c6f40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268203, "uuid": "487cdc40-83da-47bd-8a80-4008a3c0124d", "comment": "Malware payload (RedLineStealer)", "value": "0ff3d1b5ca86f9fe1cde63608816409318594338", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268203, "uuid": "9f30acca-017b-4d5a-b6c8-3c72f724859a", "comment": "Malware payload (RedLineStealer)", "value": "f14f6136df3b301c9e1affc9170981f42db83b78d036ce9542c2c8f591d33c315f7b86c379a36bca8e04defd8a2159bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268203, "uuid": "9dfbbc5f-0e4c-441a-b474-67142cbed1ec", "value": "T19D841256E7D88133D5BA1BB058F712C30B3BBCA1DDB4826B3689A8590CB36D4953173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268203, "uuid": "3403e970-b68c-4d57-aa8c-50de35943b97", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268203, "uuid": "bad1561b-0154-4016-84ea-940e8a3fca42", "value": "6144:K6y+bnr+qp0yN90QEDowUD5YQfn+QrqiK45TqK82XjSv4Rp0m+IphHCAaCnu:CMrKy90yTxfn+kqK82XhpDXCnEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268203, "uuid": "d60981d6-1962-4b07-8c17-9efd33c62a52", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268203, "uuid": "a47118c9-9150-4c66-bb39-9e9e4f8c1bb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268203, "uuid": "66df8733-2c19-45de-9298-e0b091efb893", "value": "674a3e6b5e4c066fb406c8899a4b2165.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88b1678-2b18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690309620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309620, "uuid": "450ce153-3fd9-497f-8311-4c4b5f7bf223", "comment": "Malware payload (Formbook)", "value": "7b7d545c1d9254682cc9e6945a00540c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309620, "uuid": "8872f516-15bf-4496-b308-a2f16dbad756", "comment": "Malware payload (Formbook)", "value": "c5ae9a42b26b2a0c9b7ab0e75dc45ebb11c69276345a8e8dcd6367599569fbc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309620, "uuid": "a24690cd-a63d-4207-a19c-a8171fa19a43", "comment": "Malware payload (Formbook)", "value": "bdd0cccc0793473979ae2f7328a3ebbbdd139bdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309620, "uuid": "f2d9c1c3-4f6e-4d76-a36c-ba43bc0a0161", "comment": "Malware payload (Formbook)", "value": "17c4ee3200a8c2e6e9eb59966e1403355048f6d3ab5630f93510678c0bdc26a81fadcbd16e3139f6ace7eb15c8cb5305", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309620, "uuid": "771983a8-4801-4994-b85d-82addad621b3", "value": "T161F4124106E88706D2F493F81F64A30A53F98FD57852E3289FD3DCD1B4ABF60A9116A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309620, "uuid": "0e2fef9d-feac-4ee7-814d-23e1eeeba564", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309620, "uuid": "109f37c6-70b8-4c6b-9614-d9df1080d9ff", "value": "12288:2svIkPt46c7ujzCWSD6IYkVH2J7KpzbTUkO89Ldk+7ObFodfGigs39SIk:5vIwwQCmkVs7kzXUd8Pk+7ObKhcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309620, "uuid": "fd3994ba-6a20-4513-bdc8-e63e223bddf9", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309620, "uuid": "f4afa8a9-d5e3-4439-aba5-657101a0e5af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309620, "uuid": "eb1d8a6d-b9b8-49c0-82a7-d418342c8290", "value": "7b7d545c1d9254682cc9e6945a00540c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323e4b94-2ab6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690267251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267251, "uuid": "770956c3-32c3-4226-a6f3-0ecb08342288", "comment": "Malware payload (DarkCloud)", "value": "4850b02b03b4c5afce61f6fddba41d42", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267251, "uuid": "32f07537-ee09-4d5d-a00e-6b1ae2900d5d", "comment": "Malware payload (DarkCloud)", "value": "c5dc5d0cc0ec3f2f607941f8d44019001ca18ab09abda656d4e68a5219d0e576", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267251, "uuid": "6b71a696-ab4e-46c9-8c8d-1133f55d19b3", "comment": "Malware payload (DarkCloud)", "value": "bd2fac213a29c346425431f7dcc06c9208882dab", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267251, "uuid": "2a685e5e-6dda-415d-bcbc-073e4eee0e01", "comment": "Malware payload (DarkCloud)", "value": "cd107f365c0b347358669b3be66e1f50c656c90a92ce249bc6da96583b4daef086e49723da6b75253f733cdb55f9a182", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267251, "uuid": "da50a68e-e832-42dc-a661-dafd9df0f54e", "value": "T1071523593AD44D5BD1667FFA0960B3F133BDDFD97051D2AB2C877C4E9C2AA988920302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267251, "uuid": "9f428828-608e-4405-bf9f-394b8dd21679", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267251, "uuid": "85db3b9c-aecc-49c0-aae2-577c7cabf4cb", "value": "24576:BHIcTrGCZs4SsKuw7AvndUyDI0Ax6EDyBhXko:BHIkrz64SsKuw7APdlI/I7BZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267251, "uuid": "dfe0b95a-7d0b-40bf-98ff-5080e2f5b22d", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267251, "uuid": "4ba28f65-0e3e-467f-a75a-65356609745c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267251, "uuid": "8419c48b-82e6-4ca2-8cf9-65d3f2c5ca85", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35e941c-2afc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690297586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297586, "uuid": "d39fa0b6-ee2c-4c18-b16d-92fb977164d6", "comment": "Malware payload (AveMariaRAT)", "value": "b19e8e33a170cb790b190ea880167387", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297586, "uuid": "22982cfd-309e-4ccb-a09a-737b84ae222c", "comment": "Malware payload (AveMariaRAT)", "value": "c67104c60a24c3777c00e32f300952899d62184694d46f3035e16aa3c339ff3f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297586, "uuid": "77753b3c-4814-4523-8131-250f072458e1", "comment": "Malware payload (AveMariaRAT)", "value": "30a976ad978a73871784e6dcc981ac4958fa17d8", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297586, "uuid": "d71fdfed-c880-4986-afd0-c2258da4c42e", "comment": "Malware payload (AveMariaRAT)", "value": "7d966bf7cf9be0e4f4514c2f1292b8c770bd12ef18bd694b192de50a6285a48ac1e18757915cef064f2b00b537b49b72", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297586, "uuid": "d8f4b4a6-4ab8-49bf-ab38-6f4b59adf900", "value": "T198C3120363D122B87BA20FFBF9E46BEE1D58849516E0D6DDBB5312A31E72C4CA745039", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297586, "uuid": "c697a1bc-2d07-4b0c-a5bd-7655542b9172", "value": "3072:2CBPrGqsrY6od7uyPpfime59r+KgdZ28AS2:2CBP+k6oFuepeXadZrAS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690297586, "uuid": "35606fa2-647f-4d44-9c33-14d764cfe772", "value": 123079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690297586, "uuid": "f793b3df-09b1-4cd0-91d7-5767c9448479", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297586, "uuid": "9d06f151-c289-44ef-bd68-2ed59511dcd3", "value": "nPO.No.660240685.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b149ee71-2b17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1690309125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309125, "uuid": "90b45967-7d3f-45b4-8539-77ed58718eb1", "comment": "Malware payload (Fabookie)", "value": "3e5ac747639b25a1f1e8972f5a1800c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309125, "uuid": "30ba25d2-0238-4f4e-b522-ccb8a8b577e6", "comment": "Malware payload (Fabookie)", "value": "c6f1c4643dcc47ecfe495407c7ef7fcdae641f554ff005cac496695c9a3b6acf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309125, "uuid": "dcac563c-8557-4084-b123-5e550736b8f3", "comment": "Malware payload (Fabookie)", "value": "6577462a3fccfd2fa13a2fec2e67e23c3e873fab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309125, "uuid": "c348abf9-e9b5-4d9a-ad69-1404a04e39b5", "comment": "Malware payload (Fabookie)", "value": "db363984be2cf285bd74d3576be62ea464f9068e803da563176d7f0955bcc61b3ae0e9550125ad14393dd99dd59a77f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309125, "uuid": "dc79075d-6775-49bf-9cc2-654bd6f97083", "value": "T1F084DD64F0B2ECB3DA126B7039FCF91C91AD71551386869E365AF0B692D330031DDBA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309125, "uuid": "ab9a63d2-075e-4c0c-9df7-699b79ffb7e3", "value": "96cc98468ed325b3857363887597bc67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309125, "uuid": "1e575d6d-e537-4696-a4b6-771551e826cf", "value": "1536:qyK9MjWCNKIuOCWqeyGaOi2K+Sm6uCWqe+aOi2K+Sm6uuCuCWqeyGaOi2K+Sm6uN:qX9MVPuUXnAYy4AZ6LvcgJFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309125, "uuid": "78ac2e65-de9a-475c-953e-e363dcd8fb8e", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309125, "uuid": "df6aee77-4759-4606-b793-e70a0faa0c22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309125, "uuid": "959bf68f-0a01-4101-9ad6-5f96ab1fb3bd", "value": "3e5ac747639b25a1f1e8972f5a1800c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788cf305-2ae8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690288843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288843, "uuid": "1019f501-d439-4fa8-9260-6a5a8fc07caa", "comment": "Malware payload", "value": "d19166c7d867eaa88d5b9a49b5032b9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288843, "uuid": "de11795a-19da-491a-9713-98728ca8ac7c", "comment": "Malware payload", "value": "c713b1f7a1b54131922962485dc925fb537829b646237cf735ccbd5ffb04656c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288843, "uuid": "27d6c5e0-771b-44d9-9db3-fda10c72c35c", "comment": "Malware payload", "value": "be96ec94f8f143127962d7bf4131c228474cd6ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288843, "uuid": "f8c5bffb-86d1-4428-91dd-82877c41e85c", "comment": "Malware payload", "value": "fd682fdfd7d1914f2346eb6cba54310077d7833d48ef80ed94f570c5e5698533e311713d81c63eb358403ededa1ff5bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288843, "uuid": "b8a78774-4fc8-44f8-afd5-6fdf408fe711", "value": "T157F5C056A3B400F8C1A7D178C9169607EBB27405137497DB56E0CAA66F23FE22B7F324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288843, "uuid": "2f2013da-f9c0-47b8-a659-05bdd5203bce", "value": "3dfa11485171cfef127e8b3a8a355682", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288843, "uuid": "98fbc4aa-58b1-4170-9acb-c478a9f8cd8e", "value": "24576:V9SZr+RJrlOXSlvX8sRimeFqJFf48VayIGFL4EndmuvcANF1wTFN2P7cYQU7IPs/:HzlOXS9X8TmeFqJDayLL4tUjwTF6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690288843, "uuid": "9b52d327-816c-434a-847d-5ea6ec630bae", "value": 3417088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690288843, "uuid": "5a2719c7-13d3-44e2-b92b-185a41a94f10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288843, "uuid": "92887f6f-db39-4d36-9a63-39d94c1208b7", "value": "4496iKzQhkhlziKzdxfRihzUykrn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1cd37e8-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690267867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267867, "uuid": "95352f9c-c6bf-4194-a4f3-7208459b53c9", "comment": "Malware payload (RedLineStealer)", "value": "0ad21b871295c39ec4bebaa9e05101b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267867, "uuid": "99571dbf-3334-4a22-a480-9ed255947e8c", "comment": "Malware payload (RedLineStealer)", "value": "c7374ad603a0bbffe5ab6839449f5633b578539d7f7326d2b9d01006a0586b45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267867, "uuid": "c688eeb7-a7f8-4eee-8912-2d498460662c", "comment": "Malware payload (RedLineStealer)", "value": "88ba642b3f731b632f61974cc61be62482cdd72e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267867, "uuid": "49c986b4-b517-40db-8af0-1a2e9f627cb6", "comment": "Malware payload (RedLineStealer)", "value": "2afe12c62b8858f888290b190a0b75288bc7876d8441859b902efcde41cf34cdf4a2c8d27c14d419b34abf8fb6847ea4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267867, "uuid": "fb870250-bbfd-440c-8ea8-de5ca8296fe8", "value": "T11E840113F6D94433D9B627B008F642D30E36BDA2A87893AF2705591E1CB36D4A876737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267867, "uuid": "b3c5f1e6-1e4a-44b2-a72a-7ffe7b0f059e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267867, "uuid": "204f14a5-3195-47c7-9114-ce412dd1b522", "value": "6144:Kay+bnr+qp0yN90QEnelxQMrmdNrLbTse6JokqqxaGiGjmPIr0I8a0lC1:qMr2y908oMr05Lr6JhxaDIr0Y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267867, "uuid": "565e374a-d976-4c03-aa0b-8457590ee384", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267867, "uuid": "e581ea8d-cbac-4b43-b263-d452d0c7ad91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267867, "uuid": "7a79a497-ec5d-4bf2-9614-12bb0a9800f3", "value": "0ad21b871295c39ec4bebaa9e05101b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab56ceff-2a9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690257575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257575, "uuid": "88b52ead-ab25-499e-8c5e-ab9efa2fa49a", "comment": "Malware payload (Formbook)", "value": "80e388433ae9dbb6a379d1700285136a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257575, "uuid": "d3ea1942-7717-4fd6-8126-e8de102ee82f", "comment": "Malware payload (Formbook)", "value": "c7616a546f8e22dd0a80b275f5991b6c6ab567d278be339904d6bff0c5c00a42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257575, "uuid": "7d9811bf-68f1-4065-8f57-0dcbf18ce3be", "comment": "Malware payload (Formbook)", "value": "5788a19c3351eea47e641a3da231a099b40bbcb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257575, "uuid": "a8468402-d97c-4901-8b14-0123815c2382", "comment": "Malware payload (Formbook)", "value": "96b99990675bd55d10a6c660419bdc715e2124d22cf4d44fe906f10af99fa1943378de889ba0349a574b6c50b33e350c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257575, "uuid": "52664682-47d6-4191-9b0e-f175d92a8997", "value": "T14B05383858B81727C1B4DFF68AD48427B2E0A96F3114ED386DD357D64216B06E9C3A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257575, "uuid": "e9ac8f37-3fc8-4cfa-89f9-e7d76d668ce7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257575, "uuid": "5c008343-7d55-4587-a723-8327e75b60d0", "value": "12288:I4tEymdG38j7ONF6bJvLQLXy/aNKaP3NMHVMkfIV10wUNy+NvLNG4Z:I4tEymdGsPODGsy/WK6NMykpT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690257575, "uuid": "9cfa507a-8270-423e-86dd-7297f49378b5", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690257575, "uuid": "61420d92-c7bd-4c09-a5fd-cd3ec90ee958", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257575, "uuid": "b0bb575d-5121-4b04-8199-c06f8f7895db", "value": "80e388433ae9dbb6a379d1700285136a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d17b333-2ad6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690281147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281147, "uuid": "fe255064-6e6f-49bf-b7f9-044e0cd9409b", "comment": "Malware payload (RedLineStealer)", "value": "6b025717f38a3495a4fae07d367a8add", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281147, "uuid": "9e483bc1-18f8-4aac-9414-5b543f663b9c", "comment": "Malware payload (RedLineStealer)", "value": "c81f55200dd33d0685e22c824cad971f68ae4d1869f7eaeb0a57b83c01b3290e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281147, "uuid": "222b9b6a-c648-42c5-bc27-5974301b81e9", "comment": "Malware payload (RedLineStealer)", "value": "6abc8043827755a89b9b3783f4609b97a6c7e143", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281147, "uuid": "a0b376fc-c387-4724-88e4-0799167dda03", "comment": "Malware payload (RedLineStealer)", "value": "2116193bdb42274ec949ccfa86236d5a6ede7ca167ace32e44923135461b4d715b1b03e56b0906dbd2aad426400859eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281147, "uuid": "b86791ac-bb05-48cb-a070-c3b282a000b6", "value": "T1B9840143A7E85172E8B47F7008F613830B367CA25D78535E3781A95E4CB26C8A87677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281147, "uuid": "0bad5d6b-70a2-41f6-a6f8-b660cae4e11f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281147, "uuid": "c213e451-cb48-49ab-8ae9-e74243f3530d", "value": "12288:JMryy90nrIKwIrJ/cpbgBYCMwtogFpC6g:vyIrIKwIE0z4kpCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690281147, "uuid": "92c1222a-76f7-4942-a456-36a367252d7a", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690281147, "uuid": "662dd16c-da5d-4e30-a997-ba7ed273a0cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281147, "uuid": "01d327e2-5675-42d1-96fa-ae0a792e0c35", "value": "c81f55200dd33d0685e22c824cad971f68ae4d1869f7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2caa2a-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690280229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280229, "uuid": "48caf911-f291-4781-a8da-67a8805b4533", "comment": "Malware payload (RedLineStealer)", "value": "2a746fbd9c7e9f28d03047a2169878a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280229, "uuid": "96695709-5e01-4baa-8a62-9f6a697e07a3", "comment": "Malware payload (RedLineStealer)", "value": "c847eadb60d6d67fc092dc2139938319e505eeb5f2e4acd961508d3bbcc216c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280229, "uuid": "c12d1271-52db-40ea-bd8c-38a1afa03446", "comment": "Malware payload (RedLineStealer)", "value": "9cb0d66e76db38cfb7c3fb89e0751759c7ae0b29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280229, "uuid": "59b5a0c2-8394-4b13-b05a-d8a167753fc5", "comment": "Malware payload (RedLineStealer)", "value": "a4a0aab236abcb762a1a5b0be73710d39820519169e9375a684c3eb91d5a3e7b7e4c72687bc74764dd159177113bc0fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280229, "uuid": "64e89121-8b88-445a-ad9e-993c5fac1632", "value": "T1A1840213F7E44133D8B51770ACFA03830E36BCB59974836A3649A95A0EB3AD4A57137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280229, "uuid": "d0885167-d6d6-4dd7-8220-8288eae1021a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280229, "uuid": "1cfa5b6d-c96b-4d39-a6fa-4d29e790c7dd", "value": "6144:KWy+bnr+Up0yN90QEbRo6t5tSmp/tHgKeJG/wNa8jry4dtmTh+b0KREb0crTdsO8:+MrMy90x66tZCKuG/cRjPHpab0cXOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280229, "uuid": "57a22f44-07e3-49bf-b181-e89e3cacc759", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280229, "uuid": "aa0da235-c227-4b0a-bcc9-28326cd33dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280229, "uuid": "35434ee0-4bab-4738-8061-8286fc66ef67", "value": "2a746fbd9c7e9f28d03047a2169878a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f64c8cd-2ab6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690267407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267407, "uuid": "eaf51b85-7e65-4d28-8110-8ed60c600de8", "comment": "Malware payload (Loki)", "value": "850b0b90dee6a3eccaf734b887b5dd58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267407, "uuid": "088356be-19f3-45dd-83a7-9094899a3e73", "comment": "Malware payload (Loki)", "value": "c8ad050630ea954712c67d5c27e8f75542d78e7d43c81554c0a652da9218a880", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267407, "uuid": "2543b453-c5ac-466f-b64f-7dcf777b8a5a", "comment": "Malware payload (Loki)", "value": "543c7cc7ac28f8ac6ddbe08bf4cbd0163660dc14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267407, "uuid": "34a3a223-2b4c-4200-9e5d-9c0a983b5d9d", "comment": "Malware payload (Loki)", "value": "14a1c93a10f8df9227ec5146cc6a382538a6ba3b994dc0351db085fa74ead152c4c0e532e72bc9f1d898fc74fbba46f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267407, "uuid": "335755e3-761e-4699-923b-9319f7734a78", "value": "T129C422A93E644687C1195FF8206177B0A3BEDFD93411C3172C8B708EEA79FAC5252627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267407, "uuid": "90739576-1a88-4863-b53e-7e62cad298f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267407, "uuid": "e5cb1672-8f65-4aa6-8b73-3a14a4dff5b1", "value": "12288:AYiIoFwIrG3XCCaaMTWH6kF0PywR7YUa4krFoXWhQ8ARD9p5:AHIcTrGCJTKF0aq7mrSm0B9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267407, "uuid": "ee58da95-1a20-4972-b170-626b20086a79", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267407, "uuid": "c43de37b-23e4-4182-a056-513107e22af5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267407, "uuid": "e4237a88-b64c-4b30-a341-2f95436df487", "value": "AWB#8457108962.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58e5632-2b15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690308327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308327, "uuid": "123c2a65-c2bb-45bd-9a88-f2bd13ea48ea", "comment": "Malware payload (Formbook)", "value": "f1c41473f0daae85c1d2579ecf345809", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308327, "uuid": "d189afa1-922c-4073-8125-f255d184c055", "comment": "Malware payload (Formbook)", "value": "c900971c1b3ace4fd4cc2d3bed19ae9b71a43b4f32ee8bede727473efc0b27ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308327, "uuid": "02adb732-2755-4df2-afd6-87c946bf18af", "comment": "Malware payload (Formbook)", "value": "ff921e86cee9a27dafcaf5576f493f067c080360", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308327, "uuid": "5e1d5e24-98c5-491a-8f2e-fc28c3f8e773", "comment": "Malware payload (Formbook)", "value": "4ef4e039e5941383bb125ef5e95f9df79adc704c5a8eb7ab675596c96cb7457bd4b9e56a5841501effd3f827963a8d46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308327, "uuid": "264aa2f3-38ca-4a52-b976-9b86bedfd1b0", "value": "T10405F12136A9AF57D5BA47F94020733013BEAE9D7039E30A6DC370DA6976F804662F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308327, "uuid": "95e39c04-6ebe-47e4-9ed8-12060c382c56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308327, "uuid": "df6e069a-1414-40c1-b366-08e705778f92", "value": "24576:Rxc2HIcTrGCScqHkwfrlP2zP7LNITSU3:3LHIkrzScmfZP2z/qN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308327, "uuid": "24d583db-4b2a-4e9d-9e2c-d582df9611c2", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308327, "uuid": "da555828-2bf1-4c3f-bb64-896a20c48e81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308327, "uuid": "c29e4722-2a45-46be-a315-f353e670e254", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3a0e12-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1690296958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296958, "uuid": "652e6437-44f8-43aa-ac18-595702e382a1", "comment": "Malware payload (Fabookie)", "value": "6683d269b67e05687b6cdad6dd4a25d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296958, "uuid": "d8c9e1c4-e463-42ef-89f0-1c876c4d6920", "comment": "Malware payload (Fabookie)", "value": "c928af9923959ef79acd8f5e57324eea991e44df651c7647bdfa550497b5b2ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296958, "uuid": "499bf26a-c62d-48dd-a946-9b4faa635339", "comment": "Malware payload (Fabookie)", "value": "296e0391530d82ee6ce673abb8084cccb9f27909", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296958, "uuid": "dd22f122-0ed8-4a5c-916e-7c3f9db8aaab", "comment": "Malware payload (Fabookie)", "value": "1435694e9f90451fca1937142d4f41c1b40db7cf1eaf82b7ea1e57adfb89cc3b69714659d0ee39202ca4fbd1c34e36fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296958, "uuid": "95b1d81f-a407-40d3-976b-512461a9fe03", "value": "T17244CF2276E0D033E5A745304930C6A16B7BB83367B995CB73A82B7E5E703C06E75396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296958, "uuid": "1fa03399-cf6c-415d-8937-b1828ce6d8b0", "value": "41f54a8bceede5b7d9a3e6f46d43695b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296958, "uuid": "2a58c9ce-ee9a-4361-a49b-168c7330509a", "value": "3072:decHoS7UEWvGs8PatxWWfuAHHpR46SOv1Ch1yW/mLLQ3Xy0aHyrW+9ILa:b7Qdvl8itRff86SOvmATLkKeW+9IL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296958, "uuid": "b2c520e5-3965-4567-a971-792ec7920663", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296958, "uuid": "e43c4019-c45a-45a5-a003-f7d2abbf0e7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296958, "uuid": "8864d0fe-3ffc-4f96-9c4d-d85fea7eeb1f", "value": "6683d269b67e05687b6cdad6dd4a25d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778598ed-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690308598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308598, "uuid": "88942db7-7744-4f86-8c0e-fa92ecba6a96", "comment": "Malware payload (AgentTesla)", "value": "977870d3f82e6270ea050e4bc1d55243", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308598, "uuid": "0e094770-df4e-4c6a-a8e6-8cc9350b63d1", "comment": "Malware payload (AgentTesla)", "value": "c93dc9b3ec14e0e1d375ee919ac40ed95eb67eddc6cb9b7508b4f64743ad8804", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308598, "uuid": "292cb5ea-824e-4594-8f2b-0a7454c3258a", "comment": "Malware payload (AgentTesla)", "value": "c9b624b3473046fb99572555dab639b2e8b6b79a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308598, "uuid": "6a5c3471-626a-4443-a74d-d711d4ddd9a0", "comment": "Malware payload (AgentTesla)", "value": "5713a077587896a617a546c352a86dfdefa7e24fa9029ad7699703fa5624640342cfad38bd90a9d7502912f9ea7396e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308598, "uuid": "c88e7d55-8f9a-4269-aa04-6e60b5a22424", "value": "T10AF4124011AA8713C6F497F81779A796A3F6EBD47997D309CFD6DCC4B0AAF280811923", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308598, "uuid": "b466fb42-e688-41d8-8ea0-fc5ea6a2fb6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308598, "uuid": "d5ea2467-5686-40ec-be48-f323fb9aefd2", "value": "12288:ajvIkPt46c7ujzCWSD6IYk9cHE++C1wxNf3SptdtIM+p15E2gYPdgaPqwhvrx4Ik:8vIwwQCmk9gE++owP4bd+pbE2gYPdgeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308598, "uuid": "5d9446f9-e1d4-4ecb-9182-9a299511c1c4", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308598, "uuid": "1413be88-4328-4f1d-8c32-8f2ac21c107b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308598, "uuid": "2ffaf708-3593-47c7-9638-aee55eb77b54", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38734af-2ae7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1690288593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288593, "uuid": "7c2aeae3-af00-49f3-9268-1c233c0beea0", "comment": "Malware payload (AsyncRAT)", "value": "6b50fa321a93a385d30c1e5b30f2d013", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288593, "uuid": "d728f24f-3b84-4d59-b36d-fef8ad08fd95", "comment": "Malware payload (AsyncRAT)", "value": "c9d1742d8da3450bbfd149773a807c012402cc33453726d4f79bc3fdb206daab", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288593, "uuid": "69f8c1f0-a495-4bfd-b0e4-cc8d446677fd", "comment": "Malware payload (AsyncRAT)", "value": "1a0bb4f0f1f1499a4354a0a9f630073aceb64b3e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288593, "uuid": "ddd80a5b-7772-4063-985f-f14b5762bbe6", "comment": "Malware payload (AsyncRAT)", "value": "a860bfbf2fea734e6aef1544bed2bc182cb98a87174d475e0061e9cf9d5e67966ff6c859c22998998a584db07fd52b43", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288593, "uuid": "94588e38-65d5-4aed-a51b-20ad84748071", "value": "T1BC1533BCEA30553EFAB94DD2575D7DDC708FD4AEAF0A7702E44AA421283227106F462D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288593, "uuid": "01d3a000-e34d-4b46-bc3a-4ca2c7c0589e", "value": "12288:LxR4g66mNdrWq4xhwRSbSpnMbsX1nDWFZz9ev2IXAGqd1NfBvnODEnYXYYOg5AQf:0gfC1sUSbsssX18exk7rmI/Y/t11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690288593, "uuid": "a7a1b939-de28-4889-8b2a-8bd6d6806128", "value": 943886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690288593, "uuid": "2ef8a519-64b4-46f3-8466-eaa51650a313", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288593, "uuid": "0b7c06f4-a9cd-4504-88cc-9c88cdd8b922", "value": "Odeme_Plani_1.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1955f8a7-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1690308440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308440, "uuid": "32ffff12-5e00-4997-b17a-6c08c9286a6e", "comment": "Malware payload (XWorm)", "value": "ab98c1c90c71a23b0d0c20b5b8826206", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308440, "uuid": "0943bb27-1ab6-4cdf-ba8f-ed3e55967652", "comment": "Malware payload (XWorm)", "value": "ca21d7c75d58476f9cce8cebba827e922a0bb3b1c19cc49b6e5008f8cd9a23ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308440, "uuid": "2ff1b184-ceb4-46d2-871e-3129a4fb2f46", "comment": "Malware payload (XWorm)", "value": "21693ae70536be4d4e244e5c0361c6d0f1750ad1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308440, "uuid": "fcf4b995-d8e7-425a-8f1b-f34b5358cf3b", "comment": "Malware payload (XWorm)", "value": "fa55652752b7174607c92f40056325cdd333e9dea15d1cc7a1217c94f22150bc103648cac271aa21ec85d85296a52569", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308440, "uuid": "88ea568b-f9a9-4fe8-a510-10ce373f8216", "value": "T117D24C083BE58327D9EF2FF229B291010275D517D923DF5E5CD896AB6F67A8143003E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308440, "uuid": "70eeb4b3-2651-4771-90fe-869530e23515", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308440, "uuid": "9a8f4f2e-fda8-4271-a5db-f2e9722db970", "value": "384:x7wTA+5OfhxeelKn4MPLZhspJCXlYECwaiUXQsbRugtFuBLTIOZw/WVwvn9IkVur:RFx7s4EQw1YETDUAsbBFR9RQOqhxbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308440, "uuid": "027d7603-da53-48c1-9283-df0f4d5b4079", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308440, "uuid": "ba9de232-2121-4597-86c4-d83c6dba7f3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308440, "uuid": "ee8c45fd-0fb2-4a6e-b727-c1f0ee3a3aab", "value": "bO2K.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c2a9d8-2afa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690296514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296514, "uuid": "78388e76-24fe-430d-8523-29f100b97954", "comment": "Malware payload (AveMariaRAT)", "value": "52b6772d88d3d37254152bcb6e063bec", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296514, "uuid": "15e5c7f8-584e-4c84-89e4-0b56ff5a4e48", "comment": "Malware payload (AveMariaRAT)", "value": "ca59bc96a7448943bd999c40ea69b7a3afb12e4af35cddd9e6597944b64449fe", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296514, "uuid": "80802a12-f7f1-474e-a19b-9a487b701abe", "comment": "Malware payload (AveMariaRAT)", "value": "06aeca23a86262137d62a39b71012ac53f746c37", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296514, "uuid": "f7ac1954-364b-4fc9-b5ae-23c5aca22ae7", "comment": "Malware payload (AveMariaRAT)", "value": "81cb220dcf93839b9a924ec77df2d47788c06dd97cc80abcfcfc125f2d146a555433989c8107a50b16dbaa7abc8c6614", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296514, "uuid": "0e785265-e35f-4a70-b4f0-caa3a85ca327", "value": "T1872402499BD87022C6BF057218B7D90BC730E682D81DEE5B31CC1637AFA7662ED522C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296514, "uuid": "cc4a8843-366a-462b-ac5e-28f5b5be0aac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296514, "uuid": "2249279b-fc71-4e98-8e5b-ad9752301ceb", "value": "3072:sNOLRveLpJUPgXFIB3YOCunBU97crkZZ/pa2ebL6to:SOLRvUIuz8nBIYrkZZYHKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296514, "uuid": "2a7bf896-1a4c-452e-bf8f-0d509874a536", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296514, "uuid": "9ae29934-a556-4775-9736-7ca279b58beb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296514, "uuid": "24b9e9d5-be36-4e31-be09-d3f7c0725a6e", "value": "PO.No.660240685.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5769d4f2-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1690296948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296948, "uuid": "a0fef23c-b1fb-44a8-a96a-42ed143e6dc9", "comment": "Malware payload (Fabookie)", "value": "b704e871613402c0ed55c974260daeb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296948, "uuid": "8459aed9-caea-4f97-a5f6-9a1fb18efdc1", "comment": "Malware payload (Fabookie)", "value": "cb112b5e928fab10549207c4b620df79b19d464cd53e49ce043d3b3dc8ad396a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296948, "uuid": "6244199f-3f2e-4a82-9fe1-fd14ea4cf9c3", "comment": "Malware payload (Fabookie)", "value": "15d7d38d086a69bc73b549e1bf335ce8249fd174", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296948, "uuid": "efd08dca-44dd-4b7b-9497-e703d07d05ef", "comment": "Malware payload (Fabookie)", "value": "cf3025e2a8350d61b1cb9414a9b295df6c28bb2e09324b50ca0d1471b7cf8b50027c96e4de0a9e3f7ebfad4b1898740f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296948, "uuid": "67dac89d-9de4-4856-894c-79db269dddec", "value": "T15464094792B17C51E9278B728E1EC3E8761EF5D08F893B6622196FEB1C711B2E173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296948, "uuid": "5c87c6e7-6be0-4eea-8fe0-c536b9aea4ba", "value": "6dd6b46f56344bac3e06d5c8db854c3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296948, "uuid": "6ff0c22c-5bf2-4f12-b93a-2ef772ccf37e", "value": "3072:a6fhhAVjLM2X1zoSlvR+18AEcteD9ZzeLdZlcnG7JdZ5cqM95gU1RvpTbzFpT2pS:HeVjLM2XB5eLEo4G7JBrU7J1pT2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296948, "uuid": "15f76eef-e1b3-43b9-81a3-a67622e06fd0", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296948, "uuid": "b5d486ea-4e25-4bf0-bf10-6ffcf799624b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296948, "uuid": "9102a769-96b8-49dd-a194-728919fcd6cb", "value": "b704e871613402c0ed55c974260daeb8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9616bf-2aa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690258247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258247, "uuid": "fa1ac69f-5a5e-48e2-9ada-705bd1f54352", "comment": "Malware payload (AgentTesla)", "value": "7f90abc66068c675298764843d0645d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258247, "uuid": "a0c455dc-5495-4b9f-ab2a-27af81949d33", "comment": "Malware payload (AgentTesla)", "value": "cb4693314ef10fc7c411b7c9a1b95b2b58acb425aee5d36015da9108c442087d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258247, "uuid": "3a05eee3-15d1-43f7-9dce-8cad6e7db1bb", "comment": "Malware payload (AgentTesla)", "value": "4c21953f110ea5cffb5a4b877602eeeed84fce37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258247, "uuid": "29dbe915-1281-42a4-8d8c-53099c00368e", "comment": "Malware payload (AgentTesla)", "value": "c8d3ded3d6519d48b8d67e4bf7e529694025c79aca53967478724c9af5d4a1bc7bb3f9514ed4f9997b9e459ae2cd21f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258247, "uuid": "6634f572-5fbf-4616-9673-1f563cd2ffb9", "value": "T135942B382D524730E07F56B4E65B3E1B3614FEAB6460D62535B63E0B3B5A213B4F2329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258247, "uuid": "2f5e0ec4-07c8-4786-97f3-b6a366f04da1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258247, "uuid": "be945552-ad15-497d-be09-d64a370a51ac", "value": "6144:GvbjGM4kYAxDIB4P8W9JvTd9GeMmd5FE3+8+I3Dfv+mdQzHAbx:8GkYA9Icb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258247, "uuid": "833a3014-027a-4c85-aae5-94efcb7e8d9a", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258247, "uuid": "d0cfaf53-f599-4d51-b260-ace12217298e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258247, "uuid": "a779588f-979d-48a2-bd67-037ef80f2606", "value": "7f90abc66068c675298764843d0645d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28fda21b-2ae7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690288280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288280, "uuid": "0b678d73-03a4-433f-8816-da578319486f", "comment": "Malware payload (RedLineStealer)", "value": "48761f8b0576e7bed627120ff51b4863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288280, "uuid": "a4e4b116-31c8-4029-a00d-1ce490bc3e3b", "comment": "Malware payload (RedLineStealer)", "value": "cc499fffbab36b8cf303fa4f9bc26799497c0dfa94eb71ef1480ba774d71637a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288280, "uuid": "233a6008-7c46-45d7-8709-9c6629bda441", "comment": "Malware payload (RedLineStealer)", "value": "ed405398883e8217bce5005159708ad3d0108b7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288280, "uuid": "641445da-2e90-4d9f-ba16-2861f834cfc0", "comment": "Malware payload (RedLineStealer)", "value": "be8186b87f6ddec8e822c39fef1750d0615b90348401c571900d84dc82c61f4d55c75626c1c34e57e364fc53000c948f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288280, "uuid": "b9058f73-505d-49a3-be5a-3b14aee46dd5", "value": "T1E44429D6BCEEF22FDDB72F39D2488CF334327867A606A41261A26AACE74C314D555344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288280, "uuid": "6936626c-17c8-412b-a55f-3fb45e9b2dc5", "value": "49a974ece3bbf5d3a2072773ace1c1b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288280, "uuid": "912c9db9-8268-4567-8c6c-c9cb5e61a07a", "value": "3072:1KnQwd/gQU58zzwfyVjjs5D7ONGydJpXGU+UzgyFa0Um0GH5L8QVxDj+:1KnX/MITs1SpXIUzgyIF4ZL8QG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690288280, "uuid": "716c28fa-58b6-4588-930d-e501c5b43960", "value": 262256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690288280, "uuid": "50361711-a69e-44dd-84c3-4655a0436e21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288280, "uuid": "615d8375-d375-486f-83a2-86bd41efc0bc", "value": "SecuriteInfo.com.Win32.PWSX-gen.29295.6868", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f78714d-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690267863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267863, "uuid": "7b754821-031c-4580-9a39-71b44e4df608", "comment": "Malware payload (Amadey)", "value": "057a66ce598dd6a12b09ef99228386d3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267863, "uuid": "718b8671-c3f4-4ccc-bb65-ebedacad2a00", "comment": "Malware payload (Amadey)", "value": "cc5346c8326d69984cca3feda7896fa9babd7a255be1684eb7a2b760cd9ea8e5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267863, "uuid": "3bf63ab2-5a85-4011-b8cb-e3ae6363b7c6", "comment": "Malware payload (Amadey)", "value": "f8611f2949a57307d9e1b966a53b90464f5299cf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267863, "uuid": "f0db2381-c6a7-465e-b25a-ff1560eeeb1a", "comment": "Malware payload (Amadey)", "value": "77cc790cf9cbfbad665494fd0cfb00ce523b803994b2763a1885c4c0240b1b53f7174e7706468866f31110220be96a61", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267863, "uuid": "f2156681-8f46-4d28-9fb9-8b8c1afb7e7e", "value": "T155B41252A7D88432C9F6577158F707D30A367CB28C38432B2796A95E2CB26D0B531B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267863, "uuid": "7df0bd00-94d9-4ae8-829b-5c40f9e191bf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267863, "uuid": "7445ebe7-9257-4566-b95e-1ad4ca6832b7", "value": "12288:tMrgy90KXVUoSdCBeAjvdZzyvJ0aQ2KxyU:NyFXexYkApZzyv2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267863, "uuid": "c1e057e4-ff01-4754-af09-aa80d60651fa", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267863, "uuid": "ecb81f3d-45aa-46c0-aef1-4d7d137ac905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267863, "uuid": "f104a245-c363-4b05-97bd-27ac43b06676", "value": "057a66ce598dd6a12b09ef99228386d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc949b8b-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690290783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290783, "uuid": "446ef7b4-a3db-4059-b986-183800820116", "comment": "Malware payload", "value": "e8a3fe4cb11ccd50371f19eb593e87f2", "object_relation": "md5", "Tag": [ { "name": "80-66-88-145", "colour": "#AD4147", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290783, "uuid": "d74c19c3-1cc3-43a0-a7c2-5b322ab8ecb3", "comment": "Malware payload", "value": "cca4d187cb86db995e90cfcf05fb0c6c3fff4161ab5e0a712da96e2786888fc3", "object_relation": "sha256", "Tag": [ { "name": "80-66-88-145", "colour": "#AD4147", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290783, "uuid": "825a10f1-ad12-402f-8d5a-ca0ef187da82", "comment": "Malware payload", "value": "72376d4e1583e467f33023a136dbe84ccd4976d1", "object_relation": "sha1", "Tag": [ { "name": "80-66-88-145", "colour": "#AD4147", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290783, "uuid": "14b713ed-ad08-4c30-bb64-b2e60006c596", "comment": "Malware payload", "value": "c09c5eee3d271b7e23e8da095ba82b753af9d8c15d63969f3f81e606b955a1fe809b0c4e080b64fd0a1ab8f7df74fba2", "object_relation": "sha3-384", "Tag": [ { "name": "80-66-88-145", "colour": "#AD4147", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290783, "uuid": "779646f1-da69-409a-9ac6-a889f59038e9", "value": "T16FF4CF4F268C265C9BC89DDA95925BA7C7A03039711B318DCF956E4E41ED833BBB3C24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290783, "uuid": "f5aa90a1-5fe0-4e38-acdf-47e3ff963cff", "value": "12288:1OvHkOOw7i02p4YG3gfR7NIN9Ii86eQLOWfFSNVukBA6b8kO1jup9j1vzYsgCNjw:1OvHX7i02G0NIN9N8VQLpfFSlnsjupXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290783, "uuid": "9087e602-e4a6-4807-b352-81548834b238", "value": 775529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290783, "uuid": "2a7f1e28-a34b-4d96-be9f-8ae2c751b3f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290783, "uuid": "3179a317-8c35-4e22-b9fb-bccd23af2d5c", "value": "agaegfa.au3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53572acb-2ade-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690284486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690284486, "uuid": "e6e97e11-ca61-4de7-9432-fc297ed52655", "comment": "Malware payload (AgentTesla)", "value": "b2ba2674ea8d9dd229b05773c6308b25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690284486, "uuid": "750f9537-2091-4a72-afc7-ab477fecd3d5", "comment": "Malware payload (AgentTesla)", "value": "ccb49243b60372f1bca2b75fd5342f273983f2d6151a1c0ac704064c7b46098a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690284486, "uuid": "bf762ca0-61ae-4ad1-ae96-cad5aee30f06", "comment": "Malware payload (AgentTesla)", "value": "26909b6da3cf3fe2a752cf58d1f9e3453e0bec23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690284486, "uuid": "fba724f5-3287-43c9-b292-6106ba029a8a", "comment": "Malware payload (AgentTesla)", "value": "0542e255f4b2045bc77ee32ceffe906064da33ecd802da34ebd031d2ed7b349ebcd6c3c4113581d39fbb97a6e238703f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690284486, "uuid": "f288b83d-3d21-4843-9070-f42715601a73", "value": "T1C2E4CF26A794AF9FE0BD437891310A1897F69A173120FBDA7FD210DD58E5F40C368A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690284486, "uuid": "b92854a4-0def-45c7-b2cf-bc3c2d9c82c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690284486, "uuid": "e00b7d85-40fa-4ec3-9698-bd3458191bc2", "value": "12288:viopPH5Dcjlgv1YUZgJeEq5bTA1e5W0hQJEoSjmC4T5ELd:KAZgjGveUZdFTFRQNSp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690284486, "uuid": "4622f15c-6c86-49f5-ba60-4cb9983de1d7", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690284486, "uuid": "7b45462c-ab14-434a-9fa0-4760721ac03a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690284486, "uuid": "ae98a60b-8098-420a-9a1d-be5e5db65580", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c686d5fc-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690267929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267929, "uuid": "766de67d-2ee8-4b45-a712-a58f4d80ce18", "comment": "Malware payload (Amadey)", "value": "5b8be81e5f75f817bab6afe8b6b985e6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267929, "uuid": "a93db6b3-4a2b-47c3-bfc6-f6dfc7701afe", "comment": "Malware payload (Amadey)", "value": "cce9d70d28ddb699811cbd4445e977bbcae3026516e0f850c97b52814735c96c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267929, "uuid": "e5780b62-aa83-470b-bab0-050989416113", "comment": "Malware payload (Amadey)", "value": "39a0488c3cbc9604b504763d338d20c890f571e2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267929, "uuid": "93d0bcf6-a38e-4335-b9a1-1413cce2628f", "comment": "Malware payload (Amadey)", "value": "d40130280d4af5ecb4c595ef1a2bbdb4c4281110590a1c67f9cc70234c9bc99403ea67c1b837956f2a85a20aaf50ce08", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267929, "uuid": "6a541c47-9a65-40f1-ba10-aaa56c08eb6c", "value": "T193840152ABD98477EDB91B7058F7038316367CD04CBC826F234AAA1A0C726D4A57637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267929, "uuid": "0a406c85-f5ee-4180-8210-f2112a6a9f82", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267929, "uuid": "fbe0bd43-4905-4ae0-bdf2-77cfa14188a2", "value": "6144:Kgy+bnr+dp0yN90QEq1Ry/sY7kWzjZNKQRWOFZj2kAJXeLgFJvhfnvP3Ox4QaL81:MMrty90EIsAjSRl//b8TAjxh+Mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267929, "uuid": "d1ffd5e7-e787-4f6d-ae0b-87d09018e429", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267929, "uuid": "d97d9d59-d583-4697-aa95-0866bb41e310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267929, "uuid": "e49168e0-3fb7-4386-86f6-e92893f7189c", "value": "5b8be81e5f75f817bab6afe8b6b985e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c852bd91-2b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SystemBC)", "timestamp": 1690307446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307446, "uuid": "224cbde9-2224-41f1-93dd-60f1db458d39", "comment": "Malware payload (SystemBC)", "value": "1c973c1ac0fef68fcf5041312d126f1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307446, "uuid": "4b986401-9b8c-40ac-881b-d89d3dc81910", "comment": "Malware payload (SystemBC)", "value": "cd40f468a59f1a6af15e76616d8f76e9e8fe854414fed5379d6284ed9e11f269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307446, "uuid": "1b798563-50e5-4d1b-9b4e-eb1e89d206ab", "comment": "Malware payload (SystemBC)", "value": "e2539273cec31c0f4a6bc18757029e7a245a6d6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307446, "uuid": "87252ee9-d0b5-4e0b-b006-aad05a6a2482", "comment": "Malware payload (SystemBC)", "value": "21bb6de46215da4b3eafe2d4cebf11e3e77feb8730339cb882bd8af48a85dd74e0ad27de563d51f7889f7ae91e6a055e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307446, "uuid": "83c8d369-79b6-4f9f-ac1b-8e69b9942b1a", "value": "T15736B035BF80B42ED32219FB5B36D277582979CD292FD87536D41B4ECAE83432725282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307446, "uuid": "0eacaeda-50fc-4db6-a971-5f5671037536", "value": "2dd7ccda47f8c453a5f25f913ac9621e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307446, "uuid": "74a0502e-7c84-4c62-8f5f-8a645c710fb9", "value": "6144:vOaZsS4DFasluB04DdbHXrW2AmPxSB/lKfwmpjLkBGxalTK:TZsFDFas+l3a2AYfnjxxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307446, "uuid": "01d780c7-31d2-415d-8c2d-502510120204", "value": 4929024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307446, "uuid": "c39ec707-b302-40ed-8837-63cb7016fff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307446, "uuid": "13f5becf-295e-4ebc-9d39-e3665ca3ee60", "value": "1c973c1ac0fef68fcf5041312d126f1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1a51b8-2aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690269124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269124, "uuid": "8038e0e8-711a-4d17-980b-cc0d319e2ade", "comment": "Malware payload (Amadey)", "value": "e1be4a259eb657102b932e96558c8699", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269124, "uuid": "3fc528ff-4a61-4475-8c16-63e2ac9d508f", "comment": "Malware payload (Amadey)", "value": "ce2c6f30a9ddfe7d62d6cffc6b3dfbee0cc839a5ce98747bfa6c8098b24da8a5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269124, "uuid": "a81c412a-673c-485e-b6df-d96142417f90", "comment": "Malware payload (Amadey)", "value": "bd8cfcc9e3862fb74b7bc5f769919a1d50ff8045", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269124, "uuid": "b292eebc-56cf-40cd-9c16-fd57a6b5cdf0", "comment": "Malware payload (Amadey)", "value": "bb5b973de449dd2bd3afbb7ff55276e0a2457fd8e92ffe4ed04bcab1f6d5348874fe454fbf5084d7cb63ed29c6ba84d6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269124, "uuid": "5c039ca7-b3d4-40f0-a6b5-743d77c64b4d", "value": "T195B40227A7E990B3D8B5277088F512930B34BDA58C74935B23A96C1E0DB36E0E53177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269124, "uuid": "7993a3c3-9ca8-45a4-9b48-85738ccbe756", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269124, "uuid": "75c18019-267e-47c8-83c6-9e4a1cf9c289", "value": "12288:BMrGy90EQ2BKgdCl8CaOOHkllv7WyOuUaZaMfk+:TyHBBKgdCKCaZYxsa40k+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690269124, "uuid": "cfec4adc-58fd-48be-a489-faba8c2cb491", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690269124, "uuid": "f2934513-8915-405c-bf59-a65ea655ea04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269124, "uuid": "1ecffb6e-542a-4ecc-98d3-e3ce29ce65ed", "value": "e1be4a259eb657102b932e96558c8699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e263446-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690290463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290463, "uuid": "2db99622-64bd-4c78-bdd3-9485d9365090", "comment": "Malware payload (RedLineStealer)", "value": "a66ad74c710c06cced5218febbadbe26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290463, "uuid": "1f5925f5-b244-48d7-82e8-728bbc137034", "comment": "Malware payload (RedLineStealer)", "value": "ce6536c7a150a17a6a73fee4bbcdaf098bd83fd4d363cbba3a5c38231e15a56d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290463, "uuid": "d3946060-347e-4d86-ac1f-dce9b9a5ff08", "comment": "Malware payload (RedLineStealer)", "value": "297a41b83280cf35a5ffe1486e1b1dcd07140c10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290463, "uuid": "c3593e46-ca48-4f80-86a8-32307463a2a7", "comment": "Malware payload (RedLineStealer)", "value": "494e0cbd5c959d4758ec28c4bfe28d9c2034d4c62edc5bb335750b8b1cee6267f7135b6ec330d47288f06af8a9cd54c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290463, "uuid": "17a4493a-f952-4ed7-8ad9-e93c9d8afdc4", "value": "T17C84F143B7D88436D8B657705CFA13C30B36BDA2CD64826B3256A84E0DB25E09971B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290463, "uuid": "2d6ff5cb-a777-41fe-9ad4-5d8bc64a9712", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290463, "uuid": "38ece03e-eeb7-4529-b87d-1cb692e4a15b", "value": "6144:Kly+bnr+qp0yN90QEA0uOpr6bGNe5tCOmyoESALVbmmzIFZDCjmd/Q:3Mr+y9051pGCO1/iaAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290463, "uuid": "d341b360-e539-4434-ba64-7ae98df923be", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290463, "uuid": "f4aaab11-b718-455c-9720-be6cbd98b221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290463, "uuid": "b52fc601-dd05-4ac1-be6d-624e19bfdfe7", "value": "a66ad74c710c06cced5218febbadbe26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2ac591-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690267937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267937, "uuid": "087c26c6-3b5d-4cc5-bd89-ea557725fd4e", "comment": "Malware payload (Amadey)", "value": "5652ba95f4f9baa86aee122888635dc4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267937, "uuid": "e71b2cfc-b2d4-4189-8aaa-351ecd364d33", "comment": "Malware payload (Amadey)", "value": "ceb52130a83fe584fa082ce333ac099fee20058bd6dbe3fa86a1175201185845", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267937, "uuid": "42612f09-4900-4b54-b40a-192374b7381e", "comment": "Malware payload (Amadey)", "value": "74c903294901877b4b69e8a7bd564d710e664459", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267937, "uuid": "78a86880-442e-4083-9aa0-4ef2b3954f0d", "comment": "Malware payload (Amadey)", "value": "f8581ee3f78d7b59641d2ea159056a94fd57c938fcc7c4fcf4b7d1757596e39a997957b14bdd45ff63bb4c2d399a442b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267937, "uuid": "136b3c42-4e92-4de7-b065-c2b850a16ada", "value": "T11F840207AAD98472E8B5177058F703D30B3ABCA29C74573B3A42A95E1C721D4A93377B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267937, "uuid": "08637820-da1e-4ed0-aefc-69ae27a630f2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267937, "uuid": "c719b573-8d8d-4ceb-af2b-1a0e6ac49dc7", "value": "6144:Kiy+bnr+Rp0yN90QENyrGDHRS2C6inHwOtvxYAfuepUqopnYrUkHi5:OMrly90uSDUWinHnVfuBqoi4D5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267937, "uuid": "f5df2e7c-ab38-4d4e-937f-788d5407253a", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267937, "uuid": "b66ce664-e4ce-47f8-970a-247d3dbc46a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267937, "uuid": "1bd68528-20db-4051-9ee1-03e3f34ca453", "value": "5652ba95f4f9baa86aee122888635dc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3443cbf0-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268542, "uuid": "d69d61c3-d226-4155-bd4d-1744620e1966", "comment": "Malware payload (RedLineStealer)", "value": "baf6bf402f81d7fe9fe4c05ef6b58d5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268542, "uuid": "7d53b14b-52ac-4bc3-9cac-f884e2789de1", "comment": "Malware payload (RedLineStealer)", "value": "cf508f524df675c9a2404fd5265556252002163f99edfa16c1c25e2f6b4cd1e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268542, "uuid": "b8ff716f-34db-4da7-a034-573f89e13135", "comment": "Malware payload (RedLineStealer)", "value": "72b30521379b9b98b76b6d573031e79df0acb0a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268542, "uuid": "caa6684c-cc2a-4521-bfad-3035fb97442c", "comment": "Malware payload (RedLineStealer)", "value": "8cdc8aba4dcc64857dd00f6ac68c8434f77c3b39019739cfcf2cc80e33cdcde2f40dbbbb78396b7908be0cb16f4b0e3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268542, "uuid": "0858693f-42ae-4b2f-9f48-98ee4abc4811", "value": "T15EB40113AAE89032E8F523702CFA13970F35BCA16D68D36B2755989F0C72794A57173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268542, "uuid": "ef74fe1a-fa28-4160-a2f7-a1bb7c28a9e9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268542, "uuid": "f254beaa-ba9a-4381-bd21-64f722928cf1", "value": "12288:DMr/y90B37RBXdUiGpwCS8FB8JbojU0S1JqC:My2tnUlpwQGTqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268542, "uuid": "6d6b4eaf-28f2-4c25-bbb1-684426b49df8", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268542, "uuid": "55c08676-64d4-49c0-ac0e-34e0fc7a135a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268542, "uuid": "b6f826e7-8f3b-4c0d-a431-68b6e8493975", "value": "baf6bf402f81d7fe9fe4c05ef6b58d5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f883b04-2a81-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690244429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690244429, "uuid": "68b1aeb0-519b-4095-b1cd-9228a9542047", "comment": "Malware payload", "value": "c4f44f314b380ae7de616473c1f67041", "object_relation": "md5", "Tag": [ { "name": "pw-4545", "colour": "#2247E6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690244429, "uuid": "cfdd682e-7df9-43a5-9909-37d1e97a7f04", "comment": "Malware payload", "value": "cf745a76b76123f0168d7b5955cb37a639c0c9c0383a58d16a0554871991274f", "object_relation": "sha256", "Tag": [ { "name": "pw-4545", "colour": "#2247E6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690244429, "uuid": "8e86a5b4-2aae-49a2-b3f4-66145a1064be", "comment": "Malware payload", "value": "8f0cf9ab130b9d2b2de65d44db4fe86d501e6f31", "object_relation": "sha1", "Tag": [ { "name": "pw-4545", "colour": "#2247E6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690244429, "uuid": "e5d86996-09e5-4b10-909b-4bcc70b92ecd", "comment": "Malware payload", "value": "e67ed8597ae520d10030753ebe53532320609d1bdae1cd8601b7c512a1fe0294c5b356c871ea4a05fb58233f2d3a4739", "object_relation": "sha3-384", "Tag": [ { "name": "pw-4545", "colour": "#2247E6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690244429, "uuid": "df5d25f6-a001-4543-b412-ca6a04fc1db8", "value": "T16137333BCE5EE650B0A9498D3AD429C274FA04758AE5F3D8709767F298EB4145BDCF00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690244429, "uuid": "a38fbf49-1322-4284-924e-625d6c1efe2a", "value": "393216:68zMDQ97wtr+6QsO42WDu4Z0rNyo4W52+zKGJGD3jYrf1aTHkIs:7zcwstr+F42WDu4ZmqzMrf1aG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690244429, "uuid": "3d053497-5950-4328-9534-22574ea53db6", "value": 22716496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690244429, "uuid": "fb29df58-3e0e-426a-b10a-eab9a36d013f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690244429, "uuid": "dd58954e-6507-4850-9fe4-18e623aa97dd", "value": "E9Y@#$-Setup-Pa$$W0rd-4545.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a69878-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268192, "uuid": "4b7edd9f-011e-4065-a30a-fc1377143518", "comment": "Malware payload (Amadey)", "value": "42d832225905a375663e5326aa3bb4ba", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268192, "uuid": "89388172-2a8c-4faf-bc1f-2b5817d321d6", "comment": "Malware payload (Amadey)", "value": "cfbd79446d78b7250b041c48a5b5caf8dc1f55d1e0a9f4d6b032ecf8beec096b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268192, "uuid": "2cb9dee8-31b6-4724-8a45-4af45886ca76", "comment": "Malware payload (Amadey)", "value": "f5ae31eb7a9f13f965d042edbb6a527caf11d760", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268192, "uuid": "7dcccb25-09b4-47c8-88e6-69f20ededcbb", "comment": "Malware payload (Amadey)", "value": "27fa873d23d56df4dc24b49bf9493d851907aefd3a730b2d59d5e0e456b39d2f97ce053772819ead947ccfa8bcab6122", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268192, "uuid": "182f1328-8bc7-404c-af82-bde48cd0b606", "value": "T189840153E6DD8073D8B517B018F617D30E3ABDA1597483AA3386AD1B0D73AC4A876327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268192, "uuid": "50874e2d-0bc8-4ec6-a65e-87e8fdf2535c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268192, "uuid": "1c8f224a-d0f7-4957-a4e0-ebca4c009982", "value": "6144:Kpy+bnr+ip0yN90QE6KDtKEQQ3nA8igOpXmp0iaokQjd:LMrey90IEtKEQQwaOpjvokq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268192, "uuid": "8fe82573-f6ca-48f0-9e31-79859077009c", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268192, "uuid": "bf9bf4c9-792f-4fc8-a49a-8c7b4582c0d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268192, "uuid": "6bb5e9fa-670b-43ad-a65d-d92d9091a2c2", "value": "42d832225905a375663e5326aa3bb4ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d40cb1-2b18-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690309669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309669, "uuid": "c0310251-3319-432e-915e-8ddb2d77d81c", "comment": "Malware payload", "value": "80066ea5b0bb5223edea70e28b8b9650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309669, "uuid": "9625c2a6-b8a6-4f4e-aa94-3c33c48229c2", "comment": "Malware payload", "value": "cff37ce90ef9a1056c42c16d39c6e5f080a73ce178425ef93222316523d30fd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309669, "uuid": "c93da609-132f-4c77-ae9f-3eea84b03f50", "comment": "Malware payload", "value": "41c70ec4bb75096b337ad3061aca5d7bec5fbd89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309669, "uuid": "0e0746de-3315-47fd-97c8-31d81939ce58", "comment": "Malware payload", "value": "d9b24bba27ecfd6574731bfe80289fb75057473f7140109556a316bab376fe6e032853580cbeb766fa0b20b3900303ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309669, "uuid": "3b1f70a5-d581-485f-b357-4ef9c22a1a99", "value": "T15EB5E17866DF80B4E8828DEF5BB59A1AA51F1A401B525BDDCD8FCF218F9089750DCC32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309669, "uuid": "20fd650e-fe88-4670-bd82-c1301ee85e66", "value": "49152:2b7ny9ByilGxhSzw8q0G+C4NNJJ2DKy84sI:A7fxgkcbJJEKy8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309669, "uuid": "7729ab83-0347-4c66-aeac-7dbb736a4939", "value": 2309387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309669, "uuid": "bd2a99d4-9bb0-48b1-98ca-15ee609263bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309669, "uuid": "6bd1b05c-6ff1-4ded-be0e-daf73e023e20", "value": "80066ea5b0bb5223edea70e28b8b9650.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6593a5da-2b04-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690300837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690300837, "uuid": "d230fd0e-c91a-442d-a0e8-3d2fa3d36f12", "comment": "Malware payload (RedLineStealer)", "value": "9139f048f1e79aa4b85629c03ecd1c77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690300837, "uuid": "8f194db2-b47f-4dd6-8785-56a99a4d2fb4", "comment": "Malware payload (RedLineStealer)", "value": "d0a5980dfe8a632a382ea0c15fe19c05adbdccc5ed3bbecf6b87bb5cb3bf8f8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690300837, "uuid": "a0c30828-bb5a-402e-a3a5-cad33d97a442", "comment": "Malware payload (RedLineStealer)", "value": "1f3cd11913692cdf04721b1249f3a0c031d0fad0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690300837, "uuid": "147475d7-aeb0-404d-9656-305a0acb7d6d", "comment": "Malware payload (RedLineStealer)", "value": "0a3a111a47cfe1b67079205dcba70045a31a3e0014efe57edfb96991fc149e441e87350f09ed14b21d0fc39c8ba54fe3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690300837, "uuid": "2bab380f-28ba-4685-ba96-8a7006f9602c", "value": "T10804D6583247697EC97F483D9C700CE4A77CACA71246AB079C8EF0E4393A7919B151F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690300837, "uuid": "faa98f93-55b5-4a71-aa9a-f9915cee3669", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690300837, "uuid": "c733884b-46d9-4199-954b-833ef9479812", "value": "1536:jZ1U536sv0W7T6IkIjrHmiv7IX2muKn4GxNStYQLrbueEo2GAjh3lR0GkRT8e8hM:jE3FQS782G4GxNh6QoFAjh3lRw8e8hM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690300837, "uuid": "d664b82e-812c-4f37-8bc3-97e241c4c352", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690300837, "uuid": "c05e67f4-0104-4554-bd6c-4a57c85ddec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690300837, "uuid": "bbbb9bf9-9105-4130-a817-d5b02f1fc5f3", "value": "d0a5980dfe8a632a382ea0c15fe19c05adbdccc5ed3bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d23b5e-2b07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1690302101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690302101, "uuid": "d48f1cb3-8a65-4164-aace-519a9d22ecb5", "comment": "Malware payload (Smoke Loader)", "value": "c354b13abfc9c46705a58c01a3c0bf2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690302101, "uuid": "efb2484a-a4b8-4431-b21c-0d5bb26404f8", "comment": "Malware payload (Smoke Loader)", "value": "d0b81e9006475f247dad8dfaa06d6ad883d79de31f0957c338c89dc121da49a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690302101, "uuid": "513f01c2-d0ed-4c14-8d3f-1949eee1f81e", "comment": "Malware payload (Smoke Loader)", "value": "ee4ed45567f1466555d86a69403c3d8640a8c305", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690302101, "uuid": "76d50cb0-28a4-4a0a-b760-805a9abb3bdd", "comment": "Malware payload (Smoke Loader)", "value": "0852ca2d5683c578e93c6e8f47b3032a55db2f19b82e89407ecc1b018b02bc0e7d13314743427e71644dbc879afa8ff4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690302101, "uuid": "853c6062-6d77-45e4-9b72-023fc1f4ffbe", "value": "T1C444BE227690C072D0A39A315870CAA66B7ABCE29B6482CF33983F3F5E716D05774757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690302101, "uuid": "9608abc1-6282-4835-8efa-c05091fd6dc5", "value": "21f576cdd9781dd6a4a8eb3639210862", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690302101, "uuid": "f460ce6f-6252-4c0f-8f96-b8eb3d8cd4ea", "value": "3072:c9r9M7o1Ng92sTBv2bBnsfjLaI3CHa0JAlJuAQhKsGlEdBFOFDDUY2xSvWAER:mGk7g9XTd2bBsXiHa02lEN7RxY2Y+AE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690302101, "uuid": "eed6d3bd-caae-461c-9cf2-cc6a2348c486", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690302101, "uuid": "f469b1ec-13ec-495d-9579-2b2d2f860552", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690302101, "uuid": "3f57959f-3b63-43b4-bf91-ec2286bf26a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e7683a-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268569, "uuid": "c2aaa412-891e-4022-a64c-4cbefaa587f9", "comment": "Malware payload (RedLineStealer)", "value": "d03906c8cd206f44e7f2763f747e17c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268569, "uuid": "771870e5-b8e2-42ef-8f44-65c4f3fe3685", "comment": "Malware payload (RedLineStealer)", "value": "d1838d404a9f6d7a730843e53c448809ec2082b5f9a42c686deebf0b83658476", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268569, "uuid": "70fc91b1-cb7d-4058-b81d-e2120edf9216", "comment": "Malware payload (RedLineStealer)", "value": "df2e2e5cdb17048f3ed146b6111306757233581b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268569, "uuid": "ae798df4-be84-4384-b578-97c7f8b41468", "comment": "Malware payload (RedLineStealer)", "value": "24abac8f261a0f0f79b6871a803afc8bb001f946b59c7a41c837ddf31c16e78d360b77c593874254805656ca0f12b3a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268569, "uuid": "8967975e-1b4e-43fd-b023-2994b9608c0e", "value": "T158A46C0796B17D55E937DB328F2EC3E8761EF5508F497BA62229AE2B04710B2D273710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268569, "uuid": "7abf1c8b-5b0f-4666-8208-1c6dd4a1134d", "value": "020eb28774c582d508abf5443eb41b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268569, "uuid": "433b2fa4-df75-4afd-88dc-f1b75d6008a0", "value": "6144:NXk3LI9yEjPuhCvJCIdWwnA3DJHx5CfYXJ0LL/VR2UvLv1pT2:lk3M9yiumJCId3nA3DJ1ejjvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268569, "uuid": "21e6dfd3-c55b-42d1-9594-7ff390645578", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268569, "uuid": "89a77e79-02c7-4049-b10d-d4dc57fc1bb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268569, "uuid": "ca816565-1b62-419a-a203-1907ca7300e0", "value": "d03906c8cd206f44e7f2763f747e17c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a474979-2b14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690307717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307717, "uuid": "f7c74fd1-5d15-4f62-9227-d9c55b13caf8", "comment": "Malware payload (Formbook)", "value": "94f1efcfd1cee251a23f34dfa8a8f5d2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307717, "uuid": "8f5c0bf8-6d78-4b5b-bccf-6ecc57ee7a79", "comment": "Malware payload (Formbook)", "value": "d1a9836f81c388227c21a4119aa9a179e19f7c472146b95a0d084053a8860b2e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307717, "uuid": "903eed96-cb82-400c-aef7-1f2ffb5096a1", "comment": "Malware payload (Formbook)", "value": "42f27383800aa461f35b33ee91ce0c8165d603cd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307717, "uuid": "f2d8b9ed-bdb6-4bd5-a273-ffa533c135e9", "comment": "Malware payload (Formbook)", "value": "a211979d829053391264967fa6edb76d445408d8f9c84035e66b7e16519df712d1930484457e7ee41c950427e013b412", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307717, "uuid": "41c83c73-bdd9-4827-93b6-43dbc5c8ce9b", "value": "T19575F103E8119E97C40C83F47EA32DD54F4A6F06E4956CDB15123FAB3AB3662499FA0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307717, "uuid": "f03d2703-978e-4824-b436-ea2a2384c684", "value": "49152:3nuP+6Vd1Fd6VoiNhv3tZQXXnAgWj+RGk:3n3md9moMhuXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307717, "uuid": "4929fe51-c74f-476d-96ad-a7ca95245e7c", "value": 1616896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307717, "uuid": "62b5d87d-2aef-4e1b-b92c-aeaa77969bc6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307717, "uuid": "721eb53f-01ce-4e69-94a9-f32ac186caa7", "value": "especificaciones.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b14a05-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690273944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273944, "uuid": "d5a88516-eac4-49b5-b6f8-041aea5cef34", "comment": "Malware payload", "value": "cb4f19f79ae08274540d5120c881739c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273944, "uuid": "e13d3caa-9818-48f4-b29d-2f059a47246e", "comment": "Malware payload", "value": "d2261b16a940231686db17a3e27aca8f7cf6841c6b0b7cc3b3ac293f01a75426", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273944, "uuid": "712299b3-6509-4273-b02c-b772d41b8dd5", "comment": "Malware payload", "value": "d5431a957602bd972b6a28d443c416ca6ca2dbba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273944, "uuid": "7c962873-5f76-439a-9892-0556360ea868", "comment": "Malware payload", "value": "906a4ab592b2e692495bf1c1ff284e7f724be9730c2238b27274668baf85c1a5c53ad237f929da45be6a53aeda7ec0c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273944, "uuid": "53207148-baf4-4960-ba6c-46d1aa1f1fcd", "value": "T1FAB53B73B744753FC46A093A4627F6689D3FABE129068C5B97F44D4CCE390502E3AA4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273944, "uuid": "f81d45b8-8b2e-48b6-8764-a0ce2fa633fb", "value": "a6a147270aff725bb19edb907d502ecb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273944, "uuid": "7f7b434c-03b8-49a4-8d10-f201e2cd0fd2", "value": "24576:7zwVdVkDkS75dJ33vgvKgUXwuvcx13mZTNCdDBsSpQCxtngh52P3FZgcaSAOza:vKkJYmZED+SpQJ52vgj6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273944, "uuid": "029c2662-1d23-4799-8e2c-14b78560f2ba", "value": 2348544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273944, "uuid": "315ae02c-d963-479d-8935-fee0ae5950ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273944, "uuid": "7e8f7fe8-47d1-476a-bdcf-5792964af49a", "value": "SecuriteInfo.com.Adware.Vigua.8601.12623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27db60cb-2aa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690258214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258214, "uuid": "0dc725bb-b8f3-48d5-9ae6-f7fd7af7da36", "comment": "Malware payload (AgentTesla)", "value": "1e53d9febc3ded7142d2f16fa2bf0dc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258214, "uuid": "3e0743c6-986b-4ed7-89bc-c9b5eb42e6ff", "comment": "Malware payload (AgentTesla)", "value": "d249d15759dc257b0373947a598effad7d0b33ab13a76d73e188c466199dd1a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258214, "uuid": "5964e60c-6a09-492d-9d49-e4c1b513e915", "comment": "Malware payload (AgentTesla)", "value": "89b9f35c9aa32de38878d330020845f5f7307ce6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258214, "uuid": "9bf88963-d0f1-4c65-a00a-fedc9ab766d1", "comment": "Malware payload (AgentTesla)", "value": "d3da252afa52590840e0cb1bef42107a2dfd0f7a7f69155c72f1c4e5bc1f455fef930de6dba2efa30c51d64d22b0efd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258214, "uuid": "a604e6fb-66c8-4f48-9978-cf103e68bcd6", "value": "T1EFF44B6F618CC8CCDECB6A7AC961314DF267568ACF67017C07146C854FB9E7588A0BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258214, "uuid": "13803dd6-cd51-4c3a-9add-6cc1577e296a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258214, "uuid": "000c8a52-e61d-403e-be6c-443a75bc58d4", "value": "12288:D6n0u9PSzWUAPSzWUZeRNq0tnJL8KC3ynkpSdbB19RK2EyzH:+0u5dUmdUuRRrC9wdbbKBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258214, "uuid": "a4a17a9f-4feb-49e5-b192-56fd76b8ae5a", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258214, "uuid": "4ae0bd6a-3f74-428d-8adc-337f24bc0278", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258214, "uuid": "8a0540b9-9e98-4276-9f59-cfe33123199d", "value": "1e53d9febc3ded7142d2f16fa2bf0dc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95d57c4-2b10-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690306105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690306105, "uuid": "086c607a-2bbb-41c9-8c3d-c985b38c42af", "comment": "Malware payload (AgentTesla)", "value": "06c8ec1f6eccf81439105e9488c53dfe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690306105, "uuid": "01d18d9f-4d5b-4be9-9e68-2d9f6d8e4251", "comment": "Malware payload (AgentTesla)", "value": "d254597f97b77a7c2e13c980947c0b19a24f21cea9226826c2a9bd13d7a5e335", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690306105, "uuid": "587a34ed-d446-4310-a32c-50068fc83fda", "comment": "Malware payload (AgentTesla)", "value": "32f34312e4397f8bea814ed2ecdb6ba823795f89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690306105, "uuid": "694910d8-dffa-4432-b1c1-1c3198b23503", "comment": "Malware payload (AgentTesla)", "value": "a8738da753963fd08335cc826fd96540902cec38d0776f283ccd53019bf88311b7ed87d67c1ce9e67d5c436415dcaf84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690306105, "uuid": "1398818a-8ddb-4b7f-9985-0fd5bc1dff95", "value": "T1FBE4126172DCAE26D1BFA7FE194218310FF15A972122F70C6F8D68DA0E367405B447A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690306105, "uuid": "7bd091da-f5ea-448c-b079-e318011c15c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690306105, "uuid": "392b8afe-fd3e-42fc-9760-46092491c34f", "value": "12288:IXPZRy1T/Wwa55kU6U2F9wOukMB1yK3v612W/ZZezwtP0TZf0G:iUM6U6UmAhGZGwtsTZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690306105, "uuid": "0536fb8c-8819-4331-b20c-78d8b7619c6f", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690306105, "uuid": "8f278566-fed5-4846-b29d-476a6bff12a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690306105, "uuid": "d2ebb6bb-9252-4ba0-9c13-f5bf21b5058b", "value": "SecuriteInfo.com.Heur.Variadic.A.410.1.1181.24170", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d582a42b-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690282127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282127, "uuid": "66f5267e-37ec-46eb-9534-157707aa8319", "comment": "Malware payload (Formbook)", "value": "a696c7e49cc880915fac5a00565c39c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282127, "uuid": "92082bc9-a46b-44f3-87e6-ff766a92fea0", "comment": "Malware payload (Formbook)", "value": "d2906d9945a58df92abb912c1932d44533d174118522982a2fa36adb592a7801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282127, "uuid": "684a99e0-7ddc-4581-b652-9a0092a5704e", "comment": "Malware payload (Formbook)", "value": "5133297bef017aba9f97672e06e85a7ffe7f9797", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282127, "uuid": "5aa3c06d-ed28-42a4-b319-8cdbe55ff829", "comment": "Malware payload (Formbook)", "value": "762f848a7cf50a92e0d7f3efcc592896da62e913df4964ac53a6e8c58bc5440ccfaa7cfd4a46938a1bd3b45f15b91c47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282127, "uuid": "cbdaf7e3-d839-4f32-80f1-70e33b6a3e55", "value": "T1F974D092A6CCECD7D02684B50E62B27D7B32BE254D280D162F96F80D763814364B7F6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282127, "uuid": "161b0980-8971-410c-ab7e-64239036ae2a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282127, "uuid": "7c052ba4-1da1-41e6-9508-e69b91784a23", "value": "6144:gYa6lQ97n6WUJ9Wna/ilaka7iVcWRFmiE0SaORGuP:gYLQ97kma/il+ic0FxE0SaO0uP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282127, "uuid": "cf8b0ff3-6351-46fa-9224-a2fc0860cdac", "value": 364516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282127, "uuid": "195f73b5-7d36-43a8-85a0-4b5acbff671d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282127, "uuid": "12f89815-883a-4b60-abf9-7bc163b220d7", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83c4eb9-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268844, "uuid": "9655e925-8415-44b1-b8f1-74091faad30d", "comment": "Malware payload (Amadey)", "value": "54fc8b2f98be76ec2fc0d35ae82b7f8a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268844, "uuid": "90400014-01fc-4286-988b-19374b055137", "comment": "Malware payload (Amadey)", "value": "d32b86afbbd51a1a135fb27234624480b133b827a340644da97664e3682d0aef", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268844, "uuid": "2d65d400-e382-4e12-8e96-71a1de305a6a", "comment": "Malware payload (Amadey)", "value": "bb4f92f1ec85cb11b1ddd1e62f5178fc179ef537", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268844, "uuid": "1947de21-c321-4b0e-9ba3-59b95dcce8a5", "comment": "Malware payload (Amadey)", "value": "399814ce1fef950166e8f2021e52c4ad35b88093918491483d413f2b748595cfc077c2265ea9ff56bf5e9afc2bf517bc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268844, "uuid": "1ac2dba5-ff7e-409f-a77f-e12d756485fb", "value": "T1DC84F142FAE49072DDB927B058F612930732BD614E38936B3746E86A1C736D4EC3176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268844, "uuid": "da9ecd54-95d6-4482-b50b-71a09b70ee18", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268844, "uuid": "c88b729e-a3a0-425d-b854-443ec6fee0dc", "value": "6144:Kty+bnr+ip0yN90QEZwgHQ+MFRHYaAVOhMYYGef3c2gBZ+t45D2L1HlxQYYlfl:vMrWy90AgHfUAXtgBYC56L1HdYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268844, "uuid": "8e2b283d-d63f-42ba-94b5-9e57df1441c1", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268844, "uuid": "bbc21410-f26c-4e3c-9503-a5618dd39409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268844, "uuid": "6ff16611-905e-4dfe-888a-f2029b476c11", "value": "d32b86afbbd51a1a135fb27234624480b133b827a3406.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131e7e34-2aa6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690260326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690260326, "uuid": "d50a64b0-4d0b-4ab9-b240-6314ee56ad3a", "comment": "Malware payload (Mirai)", "value": "33aa1ecc538367e1aebf40c886d8c266", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690260326, "uuid": "da07abb5-9a2c-433b-b984-b83e12bd4ad4", "comment": "Malware payload (Mirai)", "value": "d3337efa00ca8876c53833db4d4ad881eb4bf38dd9f9c3ae60bc477f9207b8a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690260326, "uuid": "fbf79574-4d1a-4f15-97ba-f4f6b2e2aea8", "comment": "Malware payload (Mirai)", "value": "673bc16624bcdd6c628e63f309c667acbf4baca0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690260326, "uuid": "4cb35df6-cc4c-4f9f-a7ab-374f4cca81a2", "comment": "Malware payload (Mirai)", "value": "46684e676f495d9c187713e7059cb78c088f3b0dce8e4a3b75be20e1f6ffcd94001f3640be18442adbcdfa4d76b2d6d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690260326, "uuid": "9c9e3b9f-e8d9-4732-af31-f59d69b4e609", "value": "T163735C95B8115EBDF95BD9BD81220A09FA2173004FA30F2BE267FCA32D731A59D07C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690260326, "uuid": "b930be6d-1cc7-4720-8683-4cba9874fb58", "value": "1536:RChiYUWPqnkK70Qqig0i5+0o0t0GgP9KkS0iB9pNFaX/xOPTCpfAObS8vW/X:R2ZK7oicJAKkXiREZbAye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690260326, "uuid": "eca86000-00d5-4438-be9a-d3d64352dd92", "value": 80352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690260326, "uuid": "dc053f7d-d93c-46e1-9d50-37c74ada466a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690260326, "uuid": "f84d6db7-0202-4f86-bcd8-cd4e68dad6f6", "value": "33aa1ecc538367e1aebf40c886d8c266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7340372c-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268219, "uuid": "20d31b21-1808-45f4-b057-38304ec2a11e", "comment": "Malware payload (RedLineStealer)", "value": "7ed06c3aa88e6be1642efead0a16b89b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268219, "uuid": "4c99a8c2-ed92-4da2-9e0b-df50d16bd7cf", "comment": "Malware payload (RedLineStealer)", "value": "d39216a7a35201f72e745abe5269f5540ef42e5386dee096f6cd7dbaf2fe76d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268219, "uuid": "7cb52004-584b-4095-8a9d-8e1f5ce045bc", "comment": "Malware payload (RedLineStealer)", "value": "75b50542793d97e4f8230e61f565b157e517fe93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268219, "uuid": "8bd28b83-b7a9-4811-bd47-e8e77b0e5de6", "comment": "Malware payload (RedLineStealer)", "value": "2b3237b6af667a3c019a6bbd0fe56fda7def00adba09b7247e3a00b1ebd16dd395f352cd41d072fd3e375511e9985988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268219, "uuid": "4e41c6d8-5a29-4cca-91c8-1b8d59cf15f0", "value": "T1FA840213F7E88173E9B5277118FB12C31E36BDA19D74C6662386A84B0CB36C4A571727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268219, "uuid": "89a53b8f-940c-4505-8d07-59e35a43b4ac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268219, "uuid": "59f8f9e4-24e4-4637-9e94-3823df05986b", "value": "6144:Kzy+bnr+dp0yN90QEAPUKtxBgM3Vcq21/X3pKBdZvaxN6cMjWLpFm85OZKBVqEFd:tMrRy90RM3Oq21/oLZyxmOp8fiyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268219, "uuid": "6cd5ccdf-44da-4a06-a696-4f957d2bb3aa", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268219, "uuid": "836a5a50-018b-4a7a-9c53-de6156baf7b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268219, "uuid": "37798645-e5f0-4aac-8013-ee84c7816faf", "value": "7ed06c3aa88e6be1642efead0a16b89b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6a7918-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690280231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280231, "uuid": "cee43a8c-4a8d-4a53-9c47-441ad4700d3d", "comment": "Malware payload (Amadey)", "value": "3b1218a0dbb1e2af9ad31952be9fb935", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280231, "uuid": "c246e57f-d5bd-4ed7-8d03-710eed36822c", "comment": "Malware payload (Amadey)", "value": "d3d90d9e937538bc283250e869430a4264592f748b85a2dd7d13113da233ec26", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280231, "uuid": "525570b3-4433-417b-802a-f85287a145e0", "comment": "Malware payload (Amadey)", "value": "0f490dbf2b13feaaaee2a94497ddb667c9c4d7d6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280231, "uuid": "c57fa59b-f954-42ef-a68f-6878aae0a102", "comment": "Malware payload (Amadey)", "value": "eb08c292f6a34e62d69100d7b5b11b4683a371dd4995f731425546560cd29cee0507e8885ab9e3bda1f7e9886fc578c0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280231, "uuid": "1043b72e-06d4-4254-9ac1-94472357059f", "value": "T1E12408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280231, "uuid": "85514d79-dbc6-4670-97f2-bf2e24bc4c0d", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280231, "uuid": "46193ddf-8c94-4362-a5cb-a900b70113f2", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280231, "uuid": "c52b47d8-f3da-4f3c-8e42-71c0df3ab137", "value": 229499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280231, "uuid": "ca7ea701-8ec8-4f8a-931c-a1255e4743e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280231, "uuid": "cebba378-d0cb-463c-a4be-0aff40da68f8", "value": "3b1218a0dbb1e2af9ad31952be9fb935.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6cc7785-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690267902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267902, "uuid": "edba13d8-b066-46a1-ad86-81432129a4eb", "comment": "Malware payload (RedLineStealer)", "value": "2d024433645b86971c0cacc2989af0ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267902, "uuid": "9ebea44b-ff80-4009-8e1a-a31d3d91e53b", "comment": "Malware payload (RedLineStealer)", "value": "d42c61ec5e66a2885fcf8fcb6a781cfa108b5380d7e8f3553fc63b7eedb44bef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267902, "uuid": "903a92b3-af7f-4ab8-8dce-9a2588d2aadd", "comment": "Malware payload (RedLineStealer)", "value": "cf86e62782c1c3ff0014390511539694ab396b33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267902, "uuid": "dbe46632-9445-48d7-b80b-9265dd577844", "comment": "Malware payload (RedLineStealer)", "value": "ee14ef3f0ce9e1a545c8aae27026c69ec827e98ee56086d4da6751d2b1f7a3d3643b8afd007225cc7d457fedbaeb731e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267902, "uuid": "c0aa1b70-2c7d-4ca0-9110-1ed0afa518e9", "value": "T174840213EBD4D433D8B41BB058F612C30A39BCA26979936F1389A95A1C726D4E53273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267902, "uuid": "2606e460-d2df-4e15-8c33-39abb85c1d3a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267902, "uuid": "cfaed803-eaed-458a-ae52-4a84e1675651", "value": "12288:FMrQy90SKYP1aa1Wg3+HgRO6AAgBYChg1k:tyxKYN91Wguz66zq1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267902, "uuid": "013a1c22-c1d3-4284-8870-76fb9db3427c", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267902, "uuid": "c1516315-427e-4a0f-a567-6716680b655b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267902, "uuid": "d1c15fa1-2a85-4193-8857-0b1e0cd4189e", "value": "2d024433645b86971c0cacc2989af0ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13dacf5-2ab6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690267437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267437, "uuid": "8d5fef11-9c40-4766-a37c-567a44937309", "comment": "Malware payload (AgentTesla)", "value": "89e534783d4e2c7bb980de437f646c58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267437, "uuid": "c284f1dd-4232-4ac3-9daf-ff531ac184c0", "comment": "Malware payload (AgentTesla)", "value": "d4a5fb621efb69e38a3926650e51292b6dea0f0ebeaf32e555a4e5e279ea7efd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267437, "uuid": "d71a2a9e-25ca-42cb-8dfc-955e9eb047ae", "comment": "Malware payload (AgentTesla)", "value": "0c8f371010ac3c049984a42ffe508d11ed6aa268", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267437, "uuid": "1792f3c4-62c5-4533-a063-385cde39e78c", "comment": "Malware payload (AgentTesla)", "value": "2497b000ecbbe6e4851c9bf534bdbdd033b0458db85ef490e52a2fef4b37d45c53f0a15ecb63dd66022d3079c470aedd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267437, "uuid": "4aac1c70-e888-43b8-b3b1-224f0333175a", "value": "T10A328D3A69C83ABED706113D40EB5504F2A43083D32B5B3FBA31E778C5751CD6A04795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267437, "uuid": "b07a9bbf-d51b-492e-ac17-953e73f11da6", "value": "192:vya0NwvtvWhARgZVPCK44AG9xXSJ+Ej7dJYfKwYKM7lWYzcWeOi:vyXwvtvWhANK4499xXSJf7dJYfc0YzZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267437, "uuid": "67994f63-158d-4194-80ed-8e14c05154c4", "value": 11082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267437, "uuid": "d64db2c4-5c25-4730-be44-7241b3db0d14", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267437, "uuid": "a494d1e9-fb89-4bb2-9f91-82a25789b016", "value": "AEDRTLX3000157923.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8689800-2b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690307526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307526, "uuid": "ca695e5f-0371-4c31-a4dc-ee6dd993bd36", "comment": "Malware payload (SnakeKeylogger)", "value": "8690cb7fbd24efee98c4d9a904918830", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307526, "uuid": "4322e771-9be1-43b4-aea9-414a003d8385", "comment": "Malware payload (SnakeKeylogger)", "value": "d59e68cbaf8565ea560db0e70ae412833962a15559c7b24e8af904b0ed5de8c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307526, "uuid": "640e43bf-dce0-4837-9352-832bd1988bd2", "comment": "Malware payload (SnakeKeylogger)", "value": "1ab24a0ecd273a8ac2b3fbe05af0d9821932c889", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307526, "uuid": "eb22db0c-b2d6-421d-b4da-ef97eca197f8", "comment": "Malware payload (SnakeKeylogger)", "value": "ed1163e841e1df60c48fb35af23dff3e5e449ac0166935dbcbab0ba41f88b952adf8a21ad74d92d95eb19fd380b0b7c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307526, "uuid": "0d002124-b219-4db8-aa8b-30ba7342d376", "value": "T1BDC1C71163D89332E9730731ACB39B4163B8E7A09D83CF2F7C84514A6D423A41D62BF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307526, "uuid": "cb03a4e5-75bc-4580-8a07-f7d90d20f159", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307526, "uuid": "d123fdb4-70b9-43bb-8b0b-622962670ad6", "value": "48:6WvxjDh/NgaQ7py66RzwxdvxiJyTko2msFfXJx8T5VTy7OpsVtiOlNgqFSpfbNtm:7wovM5iAd2m4PK5k73v4zNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307526, "uuid": "14ce60f4-3f17-42dd-becf-33c6750aad72", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307526, "uuid": "db6139cb-e899-472e-8a09-706016824164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307526, "uuid": "1e17230c-ca68-40d4-83a2-6f06437d6529", "value": "09009774-5433222-888988-777780-7544566.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1769c2e-2b01-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690299784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690299784, "uuid": "cd399fef-fff0-4e85-9ea6-8d2a2ee5d3c0", "comment": "Malware payload (Stealc)", "value": "3592b52e7f5264904cfd06ae567fd04f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690299784, "uuid": "835ee92e-6299-4aa2-8889-26eeb8720dd1", "comment": "Malware payload (Stealc)", "value": "d5b4716082c735fbf29d7984ff7a99d1a5b35fb8071b94223cb34d9d77199a74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690299784, "uuid": "966811e4-cbc3-4de8-bc26-073febd09f19", "comment": "Malware payload (Stealc)", "value": "fc4944faddfc3f3f11d5cbf906b65277df6cfa46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690299784, "uuid": "ff4487e3-0999-42ae-93d1-1c8694d478e4", "comment": "Malware payload (Stealc)", "value": "de22ef966ee0386dd3f5a6f11506bc237512c47fe62ab081b57069e0552c25e402f802f797e2aaf22fb637d115516884", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690299784, "uuid": "bacbf023-3c28-4d77-b07a-a80d2cd56748", "value": "T15344AE21B690C072D06369315974C6A11B6BBCE3AB7486CB73983F3E6E716C05B78B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690299784, "uuid": "35d93750-32e2-4bde-976c-567a2235e8cf", "value": "1c187c5419584098cd104bb53d369d28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690299784, "uuid": "a3080c5e-77b2-4c58-8adc-d7ab9731ff66", "value": "3072:i/fZ88sy8tgVvEJOvs4SkAqSzSzDw5enVMOQuu4LIK74uP31L+78/g:+SFyegVMJOs4aozDw4pQuuWzR+7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690299784, "uuid": "56b8aa06-c22f-4d97-9b79-47e279e6e113", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690299784, "uuid": "8fc82369-6a19-41a1-b64d-586b4f4583ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690299784, "uuid": "84b5bf7d-a179-43f8-b9d2-f987bc575b43", "value": "3592b52e7f5264904cfd06ae567fd04f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4eb89f3-2ada-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690282959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282959, "uuid": "51bedec1-2157-4f76-9131-566cd92078b7", "comment": "Malware payload (Amadey)", "value": "3c323d8a94ea6949da8999e5d4d1bcb9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282959, "uuid": "ebff379d-cb98-4ff7-be87-8d3ef458d7b6", "comment": "Malware payload (Amadey)", "value": "d5eb06a204589c4b604304b2797df64e7926c87fd6823b0a8e40cf061562ac3a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282959, "uuid": "b311c9c5-7804-4757-ab8e-a41bcd0f7dd5", "comment": "Malware payload (Amadey)", "value": "11dd37183c64b74d204ba22328e7ac047ece6b17", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282959, "uuid": "84b6106a-69b9-438c-9577-d6e17a7d69d5", "comment": "Malware payload (Amadey)", "value": "f6e71d1fa72eae71800e00703876996739cb3776808de15bd680d6a0c902bbb3e51463731ef4720897676274ebfdd70c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282959, "uuid": "47f2c486-e3e8-4970-9cda-089626240e09", "value": "T1BB84F113F7E98033D9B817B098FB07C31A377C60997843AB2395A95B1CB3690A57176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282959, "uuid": "e65e83a3-f079-44ee-bd00-efb4773d8df3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282959, "uuid": "f47f0714-9acd-49d3-b571-a16b3202e87a", "value": "6144:Kuy+bnr+Gp0yN90QEl1fiUwnVYFjR+uzctyRd7VSIFyMwpWmArMVChMw2:aMrCy90r10VYFjZIt8d5SI0AICN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282959, "uuid": "3eddb6d8-68f1-47b5-89ea-7eada7516477", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282959, "uuid": "5bd28272-6b3d-4549-b4da-9f4e0b29b488", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282959, "uuid": "cf1349c2-3222-400c-a5bd-c1d9e56a5afe", "value": "d5eb06a204589c4b604304b2797df64e7926c87fd6823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e60e8a-2b3a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690324103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690324103, "uuid": "8f82aa0a-c6d1-44b6-b1dc-6482ff6c49aa", "comment": "Malware payload", "value": "cae4ece4402014c0e2527c2a277c6e04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690324103, "uuid": "cdf3a9c5-922f-4fe3-8fba-19d544aaffb1", "comment": "Malware payload", "value": "d5f1a77bf8d84cf38a76a3a077e7d0cdbdb8f436392ec8742f7463c0f8067362", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690324103, "uuid": "d87b15db-6c9b-4d32-b3ab-a15ec1a16cdf", "comment": "Malware payload", "value": "2101cfb25a8bfa1bd26b0f41aedc3f0b868dfb0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690324103, "uuid": "a1304fe0-a8f6-497f-8cf2-3feebd4c436a", "comment": "Malware payload", "value": "efc4cd7575d42d8c1d430191442fa7d3c38129ce364dfa14805bf692414b5029b0495a2b8fda07499644d3b1dcf3886d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690324103, "uuid": "d310a267-5059-426a-a0e5-910f3193e6b1", "value": "T1AE74D021B990C032D05769310834C5921B7AFCA3AB7586CB37983F3E6EB12D1AB79757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690324103, "uuid": "e3f904be-8d02-4b20-a248-76d542195912", "value": "5ea05395629dd7cfa2fe7ed080de0303", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690324103, "uuid": "a2b14bc3-0ddd-405f-9ab3-4199b4a60070", "value": "3072:FUUoCzQNexgMHCs2PiBC9tnKt0wY6ciEuDqPgcPe6DslZu1/PttQryn8Dc3/u9tW:k8MMgMism8CfU01CEumYH6WZuFr2JH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690324103, "uuid": "097f83e7-7f22-4bd1-bbda-c1062a4e42d3", "value": 360960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690324103, "uuid": "98d34e37-ee59-44ed-89d1-a5e35d442292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690324103, "uuid": "111e0491-df80-4554-83eb-66c370a234bd", "value": "SecuriteInfo.com.Win32.PWSX-gen.22075.20764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219aa52a-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268511, "uuid": "7a40ed03-75ae-4988-ac25-717d08107dbf", "comment": "Malware payload (RedLineStealer)", "value": "834a873f4d08af5b2f3da6fff14794e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268511, "uuid": "df836850-53f1-4ad6-89b1-195e156d96d5", "comment": "Malware payload (RedLineStealer)", "value": "d61d31212c32abff87a8c27314e44f78d56451035e8d96f36689e904f2f6c2bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268511, "uuid": "fa754ba2-63dd-4887-84d9-c7c89b65d4a8", "comment": "Malware payload (RedLineStealer)", "value": "5a1185b4af9e7e006f479cd05f203a4b7ac03149", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268511, "uuid": "183975a0-5972-41ee-af70-d3765c1cbdee", "comment": "Malware payload (RedLineStealer)", "value": "ec0bbb3c4b707e9748ef3d518427058d5660607e428392629bd57b42e5d17373c97f2273a3e66f7833f0d42633e37035", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268511, "uuid": "0d36d1c5-8649-48c5-9ef8-6f0bd2fbd757", "value": "T16E840216F7E95032D8B267B058F602D30F35BD716D74832B2395A81A1DB3AD0A97273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268511, "uuid": "6036d855-a353-4f0b-a58f-54bd42fc5ead", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268511, "uuid": "3b27f8aa-e58e-4496-a923-e46a21a87f93", "value": "12288:1MrMy90P1vbc0NC2UZ3OmhgBYCpdKtnfer:ZyA1zNC2UptqzWnfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268511, "uuid": "5f5c0e46-1a55-40f0-826b-625b280f35ba", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268511, "uuid": "40a7626b-7d45-482e-b974-71bd8f6d720c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268511, "uuid": "fd4b751b-af4c-4254-9522-6c5b13e60291", "value": "834a873f4d08af5b2f3da6fff14794e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d76513-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690308564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308564, "uuid": "0310b8be-f1b2-4ca7-afa6-8db4c4f2bdcd", "comment": "Malware payload (GuLoader)", "value": "8f8de6d1b7747a022d5878c4118a0e5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308564, "uuid": "faf0cfa9-a59b-45d2-8cff-a2ca5630105f", "comment": "Malware payload (GuLoader)", "value": "d63d28807ab779abfb6c7dc81d0032bff7597ecadbce18abce685e0ba9b8f2d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308564, "uuid": "efc40278-e51f-4f0d-a0eb-06f312f0f240", "comment": "Malware payload (GuLoader)", "value": "01f5321c5aa9fa99e1eaf651a47e2ab0269eade1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308564, "uuid": "8723f6d5-64ad-4732-a172-bbc10fda09f6", "comment": "Malware payload (GuLoader)", "value": "9157ae1a39151bf6571ac5622c8f8cd096158424a7a01deb286b40f1634a0723316cec250a24e71ac839e4083bd492b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308564, "uuid": "6c454a7b-8927-4a8c-a983-2a07141cad78", "value": "T1EA8401371EE15853CC5A5B7229AD86F1CB719D202824493FE7307F6D2B325C1DADA06B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308564, "uuid": "2853b2e9-4355-4bd3-a716-b7d654fdb1ef", "value": "076b06e6a65c9b7cca5a61be0cd82165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308564, "uuid": "816fcf04-df49-4897-a71f-7683d8f937bd", "value": "6144:Ki2E/GxdA4k7JgHCKfMdsvOG6jUfXFjvDyVMlKCdMIbnFMlzb7LnxvA:tzP7JM9v96jU9T2qwCbwzbvx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308564, "uuid": "ce38859a-60dd-4b31-8d92-da64d71da095", "value": 374888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308564, "uuid": "7c1bb51c-b760-4f99-ad1d-3714a69e56ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308564, "uuid": "14dd7f0f-3b0b-456a-a8f0-50cd3f198990", "value": "Msa INQUIRY 21019612 dated 25-07-2023 - Reminder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94736839-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690280300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280300, "uuid": "61e6d863-757f-4ef9-a9f9-c8c6939fb5d5", "comment": "Malware payload (Amadey)", "value": "b54791d733c2c0832ed7957ea0353736", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280300, "uuid": "7640c778-c286-481c-b9ab-972e90e125ea", "comment": "Malware payload (Amadey)", "value": "d6910203b32e1089755748e539c5d3876c10e3fcf2b5fc7facafc26e9ed37795", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280300, "uuid": "baef3062-8323-40f6-92b0-0dc4b736c1d1", "comment": "Malware payload (Amadey)", "value": "c6e2d27865e77474a0ab4d3daa4b3b0aeb260f04", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280300, "uuid": "9b4e01d8-9f5c-46ae-8573-f938d5d6edea", "comment": "Malware payload (Amadey)", "value": "0295fc1221764dd12a19f99c94daccf6f981456c953087b954f0f451ff965861f2558e341d5a80f21efe478cbb822e68", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280300, "uuid": "04177aca-8cc6-4566-a6fb-8cf3cd26a40a", "value": "T13E840207A7E85033DCB6277058F613CB1A397CA14D38876B3791A85E1CB25D0AA3677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280300, "uuid": "c69ce0e9-1fa0-44a4-a008-15fc21c7bd8a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280300, "uuid": "b9aa5eb2-f64f-475e-96c5-6493a5b4fbce", "value": "6144:KTy+bnr+xp0yN90QEAf3CiUewEO2zN+br4e+PEBv+VFmN4SIobnf/i:9Mr5y90mffUelzkf5bv+Spf/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280300, "uuid": "4d172b6f-a0a9-4c89-bcad-6d57f5327131", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280300, "uuid": "142186b1-ec58-4bb6-86af-f46d465e9363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280300, "uuid": "86741259-b6a1-47f1-bc85-a76e77b5df31", "value": "b54791d733c2c0832ed7957ea0353736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e31938-2abd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690270235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270235, "uuid": "9b0e0b76-fe32-43d8-9658-ea0c3066518f", "comment": "Malware payload (AgentTesla)", "value": "c722d2f52008c73c9a8709782226da29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270235, "uuid": "26b9288e-1553-4e84-85b8-5395630585bf", "comment": "Malware payload (AgentTesla)", "value": "d7452aa661d2be744d938ddc39cbfae42634331aa9c71fcb6707f74c1c36d388", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270235, "uuid": "ba109e96-b61f-4464-8948-1345099da62e", "comment": "Malware payload (AgentTesla)", "value": "ae251c56376dd87f0e71dac242ae78c6665bf589", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270235, "uuid": "5964a72c-e33f-4d9f-bd39-e88f631b3723", "comment": "Malware payload (AgentTesla)", "value": "2fdf5c052f637bbd265a1d0e6f3a5177bd3f9f9bc1db04c1532a9dc2d0e0cf0a503270111409c16d0f6f0cf76cee5b41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270235, "uuid": "6ecf8388-5783-4122-8104-008ddb1556e1", "value": "T1AEA42388475F6669B2323EF9683AE2A606E3E8B1FC8B66F7D6828371C1435731151770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270235, "uuid": "04eb16bc-982f-441d-a62c-d272ea3a15c7", "value": "12288:inmIAMGmXwxoy1+zafhoFpFQ0Ob/3IP5StFQd/nYCbv+m:imRMGI3y1CafmZQFb/3IQPEtbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270235, "uuid": "e27b8e3a-b450-404c-9fcb-b159fe0e321d", "value": 472928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270235, "uuid": "3efbc2dd-1d20-4b61-8255-f224a5d1d56d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270235, "uuid": "3eb44653-720a-4b19-b0ef-f970218d6c06", "value": "payment slip.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ca900a-2b0b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690303680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690303680, "uuid": "4a579625-22b1-4688-836a-20e8469670e7", "comment": "Malware payload", "value": "e13a30ad2625e1dcadd2e47c5afa5a13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690303680, "uuid": "80095563-a0d9-4d64-bcb9-a7791fab78d1", "comment": "Malware payload", "value": "d77e3c1254fc429ab068607caad8b94ed8f7976ec61e70401cc959cac37373f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690303680, "uuid": "a32ed378-73f9-4cb8-bb7f-d4ccebc55b44", "comment": "Malware payload", "value": "446a1234e83eb3c4093f3cc2a28611e6d9a0f943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690303680, "uuid": "06b7273f-0a64-46eb-91ae-b8feb9db3842", "comment": "Malware payload", "value": "091fab1d4414d7c9ddddec24f40105e56f723ae1b94e55eddcc972b6244a223d70bf9a0075eb965b63ba7543725c4836", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690303680, "uuid": "474c25b0-38d4-4176-98f0-33ec02d88257", "value": "T166B1822173EC9337DE3347719D67B2814B78E6049C5B6BAE248C7207AD0B7184533A31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690303680, "uuid": "e921113c-5db3-4bfc-98e1-9e11bc712761", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690303680, "uuid": "42b90e0b-128c-4b05-9356-9bfabdeba823", "value": "48:6Ja88qKguRyz9OQLPIPuU8pltS9XjLUxfyQi1uwuGu/Ositn+lP4cL5wFapfbNtF:nQKkDfNlWjoxfynuwuGumadLNTzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690303680, "uuid": "7872c776-ebe0-4c33-91b8-995af1ace08a", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690303680, "uuid": "3cc378cb-f19a-429d-b05b-21249f0debe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690303680, "uuid": "77b0114f-6540-4105-9a69-03138cdc7326", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f5963c-2b15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690308334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308334, "uuid": "48072304-9747-4a54-91f1-2440f78411a7", "comment": "Malware payload (RemcosRAT)", "value": "a88b7f891bcaa35a49f161e87ade9dee", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308334, "uuid": "8b236926-6e7b-4075-bdde-bfdbcb47e184", "comment": "Malware payload (RemcosRAT)", "value": "d7c063688bc39f50ab2364152612283ea08bc14c50db154999358deafe75f7d1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308334, "uuid": "32278abd-f101-453c-b84e-10993b362043", "comment": "Malware payload (RemcosRAT)", "value": "980d0083aeaa216f71ced7819d48dd5132cc5818", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308334, "uuid": "98413957-a963-4490-abf3-46a757c5fbec", "comment": "Malware payload (RemcosRAT)", "value": "dff652c0b41b778a1b0599fb345e34f5dee5a0df4e35ceeaf5815a87ade150afa7ce228003f94711d75802f1d09b4ffc", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308334, "uuid": "6a764320-bf71-4b10-a178-c2c27b171693", "value": "T1F715023121A85B26E9B09BFD1DD200BB8B73A119045EFB505ED2F4DB9CE2706D290DDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308334, "uuid": "e296df91-ebdb-4ad6-ba1f-e432d1b83f83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308334, "uuid": "a601ec93-1c2a-4477-b0a5-f1dfd51109ba", "value": "12288:7UDexpPSzWUAPSzWUEeRNq0tnJQ6LQ9hIVNUyX5fnGzxOFNLu9qqV9r3ElqvoMYi:MerdUmdUDRR26MxyJGzx4pua0oMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308334, "uuid": "4ba3856b-f041-4554-9a37-1b185f081e95", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308334, "uuid": "6356bb6e-6376-4f5f-98ae-09bf1c2b4f8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308334, "uuid": "e98da28b-c16f-4ccf-b962-bfded3f0b745", "value": "\u5df2\u7ed3\u7b97\u53d1\u7968_ (ICBC)_Pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf115ea-2ac0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690271829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271829, "uuid": "0b964b9d-dd86-4154-82d0-b30cf659d232", "comment": "Malware payload (Amadey)", "value": "bcd36d28bc0869bb2a519bdda77b7806", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271829, "uuid": "0a6d1906-6b87-453e-bc25-c9b0b7bb9800", "comment": "Malware payload (Amadey)", "value": "d812bbf609c777cc725e9ecb3293a15c74c3692c7d2b4349eedae71730437714", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271829, "uuid": "4e7e0811-101c-4147-b681-3ea62deced95", "comment": "Malware payload (Amadey)", "value": "aeffbd01ffdb7fd38b910832293c46b25f977020", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271829, "uuid": "e748ce7c-9974-4b63-b391-09f447737142", "comment": "Malware payload (Amadey)", "value": "dace82260b67f2bc038b78167333eb2608b5a23b0349c4b2e39c91970bf6b42682245c2ea34a28a6f7777634db0456fb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690271829, "uuid": "bfb43e8b-e646-4553-81e1-96542718fe94", "value": "T136840117FBE95173D8BA27B118F602C30B367CE19C79837A3285594F09B32A4997172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690271829, "uuid": "5e0df8c0-dd41-47a2-9191-26c5dd01139d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690271829, "uuid": "f38c8b2c-cb3d-42b2-9128-9b8d9e83e49e", "value": "6144:KBy+bnr+/p0yN90QEPn4tD+HUJMDicwlZGjSOVCMAHmxAlfV0NIlJ0dl:TMrny90h4tDwniVwSOADPQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690271829, "uuid": "e6a4684e-a785-4f60-8efb-b1fab03a324b", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690271829, "uuid": "5215d088-0121-454d-87f6-a1815aaa0174", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690271829, "uuid": "abf25d2f-912d-4ead-90a6-33d3f2db3e35", "value": "d812bbf609c777cc725e9ecb3293a15c74c3692c7d2b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e223a7-2abf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690271146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271146, "uuid": "5a337c94-2554-4210-bb37-1b7cf6819b08", "comment": "Malware payload", "value": "1e6f59f4a655939ded34e0d59433b08f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271146, "uuid": "f6ab7380-a893-4b72-866d-f49ef0961854", "comment": "Malware payload", "value": "d8ad704de14dc78b05730b9e87b4f8fa83fed387d68c17a8a7722cbaae9b0ccd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271146, "uuid": "406dee14-d4b3-4d6e-9449-e98737dd5c49", "comment": "Malware payload", "value": "983a578849b2a21d25045af0e5dcadc2b6ae6750", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690271146, "uuid": "59f7c89b-271d-4320-96bc-a47300568210", "comment": "Malware payload", "value": "216c024ab7b8532060ba5ab765b23446e8ee3620eff7df4b3fa5ed8946a35ed649c5a702d0cb24906239d3579d4be1f5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690271146, "uuid": "b200e613-f444-4ffb-9342-7d80c13e9a82", "value": "T18A423A8D74A9D971FE6F037208DB760AF5766D11746275AB63F862FE4E623C180D002B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690271146, "uuid": "327a05c8-5b1c-4b2f-b0a9-4ee2a2c623da", "value": "384:simGPWPIOgIrcXqTRFg0B1IpfMSFOZ96S3:pPWQOgIoI3rMpfZQLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690271146, "uuid": "ca90b896-a466-4abf-aad4-28b8799d89ad", "value": 13008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690271146, "uuid": "2106f4bd-d959-4210-b6b7-2140b5e507f0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690271146, "uuid": "4fca5c78-dccd-40ab-9dec-cdab4f1f97af", "value": "d8ad704de14dc78b05730b9e87b4f8fa83fed387d68c17a8a7722cbaae9b0ccd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b8fcbb-2b10-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SystemBC)", "timestamp": 1690306104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690306104, "uuid": "122280a7-2ece-4d6a-a952-6fd31d3179e4", "comment": "Malware payload (SystemBC)", "value": "571a3130d8dfa900c4f1fc443b18a69e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690306104, "uuid": "3a8b2a61-ba64-424f-9c96-a1c4babaaea6", "comment": "Malware payload (SystemBC)", "value": "d91e0131e9a5854d8a2299742a4332bf127a185b72949d731d5e48aa87144f94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690306104, "uuid": "530240a3-e92e-4d67-9117-6d6b7fa05202", "comment": "Malware payload (SystemBC)", "value": "c1509161b2bd443739648475f39ee710dbbfe869", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690306104, "uuid": "506d78bd-db36-4f57-a166-dc0705864539", "comment": "Malware payload (SystemBC)", "value": "674ab51b031306ea64a9e2ffc119db396cc900ac975eb9e58f2f4a30c018491bbc8e404ce711ececafa126e80c1bf5a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690306104, "uuid": "83c1c8e5-57f3-4f90-9531-2d0de9162879", "value": "T11C85C00ABBA69236D9B36174CF7582656E6BBD400711D7C7A2E03B494F34DD07E322A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690306104, "uuid": "887d68eb-c0ca-47d0-a593-9087ec311c1f", "value": "14c198737dea646ad253084b784990ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690306104, "uuid": "a32c9660-778f-472f-8ade-991c0981114f", "value": "24576:juJN/7n6lbcu8oba51zj1SqdAGFQZIxvH7Gv3V8tZLAA9u45UJoeVO:86+u8o23zjYq+ZIPX9P5UJoek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690306104, "uuid": "64b9be62-f094-447b-aa4f-f6df40157d3d", "value": 1808104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690306104, "uuid": "a8b9d6a8-88d3-404f-83f2-0dffa5288d01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690306104, "uuid": "f247bbc1-6b31-4ea8-9eed-3b937a38173d", "value": "SecuriteInfo.com.FileRepMalware.1537.4965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08aee20a-2aa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690258591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258591, "uuid": "85aa6ab6-65a2-4366-80c1-f7a81167d7f7", "comment": "Malware payload (AgentTesla)", "value": "8e2c26151d6255d8c5ce929f15fc94c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258591, "uuid": "24b77501-47d6-4820-86f8-9c7fb49ea65e", "comment": "Malware payload (AgentTesla)", "value": "d94a3f759876a4d6785378613946eccae1b6ebb4c4c19fb098edcb218dcfbf0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258591, "uuid": "efe454ea-ccc3-4ad5-bd97-91ca3e9e1fec", "comment": "Malware payload (AgentTesla)", "value": "bd832f0679a42c05d19fa0b255614007c327eb13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258591, "uuid": "3c13f31a-5cf2-4357-a23f-76f402f32c7a", "comment": "Malware payload (AgentTesla)", "value": "6229d94012c79252bd84ef53584c6482918c9b99d30063c3dd85f8baabc4d7dfeadfc3549a8310a93c1db7f81afa41be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258591, "uuid": "2946af3a-d642-4d75-a147-9464b8f1dac4", "value": "T127941A382D564730E07F56B8E65B3E1B3614FEAB6460D61531B23E0B3B5A213B4F2729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258591, "uuid": "27276251-129c-4d74-93b5-433fc9a167ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258591, "uuid": "b2e0c296-6adf-45c3-b21d-f0fb8ed82e07", "value": "6144:vUbgGe0gj1kcaZ9NZkMjVfSCBTf5FI3+8+I3Dfv+mdQzHAb5:TB0YZGD3j0CpfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258591, "uuid": "b40d91e5-92bc-47ab-a028-735f82583d4e", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258591, "uuid": "84bb26d2-71f7-4ec4-81f0-60341a4c9de7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258591, "uuid": "c05c2b40-8a98-46e2-ad72-d6996bace4e9", "value": "8e2c26151d6255d8c5ce929f15fc94c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d429cb27-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690273965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273965, "uuid": "8a61e6cf-1b8b-43bb-969b-6c88df2fcad2", "comment": "Malware payload", "value": "e464f674ef8d421f8269dc8d3efbb63d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273965, "uuid": "3aeec17c-413a-4790-9b81-b6689e22d97b", "comment": "Malware payload", "value": "d9f41d1622e130d079aa301d0782eee1313bfdae77a3eaebf54829346543ccda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273965, "uuid": "37ca42bb-2283-42b0-9321-55ae0171c045", "comment": "Malware payload", "value": "00eeece77f940d2e3f4dd8a9b3589a70ab6ba703", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273965, "uuid": "68109353-fdcc-43fb-b9c6-c656f3b273fe", "comment": "Malware payload", "value": "990c2b3f81f2876bbeafe3a92c194f47bdea1947741c0a41acf00ebbf1051ff3920ec87ac595f4bd89fef2b8e7bf6ea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273965, "uuid": "0c244787-60ab-4742-bd0d-4d734ae1cd82", "value": "T1FCB54B73B744753FC46A093A4627F6689D3FABE129068C5B97F44D4CCE390502E3AA4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273965, "uuid": "597319c6-1f16-425f-861c-0470e6f56e74", "value": "a6a147270aff725bb19edb907d502ecb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273965, "uuid": "9db81c69-8596-42cb-a431-0a4d4653045f", "value": "24576:FzwVdVkDkS75dJ33vgvKgUXwuvcx13mZTNCdDBsSpQCxtngh52P3FZgcaSAOza:xKkJYmZED+SpQJ52vgj6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273965, "uuid": "19201625-9b31-4f78-887f-fef4d12deac1", "value": 2348544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273965, "uuid": "77e35d15-2130-4708-a850-d38e76870ce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273965, "uuid": "ce8facef-fdd4-4d43-a3c8-319f270dff80", "value": "SecuriteInfo.com.Adware.Vigua.403.21008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2d8d58-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268178, "uuid": "9960587d-cca3-4a75-b4a1-d258b6dfb83b", "comment": "Malware payload (RedLineStealer)", "value": "476057bee0bd5d2419e9b1ae666c20df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268178, "uuid": "bdb361a2-f806-4323-b34b-53c73d5ccb87", "comment": "Malware payload (RedLineStealer)", "value": "da296d2daf1eb0f7d0701ff20254dd73eb3a5970ced202b6322a7cdf9d42e0f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268178, "uuid": "1e6f9736-8d9d-49bd-9757-0293ba91d08f", "comment": "Malware payload (RedLineStealer)", "value": "6874a2cf3803a3e8e40e92fe7833ca2361714360", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268178, "uuid": "37669ae4-f47f-499e-9a67-14f4ebac2d08", "comment": "Malware payload (RedLineStealer)", "value": "82ada534b548e0a910b4027523e0c3248e4ef8b343c64d6d0b10026bc73ec2b7e23cadd0d8d1008ee7f9b5e2844d2409", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268178, "uuid": "a60d4915-8c12-4f06-b1e3-3367c780f098", "value": "T1F1840213E7C89473E9B52BB04DFA13D70E39BCA19978871B3641A95A0DB3690B17133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268178, "uuid": "149c0be4-4ae3-4fe5-a1f3-4c0bf7bcb9bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268178, "uuid": "5326443f-4add-4ba7-a75f-4f6bfb7f2e80", "value": "12288:IMrky90Y4BGYvv+2RhBfFCcFwgBYCWKa3zlGmJ:MyznYX+Wbfrz0gmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268178, "uuid": "3cb21585-4b8c-41b8-ac46-6e4947e9752f", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268178, "uuid": "3b6be2e7-e222-4c9c-a1ef-620c801f8070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268178, "uuid": "2e93f599-8522-4511-9f52-813cdfeb32b5", "value": "476057bee0bd5d2419e9b1ae666c20df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217a399e-2ad5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690280537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280537, "uuid": "2106f979-538e-41f1-b099-010059d93be4", "comment": "Malware payload (Amadey)", "value": "38ad5ca6591eab9c95ba3e432eb37992", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280537, "uuid": "c2be1a9d-a7fa-4581-991f-d670ad35d4cf", "comment": "Malware payload (Amadey)", "value": "da316c762cb18710a5091b344a4bcd8dd4636c7fa5618749f29530a992e1ea1a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280537, "uuid": "4e052e28-b02d-4db6-a3c4-62aaf11177c2", "comment": "Malware payload (Amadey)", "value": "74994992e693027863a78053fa60b92517a16bb0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280537, "uuid": "cbd62ca0-90b9-4fab-9421-44d11215852a", "comment": "Malware payload (Amadey)", "value": "250484b0af6c975596756303a3115ac1c7d3d24a72886d9f3b1bf71a44ddc8511ca60697ff33adaed3b9bdcd885cf207", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280537, "uuid": "ae0e5f45-3dec-4255-8a30-1e1da6d77c2d", "value": "T16C840203E6D99072DDB4177048F617C30B3A7CA16C78932B2796A95B0DB36D4A83277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280537, "uuid": "096d630f-2291-4dd9-80a5-6086f4108e86", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280537, "uuid": "896ce6f6-24fd-4968-855a-47f70d86c0bc", "value": "12288:nMruy90lTzksnu2CPf4VsAhgBYCVYGPj:xysuB4VFqzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280537, "uuid": "8fa05d61-2da3-47e2-b00e-d1b7a1545f61", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280537, "uuid": "77f8f6d7-0615-4d5c-a391-8dd70a9806f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280537, "uuid": "7cf8d076-7f89-4298-a11f-24f711882cc7", "value": "38ad5ca6591eab9c95ba3e432eb37992.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b9960c-2b15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1690308307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308307, "uuid": "98c5fba7-7fc8-4063-bde3-86b332f55767", "comment": "Malware payload (DCRat)", "value": "290f4b62b6b3dff19a3cf39546795510", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308307, "uuid": "6c3448f7-cc1c-44dc-bfb7-ead0ca2642a7", "comment": "Malware payload (DCRat)", "value": "da50af5d709ff0e6f23714dc7e8ab48ea83812fe474f33f614bee62d9129d5a3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308307, "uuid": "d81ba61b-7ec1-4587-9742-2fc358b576d7", "comment": "Malware payload (DCRat)", "value": "d3feb6641752c456044dbf71a8a6a776a167a653", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308307, "uuid": "744f0bd9-6a43-4a7c-83b9-928e4792ca90", "comment": "Malware payload (DCRat)", "value": "ba28f59ec3498af6707a7270450a66ed34ede89f166c5601d069b815f80d382c372c0ee39600e8bfb7fb64f27d422770", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308307, "uuid": "64b2372f-e284-4c3b-b6b2-6bb5bdff12a8", "value": "T134453310525E2D2AF0CB6BF015D59A416320EEC33170AB16D3F1D8A3AD9AE4B4356FDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308307, "uuid": "e087c379-1335-4208-85aa-43c6a8e35732", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308307, "uuid": "c2d925be-706c-4046-ac0f-889a0d7824bd", "value": "24576:u/FKvSnbUkfcdIAAKNcgVTKPoVYtqCc5l1SmGU/ZSytJ:ss6bdfJAdcgVTqjcwmGU/ZSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308307, "uuid": "d9e4a0b7-8dc6-4fe6-8f55-b000a8b06f14", "value": 1228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308307, "uuid": "44691973-2ad7-4db7-8d1f-2996f556879d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308307, "uuid": "fffd49d4-0971-4d06-8678-2aad111a40f7", "value": "290f4b62b6b3dff19a3cf39546795510.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ac3c37-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268840, "uuid": "099745cd-e8fa-449d-85b1-596283a14d7f", "comment": "Malware payload (Amadey)", "value": "e1b243c294a9dbd1698ed9aca9c4fc2d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268840, "uuid": "0ebcfe64-fb3c-45b5-b083-9811dfc1a289", "comment": "Malware payload (Amadey)", "value": "dbb68f809f1c082132934c3a85584117651f3b7232dab7d6ff9a0e718847016a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268840, "uuid": "5971914c-c3d8-44b8-88ef-33c56d2f9cda", "comment": "Malware payload (Amadey)", "value": "d9009f902808b7ca5ace1679e651484ec12ff931", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268840, "uuid": "b6568298-5811-42e9-a800-03e3bda9ea34", "comment": "Malware payload (Amadey)", "value": "db191b439180a90e7d59b77ea292108797b192d5c8b729b6ba814e7869f3f0e67014efc50c8f9a16e32ddba1d6d78b88", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268840, "uuid": "1981783f-7213-484f-9173-5d4d4ce37535", "value": "T1E12408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268840, "uuid": "e6408aff-4f66-46ac-b6bc-f6ccf8f9147a", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268840, "uuid": "897bb135-8c6a-4313-b5a1-f359223f0911", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268840, "uuid": "aa196668-4f6b-4a08-9bc8-b68069ffc214", "value": 229245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268840, "uuid": "08ecc411-cbd5-43db-b7ed-fd062f029c6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268840, "uuid": "4ddcf22a-f6fc-49bd-bdf1-a2d9c720f585", "value": "e1b243c294a9dbd1698ed9aca9c4fc2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47071d2e-2b19-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690309806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309806, "uuid": "567df72d-6d9f-43a3-808c-1df74f8f0c4b", "comment": "Malware payload", "value": "8dc220d410b3ead28a1279902d3e89a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309806, "uuid": "9da03769-a171-4763-bd7e-06bac82827d9", "comment": "Malware payload", "value": "dbe40b9e6a1cdb3db55a42228312ec4b8e5661ccef00dee81daadbe5bc56490e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309806, "uuid": "01cad604-b18e-43e5-beb7-3cc9f47a6e83", "comment": "Malware payload", "value": "3269ea358d8ff1a24a30f2ee382c0d4d35849f4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309806, "uuid": "b3658c0a-248a-48ae-8bf8-40ef6b8d270f", "comment": "Malware payload", "value": "0ef9a258aa8f0c0403ab1301bda90fad23465c5eb5a2d239315145d68f49f82f8a327d52384cb1cbf65b921f0117e755", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309806, "uuid": "adb36164-3be4-4568-b50f-324e338bdd02", "value": "T1DF95AE03B66786F2E28957B6DDABCC04C361DA83732BD70B788E23A555433B79C46607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309806, "uuid": "50eae846-d5b4-47e2-aba7-440165d563c1", "value": "49152:irjqkI9wbOEyCbdaveg5Q7FHo+sbC40fh:d+OKJo+shW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309806, "uuid": "258b95a5-1435-447e-b656-2d0d6f1731d8", "value": 2026667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309806, "uuid": "3b35c872-cda0-4467-8542-3a41c161d670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309806, "uuid": "ba95e25e-b131-46f0-aac1-66fb96e29f40", "value": "8dc220d410b3ead28a1279902d3e89a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86c407d-2ae7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690288602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288602, "uuid": "0756654b-1c5a-4870-bf56-7248a2bb658b", "comment": "Malware payload (GuLoader)", "value": "607211400deddc988a094c7db9cf0fa1", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288602, "uuid": "f6ee4ab2-7be4-4c34-bf55-da2268aa87de", "comment": "Malware payload (GuLoader)", "value": "dc05e3a9edb3549e0f990679928f9b60197f24babf8411634e246d2d4ea2137d", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288602, "uuid": "34305925-97a8-4143-8923-a923f6a954d4", "comment": "Malware payload (GuLoader)", "value": "3451709213707a57979fc49c19267024a2e21be5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288602, "uuid": "ffb77f90-efff-4181-9557-26dbd24ffff1", "comment": "Malware payload (GuLoader)", "value": "c70882270e5bab799d8012cf6503acd052e0e6ff547138a1d80b0a9639068e248f303c221b04a9bc06b6c2265366e009", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288602, "uuid": "8d8c9a89-1861-4198-b67d-95c244966207", "value": "T13404127D7927910DF69FCB3A3B0D1EE74E272DC46C38628E090DA1A369825046C8F9DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288602, "uuid": "e987ab69-2ee0-47f0-8bc5-40478951379d", "value": "3072:Q56fJ9OzElfR3rZn67cLTg0JqLUDTG+XjYIgDdDDzy+P02LlyOytjFVHm5M6yjRH:IwEEnrZ67cPzsYDTf0IwW2LUTVHm5M6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690288602, "uuid": "c0deb390-f6ca-462c-b569-d0da63dba6b3", "value": 173908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690288602, "uuid": "45bfda11-9cfc-4823-8dda-e86e509ce4ea", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288602, "uuid": "8e461374-8119-496e-a6cb-6414458cb023", "value": "PURCHASE ORDER #0881177252023.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367b625e-2aea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690289591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289591, "uuid": "4140d339-368e-4280-9d51-5ac255a4e488", "comment": "Malware payload (GuLoader)", "value": "42160fdf7a6465d852e0e28c723ebdae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289591, "uuid": "de45e9a5-c10b-4dec-acf5-03bfe2ca44e4", "comment": "Malware payload (GuLoader)", "value": "dd6c1c1b528f95923c4b501a1b603a28e00338dfa239cadbc8af87e441f047f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289591, "uuid": "b471da46-b5a5-45aa-b513-06e9e1309f51", "comment": "Malware payload (GuLoader)", "value": "4749424e0365b963a7a8e60a9b51e4ad0ac1b701", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289591, "uuid": "684c634a-af46-4a4a-b362-02e98ed1cd3b", "comment": "Malware payload (GuLoader)", "value": "508c038d2250336dc4b9691573409c0b1d971534f4dce7e2c8db28610f4bd2a061801efb9c573d76a2b28c193a1f215c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289591, "uuid": "755c8bda-d8ef-4ca7-8930-b742a173e5e3", "value": "T135741241526080BBE5E942709CB65B3F87DB6E2468F062831B9F3B417EF71B14A2DB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289591, "uuid": "8aa4c07d-46c6-43e3-9168-664795a51e92", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289591, "uuid": "ff69950f-5e49-4eb0-929d-5b08b1044635", "value": "6144:Ap0BurXv4NDgLiDx+u6jcEtnPEhsC5KXtB5L59KtE9s8UHkb:LBurXQu5jbPaKj5PKtI/Um", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690289591, "uuid": "eb77084d-edac-45bb-a363-0d097d463e34", "value": 364960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690289591, "uuid": "4d5891cb-51e9-4d77-afd2-b6445e92a04a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289591, "uuid": "d0ef85b3-d05b-4127-918c-ff146be71f44", "value": "PRICE INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6228931-2b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690307522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307522, "uuid": "cd7d8882-5b22-4d5d-ac33-1025c8d5a8e6", "comment": "Malware payload (SnakeKeylogger)", "value": "bae09d2e5fa03fd22a13eec99759dd84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307522, "uuid": "492df031-e204-4f33-9fd1-b9d72fcd97e9", "comment": "Malware payload (SnakeKeylogger)", "value": "dd6e84545935c73f8042ff869d3445f6c2ddb21bca590c17a14b0b996f000e2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307522, "uuid": "598cbeeb-7ec8-4ae7-95e9-719d9bc745fe", "comment": "Malware payload (SnakeKeylogger)", "value": "37c17c633701642a8fadaf05db845166f8ae07cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690307522, "uuid": "e5f16a15-6c5b-4ef9-9100-f5f8b6899cd0", "comment": "Malware payload (SnakeKeylogger)", "value": "dde56ecd4f783833506dc3d29dbb82153745e07916715c87ee74e4b3f82ab9b991ec7d035375764061a626668b3fe94e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307522, "uuid": "27814a77-101f-4ab5-8ba9-b05bef874d86", "value": "T103E4124001E58707D6E897F51B6AA71257F8EFC929A3E308DF8A9CC5B07BF345216263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307522, "uuid": "6612fa0b-0a57-40e9-bc4f-d77b80aa3a26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307522, "uuid": "80e85562-599e-4412-b446-bd9c387dd740", "value": "12288:O5qIkPt46c7ujzCWSD6IYkcvUAocGZTayAXOpixrBbH9jfITLPPb2Ik:AqIwwQCmkKGwepKbHNfoHb2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690307522, "uuid": "9c97a265-8aac-4b14-a47e-17d9fb4a9281", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690307522, "uuid": "38eb2c65-3f93-44c0-8aa3-8c008a5b7faa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690307522, "uuid": "8b417d36-aae7-42c5-ae30-a4b98cb468bf", "value": "PAGO 00766.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daaa0dbd-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690282136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282136, "uuid": "67dde76f-07cc-4799-adc6-6e02ddaa1ba7", "comment": "Malware payload (RedLineStealer)", "value": "49c62d54773f0aaaa52ef8520691d1e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282136, "uuid": "aacc4ecf-30ed-4e12-a17d-8f6e01036e27", "comment": "Malware payload (RedLineStealer)", "value": "de1e395425ea1cb66a500650a36c47908d24708d7c2329f6174e09fa122a73dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282136, "uuid": "522b406e-802a-4947-936c-ee849312247d", "comment": "Malware payload (RedLineStealer)", "value": "57c8a1e332ca42ca44bc33914934e028cfcfed27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282136, "uuid": "74b25ab1-b29b-4907-b249-e288804a6f61", "comment": "Malware payload (RedLineStealer)", "value": "9ee9bdbd9696e3ab11f9d8827bd98cdc7203be7fa839dcf6463293ed202dfeee7a2f198689929fbd15922615e12ac864", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282136, "uuid": "38904b32-4038-475e-a317-832974e136e5", "value": "T12F44D02075C1C1B3C477103085D6CB3A5A797475476AA6DBB7DC2BBA5E203E1A33A2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282136, "uuid": "67f846b8-9249-402b-b0b2-38ac901dfdf3", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282136, "uuid": "f239f780-d31b-4574-aa70-9d713f35cc50", "value": "6144:8DKW1Lgbdl0TBBvjc/Fnh4DzMImoy4WzXvjip:qh1Lk70TnvjcduHmB4sW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282136, "uuid": "e3be5c17-0f10-4784-bed9-9a866aa9474a", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282136, "uuid": "1a3820af-73e8-41a7-ad75-8b80403722a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282136, "uuid": "8f31e710-f91a-4d5c-8196-1e66e4f38d1b", "value": "ZXEA20220909 quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cd1a33-2abe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1690270711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270711, "uuid": "5210dcad-26ba-4000-814d-cd2e6a8848af", "comment": "Malware payload (Loki)", "value": "b3f6b5b50c9a84e908ca2b009639180f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270711, "uuid": "219e479b-439d-4d8e-9fa2-05264b104680", "comment": "Malware payload (Loki)", "value": "de3446d049a6b7189de5455bdd16e554dce659c21e7221520b131dd4a061d470", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270711, "uuid": "8097ec36-90b4-4208-a496-1c9fd9f3e1d6", "comment": "Malware payload (Loki)", "value": "495fa1190d7acaaae01a7a7d24931537c2f91b84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270711, "uuid": "6aca67e2-2eae-4cfa-9779-230626a68b2d", "comment": "Malware payload (Loki)", "value": "15dc76ffbfdb88c6aa2221034f3911b94b82214f2c962b241de34730070cc04c134dce80583698a99e52fa8a01d5c3ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270711, "uuid": "38a2ed9e-40b0-4d4c-9fb3-fa5e94ba1139", "value": "T136C41316BAE24A63C6262FF8146077F633BEAFE57511C1C72DE7B48EB866748C211102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270711, "uuid": "b71d0822-195d-473d-b516-3703c9f19891", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270711, "uuid": "eeb928d5-1517-4c77-944c-1af34cf0cd86", "value": "12288:9UYiIoFwIrG3XCCaF/+wzhqqvzLEk8Jn4E4hp7VKZaOUU0OJriE5kuc8R9WcNKM:OHIcTrGCV+wNvUkREg8ZXD0l8TWcgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270711, "uuid": "f62a30a1-8aba-4e64-9661-4281ebb5d4e1", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270711, "uuid": "82a644ed-d905-4ff2-aae6-9aec6a702f96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270711, "uuid": "514755b0-e522-4543-80f0-163d042bd2c9", "value": "PO#13046.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec7d494-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268184, "uuid": "e46d4ec5-4cf8-4ede-99a5-8d9d8a841b8f", "comment": "Malware payload (RedLineStealer)", "value": "20d72b3bebec64216a29a1b73792ebd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268184, "uuid": "d185ce8f-d141-48a5-9381-9e272570ecd1", "comment": "Malware payload (RedLineStealer)", "value": "de8918ac389d0d337d89be8e0da646df39dc0e12c56ea2f5e923bb8fba737840", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268184, "uuid": "49edc087-b5fd-470e-8de5-418450a4d64b", "comment": "Malware payload (RedLineStealer)", "value": "59f86b485cbfd2562cc57e7fd7fd443d6c78370d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268184, "uuid": "d56198c9-758b-4e64-a75e-a682700492c2", "comment": "Malware payload (RedLineStealer)", "value": "7e9288d3b5ba399fd8674c5c875b9622b0c714764dc0d954b596bdd3c4580420b782d80dbb4a2c70d26f25213ff586c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268184, "uuid": "5ead09c7-124a-4e88-b0b3-4ffb579ef0e4", "value": "T1D4B41256BBC85472ED7567704CF603C30A35BCB2ACB8836B13599E5A0CB26D0A87573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268184, "uuid": "d67e735c-47b4-4c84-9229-e47f4875db95", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268184, "uuid": "fafed668-73f9-461b-8180-20ff856087c2", "value": "12288:WMr2y90Vjaf+kUvuCETzCvMWXfhTpRZFCUDko5:YyojaBUvuRXCvZfNpRTC7o5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268184, "uuid": "10305bd9-bb7f-4117-aeb4-4963caaa6d1f", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268184, "uuid": "7d155e8f-a806-4254-8ddd-20b1f537f6a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268184, "uuid": "f53f938f-a3cf-4f5d-acd7-163a92e3ede1", "value": "20d72b3bebec64216a29a1b73792ebd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cabe0b11-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690282109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282109, "uuid": "79f58c4c-46c6-4bcf-9fc1-6329b681431a", "comment": "Malware payload (AgentTesla)", "value": "a7f410624e4870e19da2264ab6aeda6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282109, "uuid": "711b0630-8b05-4038-9277-314d7033155b", "comment": "Malware payload (AgentTesla)", "value": "df2ddabfa19f0d12d7626eb76d5202cfbfc21ea56f5b78505af147d827b1b590", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282109, "uuid": "4b098d18-f18f-4ac0-a38f-4c04513b7d89", "comment": "Malware payload (AgentTesla)", "value": "f730c84d3e321e52a971ac906aabd1204e22ef66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282109, "uuid": "92eae722-a855-475e-b5bf-cc6e4b6ac34b", "comment": "Malware payload (AgentTesla)", "value": "51ea7cbdce26f03d534aff43b50b3ba705eacbe15b2a4dacdb467d7509a37aa23d75bc794cf375ddc6ea9d915b2dc3e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282109, "uuid": "ea2c33d5-147a-4ef9-aa70-8048f92bd4c4", "value": "T1A3E45ABC313477DFCA13C876D8642C60A6E0226747DBD28E882715AFBE1D5A6DE141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282109, "uuid": "b98c1462-0b61-4ffa-b18a-4726ad195a05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282109, "uuid": "1ccbc439-5d95-45dc-99a9-b7d1f2b5a870", "value": "12288:xVtNAR1Lo2vyRor7tMgXZMsxbhsO4gUK7E6Rn5KzaJmVOYDfLqTrQaSejL8Z8tGN:DgRdo2KRW76YCwbhsOVU/snAORyfLqTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282109, "uuid": "b7bb50a1-3056-46be-81c1-9927f4f2e272", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282109, "uuid": "a47644bc-fd24-4215-878a-ed2d69c338d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282109, "uuid": "bc7e8d83-688d-4556-aacb-ead90bfde79a", "value": "gSfsPa9oxjPyjps.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4afa5f1a-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290485, "uuid": "35c2014f-158b-4ead-b867-0b3ecba8ad52", "comment": "Malware payload (Amadey)", "value": "df41ead29e9dd60e956792d90cb777bf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290485, "uuid": "757c5860-1574-4e48-b0ef-11871902c813", "comment": "Malware payload (Amadey)", "value": "df51428297b2a125a90d95e1f0dc046244a966512a3114cd142c5a8a661e85b7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290485, "uuid": "d5eb76cc-8a4b-457a-95f1-141afa4a415d", "comment": "Malware payload (Amadey)", "value": "578e5c0f66514d6b7884dd51d5a61c2e51a8540f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290485, "uuid": "ef4a04a9-264f-4f77-ba6e-a5e617cc7cdf", "comment": "Malware payload (Amadey)", "value": "58275dcb2e91b34e2e16e1c1a16a1192c64d57c854e6ce2277b9fbdf19c468d3e8a8b6734bc35fb729130e73d3032089", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290485, "uuid": "d35171dc-8e9c-4bbe-a547-a39caa1c2031", "value": "T10FB40267B7DC4072DCB567B059FA02930E367E628974C62F63859A5A0CB36C0D87173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290485, "uuid": "282e572a-3ae5-4c2d-bfb9-1c63c3b80ab0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290485, "uuid": "8b67ae6c-75e6-4e85-b313-721db7a071c7", "value": "12288:mMr3y90Wrz6dIqsQxwg/LJu5jKHAmVeqS7:Byb+dIqs+wg/lu5fceqS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290485, "uuid": "cd10f94b-c734-4646-91f6-17d27f331c32", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290485, "uuid": "81c1fefc-c1b3-469a-b28d-113d8367eb71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290485, "uuid": "e9d43a18-de61-4146-9575-7e9734fb3db2", "value": "df41ead29e9dd60e956792d90cb777bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93fd1a7d-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690268703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268703, "uuid": "31cadf14-d4d7-42eb-81e0-69d72f664fe1", "comment": "Malware payload", "value": "5d82ac7c6654ac0e25e64f52ebd43aaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268703, "uuid": "aec43972-d6aa-491c-82e9-8dd879193a15", "comment": "Malware payload", "value": "df64e519251717c6ad5470fe40a6285a71550241138053f3e470fe2ba5d9f38d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268703, "uuid": "f9db6d62-8d31-4406-9823-b69e9150faaf", "comment": "Malware payload", "value": "cc3be9717e5e644d569e61b8c76921d49783b31a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268703, "uuid": "9b2bd0b5-a006-4e33-91e0-0048ca56ec58", "comment": "Malware payload", "value": "f30c5616199b21e8b3c1fe3b8c956e9c2376a9c852010fb96fe54fc63ff2a1891e1b7325c5b7551b5a40ca3ed812dac8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268703, "uuid": "5e10903c-29ce-4b76-8999-7a15b30f27b4", "value": "T11BA69D85BC1D6862DAD8AAB07B7601A43236FC54DF8183277614F76DBDF2318AF52360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268703, "uuid": "27b4a980-ba67-401b-841d-3f7bd255a986", "value": "98304:YKBGpV2jRGlxfLZkrhT7NrjTyUi3EYtp7DCNcqVQfpluJ29d8puqmadkNJFvMHoc:Ep0dGLZkxlyX0IP6Ol829dyuWdSgZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268703, "uuid": "b084a03f-4b52-4d0a-8166-561d71adc922", "value": 9487297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268703, "uuid": "d8fb1ff6-2d43-4540-afc6-3bb8823ec995", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268703, "uuid": "94e8d82b-ce2c-4e21-a932-952f25781c62", "value": "5d82ac7c6654ac0e25e64f52ebd43aaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc917d1-2abe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690270785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270785, "uuid": "fd5e5bb3-4b45-4752-91cb-aedf2e246b2f", "comment": "Malware payload (AgentTesla)", "value": "146707650da4fa3e613c41dddf31e4e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270785, "uuid": "96836c8b-cbd9-4de3-aba8-bc1a2c79abdf", "comment": "Malware payload (AgentTesla)", "value": "df72be5f9ed3c15149f37c8fdb80683554f439257317837b0b6bb96dc4cac387", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270785, "uuid": "0c0d9903-f962-4169-afd2-bea23e8af3c1", "comment": "Malware payload (AgentTesla)", "value": "641a8cd33f334f6776792d880d13f5dbb57510be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270785, "uuid": "e6b6a2e7-7737-4dfe-9412-c8c684e6cf09", "comment": "Malware payload (AgentTesla)", "value": "3d73e0edd65092c8bbda3bf5a3316b64c1b5d6181bdd776c107f73b3896bd6c08f7c7a4289870f4f6cd15a0dee448696", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270785, "uuid": "b8cb983d-6b60-4a3b-b3e5-7173da9ec93d", "value": "T1E015F12035A9AFA7C5BE43F85070327453FEAEAE6035E3096EC270DA5971F848621F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270785, "uuid": "71b2dc10-00da-4eb5-a883-3c8ada76dbd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270785, "uuid": "759264aa-1269-498f-8a37-f79a1e006284", "value": "12288:qfgETK2jYiIoFwIrG3XCCaEHsbHQGQTCEsoE4RSjlKI5E3/7wHlqKylGP+tjmBvR:8xPjHIcTrGCSgGCEDson7mlq1lHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270785, "uuid": "bd10150a-fdfb-421c-9fe8-101d83fc5c7f", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270785, "uuid": "d84a7781-7a3e-4d6d-b396-1de3a0588b78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270785, "uuid": "e9b0f836-398e-4232-82c4-f6158a526092", "value": "bank detail.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573e1c8c-2afd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1690297807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297807, "uuid": "a1fee8a4-49bc-42b4-9086-0cad8f85d346", "comment": "Malware payload (DCRat)", "value": "214c4e64eec87c668d7e03411675f80b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297807, "uuid": "7f12213a-4ec2-46ec-b748-f24c543d2835", "comment": "Malware payload (DCRat)", "value": "df9e5ceb75c0d9781e09d9230210033645e89e79c5cb6ec5709fba052bc3e641", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297807, "uuid": "9f4d47be-1546-4f6b-bb9b-7f1062738b89", "comment": "Malware payload (DCRat)", "value": "daf874e94952ea62f24e32cfaa0ed597e35e5d1f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297807, "uuid": "a555873f-12e4-4dc6-8e7e-5411adfb3846", "comment": "Malware payload (DCRat)", "value": "6ab84ca3b070af583ac1efd5126d312a91b387009692c0ef9969756bf776d87647b4b9b5b02270d6e07116a89f1b09f6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297807, "uuid": "ee4e5777-75a9-46f7-9311-924c05969ed4", "value": "T11CE53327561C6EE6D46873FEBADE7E1801D40A2F628FCDD8953F37602B0EA8341594D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297807, "uuid": "d58e898c-48bf-4b7b-bd4e-6995a731519c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297807, "uuid": "225babf4-ddee-46a5-8fd5-0cf73f87b805", "value": "49152:XViJHzf4G9FHX7iy8P6OQ8sqaxY468v+ObRIdG6C9wQFQt+4C6yFNrtCRfvG6YCt:XYJHzbBrd8Ptspa47+4OEFdFUDCByO6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690297807, "uuid": "fedb47e4-af17-46ea-88a9-f1d0134418dd", "value": 3128320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690297807, "uuid": "5b0c5c87-4012-49f7-9366-85f58792c4e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297807, "uuid": "be9b44e9-c3dc-4f3a-807f-f9f17c881cd6", "value": "214c4e64eec87c668d7e03411675f80b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5c1b8d-2af1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1690292794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292794, "uuid": "99304766-d3e1-42a6-a76d-c45c0d84478c", "comment": "Malware payload (XWorm)", "value": "cabee3b3963cae4f1a8344167a35397c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292794, "uuid": "716a182e-996c-4963-9932-b645e244efd0", "comment": "Malware payload (XWorm)", "value": "dfdcb766fdbf5c8be70594c09b75907bca9a35c61f1245721f82a8fc07f5b424", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292794, "uuid": "6af13c56-0c46-4a3e-abe9-ec8cd1de8f7a", "comment": "Malware payload (XWorm)", "value": "c7db07f00f91483c9360a32371bbb8b1681ed2de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690292794, "uuid": "3f2e1230-fa63-4617-ba0c-da55a2c33842", "comment": "Malware payload (XWorm)", "value": "dbc2407fc3a12cf5634fa7537da7b65b4e96c779fa5a2f799481f7edb940f651ad810143b738a2256b5f19caebdfded0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292794, "uuid": "839d91e7-f4a7-4135-9147-f06638577133", "value": "T14F9485B1362254C9C18A1DB8CEB7366133A739BCF885364CE89B772F5653265241EB0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292794, "uuid": "bbcbf64e-9bd3-4cc5-8a44-5eaae21665ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292794, "uuid": "930b4800-669e-4166-b0cb-3545aa8b9f29", "value": "3072:q+S7JbeW4Gc8yJYFuVWnory7z3KNldg2qCpQAFObra8/JHCCxHkyxQIF3hqj4pqA:q+2bp4UFu7NNAE3uI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690292794, "uuid": "943b4333-6553-42c3-9285-df43e87c3628", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690292794, "uuid": "9aaafddf-8cec-4137-8673-0683569efab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690292794, "uuid": "35e25dd4-4c88-4bde-a1c1-ba8dae2d51bc", "value": "fed1744007643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c1b31b-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268808, "uuid": "45c91bfb-f3b0-496c-8237-244cc912419e", "comment": "Malware payload (RedLineStealer)", "value": "c9eac385d0318a8c0dd90c77d200298c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268808, "uuid": "670e9213-9182-44dd-b2e6-3a8eef910790", "comment": "Malware payload (RedLineStealer)", "value": "e058f58c82f239640bb1769427a62262ea51905c62df23907eb728668a55cc3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268808, "uuid": "241b7425-5f4e-4506-8aa9-67fc34d52320", "comment": "Malware payload (RedLineStealer)", "value": "e306670e2695d256b8ebbf7abc47430708de6b1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268808, "uuid": "c94622ff-8a87-4f54-8dc9-025c059c2225", "comment": "Malware payload (RedLineStealer)", "value": "121519190adecd9b0b49d0d424af124472b37f6ae52cc4d0f0c261cfc317ac18bd5d3d1c4402f7fdeb9b71ffa4244dfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268808, "uuid": "1db2300b-ccc1-4956-8fed-f389d619afed", "value": "T133840242B7EA9472E9B6177048F613D30B367DA29D74935F2B82AC5E0C73690A43173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268808, "uuid": "a53822b9-78f3-4b8c-bd2f-b3d6c66d2b01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268808, "uuid": "dd0452bc-c68e-4e7d-95aa-672fe59ab4d5", "value": "6144:KKy+bnr+mp0yN90QERW7VKqik7RHY62DCb7oCWGLWbgBZ+t4jDeNbEA:GMrCy90LWDkrNgBYCj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268808, "uuid": "1b67907d-dd8a-4c1c-92ae-eee05f584f55", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268808, "uuid": "eea814e1-5fd3-48be-a50f-a3c9e0ffbd74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268808, "uuid": "ec5ede1b-6daa-4828-a359-4a3deb74e053", "value": "c9eac385d0318a8c0dd90c77d200298c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a551a7ff-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690267873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267873, "uuid": "3efb0beb-8418-4df3-8099-7089543f4bce", "comment": "Malware payload (RedLineStealer)", "value": "25df728763347641338d6d76525933ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267873, "uuid": "61dfc7dc-f980-4a1d-8194-520a63a5d57a", "comment": "Malware payload (RedLineStealer)", "value": "e0e95a98754efc7dd70507be038e6b3db9014d9fbcf1df0b86dc982c0ede72d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267873, "uuid": "0ccf3e70-434e-4ffb-ace1-c3f1fbb8737f", "comment": "Malware payload (RedLineStealer)", "value": "19a5a6a512cafece9a126231f8a8e5e0705a4483", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267873, "uuid": "745b2809-c02c-4e38-87dc-606913dca579", "comment": "Malware payload (RedLineStealer)", "value": "14de543e17719645999101391d52308e1eeb2ec1e612a24ad3593568e2cf9777473e3c6962d3bbd8786eb534f51163df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267873, "uuid": "7f2a2c88-ed19-4849-999b-d366e3337afb", "value": "T13CB41203A7D5D032D8B957B068F603930F39BDE15D7893272786A85E1CB3694A83637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267873, "uuid": "458b61bd-eef5-4f4e-aab5-3cbc1521d1af", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267873, "uuid": "9ed5427a-327d-4d42-878a-c4a14b6e9931", "value": "12288:3Mr7y90m7uD8/EBcsoXZc1R5Z1nQpPq4o8IIIECy:cyJ7uD8O5Z1Kq4TI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267873, "uuid": "f24b820e-3755-4ace-86b2-2078079b25dd", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267873, "uuid": "f5dc9c14-9011-47cb-b7a8-199dac118a20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267873, "uuid": "fdbd52d2-6c99-4e55-925a-454d15abef83", "value": "25df728763347641338d6d76525933ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e9152a-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690267893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267893, "uuid": "00ecf861-5110-4207-bceb-4322d20382be", "comment": "Malware payload (RedLineStealer)", "value": "41f7c6d606dd5e857ec3896bf58a82e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267893, "uuid": "7c1464a9-4a88-48cd-9415-ce8a04eff456", "comment": "Malware payload (RedLineStealer)", "value": "e111ee546fa43ec78c9aba327edfe3a042398ac6b54bdc650ebfe05d42a003b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267893, "uuid": "d10fac30-b425-4c30-94f8-7b5fa401b940", "comment": "Malware payload (RedLineStealer)", "value": "1f6d7c773896274175a4653057d39138b1edfb8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267893, "uuid": "736f0835-ba97-40fa-a0c3-a3e5ea150b0d", "comment": "Malware payload (RedLineStealer)", "value": "5bab964f96b4d9195a535b7a8f19eb18385b2338a07edc50494906e02363f39531b568fa6e47c61fa528e644a2807877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267893, "uuid": "69ac125c-97f0-4add-86fc-2f843136be16", "value": "T11CB40252FBE44062E8F5277018F703870B3BBCA59A78536B1784AD9A4C73AD4A43177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267893, "uuid": "30541e08-5d81-492b-9e59-3176518ce2d7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267893, "uuid": "cda43f07-f449-4aef-8eee-e7c428cb3424", "value": "12288:FMrRy90FHEil1pdu82BWBd8wqjFZb1qz6CByK+ZW:UyGE8uQpWFZp86CBf+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267893, "uuid": "338d7d95-d26f-4333-8fae-61d8838184ed", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267893, "uuid": "cb7ba06b-639f-40ca-82b8-ef75ed238906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267893, "uuid": "abf6637f-1313-4508-a50d-3461f63e01bd", "value": "41f7c6d606dd5e857ec3896bf58a82e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e9d08d-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290450, "uuid": "c4993d8c-2abc-4b80-899d-84ebace88417", "comment": "Malware payload (Amadey)", "value": "8f860739b9e62354c73221f4a312aeff", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290450, "uuid": "600ec63d-869e-428a-bdc3-78b9a5071e88", "comment": "Malware payload (Amadey)", "value": "e126081b4d199bfeec2d0b874c04abcec16b727d557f2c63f46d6760fb208a2f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290450, "uuid": "5bb8526b-d3e1-400f-a142-3a70dc43b2e4", "comment": "Malware payload (Amadey)", "value": "26fccc2f256a73d9e0b4d6c338c06917a0fcc539", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290450, "uuid": "5b16ff88-6758-4945-a1be-c9f5250b98cf", "comment": "Malware payload (Amadey)", "value": "4e91577c5733a3b43c8ef4b96caa59da22a99f01e7829cedb639829110bd865e461aa7e41be3443e23bc47fb251b720e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290450, "uuid": "7fad55df-a2d3-414c-93ce-2f1efcfd74d4", "value": "T1ABB40253E7EC8132D9B513B088FA17830F35BC6169B4832B1B8A6D6E1D73B95A530367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290450, "uuid": "3ccc76b7-2bae-466a-bb20-9ab43cf9bd64", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290450, "uuid": "46b0d1af-cfcf-4deb-88f5-9c5e25c0393c", "value": "12288:SMrdy90wYlNMB096NOilJ2OqVmb2LmT9MUXNDhT:Py/e96NDlk31UZhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290450, "uuid": "02bf5e84-e04d-4500-9d69-5c5943fda960", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290450, "uuid": "7f774348-30f6-4bca-9094-f19766cab5ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290450, "uuid": "dc47246e-2fa5-44a8-9385-21a271b58018", "value": "8f860739b9e62354c73221f4a312aeff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a61d08-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690282106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282106, "uuid": "11bbfbcf-6b6f-4a29-8b0f-80d16b16df7a", "comment": "Malware payload (Formbook)", "value": "6f7ef542d83ae3143fa8b4a52634820e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282106, "uuid": "ca8f87a3-872e-4eed-8726-a0842e17d906", "comment": "Malware payload (Formbook)", "value": "e1638f39bfb4089fd651a9f543a33990fd19d48a0931911300d5ec9e091ba4e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282106, "uuid": "dd99669a-2772-451a-9563-5e296c922c16", "comment": "Malware payload (Formbook)", "value": "00618f3bea5e4c40f691b404b9b5a9a43db0e980", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282106, "uuid": "f3cc9425-5c63-449f-8441-f4b99db2211c", "comment": "Malware payload (Formbook)", "value": "48371ed0ea2781ee636e0ea1fdd27f9660d4c947a3d538d2b316ce2da20c77420445b52de98713daa6cfaae60bd0bb43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282106, "uuid": "0939db3d-ba53-4c2a-a010-cccba85e32e9", "value": "T18714238078C2F6FFC0B4A3FBD2AB71A08F52377B9E1994943AE6445155D40D8D220E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282106, "uuid": "409c076e-57bc-4e8f-acc7-2cf9e574d227", "value": "3072:aRWJYiODh3VUY/PKJpFmDaD0Vdp8ImpBZ/IQf6Vgqc9HZnRhzOj6Bi6x/x6pqp+N:aRWWi9wKrMDaEdp8ZxIe65GHRjHAO/IP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282106, "uuid": "26138b54-b47e-4d4e-908d-156c1d62ecad", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282106, "uuid": "2553ec61-fd42-47e7-86b5-131e6b36ff00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282106, "uuid": "3b485172-e601-466e-afde-f80a91724b5c", "value": "e1638f39bfb4089fd651a9f543a33990fd19d48a0931911300d5ec9e091ba4e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f98526-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690267869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267869, "uuid": "7819f293-2280-4665-b6ef-978204d665cf", "comment": "Malware payload (Amadey)", "value": "29240edd08b80771531089b5f59fa3d6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267869, "uuid": "1bba1fcb-8e49-4b71-8132-6ed746c0b33a", "comment": "Malware payload (Amadey)", "value": "e2ec89b6f97b310cd4226ce801571539356c5af49b03da5ce7c126cc5bd6aa93", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267869, "uuid": "ad1019d4-0855-4184-905e-c6bc31ee1a5a", "comment": "Malware payload (Amadey)", "value": "19d65bd45130388daf8c0996ff51064d4df499b1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267869, "uuid": "7e99641c-dcfd-4abc-ae16-7cbe3e17f74f", "comment": "Malware payload (Amadey)", "value": "c01cf7f3d0cfaa3db6df0c5f962b73a5d3d40f16e868c9abd8ee0c12500a4da56f7434a85a7b0e996c9e108ad3a04c0c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267869, "uuid": "eec9d8e3-0387-4b21-96a5-fb56743d8655", "value": "T146B41203ABE59472C8B12BB059FB03930E3ABCE589F5536F2395580A1D73690B57273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267869, "uuid": "3fccb711-1551-440d-8ff9-ee478bf31bae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267869, "uuid": "1354488d-7a59-4634-9339-fd23742bff4a", "value": "12288:iMrPy90sQ7mseRaS/cv3gNmLi4bg3/61gn4cua:1yE7msCkoIboBn4ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267869, "uuid": "1695ed18-4dc6-4941-8be2-8821aaa96b27", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267869, "uuid": "b8564fa6-7731-4cfe-85ab-d71f62a62938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267869, "uuid": "e67d821a-f143-4a22-ad39-196784341637", "value": "29240edd08b80771531089b5f59fa3d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cdd2182-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690308420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308420, "uuid": "4ea81463-ccaf-41af-af0f-a32f2af691ef", "comment": "Malware payload (RedLineStealer)", "value": "9b90639e6d0fe5ca34c15011adc922b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308420, "uuid": "e45960b4-aa6e-4999-95e9-d941ad19dcdb", "comment": "Malware payload (RedLineStealer)", "value": "e347d2c37800e83e391725e58e82a1901d3b91c04f4707bc340499bf2e6a6fe1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308420, "uuid": "e68552d8-67e4-4f07-a96b-ae00bb59d671", "comment": "Malware payload (RedLineStealer)", "value": "e477cbd9955b04eb61b139dfc4c5603785b88a00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308420, "uuid": "1ab8457a-3d57-45bf-97d8-3a10b1a484a8", "comment": "Malware payload (RedLineStealer)", "value": "13a31a0098cca20eea36e53e92a58a57988a463004039c97b7ae4e030c7b718d6aaa26e49379d63a54d8d7382eefa0e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308420, "uuid": "6ee61e29-bbaa-4f9d-a16a-a5a87d9b01ed", "value": "T1FEC5E1B03D8080F1DDA214B739FDB524469FE0E01B6BA6C706F866DD96689CD2B3158F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308420, "uuid": "7925a6a6-7ad3-475c-9432-57163921227a", "value": "99618c39aafbf01419fbcd53cea0e110", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308420, "uuid": "37c40a4c-6abb-49bd-b671-07333db7b1aa", "value": "49152:x5PMZ6O+TGIxheIomTXVRyDEEhqvIf/g:DTGCheUTODVhqvIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308420, "uuid": "28249211-ef30-44e5-b9d6-101e5ea953b5", "value": 2742784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308420, "uuid": "10803d6d-4d25-46d7-9f93-8daedf358753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308420, "uuid": "db931822-425d-4d91-affe-1dbd7d1a7863", "value": "9b90639e6d0fe5ca34c15011adc922b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58c4fbd-2aca-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690276061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690276061, "uuid": "0e8ab645-7a6e-4fea-b7fc-ac1fb029edac", "comment": "Malware payload", "value": "304a9ab4d385a6d4c8d45002f92342fa", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690276061, "uuid": "e61326f0-3ee4-459e-bf15-53c750169e26", "comment": "Malware payload", "value": "e3602d0eb7149004ae6cf4befec8c6d61ac391189122744fff4a1de2cdad4aa3", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690276061, "uuid": "7b42e20f-3f31-4175-a2e7-033f741484fd", "comment": "Malware payload", "value": "93700d836102ff1c857c880a8cad4b4387d54de9", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690276061, "uuid": "9865416e-4d06-4cdb-b235-7b6c0846c5c1", "comment": "Malware payload", "value": "5be086f51dad4070c15659fa3f7a96b88f8e748fa79427a82028696a03e119e895970dc188b611bc08942a9d0a2e6dc1", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690276061, "uuid": "d99f794d-7977-4324-b83f-b0bc5d5a95a6", "value": "T19B52272173F5BCF4F1BBB8B699EBD442A333B041A63D090F4056C64AB6A10A7C527F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690276061, "uuid": "add020a5-0ee5-42d4-bd2c-8719a1abf7fe", "value": "384:ijqWqtq9qlqDqgqLqFqMqtqNq3qBqgq8qjqPqdqsqwqEqxdqKq6qoq8pqBqvqSqS:2l2+G8P0Wj++oavjcYujP7ERxXppqwZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690276061, "uuid": "1ef303b1-5087-4ffa-8781-94bd201ae7f6", "value": 14413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690276061, "uuid": "a993194b-c75c-4ece-b6a0-f3ec7ee8ddd6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690276061, "uuid": "dbb03baa-e2ce-4671-b3f8-93891beb740d", "value": "Purchase%20Order%20PO007289.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4fab70-2aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690268959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268959, "uuid": "68ba03ce-f798-4964-bf42-3998c9c37748", "comment": "Malware payload", "value": "cbc54d616842792b31f4a58d6022e4e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268959, "uuid": "58de3eec-82c8-425a-935f-c79ab326d576", "comment": "Malware payload", "value": "e3e083081658356af3a4647b26d6c30a5ad627a04e224c2974d497ae8d98d341", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268959, "uuid": "39ab9d50-d420-43f1-9c75-b69e3f8dccf9", "comment": "Malware payload", "value": "685da69af6eeb4f29082826bf12bf0f584ee501b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268959, "uuid": "1086c16d-d26b-4915-a876-d94e9ad3be5e", "comment": "Malware payload", "value": "d83631bfab37924967241607408090401c803631c0a7b79c935ef6fb5d4df0bcb2e55832b053e7f57e429c05ce745fe7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268959, "uuid": "10f77f84-11ee-4a18-9564-1a511c1a62ae", "value": "T144A67C81FDCB11B6DA830D3144ABA23F23355D054B24EBC7EA147F29F97B5A91A7220D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268959, "uuid": "0d5bee07-eae6-4758-b939-40a95b1e4ee0", "value": "98304:DUsO/ECWTF2hZlqpwq2IgnVm1bA2HZI5ug+h5uAPqH07w0O0:Dicpwq2I4uc2XgquAP77wR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268959, "uuid": "a291577d-b4c7-457b-83b1-1da811b121e1", "value": 9605595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268959, "uuid": "1b954926-3ba0-4f05-98e6-85abf683d8c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268959, "uuid": "fa125662-1faf-400a-abec-9e3670e7678a", "value": "cbc54d616842792b31f4a58d6022e4e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03691634-2b19-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690309692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309692, "uuid": "fae50f13-ff8a-4d53-a449-49389b085edd", "comment": "Malware payload (AgentTesla)", "value": "454eeeb5a9325f310edcce5eef449dc5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309692, "uuid": "332c3cd5-c635-4889-a97c-40080e41aef1", "comment": "Malware payload (AgentTesla)", "value": "e48249f3509fe6713162d4b093f75066b53d68e8df273bf4bc818f9939b64392", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309692, "uuid": "0a5f5b73-6ab5-4821-818b-118ec7c3cce0", "comment": "Malware payload (AgentTesla)", "value": "861b5cfe45b1fb87555cba9de67cb58eeb6a5a21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309692, "uuid": "8afde4ff-50f4-47ca-bdca-d9dec7f50a2e", "comment": "Malware payload (AgentTesla)", "value": "e2792602d16467ca97173acbafda95f42185f270ea2eb86ebdfd2dca4dd51aa43c9faf188a2f4e2d556544e67905d7a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309692, "uuid": "bc198430-55f6-41ba-9c72-59967dddfbcc", "value": "T13705F12536B89F5BC1BE47F84030223413FEAEAE6535E3496EC270DA1975F804A62F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309692, "uuid": "12705525-4b29-448f-b7c0-6b1fc40d0c03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309692, "uuid": "b3bb370c-fa8d-4194-bd1b-eb18a20481e5", "value": "12288:bfgETOAYiIoFwIrG3XCCaEHsbHak5nUrzZRLcVi6E3STiO4qpt0/tq5XVcnmy:TxiAHIcTrGCSRk5ozsE6MSg/tMVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309692, "uuid": "6a62966d-5f94-435d-9ccc-40a7671a0b36", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309692, "uuid": "242a6970-3d10-4ab9-8cab-ea4a5cf2f205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309692, "uuid": "233f0724-153d-4642-8dc9-489a279b9b91", "value": "454eeeb5a9325f310edcce5eef449dc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b1fa5c-2aa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690258188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258188, "uuid": "f2ebe1b3-db53-4af5-b56f-0d7f412f70d2", "comment": "Malware payload (AgentTesla)", "value": "7e2c43244b9bc2b74533930721e2bccb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258188, "uuid": "3be07b9e-4252-410b-8d2e-1e950ebdae8f", "comment": "Malware payload (AgentTesla)", "value": "e4e869c9d64e6141d57774325f7a638ab8347d85d0afead3fb713180c3da1d6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258188, "uuid": "acbe3008-07ed-4d4e-a269-e5396503b6f0", "comment": "Malware payload (AgentTesla)", "value": "ff1e370d154d28ecc467b4aeff737b52d4061910", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258188, "uuid": "67c23fca-83d5-4d99-8eee-d60570910852", "comment": "Malware payload (AgentTesla)", "value": "5ecd9f1d1e60bcb7e13d089364274f3183812744fd9a6112a084a80051f672a3d358fc4279e77a1e92d46c3a3a10bdcf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258188, "uuid": "84b63628-cc10-4699-9259-ab3d50bb4e1c", "value": "T1B4D4E0663A18CDD7D425673D48F4E72A0628FFA63D91D60F721477AFBB73B440806A88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258188, "uuid": "cd914428-52b2-4a7e-bfcd-3be98ccc8e85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258188, "uuid": "33d9f861-eec9-4e52-8f9b-ddc4c203ff9f", "value": "6144:QRbcHr85WTaFiz9Ob6D7pBlv95KbF6SNzxEpoSU6ygAwn/AtWYJy3UBXGBMOYF:Qa4cTaFizdpPKM4VoAly+BO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258188, "uuid": "3f10453b-7706-4906-bdb3-2ad14382bd23", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258188, "uuid": "4a453386-6848-4a4e-ad60-e694a133323b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258188, "uuid": "cc23ab77-acb3-4cca-8839-73fa752e1165", "value": "7e2c43244b9bc2b74533930721e2bccb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bba4b8a-2aef-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690291775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291775, "uuid": "3c67f1b6-2c52-4e27-870a-da3ca6142f94", "comment": "Malware payload (Formbook)", "value": "4e53a0a23572d6b5e7d7802bfc69c669", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291775, "uuid": "38f6754e-214d-47e9-adc5-ec1887bb23c7", "comment": "Malware payload (Formbook)", "value": "e52940dac833cb5b8218350da11adcb63cffd7fecd9fdf82ec6dabdf0c4faa39", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291775, "uuid": "3db031f0-88ec-435f-bcdc-0f73d4d17be5", "comment": "Malware payload (Formbook)", "value": "bf3aa9e5eb9291e08ce11b13cb4330138a68edd8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291775, "uuid": "9d433df4-a129-4301-8629-01fd6a3081ef", "comment": "Malware payload (Formbook)", "value": "95bf89e4c2b4688cb2b6b2945738f577615bdb8ef782b067288ed04028717238a44c7858ba95863e656e7342dbd1ed10", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291775, "uuid": "7310da0f-0374-4c73-9062-9c919d130b1c", "value": "T1F264D0AC3A1172DFC827C4769DA42CA4AA92B077432B4553B41F65AD9F4F887CF053B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291775, "uuid": "7d5ae2cc-5026-44e6-8228-c6de17935caa", "value": "6144:XPr1wvPXluX50zFlPWpk91F8b5xgcAb+DpjDTTu:Xj1wv/8eFBWpIL8b5xxAadTTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690291775, "uuid": "7dc5709e-17e9-437b-8b2f-d7884a5cb122", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690291775, "uuid": "4fe9db20-ada3-4857-97d9-bf2e2b9e3de1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291775, "uuid": "cb1b2528-01b9-43a5-8520-dc22950dff87", "value": "PO_8776363636.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6abe98-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268257, "uuid": "bb2ecde3-95ed-412d-837d-4f5a8595af5b", "comment": "Malware payload (RedLineStealer)", "value": "4bc52a6625c6c855b2f3449d935f482d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268257, "uuid": "2d136df0-ff46-4481-a669-3fa4dec51ccf", "comment": "Malware payload (RedLineStealer)", "value": "e554a479469add7bb2795e037179705902525908c7b6d5e7626b62490fd951bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268257, "uuid": "c4ecaf57-1e5f-4390-96f9-b127600cebb1", "comment": "Malware payload (RedLineStealer)", "value": "ec3544cfa9bbb704391170a8beebc42ff76dea93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268257, "uuid": "7c6b0cd7-481c-4d48-943f-2d200e032b44", "comment": "Malware payload (RedLineStealer)", "value": "7c584c657baae1815a2537a9e9fae2f626ff8ee3925a2f2b85fbd44b77f28fea2770636557e5db3ef96d16755f7dcd61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268257, "uuid": "83fb8ef2-b65b-43f9-9231-a3661f76c245", "value": "T1E1840212BBE85137EAB52BB05CF703C31A36BCD29834926B2752A85D1D73594E93133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268257, "uuid": "dd145d51-99b6-46ae-97a1-7de51279b266", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268257, "uuid": "7e3bd284-7766-4e5a-bb34-9baf80dc8c33", "value": "12288:5Mrsy90RehbAZQpxPjmFxc5t/oyoywbcPlD:NyWexAoljm0btoy0cND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268257, "uuid": "db28041c-2715-4ba8-8903-8c786b739cde", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268257, "uuid": "b9d8ba07-a7c5-4977-b76a-d2f4e365045a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268257, "uuid": "91f949c9-a834-4962-ab94-4cf2c79b196e", "value": "4bc52a6625c6c855b2f3449d935f482d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22af3f2d-2ad5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690280539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280539, "uuid": "37fc8cb1-b90a-405b-83e3-59a99764dc1e", "comment": "Malware payload (RedLineStealer)", "value": "967a24df3926aa778146731b14bf2f3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280539, "uuid": "385bf907-12f8-486e-a858-ed64320d5cb3", "comment": "Malware payload (RedLineStealer)", "value": "e5855d4a31a93630fb5689252da81b30becab0d62b47c516b596b4e4a51058df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280539, "uuid": "f75e9a8a-87d5-49da-b0e7-678a1abe1930", "comment": "Malware payload (RedLineStealer)", "value": "33a4fa62add4b1410bf056bc727fd5281858c575", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280539, "uuid": "a88c4812-46ff-4454-96fe-c045f2b8ff35", "comment": "Malware payload (RedLineStealer)", "value": "8f2155ad26b393ccb5b907d66492b46f2ae49712154989dc2fd23ac2c9716c8253c500b24b6a5274b217ff2921e2a9e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280539, "uuid": "c07ea7af-f0f4-498e-bff0-60941d1c4b13", "value": "T1A2840112B6E84172DDB50B7018F703C31B3B7DA199B8936B3786654E1CB2AE0697173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280539, "uuid": "d1ddbd7a-80e4-41fd-9cb7-a0c9589ad2d7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280539, "uuid": "af56920b-3028-481e-b3c0-d8e941dc9827", "value": "6144:KLy+bnr+Up0yN90QE+qUDVU/GCCPH0De1u5J804PXWnfXjpt4Rp0mOY2pQYV:9Mr0y90pU6Gjf06kL80KGnfXupR2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280539, "uuid": "4c90018d-09bf-423b-9de5-e9e59c373ff9", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280539, "uuid": "346c21e7-65f0-4f52-b51c-93676e0d844b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280539, "uuid": "81f70e41-c49c-4a40-8522-b77e2e5b9f83", "value": "967a24df3926aa778146731b14bf2f3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4cb811-2b20-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690313064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690313064, "uuid": "c7cf40d0-9790-4580-9846-d03055a8578e", "comment": "Malware payload", "value": "9a8ccd2fbf7800e3fb750f84fe1a8771", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690313064, "uuid": "e1851a71-882d-4eab-afef-9f33943585ce", "comment": "Malware payload", "value": "e64fb3d5024306678f9f85e1c009b4a285eb1a9ef6c81d2e4a1d3eca7740d841", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690313064, "uuid": "4ed473c4-81b8-402e-9bea-2664e3bcf99d", "comment": "Malware payload", "value": "11311b36cb225b070fb9e27b84b7502635485bc1", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690313064, "uuid": "6a0430f7-b6e4-47c9-ab91-277e3cb3a6ef", "comment": "Malware payload", "value": "275057a08745b3e38c120ce20b29cab097a16475bb53daeceab7d4d42bc1998ea19cedb0cd5e5898d4514d63c9ce0a3c", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690313064, "uuid": "c3abf066-7251-4132-ab1c-c3b7b8b8f5a5", "value": "T1C845CA38397A7C2443DBDA1334F14B961CE9564FD1703A3B199AD8239A346C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690313064, "uuid": "d20e5691-72f5-4e4f-8c2b-47544d7b2058", "value": "3072:u2mvy8TrsZuS135EmoyZVNdtQIKwxD9DZkEj:dmvy80sSTTZd9dBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690313064, "uuid": "eb2e2fbb-03d9-4e20-8434-3807a9ee9137", "value": 1251800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690313064, "uuid": "84045d50-16d9-47f9-be81-3f1f69433899", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690313064, "uuid": "c2021521-ee9c-4e08-96aa-511bfad3b092", "value": "downloadingupd.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b33434-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268547, "uuid": "da73e448-929e-4341-83c3-b27886046f89", "comment": "Malware payload (RedLineStealer)", "value": "b11ac6bea835b6ddcf388b7befea4ba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268547, "uuid": "015ecb4b-d441-40e3-87d1-ad60db03a8bf", "comment": "Malware payload (RedLineStealer)", "value": "e65dfec49d80debce2ad8a9a10c8728d98bc338162919e41bc95cb9b05426a57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268547, "uuid": "d1b0a90c-b069-4a84-a7cd-9a3e2d1117ef", "comment": "Malware payload (RedLineStealer)", "value": "7244222685114891306be8ad9633ec5c3533d615", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268547, "uuid": "b6efd736-9800-4aa6-b884-cb83b5f43f3f", "comment": "Malware payload (RedLineStealer)", "value": "023d75ffc62a93925b0b24e084af04b5bb432341e0db856b0ab532c23d44e73eddc4973bfe61d8e25a5bd414ac080ca7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268547, "uuid": "9387da79-3c87-4a19-8328-36d1ef8f704f", "value": "T161B41201FBD94432D9751B3019F707931A3B7DA08E7852AB2385696E4CB3AD4A532B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268547, "uuid": "74c3facd-1562-49ec-aead-a82db5c2e648", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268547, "uuid": "2ecbd757-cc83-4700-96f2-e5a2f1d7e5c2", "value": "12288:QMrdy90va21Gt+yJMWeOrXVdRRpaF8BsIZ1:dyQxG/WW3rjR7a6V1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268547, "uuid": "84e3db7d-6ab6-49f5-841d-d31d0772185c", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268547, "uuid": "7f57d351-af12-46bc-aca3-0211e2916d9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268547, "uuid": "59a5300f-3550-4927-9b8d-91cee5dc5db2", "value": "b11ac6bea835b6ddcf388b7befea4ba6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf91647-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268851, "uuid": "44125a04-bc69-4000-b3c1-e4198d4d9e05", "comment": "Malware payload (Amadey)", "value": "f392b477289248ab0f1129676472bf7c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268851, "uuid": "ce2f25d9-6b51-4b14-a515-7263d5917aa8", "comment": "Malware payload (Amadey)", "value": "e678a9d9535c9d0bf1220705dfafd2dbf4e2629b7c17455512444628ef2a3d55", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268851, "uuid": "2adc953c-0b70-4209-a7df-53fdb0fc31fc", "comment": "Malware payload (Amadey)", "value": "436bce127586a86772361424ddec95ed18f95219", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268851, "uuid": "0443864e-1f27-4373-b029-a78b18374ccc", "comment": "Malware payload (Amadey)", "value": "53f94a54e97c48543ce784b0c668f6cc814ef6a6a7d6b1642f6986a834734c66deb9169773adba826edabce31b98f2fa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268851, "uuid": "88721058-3594-44db-b5da-6683cf801db9", "value": "T11F840253A7E89532DDB917B428F603D30B3BBCA19C3457672386A84A1CB3694D97133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268851, "uuid": "f5f75538-bf76-4a16-8dd2-066882da33c7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268851, "uuid": "8a94eb2a-d4ba-4809-83d5-4968b5a997fd", "value": "6144:K2y+bnr+lp0yN90QEFVEL67ofN8u8ogfHRJTieXYKR2b1m34fwb+gu2dkW:SMrhy90nlZbRVieXvRfb+gu2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268851, "uuid": "b146795c-e546-48f7-ab1d-cbe36aa82217", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268851, "uuid": "776a31bd-5784-4741-a913-794550915bcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268851, "uuid": "08b3dff8-77ef-49bf-b884-58a8abe0f106", "value": "f392b477289248ab0f1129676472bf7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4797ba-2ae7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690288606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288606, "uuid": "d4f0c006-bfe4-4f8d-8f7c-3353860cf186", "comment": "Malware payload (RedLineStealer)", "value": "f6ddd3943f91a3af10cc85525f3452c6", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288606, "uuid": "3db62a09-f5f5-4340-bf92-87c62b0c116b", "comment": "Malware payload (RedLineStealer)", "value": "e7106e1672b76d950010efc1a9cd4fc53c4aa8706b8ec4a8b6a1a66f4254bb36", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288606, "uuid": "6afb3491-8def-4fdb-a830-fd1e95de150a", "comment": "Malware payload (RedLineStealer)", "value": "146a1bb5fa08b8c6dcabc61ad69d8624f6314725", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690288606, "uuid": "a406a094-08f1-47f9-a425-ceb3b606d382", "comment": "Malware payload (RedLineStealer)", "value": "b7820db7a522500be4526c1362fed7714b371e2e2bb8cc53d59bfc5f662210544bd681ae86c8e577f5cf6291361e0c1d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288606, "uuid": "892439a9-067a-4e4c-a85f-5b3bd6a4bfc6", "value": "T16A14235FB55DB21FCEF50CE797EE6C45C09D8865AE9A30EA013E835EC4F8B88950091B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288606, "uuid": "6dc0cad2-9231-4ce8-9ce2-42ee2ecc0a23", "value": "6144:2CFqScBl7ir46NzOyczZxI43Lg93lu8tKV3TtTNdBO4i7:9FncL724IIZZ3LGf031nvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690288606, "uuid": "46d65b91-fdb5-4df8-9ca8-26a146174dbd", "value": 208463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690288606, "uuid": "0bc53fa0-5699-4a8f-ba11-9f4efe34b03b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690288606, "uuid": "650930f9-96d6-43d8-919f-7e6015369a76", "value": "\u00dcr\u00fcn Fiyat 10243975 forKARDAG A.S scan%001% doc_1.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9518c28a-2aea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690289750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289750, "uuid": "cb925c09-0e7c-439b-b4fc-33a2b3422aeb", "comment": "Malware payload (RedLineStealer)", "value": "c5fecdf6aab18eaee292d2baf72a0b27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289750, "uuid": "49263595-c749-4ff5-8cc0-32453169b03d", "comment": "Malware payload (RedLineStealer)", "value": "e74cebd114f06f47edaa171f9148eecf15f508d05929e212832eb44b93dee57a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289750, "uuid": "9d032c9e-6ac1-400e-843f-f07544dc6699", "comment": "Malware payload (RedLineStealer)", "value": "7be4c7bac4cc37cae9138ff8896ae36b31d2eac0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690289750, "uuid": "e9550d0e-b2d7-466d-93de-e070f2e8eb8e", "comment": "Malware payload (RedLineStealer)", "value": "722e38db6013acb6c6441fabca31112b65fcb181172c394ebf747b6b6b2d86c4211a992fec22f2765556753d9f890c52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289750, "uuid": "eedcc991-38bc-409f-a616-7172d62cf2dd", "value": "T1B474F12272D0D073E0A796305930C6A13A77B8626B74D5CF33942B7E1E60BD1AB76397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289750, "uuid": "4d7963a4-75af-49d7-932b-63c3c3d9b8d6", "value": "1c187c5419584098cd104bb53d369d28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289750, "uuid": "070f442b-2498-4ba0-a484-605b126c7ff3", "value": "6144:hCWHghjInKY0La3wK9RihVydQfwu3Mta+LGmmCPR:UWA5IKQP9RAitaKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690289750, "uuid": "1e68c213-c646-403b-81ff-1f308ec36589", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690289750, "uuid": "e5ca932b-c303-4504-af81-0b6c1d89097f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690289750, "uuid": "15152d2a-2b99-40e7-99a4-a1f6fb2d96fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c7bcb2-2a9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690255658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690255658, "uuid": "a94e05dd-c4d6-4566-9431-88c41d710898", "comment": "Malware payload (AveMariaRAT)", "value": "2afc90cdd567b808a4bdbb6d994c533a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690255658, "uuid": "b78135c4-899a-4312-bd99-0a6bdc61f7e4", "comment": "Malware payload (AveMariaRAT)", "value": "e886baf2ba6653cdf655d189bbee53522b5728979539f68edd47fc8f8f80a3c7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690255658, "uuid": "b3abbbc4-70e9-48dd-9848-cd214e3730a8", "comment": "Malware payload (AveMariaRAT)", "value": "bdf26777f7a95e01b545868beb386fdc204cb897", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690255658, "uuid": "838bb50c-69bb-4ef2-96eb-2139d203a42c", "comment": "Malware payload (AveMariaRAT)", "value": "940a3c5073a9cf1f7fbd877ba26d741f0339c629c377ac0d6c6c8f3b3aa5ed45ed3a79dd5682b73134eef3df70284655", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690255658, "uuid": "28034210-39f8-443c-a0b0-58870146e9d4", "value": "T194F433D70188FD7EEBB127392890937095131F390F7D854FF28B462B92BB78492256B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690255658, "uuid": "5c7f65d6-8ca5-48a9-944a-38bb1cc2e244", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690255658, "uuid": "6e46f674-ba5c-4fd8-8b7f-ea8c178c054b", "value": "12288:b9t5HrOzVIlj2YxrrHYStsKwgdYY0pfQemu5mxEBGDORK79YF1B5IIKi4w:RnrOKXr/tjwgd0rmQmAGKt+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690255658, "uuid": "421adedf-63b1-487c-aa15-94fba2801f3b", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690255658, "uuid": "47ba2e6b-cf39-4277-bed9-4f3e00d8e92e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690255658, "uuid": "38d2e5f2-256b-4981-ad95-c5140e725b5a", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.28600.494.22699", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68000388-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1690296976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296976, "uuid": "71b58449-db12-45f5-95d8-fbca9fec50e0", "comment": "Malware payload (AZORult)", "value": "73e060cea56a220e26a4e223d7a980c4", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296976, "uuid": "88cb3bbd-41f7-433b-83b3-b219d40170ec", "comment": "Malware payload (AZORult)", "value": "e913edbec8daeafe13813142950ea910369da04745480d394816f2dd40c7e59b", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296976, "uuid": "9590b009-ab75-4097-8427-704e4398ffe1", "comment": "Malware payload (AZORult)", "value": "6134d133f9cd47bd23426a491ac7021f86ce6c97", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296976, "uuid": "23685f0c-77e1-414e-8bf2-fea0ea8dc78c", "comment": "Malware payload (AZORult)", "value": "1dc8e3a1f585eacd0d133ca58aaa9ff847355737e03e7e3a05d960eb1ea21309703d2d914cad9ef4009e7e1841cb2da9", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296976, "uuid": "99359a8b-1561-441e-b14b-242d057f65f1", "value": "T1AC0402463791D8BBC96B42310E3E6B22BBFEC74D229057171B419E8B7D52652872F383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296976, "uuid": "a1073fe2-7161-4c84-8c1e-63e31f8e5e09", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296976, "uuid": "226d83aa-64da-45f2-b0a5-2cdf4e5057d9", "value": "3072:nwDijpS4DbYcr8b3Nr69EuOVfWPI68otIDIx579Dp4hVJ9yIJ3yY7g11emkYl:nFPedr69Eu7Pb8kIDI3Ta53y0WeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296976, "uuid": "832f3085-d06c-4363-951a-e01aa03b947e", "value": 187506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296976, "uuid": "1c8b8ec3-c3db-4a21-bb77-da36e431fbb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296976, "uuid": "5fff5832-a632-4861-b9de-1da513dc0545", "value": "Invoice-GTC567898.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93fa2b04-2b01-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690299627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690299627, "uuid": "0507bb70-0fba-4216-aa45-03dc9d851e9e", "comment": "Malware payload (RedLineStealer)", "value": "cb5219cd13a9b0c94be4f8f6dfcfd4f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690299627, "uuid": "aa163367-3b8c-42a1-81db-8d904e6e407c", "comment": "Malware payload (RedLineStealer)", "value": "e9bc94b0b3a42f6cbaa09b53c65395138e0f79715b6dc5322db8981cc25ab119", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690299627, "uuid": "d52fd014-818e-4ba0-a3aa-fef08191793a", "comment": "Malware payload (RedLineStealer)", "value": "eb8b0d1a1552ccf5d33391c09f04a202bb8be37b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690299627, "uuid": "91491170-ebad-4f21-ab15-9ce85cfc729f", "comment": "Malware payload (RedLineStealer)", "value": "5c2ef999f121d1b38f799b54c97cb8ed75ed187c2ace0a0d8249a8c57c63b445097af8dffb3337ea1d006e68597cf259", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690299627, "uuid": "b4898c24-e2a3-44e1-87ad-5d9318c06639", "value": "T1DF256CA2F9804126FDA6207542EFBE2C017DACB05B73C5CF1BE487EE96106D1FA36546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690299627, "uuid": "7d25af9e-fa8d-428f-8c8e-788001fbce69", "value": "99618c39aafbf01419fbcd53cea0e110", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690299627, "uuid": "99974c7a-f535-4da3-80fd-96502c24444d", "value": "12288:7en9rhpIF+G5PMZ619yEaLup3mzrgSyszQuUAAks3duzzoFiwaeQmLkEPb/84EdA:an1hpIwG5PMZ6JgQuUAc3tipepr8rA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690299627, "uuid": "0155d364-8338-40e1-ae3a-9b9c0c26bd94", "value": 1010784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690299627, "uuid": "148eaf03-4bb8-454e-a415-d0c84d407a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690299627, "uuid": "cdc4acfc-1167-47a2-934f-88ab40463751", "value": "cb5219cd13a9b0c94be4f8f6dfcfd4f1.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c259b787-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690273935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273935, "uuid": "ff1b2f55-e258-423d-a9ba-3abb7d8cea9c", "comment": "Malware payload", "value": "429bc7a46469a0282aad72a973641563", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273935, "uuid": "230a6752-4a8f-4efb-b5d9-2cf84d545837", "comment": "Malware payload", "value": "ea315725a22d8936720737e921e8b78806025e69dc5f1b6e2c71c406893f8409", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273935, "uuid": "0c115f8b-dcf3-47c5-94c3-1e558448c08d", "comment": "Malware payload", "value": "3707bcdd0eba35d2a457b27d6607868c86f67c43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273935, "uuid": "d608edaf-75dc-4ec9-9d32-33cb8e8cfe90", "comment": "Malware payload", "value": "199c1594f5f8e3ff61e8ed741e13d6e4d59fffa2f88aa92bd9f77a7c222748ed5ff915d088c50e41897726afa6cbf0b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273935, "uuid": "7e1aa265-5a01-41b1-b798-6fa8831f8c6f", "value": "T159B53B73B744753FC46A093A4627F6689D3FABE129068C5B97F44D4CCE390502E3AA4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273935, "uuid": "5b31a833-ee74-446d-b229-2358c6010143", "value": "a6a147270aff725bb19edb907d502ecb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273935, "uuid": "cba6d5ff-3056-42c6-8203-ba72863d2f1d", "value": "24576:hzwVdVkDkS75dJ33vgvKgUXwuvcx13mZTNCdDBsSpQCxtngh52P3FZgcaSAOza:FKkJYmZED+SpQJ52vgj6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273935, "uuid": "d523d178-89e1-48ab-95e5-7452325e76f5", "value": 2348544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273935, "uuid": "1a5d653e-4a47-4c81-a87e-fae5ad61145e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273935, "uuid": "70f8365e-8352-43e7-99fa-4dade8e4185e", "value": "SecuriteInfo.com.Adware.Vigua.20743.22144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14f4a98-2aed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690291086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291086, "uuid": "68c1a4f9-84a8-4f34-8d7c-b81ef7ffd974", "comment": "Malware payload", "value": "3e7a646ef6fbe13fac57541fdd7a3f19", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291086, "uuid": "e3f4362d-8db2-4ff6-8ba4-76de01c6afbf", "comment": "Malware payload", "value": "ea6eae6aa10038f050c1f215b8f6038c9ae20b55e7c8f459b6dcf86e0ec463cd", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291086, "uuid": "4142a022-9887-4c77-9fa7-9e03de854550", "comment": "Malware payload", "value": "efb6a9c4df28ea33e1c02a342b12258a8f965936", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291086, "uuid": "6559681b-e57e-4f08-bbb4-383fcca4607b", "comment": "Malware payload", "value": "36207a477f249fa7284de5cc0a1ebd762420069e08eb7675178d2b320999560133acb092c60b05f2decb5c505dba05d9", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291086, "uuid": "7be4826e-3852-44bc-abdd-02d3405692ce", "value": "T100F2CF16DA29E800DA3F687E955C06F6B05BA6C5A298D30F3C81FA8E0B9059F47571EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291086, "uuid": "f39966f1-1b22-4d6e-ab49-e23e05578a93", "value": "768:Q1GX3gUuGmZw+I+VS9eNEn9aoxB3G/XCJjN:Q4XQDbDvVSeNE9ao3Gva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690291086, "uuid": "e56e13d6-12c1-4106-9ac2-27ca3d764a78", "value": 34394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690291086, "uuid": "5c8f4203-445a-4d63-b7b8-0886cc70c404", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291086, "uuid": "720f0f60-47f6-4e26-9aad-41245e862500", "value": "Aptiv EFT Form.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d576a6ab-2adc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690283845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690283845, "uuid": "ec938dcf-a4ab-40f7-931a-0998408c7273", "comment": "Malware payload (Amadey)", "value": "44b023c1fe65ea1a2089d23c89c387ae", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690283845, "uuid": "62b0b840-9dc9-433a-90ee-3284617a0055", "comment": "Malware payload (Amadey)", "value": "ea7ad5da2adec7e4595bbe4e24b12651ccb1af0f0e2f9e7d99e2cf58d0635422", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690283845, "uuid": "a330d6d5-a89e-4b90-9c4d-9dee0cfbb9a5", "comment": "Malware payload (Amadey)", "value": "d56ab17c6d4e1668b6572ec9cd7cf23c472439d3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690283845, "uuid": "d0fc8ca7-24f0-4e6e-bdec-54c554c5b99c", "comment": "Malware payload (Amadey)", "value": "0500ab03558a3723d0559195e92b0d5af40b53fde234d24709580d34e5267454cf41a21e981685ef823fed3200ab10b8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690283845, "uuid": "fab3ff72-2db2-4f1c-82fb-4ef10455247f", "value": "T1CA840212A7EE8432DCB067705CF712E31A3ABC719928936B2785694E1C726C0E97177F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690283845, "uuid": "8b7a5b45-be6b-4a24-a3ca-da0e1658d4c1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690283845, "uuid": "a9b96c90-4b2b-4a11-bcfd-9448cdfb5217", "value": "6144:KOy+bnr+cp0yN90QEnftuhr98h52662m4izmV50AdgDH1M10VxCe3:aMrgy90xt/dN6VY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690283845, "uuid": "100b3a85-91df-442c-8b38-26159fdf8641", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690283845, "uuid": "33be99ff-c9df-4953-b780-b323807c6257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690283845, "uuid": "70d2fd34-c619-4795-a532-7bcff8c35d6e", "value": "ea7ad5da2adec7e4595bbe4e24b12651ccb1af0f0e2f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6733e7dc-2b04-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1690300840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690300840, "uuid": "7349fff2-b675-4e9b-89e5-0ad2be11e5ab", "comment": "Malware payload (AsyncRAT)", "value": "b0814f152d1315f00f1dfd65af9f4b9d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690300840, "uuid": "6f606996-67e1-49f8-8320-7f21384345be", "comment": "Malware payload (AsyncRAT)", "value": "ea8592b2064d57ebf7f33bfa6b7fb915862795b2cbe637754bdb3f21b557c937", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690300840, "uuid": "d17b9e48-d73f-4208-a5ea-4e350f52221c", "comment": "Malware payload (AsyncRAT)", "value": "4799a35d8985a84bc0cdf7d6aeb72328930f47d2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690300840, "uuid": "df65c547-6090-459a-baaa-a7e3251aa5f1", "comment": "Malware payload (AsyncRAT)", "value": "b44edf728ff9b46466e4a6f2026ec2356d11910320c6efd0228dfbfb0492e3972ba80dde367473ee8d40f8e747317729", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690300840, "uuid": "8d31dc5b-ef51-4cd7-95f3-da47979058d2", "value": "T144350202BE8147B2D5B2CA315939E684F13EBC243E368E0E339DB61C4737151D67EA66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690300840, "uuid": "acc3c945-b912-403b-8b66-27667b66b38b", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690300840, "uuid": "a4fc2bb2-caf0-40a8-952c-20e2cad401e2", "value": "24576:wNA3R5drXUDfCLInnZLV/6gAoLR01YQ6jnxJbs:p5KPhLfV0qQ2nxNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690300840, "uuid": "cfe14d06-bacc-4a6e-83c8-53fc653856f8", "value": 1142466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690300840, "uuid": "e7ef8c1b-9ddc-4fae-87b6-fd53e134a248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690300840, "uuid": "1fb9702f-1ae1-41a2-84db-fcf9af73ff11", "value": "Plan de pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b023019-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690296927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296927, "uuid": "348f86ef-2cd0-49ee-b769-280e37dbc8d8", "comment": "Malware payload (RedLineStealer)", "value": "3775a57634f7a70efcee5a8389925bc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296927, "uuid": "2917e712-dc41-4fbc-bfe6-d35d90b5b761", "comment": "Malware payload (RedLineStealer)", "value": "eaf2492c76da1792ec59a25b0337353fea666fb3f79f409fb4ea071b661ce8a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296927, "uuid": "15d1a0bf-4ae6-4741-9c09-72ecd4604268", "comment": "Malware payload (RedLineStealer)", "value": "ed4c67009e52d7f0368662af18fe61196c8c839e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296927, "uuid": "0a4acdf5-874e-4c8c-b84e-fdeb93de19e1", "comment": "Malware payload (RedLineStealer)", "value": "c95c042a6a909e89f030ab44f45b1590461f074fda52d9345e9433d851d84bb17edc020eeb331b8e909b9a3bf140a2d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296927, "uuid": "30a2b7cf-79df-4fa5-ac5b-c93a2df63689", "value": "T10D04E6683647657EC96F483D9C700CE06A7CACA72246A7078D8EF0E87D3B7919E051F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296927, "uuid": "f208c4d8-073b-43ff-8957-966863eec073", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296927, "uuid": "b3d6a977-dcc8-44be-a539-9f02c28d8d6a", "value": "3072:VLeel1BySypBSJxNbuWk99MtwHg38e8hr:NVF9le9MtwHg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296927, "uuid": "cd2cce1a-feec-4c14-bbec-aa98f6b2d06d", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296927, "uuid": "ad057cad-a94e-491c-8940-5849ab24189f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296927, "uuid": "b339742e-2b42-419a-938e-243f2b42b6af", "value": "3775a57634f7a70efcee5a8389925bc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbe1b27-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690267891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267891, "uuid": "aff5882a-d6ac-4ed5-979d-f3199334ded5", "comment": "Malware payload (RedLineStealer)", "value": "35650b85804514944e0ac8472a90b24e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267891, "uuid": "2efd314d-8ffa-4abf-8d16-19d5af039887", "comment": "Malware payload (RedLineStealer)", "value": "eafd8b66ac1d11084720c7a2b4b0a5971a8a5dd7314b53fd4a7b256aa12024f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267891, "uuid": "1650487a-881a-4a1f-8b2e-5cade2bac9a1", "comment": "Malware payload (RedLineStealer)", "value": "ba3d0a39e58d52083e2885c6ff8e421495eaef24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267891, "uuid": "ca4279ac-efeb-478d-ad20-a63e8bbcd93a", "comment": "Malware payload (RedLineStealer)", "value": "341a0f38e4e91f0e65ab8277b1c688d8d273d0b59d38035d1a18e7ebb283a24303d694530984b57be44723b27f1c7021", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267891, "uuid": "564bd613-006a-4e25-a121-d2e11e497872", "value": "T123840217E7E89132E87217B048FB12C30A36BC519879936E274AE99E0D736D4B572337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267891, "uuid": "1142cd00-b37b-4c03-8ae8-8c4090c02087", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267891, "uuid": "76bf84d4-7493-435c-a265-c7b897069e45", "value": "6144:Kxy+bnr+1p0yN90QEWU4OeyHGuYEwu9d5i6Hu9gBZ+t4ODzaOjUO+tvz:XMrVy90kU0yLp746qgBYCOKOohtvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267891, "uuid": "6c5c660e-8360-46ea-8bc1-e507e3aec0fc", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267891, "uuid": "89418c7c-b078-4ef4-9631-0b3aebd79cfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267891, "uuid": "6cfe8e93-1a8e-4afe-8ae0-8b4470593f7c", "value": "35650b85804514944e0ac8472a90b24e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c910e80-2ad4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690280233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280233, "uuid": "960fa869-6ed2-4518-bcee-2f98a14cb3c2", "comment": "Malware payload (Amadey)", "value": "0a4718296ca7a00355a0941646976296", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280233, "uuid": "3aac7077-5a61-4c47-bbed-d199b270b213", "comment": "Malware payload (Amadey)", "value": "ecfd190463a33780720aba4aa41e87b2efc6972ce72f72dcf99db4a01a7f8ade", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280233, "uuid": "f8f44269-57c3-411e-a905-8e960db44eca", "comment": "Malware payload (Amadey)", "value": "76655749c8983effc991ef9131cae7aab5e949a0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280233, "uuid": "d5a4cbab-4ba3-4659-aee2-e2e22d089cfa", "comment": "Malware payload (Amadey)", "value": "312f7ea3bed22ae0805051fc740ce728388945933bf554b3efe02c1991a908969755153a1092f057a05917113fc3099d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280233, "uuid": "f3bc140c-1ee0-4a41-b70f-7f341664f791", "value": "T121B40203BBD9D173D8B5277059FA03830F3A7CA18D74976A2741684A4D73AD1B23A72B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280233, "uuid": "bc8abe9c-3cc1-4bc3-a8e9-1be07957b45d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280233, "uuid": "9ba59bbf-39ce-42be-9c66-fca15bb39492", "value": "12288:4MrBy90C33ar31gm09Ixkdt8epDBndGlDeRwM9rZFM1Si:5yX3aDU9YjkpdUyp9Pti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280233, "uuid": "f066a226-d23b-4562-91c9-c61a4869a516", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280233, "uuid": "7f86fc17-b490-4e63-a970-bb68d37ac9ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280233, "uuid": "a3ee2d96-b94f-4824-a8f2-7aab64b12958", "value": "0a4718296ca7a00355a0941646976296.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce279321-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690273955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273955, "uuid": "76cadda2-57ea-4c18-b01b-5296b0850eff", "comment": "Malware payload", "value": "08804ff9f1e6a95a8496139403e29452", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273955, "uuid": "057c5d2f-00d1-47ad-a3c1-6c2b684ab589", "comment": "Malware payload", "value": "ed76cd4654e3572eeda054fabe84331e4eaca3bb12d9c508989b28eb6d82d60c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273955, "uuid": "44780e02-ef1d-4d2e-ba03-80ddaecbb5d9", "comment": "Malware payload", "value": "87306c383251fd8f1bb40e2717d079cbe1af0f8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273955, "uuid": "7da3ed70-a671-4d6b-85b0-7bd05a8edc1c", "comment": "Malware payload", "value": "aacb538e7c8a534b97ef9a292efb1b4c99088eb06f3956fea41897e060233cab6a3ab0b8ee026cd651f536bd835a1443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273955, "uuid": "4f5b25e6-6618-4c20-a60d-bb232c535841", "value": "T1A6B53B73B744753FC46A093A4627F6689D3FABE129068C5B97F44D4CCE390502E3AA4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273955, "uuid": "c5d0c093-cefe-4fdf-a383-7868f7bbe171", "value": "a6a147270aff725bb19edb907d502ecb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273955, "uuid": "20f8fbae-c648-4b3f-82d4-195962a3ae45", "value": "24576:5zwVdVkDkS75dJ33vgvKgUXwuvcx13mZTNCdDBsSpQCxtngh52P3FZgcaSAOza:dKkJYmZED+SpQJ52vgj6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273955, "uuid": "b384d643-3658-4857-a138-e7592d68c2a3", "value": 2348544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273955, "uuid": "515d9eea-5fe3-47d7-b027-7a6c80708c38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273955, "uuid": "481bd33d-c0ef-4cff-bf21-0e6f865d54b7", "value": "SecuriteInfo.com.Adware.Vigua.15879.15988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331ea9a8-2b19-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1690309772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309772, "uuid": "e722bf35-6332-4b86-b313-535c1a4f6e83", "comment": "Malware payload (RaccoonStealer)", "value": "e4421977151b264cb913e94b90d6db09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309772, "uuid": "7c0ead88-0408-4bfa-9393-d0d90d03473e", "comment": "Malware payload (RaccoonStealer)", "value": "edb254fe10995bdad871d3b9def3f06533a0e18fe934a3e1069cdca5f41bfd8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309772, "uuid": "7e816bb6-672e-457b-b8b2-04fb02ba5fd8", "comment": "Malware payload (RaccoonStealer)", "value": "a771fb3e8a602b005ae8e1515cba4dcb0cafc152", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309772, "uuid": "21a6eea0-0c7e-4f44-89c0-f77569b74d28", "comment": "Malware payload (RaccoonStealer)", "value": "211490b61daa8654639ce0418f92ff5873b4f9858ae2b55392e0957bdb3ef998527a3dfcbf7169a6b5256548656ee277", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309772, "uuid": "bec3655e-7de0-4a86-b859-49c8698661ea", "value": "T1EC5633E31271058AE0E1CD25C92BFD9531FA13879B83AC7CF5EA5DC635229E5F246883", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309772, "uuid": "85e99618-1a26-4a4f-b1a7-d48c7452581d", "value": "895e5e6e037e9108574fb94ed614d804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309772, "uuid": "cf37064c-11f6-4d45-85fb-18a300cf6626", "value": "196608:A0/mBWy9GNXg9IkJtzayM7aqRKztqVPoH:NO0y9GNbatj8arzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309772, "uuid": "05afb124-5fb7-493c-b08f-d1b5f7e5f1b3", "value": 6300160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309772, "uuid": "7601ed4b-89ab-44d4-99fa-007d692b20ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309772, "uuid": "aa2068bb-5013-4eae-9156-0e3affe00506", "value": "e4421977151b264cb913e94b90d6db09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8609caf-2abb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690269650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269650, "uuid": "ef17b896-a2b1-476e-9fb4-0c82b8d90152", "comment": "Malware payload (AgentTesla)", "value": "2ddac8ebd73c8492365c8823574e07f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269650, "uuid": "ae9b701a-fb13-44a0-962f-46774df5e196", "comment": "Malware payload (AgentTesla)", "value": "edb335b501c0f87e9ad72d467e1538eadaf2dcfb774b55006fd970377d873664", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269650, "uuid": "059e7505-fb9a-4702-8345-c0d8edcbab61", "comment": "Malware payload (AgentTesla)", "value": "129cd30fc4135d6f4a5c7f9e12c7a36de531ae6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269650, "uuid": "70500667-9f8e-464d-917e-9e5eea26ff12", "comment": "Malware payload (AgentTesla)", "value": "cafbeb3d949eef62f8118876d29e4ee688acf7c81d6eea338a4c4220dea46cd69d504e2e5aa0e25843982e483e22cd76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269650, "uuid": "b829dfdd-7efe-46af-ade8-5f76f4ec70e4", "value": "T1A6F4126537A9AB52D5F8BFF4956020100371A9182437D3484EF1A0EA1E76FC4BF92EDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269650, "uuid": "5618d2c2-0c2a-4b78-89b6-c349a35e99ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269650, "uuid": "a8615766-5869-49e7-ad44-266d161ed14e", "value": "12288:04vJRBusy2y/wCg0iXWgB77Cjo0mvWTHD5LB0aNyQrW:NFuBS0iXWa77F3v4DFB0KyQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690269650, "uuid": "dc071d5d-ee52-4602-ac7a-30c5d546cdea", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690269650, "uuid": "b6772fc8-159d-4320-8d0b-ba0ff8593564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269650, "uuid": "365f5f57-a32b-4638-bb5c-d8b615f95466", "value": "0rgc1dnEb1Aqh1U.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ce8f8d-2aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690269131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269131, "uuid": "077943c8-cf40-490e-8606-d563ae66f096", "comment": "Malware payload (RedLineStealer)", "value": "f2ff388644a5ed054ca06d4766b48910", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269131, "uuid": "b7052b98-1e99-414f-abf8-8304a7d662a6", "comment": "Malware payload (RedLineStealer)", "value": "edcc654b9a579718d497bc8fd38401b3d72f4aa6103be4099afc8d1dbfa0f6cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269131, "uuid": "a69528d0-2e51-4fb2-9625-af22fa39c060", "comment": "Malware payload (RedLineStealer)", "value": "5a63630fc809a15f3aaa57571009ed7112b9f1ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269131, "uuid": "8bfa7bf9-92e2-4af3-9f48-b6cda1d2d627", "comment": "Malware payload (RedLineStealer)", "value": "c3f5500c946cb83fcd482af109ab43bbb303ff72a764615dba87ed944c9dcc2039f342238d229bfb95d5feccf0422e4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269131, "uuid": "99ac4ba4-6ba8-431a-a349-4112c1a39d0f", "value": "T15AB41252A7E84573C8B417B054F707831A3A7CA49D68826B27C5ED9F1CB3AD4A43633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269131, "uuid": "fdda169d-b52d-47d6-bd62-b341dda20fd0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269131, "uuid": "3831ba8d-b294-47f5-a1a3-2da75138f4ef", "value": "12288:gMrby90VU2WhHr13aGp9/ZIY7/i8SVIdJvZi:LylhLRvIYDiWd9Zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690269131, "uuid": "b4474cfe-bf4c-4e9d-b406-784a8e60fad2", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690269131, "uuid": "7aeee572-86f6-47be-ac01-ba4afb84546b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269131, "uuid": "51e10347-4f43-47f4-8d7d-c476b46ae45b", "value": "f2ff388644a5ed054ca06d4766b48910.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d17317-2b09-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1690303064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690303064, "uuid": "748258d1-797f-466b-b514-51b25441a854", "comment": "Malware payload (Vidar)", "value": "ed6c0dc5b63e8fbbf7e12c117c74bea2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690303064, "uuid": "07237129-fbcf-40cf-b2b3-911074fcdaff", "comment": "Malware payload (Vidar)", "value": "edec11a938e090fb663fd79d3d7f4f3aa60b38ebe1c8c51da4c30934dc35343c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690303064, "uuid": "f8db7ebd-d2d4-44f9-b74c-882ff448a758", "comment": "Malware payload (Vidar)", "value": "83fcbb024f8480dac8b9ced75c30de24332bb050", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690303064, "uuid": "f00c49bf-bdef-4b3c-83e7-ae4c9558033a", "comment": "Malware payload (Vidar)", "value": "db8bb81311f889eff85c62bbc89983039ef15c8bff7764a4e4deaf971ea47bec329a95afdb0be1bfeb38928e31ef9c68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690303064, "uuid": "63ff006e-d215-4ddb-b463-4a2f4d2b9296", "value": "T104F533A335C85AADFACE50F7B06625D2F6717D7449603B4560BF33A982BB9B006E3701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690303064, "uuid": "026b6524-73fb-4d58-8115-d734dacfe43e", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690303064, "uuid": "9502e97d-7508-42b9-aebb-3a1f5f25756f", "value": "98304:AtO3ReoUDRXv6zNaqVnBkR9M4HOIeN2+eAi3:AtOcVozN43MVIeN29AW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690303064, "uuid": "84571f76-e5f1-4d0e-bbdf-2a5bc435471d", "value": 3502208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690303064, "uuid": "0b549f11-a0d5-43f8-a115-d1bce28d2f8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690303064, "uuid": "97b90946-083a-4b99-a46c-7bd9392ca708", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8936bc-2aa0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690257874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257874, "uuid": "fbcedd34-2e17-4a81-a1ca-88876f5444c1", "comment": "Malware payload (AgentTesla)", "value": "0a08e5cf3a784baa123a28f555d44a0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257874, "uuid": "a34798a3-63a2-4800-8173-bc30d2a5cd4f", "comment": "Malware payload (AgentTesla)", "value": "ee5c19be53080ac42369f307dd5a82956a8e927860473cee8352f94b01046c6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257874, "uuid": "aabcf2d7-7916-4963-b181-a956330ea63d", "comment": "Malware payload (AgentTesla)", "value": "83bba21de3ec101045d88ce32fd77b7aee831370", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690257874, "uuid": "c8721e5f-be1f-4103-bf57-a8cd4f73398e", "comment": "Malware payload (AgentTesla)", "value": "919c9d411f912d412e1f4780174bfbae875352fb01398b3caa564f8c6a2746e240a686db6365d366c4ae0ce7a922f929", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257874, "uuid": "d5645b4f-0167-4c31-ad0e-a82f77edc149", "value": "T114941A382D524730E07F56B8E65B3E1B3614FEAB6460D61535B63E0B3B5A213B4F2329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257874, "uuid": "1be3ea44-f495-4a33-8636-943b3556f1cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257874, "uuid": "bbb64adb-2a24-45bf-9a09-5dc1c0a9da26", "value": "6144:qNnbHwUxbn3OSAYeFQqzU82g5yadK8/FE3+8+I3Dfv+mdQzHAbH:qpwET33AXFQCU82iyh84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690257874, "uuid": "48cf2ef5-faa5-4b8f-b8cf-8beebd9962c5", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690257874, "uuid": "c3d47e87-2907-4f64-8243-e5d3caa31993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690257874, "uuid": "570be394-a19c-44ef-8c1b-064449d97038", "value": "0a08e5cf3a784baa123a28f555d44a0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1feca9ce-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268508, "uuid": "70e977b3-6f43-4c33-9131-d3b9fbc2953d", "comment": "Malware payload (RedLineStealer)", "value": "84a0909c0cc436b23139ed6e900d6828", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268508, "uuid": "ae284670-2d98-464e-b9b6-d651f66f93eb", "comment": "Malware payload (RedLineStealer)", "value": "eeb482210dd21fa61050ffe6cc4cf6558c66e32b87f13424884cb974ee2431df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268508, "uuid": "b23ec241-22b1-46d6-8f68-f7c2e3d64944", "comment": "Malware payload (RedLineStealer)", "value": "df51db2be6beb84231f01dd246b12ba23fa6ffff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268508, "uuid": "0d4f70c5-b607-4357-babd-faea39ac0281", "comment": "Malware payload (RedLineStealer)", "value": "4042e6911e87e2142bf9c48c91d376017e0ed88cacb5e3fc1b15fc8177249bf81e45f63eefcc873ff433337f75d18c59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268508, "uuid": "def509da-83b8-4c41-a5c9-36efa6b01d33", "value": "T14284F142ABE88173D9B417B018F713930E35BCA1AD74D36B1746A95A0CB37D8A87173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268508, "uuid": "a6167161-d4b2-4d6f-a168-00c8e53f88e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268508, "uuid": "471e2c35-24f2-4463-9b0f-04471014f248", "value": "12288:dMr4y90fQJ6gxoxVDHxSi5M1KgBYC6YnVvtk:VysQ4FHzM15z0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268508, "uuid": "d1eed3ad-44f3-42e1-b68d-a3b60ffdc1fd", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268508, "uuid": "73035506-1904-4453-a831-5ee2d49cad97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268508, "uuid": "069e70ab-e264-488f-9b40-f5d91ab78969", "value": "84a0909c0cc436b23139ed6e900d6828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30178556-2aa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (VectorStealer)", "timestamp": 1690258228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258228, "uuid": "1ee6dc36-eb8f-4211-b23d-f52316bcbcdc", "comment": "Malware payload (VectorStealer)", "value": "397060215336d4ef0f72860f062f68c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258228, "uuid": "e9b0fdab-0ee8-4deb-a72d-ad37773c775e", "comment": "Malware payload (VectorStealer)", "value": "eecebcad3cff4feac3f84bcf478086df4f134a19d2536d34dfe9fee1b418a0c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258228, "uuid": "ea8838cd-6e7f-4d66-bb27-03b2ff386d03", "comment": "Malware payload (VectorStealer)", "value": "7a69076faaf6d577658da3fc5ebcb56593a612b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258228, "uuid": "3b842706-a5ec-4902-a041-3af244864649", "comment": "Malware payload (VectorStealer)", "value": "60cfd4ff2fd34e74f1dabc6475f8afc0a0fbbf677ca97672eab1b70ad5d1df34284f881443297e0706caf707561a88d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258228, "uuid": "72520799-79ab-4c9e-bdee-3a2f7a38a312", "value": "T1F7A5E0E42E98DA93F384C47480B0D7FB857AA47E0D934115E5BFB6EEF718BA86C55200", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258228, "uuid": "1817487d-9a04-4c82-b3a7-9a9f06aadd82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258228, "uuid": "98b2f287-18cd-4716-81a7-aebc90a95cad", "value": "12288:CBFRPz0YKVfNmiNZWdGagcgDBY89YOydcWJXWSHFWBV6wFGsH//aipmM5JlXa:CHRPz0JmiQbgDBY9V2m3loV6wUYSSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258228, "uuid": "1b8fb49a-691a-4027-87d3-5c9412770c1b", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258228, "uuid": "bc056ad9-341b-4d67-97ba-85116df5cda5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258228, "uuid": "8a99c1ad-147c-48dd-b8a5-6f6e0d6063b8", "value": "397060215336d4ef0f72860f062f68c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7cbc708-2ab6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690267528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267528, "uuid": "a019451c-8667-4517-b1f6-ca4b20cd5f5c", "comment": "Malware payload (Formbook)", "value": "f9e51e77f1dab1be190db045f278939c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267528, "uuid": "8423fc71-14e3-4119-9ba3-d478a1ea4166", "comment": "Malware payload (Formbook)", "value": "eeef9f8539d9b599419583ef85788fbfe021e088a53ec61b11b4b47a807a9931", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267528, "uuid": "bb679479-5975-4fa8-b709-3d127a584ad4", "comment": "Malware payload (Formbook)", "value": "56dec7d21bd990eb2fca9069e8da40338317da9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267528, "uuid": "cee38b10-26db-451f-8333-2d2faf935415", "comment": "Malware payload (Formbook)", "value": "eda89d09628e5286aad225c2d8350b67412c23afeeffa5c3cab297d5eedc15db2095e8ac849564a9c7ea7c91a708c487", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267528, "uuid": "e1b84918-cff1-4db6-b361-f9538046b418", "value": "T1D9F4125005A98707C5F893F90B70A36257BA9FC26516E71CCFDBECE8B46BF241625223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267528, "uuid": "62f7b199-d121-4ac9-8072-2c9c361b55d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267528, "uuid": "15fa5786-1097-4892-967d-ab5d710bbdb7", "value": "12288:BbmIkPt46c7ujzCWSD6IYkk9KkMWB7hy7FkWLVttZCaMVXgXiEwwvTCncXKyZ5fT:RmIwwQCmkcq3qczZoXgyE3Cnc6cxWaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267528, "uuid": "34f617d2-9edf-4132-8057-09e55df696f6", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267528, "uuid": "119a6b71-6a34-493a-a7cf-cbff6beb373e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267528, "uuid": "caf0103e-faa5-4fe5-a8d6-9cc4d82cde6d", "value": "ENQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450d7e7d-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290475, "uuid": "84212542-977c-4168-8e56-c6aee0339ad3", "comment": "Malware payload (Amadey)", "value": "a5a1aa4d6204a1d4a645eefa50085193", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290475, "uuid": "d691410e-eb82-4fe1-8756-c5b191228e90", "comment": "Malware payload (Amadey)", "value": "eef05482c60950b557ccf3d80619feb4cea965cf2a2986ae8f80f95164b6dbb8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290475, "uuid": "3b76b4f6-0ba0-4fc8-b0f5-8c5bc24363cf", "comment": "Malware payload (Amadey)", "value": "f24b3fe424e020d1277feaf288ac638a9945bf33", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290475, "uuid": "9180785b-cd52-4e5e-b0dd-0784e8c0e10a", "comment": "Malware payload (Amadey)", "value": "dfefaa0511ac6d1e0782e94fc26b76c8eb302cd8cddbe0bb2fb7c44c79177392b4f79f6cb12a119fc87ebc6c6be5772b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290475, "uuid": "e260004c-b74b-4894-bee0-7eec03747108", "value": "T11E2408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290475, "uuid": "a4445ac1-cd3c-494e-af31-e835dd04ebf2", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290475, "uuid": "39d30672-f094-4965-a563-bdc69b7397af", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290475, "uuid": "71f503b6-aeb1-4cbe-abb5-ec752072bfdd", "value": 229546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290475, "uuid": "ed0de36f-47d6-4bd3-825d-72b5325da856", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290475, "uuid": "b5a03cf5-9025-4da6-bc87-b030f58470a6", "value": "a5a1aa4d6204a1d4a645eefa50085193.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c34ce2-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690308674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308674, "uuid": "5e1f0e55-eea5-4089-ade9-09ba1c08db6e", "comment": "Malware payload (AgentTesla)", "value": "3549fcc5cc3cdadbbbece3486045254a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308674, "uuid": "5657fca4-881b-4b29-af0c-4e46cf757015", "comment": "Malware payload (AgentTesla)", "value": "ef21d6fc3e7e8f9eeb250fb301e415db44cd1f43cf5b06a8c2ea2b9ad607e09b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308674, "uuid": "d40908fe-288e-47bd-8178-9baf5b574861", "comment": "Malware payload (AgentTesla)", "value": "ce81e71bb46d5a020ea70c03e71895e18c6ab849", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308674, "uuid": "568e3168-1c61-4c9b-8f92-a22ed4fdfafd", "comment": "Malware payload (AgentTesla)", "value": "c65791e85378b883345a8b3f7df90fc821be842613117aee8085e5951d5a25c0d3fe28322a8b1af00a30dc7cdc11ca41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308674, "uuid": "8c92d0b0-8d35-4f90-85b3-acc69ca01468", "value": "T15AF492626426294EE92A3171D052F36D86458FFC4D37DA4CFC49F21ED272B831CB9A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308674, "uuid": "c358984e-9ed6-471d-95d7-234956ef76c5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308674, "uuid": "702f8837-abb3-4e55-ba7a-b9b67ce908f4", "value": "6144:GYa6wA+J1S52rcGRLnUH005CCvJFeDXTHtYylPRmjIuEAh3aCz:GYCAQ1SYrxLJ05nuXHtY2avBaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308674, "uuid": "f52da422-7844-441d-9ce0-fbdb9ddacf59", "value": 760658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308674, "uuid": "46a40b64-b262-48b7-865f-a326e2d80280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308674, "uuid": "f15cf1dc-229c-4f6e-92af-f0dbad624383", "value": "Swift Copy of Payment\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac554094-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690267885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267885, "uuid": "681e06ea-59ff-4ffa-9ad4-dc2a38dae47d", "comment": "Malware payload (Amadey)", "value": "3d823199f0d7df7987075f5c983f348f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267885, "uuid": "49bef340-05bf-47d9-8a50-f5fb38cf6af4", "comment": "Malware payload (Amadey)", "value": "ef743a090b416cc0bd2ddd16a43a695d08c9e177189e72bd9aa6af3ba5186da3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267885, "uuid": "3fe1eaf5-8dde-47e3-8c48-2918bfb53d52", "comment": "Malware payload (Amadey)", "value": "2bbe0f6ef44b3adc952a9819e1781a3443b01811", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267885, "uuid": "c7d30b6b-8a8e-401f-991d-7f57edc7c16f", "comment": "Malware payload (Amadey)", "value": "bade01ddf3a84da7ce9077f9f525346fe8a7168a3ddf2b2a23b2ac3f594eb464d5655ac6ec37220088541cceb3c1cd0d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267885, "uuid": "3c977879-e1ac-49ee-b803-dda3b5badad3", "value": "T1A02408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267885, "uuid": "46f92bcc-ab1b-4c40-a9c4-b7156603181e", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267885, "uuid": "091ed85a-ec94-48d0-9e39-420dd476626b", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267885, "uuid": "26114511-bc15-4978-b1e4-64b021ec25b2", "value": 229157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267885, "uuid": "8a265f4e-b4a8-414b-9f09-79dee3e7a856", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267885, "uuid": "a543c184-a48d-4a5e-84eb-76cbe79e7568", "value": "3d823199f0d7df7987075f5c983f348f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db872a1-2ae5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1690287483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287483, "uuid": "04d7f294-675d-4bb6-ba43-8ee016e92c99", "comment": "Malware payload (IcedID)", "value": "038ddd714c12874c2723d0ed2759b838", "object_relation": "md5", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287483, "uuid": "c41d6b86-cd0e-44c4-aca7-90dae8e589c3", "comment": "Malware payload (IcedID)", "value": "efa83e8dbbcba65c282e41c18e6065649abc08002a89ddfd2f4d52f67ee21d6c", "object_relation": "sha256", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287483, "uuid": "551db912-0b5e-4858-af3c-695861feb5f4", "comment": "Malware payload (IcedID)", "value": "fa512f5d860b620765d80bcd5ccbd700ba78a929", "object_relation": "sha1", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287483, "uuid": "2ef73ca3-d17f-4841-8f67-49e217397399", "comment": "Malware payload (IcedID)", "value": "313156ad78815b2cc6b0fdcffb3af131e83efd77c6d6a2909e0f1833f1cc6851c15eff2ad9aa0647b89da40d583527bc", "object_relation": "sha3-384", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690287483, "uuid": "a68017d0-efe6-4053-b6cf-4975ae57955d", "value": "T132A426C6BA56F8F9CBF3C076E45123363E0DF9D144A09E724761C3BA6C24818A85EDB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690287483, "uuid": "6939173b-a675-43af-a740-53fbe8cea4e4", "value": "06f25df4360c0ab9ee30cbac816de0f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690287483, "uuid": "372f7cba-7aaa-4485-9600-b78a1fbe7320", "value": "6144:6WuzGM1ukesfTqAYVTuFOBTfh3SVOFJzlBSFHds79zAADpgSHK6BdunoHz:63ztukBCiFel3tFJz6DeDpgSHKUMnWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690287483, "uuid": "e9f9bdb5-d040-42d2-871c-c2542b241fa6", "value": 458416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690287483, "uuid": "5bcaabff-a98a-4349-8bc0-59ca1c4d6c45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690287483, "uuid": "01edddd9-e966-496e-82ca-a415a2cc4ec9", "value": "INV-Details-JUL2023(140).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494bff72-2b19-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1690309809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309809, "uuid": "79d7318f-20e2-437e-8d57-cc99cbdc4948", "comment": "Malware payload (Rhadamanthys)", "value": "81c6b0c2d2198e0dfa72cde9ff00ca11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309809, "uuid": "38be31fd-1f29-4c85-9b92-2edccc1edc99", "comment": "Malware payload (Rhadamanthys)", "value": "f0054a6c8112d1bd14324523d25d3877b7d06a2319100af62c5ba5a7f6417bf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309809, "uuid": "3145f925-15d4-41ef-8f53-ef2a5bb57a0d", "comment": "Malware payload (Rhadamanthys)", "value": "3798eaed1e85956b636dd6fe875468976087a497", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690309809, "uuid": "278af128-57b8-48d0-a99a-a1604808709c", "comment": "Malware payload (Rhadamanthys)", "value": "74b1e1c4d3b2848e9b173c85cb69455bbeb60834f4454c8507dc457c3a0d85a0e48ffa0b6d826ae1bba605a4e53119e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309809, "uuid": "33c445ca-2cec-4adf-9987-e8c06658aa28", "value": "T143F38D4A63E420A6E4B657B499F602935A32BCB15B7886FF13C4D57E0E336C0B532B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309809, "uuid": "db4e5944-f088-4676-951a-eafb53dba481", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309809, "uuid": "beb6fe86-560d-4679-933e-20ee122d989c", "value": "3072:5ahKyd2n31r5GWp1icKAArDZz4N9GhbkrNEk1+cT:5ahObp0yN90QExQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690309809, "uuid": "5dd5b4ff-8ec4-4afe-bf34-a73fdd76575e", "value": 160768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690309809, "uuid": "a47dee2a-0485-4a83-be33-e2a0613c55ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690309809, "uuid": "e05dae5c-66b8-44b8-be7e-83fd48cb6592", "value": "81c6b0c2d2198e0dfa72cde9ff00ca11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3279de-2b24-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690314616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690314616, "uuid": "6c569bc6-e7c7-4934-aa5a-a5ac2de7af03", "comment": "Malware payload", "value": "83b01cc5a0c584c8bca2047de60f3b40", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690314616, "uuid": "31bfacff-9304-43ef-a520-a186a31ca192", "comment": "Malware payload", "value": "f01d008702755b07ba71ae7af8e227c47dab8bca284898458d104fd923f3735b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690314616, "uuid": "7968b558-ae7c-4739-a591-8c0faecbbf37", "comment": "Malware payload", "value": "f7412a3ab5825764b1ee103ef20c4aa0930050d1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690314616, "uuid": "8f963953-e4e4-4334-a120-26b0379e7b7b", "comment": "Malware payload", "value": "068528e23da1f3ea795fd8032350dbbbdf810109a0dc595330b255996ae81f8cd68efc54c2c60a842028739f6468c7b3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690314616, "uuid": "e0573640-d671-41f8-8dff-70bbbb11cae2", "value": "T1A164AD1166EF5048B2B33F565ABA65A44F2B7EE16A3DC19D148C1A0E0BF3E40CC65B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690314616, "uuid": "1b955bb8-8ac9-4798-ba74-a518584007be", "value": "6144:eLMxzakJQTz6FzzdzSDen9A2jJb4v2X5FoqojoGeD88qqQN9dnh:aMxzakJQTz6FzzdzSDen9A2jJ8v2X9Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690314616, "uuid": "732c5446-8ae4-4c0f-942a-0e4501d6dd0f", "value": 332846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690314616, "uuid": "dbee5cc2-a988-4ec2-a1c5-794da10b8531", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690314616, "uuid": "f725e4d9-e9c3-4fb9-b22b-b15271ef9f25", "value": "system32.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904e1226-2aba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690269126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269126, "uuid": "87db9f70-6c86-488c-8deb-b97c071c8e1b", "comment": "Malware payload (Amadey)", "value": "dcc4601bc17536386778faa33134fb02", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269126, "uuid": "bda35d1d-aa29-43a5-b514-7fead994f48c", "comment": "Malware payload (Amadey)", "value": "f05c8cf7049760c851264415b703d88202fd83fe3dc3905c004378175d07499f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269126, "uuid": "e53c1ab8-6c18-438c-916d-24ddfa2ceef8", "comment": "Malware payload (Amadey)", "value": "026438f9a8f035fa97949166035ec93e1b4e0442", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690269126, "uuid": "eff4eb20-cc0b-45a7-b566-42db344be638", "comment": "Malware payload (Amadey)", "value": "e48c1a5d5ec0ba02821ba32eec69fd6cc2509c0919ef4a32925d263a9c8e5db4a4bad48f31691f8c554d30a07c7c0aed", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269126, "uuid": "dbbfe217-ec72-4a15-b295-9558e048bbc6", "value": "T1CFB41252A3D89572D8B617B05CFB02871B36BCF1AC34D2672648DD5A0CB2AC0D63A777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269126, "uuid": "581582a9-06b2-4520-9a10-6e1f447a17d5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269126, "uuid": "4ade9bd7-5696-4cc3-85ef-5a721dfe72dc", "value": "12288:pMrVy90tUgrI/4k0aujnDm3g3W7j6tMg+FUj0k:gyIFih0aujnD4qqmM/9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690269126, "uuid": "14e0b595-428b-42a5-b805-cf9842f16d61", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690269126, "uuid": "5f5fea8b-b1fc-4f11-8d68-43604ea19697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690269126, "uuid": "fec2787b-5e23-4a0e-94eb-738f7df1f559", "value": "dcc4601bc17536386778faa33134fb02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7909a83b-2abe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690270805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270805, "uuid": "7cdfe618-4328-4b1c-8a35-fcd123d93892", "comment": "Malware payload (AgentTesla)", "value": "da5e96d7c6b16a61a01e4889eca6ea61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270805, "uuid": "4ae74c08-ec6e-4065-bc45-db4c8aaa8fbd", "comment": "Malware payload (AgentTesla)", "value": "f0b366ccbaadcc6c619cdf56654af946919e3dba6b2968e9899e17bf4b02b5d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270805, "uuid": "3e40fe56-65a5-4998-9b5e-b9e6a83f5b96", "comment": "Malware payload (AgentTesla)", "value": "10b9a9cd324e37311142ae01277714459d067885", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270805, "uuid": "00183c1e-1c20-407c-9128-08591d4c86bc", "comment": "Malware payload (AgentTesla)", "value": "1c1dcccadba3c888b3da6c4ef9c5a98389ec3894b8234dbbf50340397b6e5543e88ad9f5fedcb1048e233e443b9c8b01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270805, "uuid": "160ba90d-b367-4ec6-9c55-dfa5e0140dea", "value": "T1F7B4233DD6D9226F82522620C95D71E8D32E38527CD5E500F66C48E2B64FF2B6BBD802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270805, "uuid": "0c1edd20-645c-4169-8c5a-156106a6a489", "value": "12288:h3ZOOyWjbQwr0S1e0lJnuqE1eOOcUu2Ls0L+:hpOmbdtG7AWl06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270805, "uuid": "ad902913-4a6c-4ac0-8d20-0fd55c3f2d0c", "value": 536298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270805, "uuid": "7947bab3-ce2c-451b-8e47-ba31ab60e5f4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270805, "uuid": "1b3b4600-6845-4d4b-b936-f676f721afa0", "value": "Remittance Appilication form.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28636e3-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1690282122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282122, "uuid": "8f69c630-3f26-47e4-a031-47c4f752b11d", "comment": "Malware payload (DarkCloud)", "value": "456b73d6317cb5a57fe14e89f9b96408", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282122, "uuid": "f662b372-d594-4cf2-b53d-70278a830a32", "comment": "Malware payload (DarkCloud)", "value": "f0de5714ce83c1b278f1426a198450e9ee1a94fdaefd77d502ec9c010cc43450", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282122, "uuid": "4fcc45fe-3730-4482-899f-7928eea83158", "comment": "Malware payload (DarkCloud)", "value": "149cc1cd047994354c0188e8e3ed8369376a8efe", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282122, "uuid": "64c94c53-b280-4574-99ca-9df4bad73371", "comment": "Malware payload (DarkCloud)", "value": "55a7af19e377a35d9ac0bdca1a792892d3b890350de404c0a92c87be2ff6def9a81a994d214d7787375b0969e0eab37d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282122, "uuid": "1e4ce504-7dae-4f31-b6c4-a131da1b86a9", "value": "T19555E0D83240B6BFCC0689B1DA7F8FA49A307C6753DBC25294133399597D686DE038E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282122, "uuid": "9e6c21d3-1bac-46e0-9fad-6535cbf881e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282122, "uuid": "196a54f0-6a7d-45c7-b4e3-424ba78a0e83", "value": "24576:ranliXrYoAUdjb+CWzRPs71onMd5RhxnxhMHwMdo:elarYJUdvjiJlMdTD3MQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282122, "uuid": "4da48610-5abb-4dd3-bb25-4f9168269b23", "value": 1391104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282122, "uuid": "082a854d-3190-4b77-b817-647bad4c8721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282122, "uuid": "0948ac50-09c3-40fc-bc02-b6f29c8c4ffa", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ca9267-2aa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690258234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258234, "uuid": "0b5a2201-2f3d-4183-8b04-7ac0bfe3f192", "comment": "Malware payload (AgentTesla)", "value": "ad81a4455bc146b9f755af0de4ccf07b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258234, "uuid": "312e87a4-be6e-4bab-bedd-e7b6b2a2b1f6", "comment": "Malware payload (AgentTesla)", "value": "f13eb672c5400eefce395ca9f5f668e2273748e3c398558e17f4c43ec314ff71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258234, "uuid": "d3f02ce5-9806-4b69-aa11-d92fa773cfd9", "comment": "Malware payload (AgentTesla)", "value": "94237b84f933138caa4cf3ad6ac7a5f207edc440", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258234, "uuid": "98e4a2a0-3626-4070-a089-e952137380c3", "comment": "Malware payload (AgentTesla)", "value": "ad090f56b51dddca7f487d26f62a36c44976241489460d04c4888fd7c87fc633157c52bd59aaac22c2e211c77352afe0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258234, "uuid": "d3bf3be6-6517-41ca-956c-dcbc1641c341", "value": "T1D7D4E1723A28C9D7D125633D48F9E6154628FF623DA1D30FB12877AFBB73B445806988", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258234, "uuid": "6db512fe-4a99-4a28-9f89-6ce2abcc3f0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258234, "uuid": "2ea43dc8-4e9a-4129-a599-19af6d0154f7", "value": "6144:BDxbuoOy3kMC4by096s5dNHA/0EKEUXF4SNzxEpoSU6ygAwn/AtWYJy3UBXGBMOk:BDIo9kM7bJ915Lec64VoAly+BO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258234, "uuid": "d3fd23dc-d174-4b53-9c9f-913a17fbf18a", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258234, "uuid": "e3ba3f7d-5b6f-4eb6-9684-9f4cb4026e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258234, "uuid": "1e699008-b7c6-4cea-98de-a1e88a94427f", "value": "ad81a4455bc146b9f755af0de4ccf07b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2ed2a5-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690290487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290487, "uuid": "aa562d0a-0d7c-4577-8302-38590db78148", "comment": "Malware payload (Amadey)", "value": "7ddf5990266565b9e7c073aeeb69488f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290487, "uuid": "b69f30ab-1ad1-46bf-87bd-bed125c2a9ec", "comment": "Malware payload (Amadey)", "value": "f1c5bc0808a093d2ceae490a312ac06b86a5a0054d2ff77a840591b0d560a863", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290487, "uuid": "a0f033a7-7d24-4045-a9f2-29489058d2f8", "comment": "Malware payload (Amadey)", "value": "5b800bc34bb362c46e75c759033770183f15dc57", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290487, "uuid": "d0f0c247-2491-4a1a-83e2-8d14beca26fe", "comment": "Malware payload (Amadey)", "value": "2786000acf71d2f3ce7715079c05920a7c4677feaec64b7c1d6248075168d8273aaec6297fc6bbd83d8f039b99908776", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290487, "uuid": "29de7fd2-7bd7-4bb2-b245-a64c996c3d68", "value": "T192840243A7E894B2E9F51BB058F712931A357CA14D388267274AA99E0CB22D4F57133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290487, "uuid": "353f0f9f-5d4c-4ae5-b08c-04b08b22b8a7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290487, "uuid": "732635f7-d1a6-4aa0-8bc6-5441afad7454", "value": "12288:HMrTy90fGuIEYoK4SjBHN+ORgBYCNYmeY8Ph:kybEYZ1NNh6zKb5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290487, "uuid": "b309281d-cbe3-439b-80d7-7e1f5a63d310", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290487, "uuid": "b0576904-a263-4fff-a7ef-53aad9af944d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290487, "uuid": "a392b636-3306-44cf-a294-f15f8c438cdc", "value": "f1c5bc0808a093d2ceae490a312ac06b86a5a0054d2ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4830a6f2-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1690296923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296923, "uuid": "52a1d3d9-71a2-4dab-bdbf-9f59b4328f6f", "comment": "Malware payload (Stealc)", "value": "2f28772b3cf7328df4f249e872568c2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296923, "uuid": "5de78029-acd5-4604-a417-d7cd74c15b9c", "comment": "Malware payload (Stealc)", "value": "f2028b4fb0b43abc5a062bd359622b254dbf0e301f2a8b842d062896ca24692b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296923, "uuid": "610f5963-bd0e-4cd2-ad5c-17ff7392a3cf", "comment": "Malware payload (Stealc)", "value": "dd4d410c55d413c4794eb0c4f60d179613ab6bc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296923, "uuid": "0d1e4dab-83c8-437c-97d6-9894bd43a8ef", "comment": "Malware payload (Stealc)", "value": "187ca864db06f054bf9970d92e490e4aa94294a130bca55416ef510cc6e641ea9be5c5bbb853b7a7452ccaa13f20b322", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296923, "uuid": "84316ab0-2833-4dd0-b76b-f818e3bc8c4f", "value": "T1A744CF2136D0D072D46369301970DAA16A7BFCB2AB7592CB33583A3F6E716D00B78797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296923, "uuid": "53d2d54a-9db4-4b76-9904-5dcf7cadee13", "value": "5dc16ea88b2eab7740fd105d5e24a675", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296923, "uuid": "41669979-6370-434b-ad2e-9820ab9fdd32", "value": "6144:EtvxnwCJczsk0zhh3a+Rpaur08m8mQOw0O:EpV1Jczr+h7L9Q8mYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296923, "uuid": "a119c79c-0d0b-4c28-afc9-5ae01dde04a3", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296923, "uuid": "8b6bdf92-f7c6-4dee-861d-cbe0d8c46d07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296923, "uuid": "9bd3f52b-1882-42d2-bbc5-32d130eea77d", "value": "2f28772b3cf7328df4f249e872568c2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28bb7dd1-2afa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690296440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296440, "uuid": "56afc06b-5cfb-4569-9c84-cec89abf1982", "comment": "Malware payload (Formbook)", "value": "f6a0b77574977295c73f6e5364ec744d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296440, "uuid": "1ad27906-cc58-47f7-ab9e-4c9e55862e2d", "comment": "Malware payload (Formbook)", "value": "f29cabcd869192ea4c18422f387028a5affa325798bb6a90749d1245db3db928", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296440, "uuid": "b5cfbfcc-6376-4790-803b-df0511eb1aa6", "comment": "Malware payload (Formbook)", "value": "c7b398757cec02fc11f4431ef3d52a2bd810e781", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296440, "uuid": "4e13e60d-5b4c-4809-95cf-72ba4b376460", "comment": "Malware payload (Formbook)", "value": "ab491dc58605f542419bae95dd5c97a68df0243784ee26f499205ecc6f83d9374802b0e78241317e3857524e16f69dcd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296440, "uuid": "385a2614-efdb-42cf-849e-79d896e57313", "value": "T1454512119F89E06CE135407914AE03CD427AB7173E89562B732F2B97EFB816916BE40F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296440, "uuid": "0bb74fdb-cdf3-44db-b6e4-9e6773e19313", "value": "3072:T4/E8dRhvlTrb+YIzQQ37ONOf1rio0MpYjfMi/s4gWTGWOcJD/Yih3rA:E/xlHarfSNOf1rH0MpYQHaTGyL90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296440, "uuid": "24bf391f-5005-4ee0-80ce-2e238ec6489d", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296440, "uuid": "0aeb55d9-4a88-4690-a748-b444fefb81c3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296440, "uuid": "07860cfe-df2c-4ee0-9d68-39c8801b6ee5", "value": "JULY-AR RESULT.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c572199-2aa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690258194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258194, "uuid": "6abf64c9-5342-4686-b1a1-9256118ce411", "comment": "Malware payload (AgentTesla)", "value": "7368d4287afabbaa641a86e0255492ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258194, "uuid": "26525063-4ec3-4954-ba77-6383192c4e51", "comment": "Malware payload (AgentTesla)", "value": "f3bbf1cfb9589105ca848b077d64840b2a4afd19e1432bcbbdcad695ba459e1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258194, "uuid": "581cfc15-4f57-455f-b409-3400c7969665", "comment": "Malware payload (AgentTesla)", "value": "06267cda76f65767c9f147964f54ee074eb3d8d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258194, "uuid": "230ecd34-5501-4f0a-ac24-71feb9461e8a", "comment": "Malware payload (AgentTesla)", "value": "177b860b259a2ba886b6e03c4eb144577797a4fb70e379f0de101ceb3895f8e86d2ad7e20aba57f89683d0e7feda45f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258194, "uuid": "b9c9d77a-b3dc-4a9b-93f4-1156c735d1a1", "value": "T1D674F1913273AA39CE1518360437515E6120EF4B3D32D3533A5E73EBEDB62AA64C0ED6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258194, "uuid": "2712abb9-8602-4ac4-8c1e-8da9056b6a55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258194, "uuid": "a76fae10-c537-4409-9326-b6ec49e1b9a0", "value": "6144:hbkI4vd7TUjkX7bdUIZ3lDp10Oj977G6eUSFvZGbpYByPT7lyvIc7SIvF680:+IedHUwfaUt1FVnivByPHly52Ivk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258194, "uuid": "864d63bc-19a2-4715-ac07-6d4bd14a9b30", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258194, "uuid": "06cc764c-a0db-4a8c-a6d4-f37f3c5b8b37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258194, "uuid": "5fd83750-5294-4daa-a9cc-853aca80a391", "value": "7368d4287afabbaa641a86e0255492ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad5122e-2aef-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690291854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291854, "uuid": "36c2bc70-df30-44e8-9157-38c2a6d339fd", "comment": "Malware payload (AgentTesla)", "value": "3c6e236f34a316bba9038582b19de7df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291854, "uuid": "8f1f8cef-abba-49d9-ac52-55b07e49b6ad", "comment": "Malware payload (AgentTesla)", "value": "f3f7dbd241d5960d5da7a86cb410090d8b85dbbfdf2cf17af4e7738399e6860e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291854, "uuid": "7159e2ca-8aaf-47c7-a4c4-a2369affabe7", "comment": "Malware payload (AgentTesla)", "value": "a115fe25b48aea70e37d494de120fd729bff81e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690291854, "uuid": "ba1e4b27-b72d-459d-b156-329fbc1e3b75", "comment": "Malware payload (AgentTesla)", "value": "5dd523dd88248563d07fe015552ab148b6473d33ad2d24b17361fe2c86fa69c3b241b5ae849c78bbcba95fd08f34dfd5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291854, "uuid": "dd792327-22b1-4f9d-ab93-c420b11dc023", "value": "T10AE4225A7AC94AA7D1695BF618217BF067BEFFC1B001D7062D43F0EEAD65F984B60002", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291854, "uuid": "2c949f1e-44b1-474a-9d0d-9440d6a3691e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291854, "uuid": "ddd487eb-6731-44bc-b79c-7f1bff463c3c", "value": "12288:1YiIoFwIrG3XCCacbMi1dU1slTnqk3D2dx38MPfwLQ9ZpnsZSlvkp6czDoe8BnW:1HIcTrGC8YedUql+k3D83lPfOIl8N2nW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690291854, "uuid": "c45d4e6a-31d2-4a89-93e7-d664618e5a3d", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690291854, "uuid": "728a4558-cc5d-4eb1-bd75-87abb1f876ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690291854, "uuid": "ad56991d-acfe-4ed9-88d6-bdf6425b1fc2", "value": "Fiyat teklifi Istegi_2307130_PER 1000 Adet \u2026scanneed 00101.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88172cc8-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268254, "uuid": "c61c4821-1f7b-46b0-ad38-0f5f46ce53c4", "comment": "Malware payload (RedLineStealer)", "value": "76865921e4b5a5ff0c0d8774d92298cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268254, "uuid": "f8556181-16c5-470c-8ae8-9401e6023fe2", "comment": "Malware payload (RedLineStealer)", "value": "f400677bbd7aa8ed6bf1d6ae5d97e980a319a3908221b2a76d1588f25ff53e06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268254, "uuid": "75eb49ac-24eb-4d20-a10b-5c41e8191185", "comment": "Malware payload (RedLineStealer)", "value": "568ac3fab1d6c0a216f8457fb120247c67b03240", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268254, "uuid": "f58541c6-16be-4def-a1f4-8d96b783a79d", "comment": "Malware payload (RedLineStealer)", "value": "007dc4c8c3b8c1533a3fc5f1e758e14f7e22bedcb13cfbfdee925c7b31a0506e16034c4f157a8de4e3f10d4969f72342", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268254, "uuid": "c101a4d7-4abb-4fc1-a8d2-d86a2b366e8e", "value": "T1A8840202B6E99036D9B967B054F707830B37BDA64C74436B3785A89A0C736D0E97237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268254, "uuid": "fa1c99d3-8ced-40f0-ac8b-433d1789d8f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268254, "uuid": "ea89f20e-5e66-4b72-be0d-aae225e595f3", "value": "6144:Kcy+bnr+rp0yN90QEuCtfjMxPBykWWnZNorLH4i8D4JWJNczx4n58SWFBdbex:gMrry90cdx5Wrr41EEi1q58RB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268254, "uuid": "775f12a3-2040-4ec0-84b0-4c420db79295", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268254, "uuid": "ddafe4dd-062c-4b38-8644-a52d0c974a91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268254, "uuid": "f0db0265-1c08-4cd2-a105-f6610603b49c", "value": "76865921e4b5a5ff0c0d8774d92298cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588e79ef-2afb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690296950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296950, "uuid": "602a1c58-b779-4653-b7ec-c48cdbc17d98", "comment": "Malware payload (RedLineStealer)", "value": "dd652feaf9e1fc5d2708a504fe0ca9d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296950, "uuid": "4a00e6d6-64c1-422f-aa73-730bc30f9e28", "comment": "Malware payload (RedLineStealer)", "value": "f4d613761f025e646a9adeea89975989bd817d0280d05fc45e61301bfaa43688", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296950, "uuid": "9f8d9199-75c6-4719-b6e8-0f78b5437b6e", "comment": "Malware payload (RedLineStealer)", "value": "0531543b0845d2f2a131944a384982651c2972b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690296950, "uuid": "55d06313-9d1f-4553-a6e8-45b33bccfeaf", "comment": "Malware payload (RedLineStealer)", "value": "09b03db22e47ef95a557e1fb994e157bf06d31dd18d46c91b7265d4013361418989952f0356b9c07955d55a47e73b339", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296950, "uuid": "1d48ff42-a4e4-405a-aa8b-b0b5b0a3ff72", "value": "T1BD845B4392F17C50E926CB73AE1EC3E8761EF6508F4D7B662219AF2B14B11B2D273611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296950, "uuid": "327a2f34-0bf3-4e0f-b2e6-be01c7add9ca", "value": "6dd6b46f56344bac3e06d5c8db854c3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296950, "uuid": "d8ec7188-4a9f-4bb3-a336-a533f9f1fe26", "value": "6144:xhr0LLM2DymWoxBIXVu+KZYozISmSt88/fCMSWmoH7mdb1pT2Q:jr0Lg10BIWZz88/KhuYbPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690296950, "uuid": "1d9896d6-237a-4b56-94a5-3377e5c2237d", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690296950, "uuid": "1d30a359-568d-4891-b6b0-07a0b1501fb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690296950, "uuid": "5021cbf1-9047-4b52-b647-fd7b6b8615d2", "value": "dd652feaf9e1fc5d2708a504fe0ca9d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43376cd2-2ae5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1690287465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287465, "uuid": "bc32cb6c-dad3-48ec-879a-73c62dd36da5", "comment": "Malware payload (IcedID)", "value": "e5cc8d76f5befdb2c8c5f8919b937844", "object_relation": "md5", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-724", "colour": "#D0EF82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287465, "uuid": "bdc00f89-dc8b-460b-a620-c77ee81738cb", "comment": "Malware payload (IcedID)", "value": "f4e559f4ae3ee80d332924eb0c13a16874927159eed21149183b3a2bf9930807", "object_relation": "sha256", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-724", "colour": "#D0EF82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287465, "uuid": "11a79244-d08c-4d78-88c9-a1d41a190e71", "comment": "Malware payload (IcedID)", "value": "0a50f69c1dee93e1abd2348bfb76245c1196f94e", "object_relation": "sha1", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-724", "colour": "#D0EF82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690287465, "uuid": "5ae19a62-4d5d-436b-bf41-9a96a947cf15", "comment": "Malware payload (IcedID)", "value": "7264331a261d6cfe9f6ff664bdb5d6ef18a6dc392a618986a07faea35170aa7c6efe96d0bfc8160d3943a983edc85f45", "object_relation": "sha3-384", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-724", "colour": "#D0EF82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690287465, "uuid": "166f134b-285c-472e-a43e-95a23929c448", "value": "T15F04237497583EB3AA3B3C6570B17EC812B575305C74F8092AFA14ED2D698EE4AE520C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690287465, "uuid": "823afbb7-97f5-4140-9b8d-8e6c5dd59068", "value": "3072:LcfOdgEpR3Z2PHK3rUbM5542hs0MgdZl2xbzxN/LB5BJldNubhEloqonUN0:EIz3MPMhBMg0xtLz9Xulm6UN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690287465, "uuid": "fd6345b7-13fc-4224-9ae7-64bdf7b392f8", "value": 185986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690287465, "uuid": "e0f0f29c-cac9-4cde-bd55-22358fc37bdc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690287465, "uuid": "30e6d97d-a066-4758-a88e-cb822aa9b785", "value": "INV-Details-JUL2023(140).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688533e7-2ab8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268201, "uuid": "02430fdf-ef82-4057-9f81-f34d7cd20cb6", "comment": "Malware payload (Amadey)", "value": "5f2d793d2f3d8aab083897d761dd4bba", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268201, "uuid": "69c41585-bb87-4e18-9a6a-12ae9ff02d42", "comment": "Malware payload (Amadey)", "value": "f5377ee6d4204bcb18bde8e7f716fd837676384df0365d894b61f3e614bf7c17", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268201, "uuid": "31988c14-d379-41c2-aa26-67501795b076", "comment": "Malware payload (Amadey)", "value": "01bfbed3b2be2b82591a634b0c2401aa6f458ba4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268201, "uuid": "1db2347c-b890-4400-b4f3-42d7dc6ead6c", "comment": "Malware payload (Amadey)", "value": "1b1a0da95e7b3fa21255a95efcd1c373bb140262ddd16c6381d37109a2de5e1db21254f6940b6ff860cb11bbe84eb1e4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268201, "uuid": "da5e73ba-a5d8-42db-a8cf-9274b76dcdb8", "value": "T12E2408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268201, "uuid": "7511a260-a571-4a13-88e4-22f330a3fbef", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268201, "uuid": "92592b3b-3bb2-4484-a40e-ef537af4cfaa", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268201, "uuid": "c67fd29d-757c-4634-81fa-50d5830f26dd", "value": 229221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268201, "uuid": "58970f8c-2018-4067-9ac9-c1966c13f8c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268201, "uuid": "807110e7-f6ac-44d2-a10d-47f7ec6598ec", "value": "5f2d793d2f3d8aab083897d761dd4bba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf304cd3-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690282117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282117, "uuid": "6493073b-ab4f-4c54-89d2-56240b5fcbbe", "comment": "Malware payload (Formbook)", "value": "4355972b425e6d8ac60bda9ab60527d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282117, "uuid": "a8fa22ac-0aac-42f8-8555-e163d0f7d342", "comment": "Malware payload (Formbook)", "value": "f56434c7deb27cd8625fb73ef500be5cadbd90adbd9654d79e9d8d66ada7a581", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282117, "uuid": "d4752f85-2fa3-4a91-92ca-48fa34a2a21d", "comment": "Malware payload (Formbook)", "value": "d556b646bbc626631c4616cf482ed756e9d6163c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282117, "uuid": "25630a2f-4665-4710-b89e-7921a38b64a0", "comment": "Malware payload (Formbook)", "value": "41ea1a0cdcdb82ad37cba1d8e42110550c6e4d59bd92e488d3725f03cb47c1b12cac6cb31ebdc8eb1146aa1ef114083c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282117, "uuid": "c823217b-ba9b-4b98-915c-bb8c1e1b12a9", "value": "T1F044124179D9D1F7E9635AF30CB803AA97EADB2836A6830E43740F0DBC5B550D90D762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282117, "uuid": "b976a1ef-cf24-4af9-bf5a-7104d16e5a14", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282117, "uuid": "21c08f3d-15ac-4b12-a628-bc934f94a20d", "value": "6144:/Ya6XsqMTNK/mhsvbhqPvkgnxPVgVW3Q/r2ga6Qf4Zk7trH5so7aX:/YtsqMTw/ilvNPGd/rV5Qf4ZkZruo7aX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282117, "uuid": "5bdf389f-8676-4ac1-b155-06506962479c", "value": 265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282117, "uuid": "ea1d0a3a-9098-4a13-a46f-82989e3ebd1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282117, "uuid": "a8d3782a-21d3-4ba7-a424-e53a6ee85d1a", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db6937e2-2b44-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690328523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328523, "uuid": "8c409b96-fdbb-45a9-9f05-ed6bdf68d75b", "comment": "Malware payload", "value": "6ba060cc4ca5510ab5c0776b9cdf6ef9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gonnacry", "colour": "#662A89", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328523, "uuid": "a911d8b0-2746-4ba5-bf30-920d2953d28a", "comment": "Malware payload", "value": "f5de75a6db591fe6bb6b656aa1dcfc8f7fe0686869c34192bfa4ec092554a4ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gonnacry", "colour": "#662A89", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328523, "uuid": "8e670d85-1346-45e7-9880-14dd2a02e427", "comment": "Malware payload", "value": "182f103e514c9945fea9bed04b5dcf8b5627c6a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gonnacry", "colour": "#662A89", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328523, "uuid": "4c6284b4-d1d5-4887-ba4d-71388633b57d", "comment": "Malware payload", "value": "ad7d2ceb6bca466ba12a2ad5d2df5efbf15f8cbd1ef7f6ba1ee6db76c1d2e8b583d876e8d0e33fbb8c86e0d3a66aac39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gonnacry", "colour": "#662A89", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328523, "uuid": "41d61ad9-d020-4378-99b9-38f577dd5e8f", "value": "T1E4B29377F2A2CA78D6D5F17435C38462BA30A4F09B32631B57190A676D03FD84F9A9E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328523, "uuid": "be8ef36f-bc32-4278-a8ee-17954653c8c4", "value": "384:2WIzjrF6817+b7VTlExh0tKhrQd9i66g12:2DW9TV9iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690328523, "uuid": "78240c4d-263c-4e33-a601-d204a0ebcdbf", "value": 23712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690328523, "uuid": "e166efc8-188f-40ef-bab3-6a43cbaef9b3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328523, "uuid": "5026aeba-e7bd-4d7a-a23a-0bcab88f8c18", "value": "f5de75a6db591fe6bb6b656aa1dcfc8f7fe0686869c34192bfa4ec092554a4ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4702fa-2b36-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Arechclient2)", "timestamp": 1690322433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322433, "uuid": "8729f5d5-1c04-4405-af31-8cb4ce6b52ae", "comment": "Malware payload (Arechclient2)", "value": "2d2438d5db3f329ecf93eb9f73d413de", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322433, "uuid": "d5425b20-0720-4c76-80d4-581da683c4c7", "comment": "Malware payload (Arechclient2)", "value": "f692345201c9c5904897ea212f6e6c5595632a955fe5e574c0c83846c428d7d1", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322433, "uuid": "fb67fa11-05a1-4814-8a93-02d63043941f", "comment": "Malware payload (Arechclient2)", "value": "2d6870abc582c24a4f498d4e36f696210c77517f", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690322433, "uuid": "3ac778fa-30b3-4e78-98b9-539a7adda239", "comment": "Malware payload (Arechclient2)", "value": "f5cdf57337c444677e32ccd785f265ba9c29ab64324d77e7558fcad18aaa39e95dd17452207197ad4792dda62f339a11", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322433, "uuid": "7e895853-46b5-43d3-9a7d-f49614bb16d6", "value": "T183A4382D33179536DAD9BF7880FF0F2C95A7425386996A4F0B8CC8C07F8539E9709A85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322433, "uuid": "03fc8b70-b80a-4d05-b555-392362b045b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322433, "uuid": "ac0fd511-6d92-4dc1-b67e-51c05195135f", "value": "6144:7lBYO4yjEb17TcMz5/hQluj0oGWA9HowGD9kh0vIOnP09Xlz34bKeA68tZTOaoWm:haO4Xb1740ZDw+vIcs9Xlz1E8tF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690322433, "uuid": "ccf6c21b-3324-4c11-aa6e-ba9ef9182661", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690322433, "uuid": "22572c59-09c8-4759-b55c-242c16c77175", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690322433, "uuid": "f56bf9d2-50b1-4675-88e7-b3dfa4ed1d3b", "value": "2d2438d5db3f329ecf93eb9f73d413de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24636cf0-2aa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690258208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258208, "uuid": "21e8a038-596b-497f-9101-1035088062a8", "comment": "Malware payload (AgentTesla)", "value": "e2efbba9160a81d844878269a05c92b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258208, "uuid": "c658abf2-8933-406e-b49b-74889c76667a", "comment": "Malware payload (AgentTesla)", "value": "f6a649f98d3501d25d226aaa3183b480f054df38f8927fa7fbbb586ea4ca4f79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258208, "uuid": "77e28082-e18c-4ecb-9624-3f94cc34784b", "comment": "Malware payload (AgentTesla)", "value": "61357b55e4c4e39bb3b9a2ad916bb0d3f64a37dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690258208, "uuid": "ed079f56-31eb-4c38-84e7-07aafa6640f9", "comment": "Malware payload (AgentTesla)", "value": "ff232da9b2c68c912f4898401f24d022f226134fa300fdbeef428bdbc8daa6869b7294d70f486170e48a618d18178f33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258208, "uuid": "9bd74e54-76f0-4b28-bf7c-430279efeaa9", "value": "T17E841BB51DB98CD0F91EB4388329EABF6F566C52082542FC1C5ABD658FB1340DB60E72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258208, "uuid": "e91c72a4-11cd-46f6-97ac-c3e25914b108", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258208, "uuid": "0439e21d-9e86-4c1d-995a-bd87214cddf5", "value": "6144:vAkZn5ybQNC9qaEbCdcxYeSfjzt5eokvXsNX2FHHeLp:vAkF5RNuqxCSxYjf15oCww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690258208, "uuid": "b6f2cfb3-dddb-45ce-ac85-7a9ab09c63e3", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690258208, "uuid": "2d6bd167-19e5-45af-805e-a51e6e75827b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690258208, "uuid": "e97ee1d6-ba50-4bb6-b80f-013fd6760d99", "value": "e2efbba9160a81d844878269a05c92b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a73f8d-2ad6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690281165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281165, "uuid": "a2343169-b01d-4b30-b65b-a6939ab02ed9", "comment": "Malware payload (Formbook)", "value": "464ef9cf248e03939837e11a92d15548", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281165, "uuid": "d5fa7c4a-bf19-4fba-9fd2-922f4b8a1ceb", "comment": "Malware payload (Formbook)", "value": "f7537939cb6791cf3b5919514a93bab3a03c8b1d4291817206543902ee63f81a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281165, "uuid": "8284d233-a5ad-431a-bb90-45bf6280d361", "comment": "Malware payload (Formbook)", "value": "edc460a5b1b815ec5a5496e1ce6016b427ea83bb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690281165, "uuid": "d9d3f313-6d36-447d-9bef-e078776a7e77", "comment": "Malware payload (Formbook)", "value": "c8ba78f6b79b6dcb9ea4f5b17c4b05eb29ab473ea9a53a2a56a1f20caef15ff5cff940af82e0fc937a8ee61cdcf401b8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281165, "uuid": "dde957f2-0048-4a7e-86dc-7c9dc582a023", "value": "T1F1626E769BC30439CB9E0BF006FB0D6615B5625793CA42D35FD00B0AECE46EBB9515D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281165, "uuid": "62acbccc-fa9b-4933-8065-490724401e3c", "value": "a6662c6630955eb0d75b891b46f3558f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281165, "uuid": "e1337481-3fa9-465c-a7a5-30100265f66e", "value": "192:2wpS43vWrZT+YMJtHL4z2JKwxmlhHppMIP3RmVfcOCs9YMCRNA2oYqwg9:2wpSFmhLJJKuIhdP3RmVXpCRQYqwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690281165, "uuid": "8c834b55-c998-4fa1-9fae-22e41f2cf209", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690281165, "uuid": "1c547156-b2ab-48fb-85b8-82802d3e6a0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690281165, "uuid": "950bcaa4-057a-442e-8ea5-7eef8ba4b92c", "value": "SecuriteInfo.com.Win32.PWSX-gen.28327.24915", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24350171-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268515, "uuid": "24a0b208-ddb4-4dab-a4cd-1e324eab3e4c", "comment": "Malware payload (Amadey)", "value": "b7072ab531a1cb8da3a56230294d3ba5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268515, "uuid": "a849cf66-b00f-4ea3-a280-967b136ea3c0", "comment": "Malware payload (Amadey)", "value": "f7b9d0767322a55a6d7c72fe221b1afe6d74a126b9987617ba0219ab6d94c2cb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268515, "uuid": "7c5ebe88-da56-4814-930a-9c587e5884b5", "comment": "Malware payload (Amadey)", "value": "6a512db71f150d46aa7635888020fef6a93a0980", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268515, "uuid": "f09dca9e-7d49-4740-a9c5-8a146a93a6f6", "comment": "Malware payload (Amadey)", "value": "2522911d176a9b4d5347f5e7282623d50c06db550434118a2b4495aeed347af4af4bd00acd922909192b316cc01873f2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268515, "uuid": "33e18bd0-d1f8-4c45-a72d-0d717bc7acae", "value": "T13D840143A3E89072E9B2177058F743D31A397CE18C7C876B274AA85A1C736D4A57273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268515, "uuid": "898aa88a-851e-44c9-9833-587ca15b7fcf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268515, "uuid": "35f8ec29-b4fe-4952-acf7-2968d211e638", "value": "12288:DMryy90ZGHHXY7f3v0njuOgBYCoCZc2YKk9:NyaGH3Yz3vYizG2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268515, "uuid": "3a6c1b36-a24c-4492-9117-f55730d2b986", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268515, "uuid": "5ab1af06-cfd0-4470-981b-3e9e59a5aa2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268515, "uuid": "48d9ba94-2424-4117-b602-64f1d551d094", "value": "b7072ab531a1cb8da3a56230294d3ba5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b28c77f-2ad5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690280553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280553, "uuid": "5c13cddc-82c9-4a4d-af23-f20f8a3d0892", "comment": "Malware payload (RedLineStealer)", "value": "7d820aa7d2983f2d6302c5bac5290af2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280553, "uuid": "0b036227-7911-4e7b-a059-7609a82b20b7", "comment": "Malware payload (RedLineStealer)", "value": "f7ec687c421042b9f3672d54d27ced636fbd2430c44b7ab08cd85cd0beaaf09a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280553, "uuid": "1431e0e5-6843-469b-8f21-8045e9307666", "comment": "Malware payload (RedLineStealer)", "value": "5375bdb0d0f4c67f40813ca88f4000f38cad3970", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690280553, "uuid": "c98c8f53-7b9e-432e-ad80-3ee7ed3a58b5", "comment": "Malware payload (RedLineStealer)", "value": "99ad930685bff334caa7dcad4daae547ea239953942e41d837a04ecfdf043ea2c0bdf6537fd80839e19f16d47cf2ed74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280553, "uuid": "a2d727a9-c2a4-4b33-b1b7-5df3a245d023", "value": "T1B1840212E7E98032D9752BB058FA12C30A377DA29D38837B3B52594A1DF36C4A57173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280553, "uuid": "b7fc6a6a-6ca7-4746-8a8c-c62ee812be25", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280553, "uuid": "0cf538d1-7346-4ff5-b1d0-3b156f7f1743", "value": "12288:/Mroy90Ku23Qqrd0JgV6IyXCsyPpGGxfbXZ:3yznqiV1ySnRGmXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690280553, "uuid": "ef3840e0-c3f5-4b29-b26b-8f7f52b989f0", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690280553, "uuid": "f31a8bcd-e7df-4ff1-95c5-d072ce99463a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690280553, "uuid": "7d918443-2685-454a-b6e9-8530dd39b832", "value": "7d820aa7d2983f2d6302c5bac5290af2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b96822d-2b16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690308605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308605, "uuid": "bf5823ca-0aa5-4a0c-9689-a25de58ffc2e", "comment": "Malware payload (GuLoader)", "value": "27ea13a29537c01fba0d2468f80a6bbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308605, "uuid": "090b83df-9893-4b39-b3cb-e22ce319b02f", "comment": "Malware payload (GuLoader)", "value": "f854bd36800e1023b94344b4e349a6a3b725872f39cadb9e6dc62b739fcf6b23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308605, "uuid": "e25e38a4-88be-4272-bc94-93a940ffebd8", "comment": "Malware payload (GuLoader)", "value": "7860c519ab4fe6080357c222a3e7536e9a562388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690308605, "uuid": "4ce87cf0-8b74-40ea-a2c5-66155282098e", "comment": "Malware payload (GuLoader)", "value": "34c3a7e7ad3d6c6111b1538ff39064a05f470a0532fb7baf02494ddc695cab9766b0b1378b774e5819147402043913f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308605, "uuid": "f640c54e-b766-4d39-be85-9ffa3e466434", "value": "T13A14121237C0C9BBC41946B28ABE7F32AFEAD71152DE9B8357C51E5B7C061A1850E2D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308605, "uuid": "1cacaffe-835c-4d78-9d1c-947de0684055", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308605, "uuid": "48950cbb-6a6a-4b9c-b53e-2ba7d0e7e021", "value": "3072:nwDijpS4DbYcr8bkFv0KlrwgsVfBDJU+uu1CJIKPfYf2bWyGPh3yn1yIJ3yY7CTC:nFPeklPdwgefnFfC21j/Pdyn153y0CTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690308605, "uuid": "dd68aab9-4216-48de-b3f0-186590558767", "value": 195629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690308605, "uuid": "b6cd0b36-fb37-427c-9f9a-032caddecaf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690308605, "uuid": "478bedf9-c913-4b71-888d-c0a4fb73f928", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e31b3f9e-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690268836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268836, "uuid": "9fee609c-c963-404e-a8f8-f4c8f829735f", "comment": "Malware payload (RedLineStealer)", "value": "f423a617abb1c3881291402b6cac8797", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268836, "uuid": "8f682f6d-9bcf-4739-8767-b5caa18643c3", "comment": "Malware payload (RedLineStealer)", "value": "f915dc615c55c72aefd316bea4e925aaf7a4c2bfa74391e4d90749dd696058cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268836, "uuid": "1720db2e-17b6-4465-bf12-59f868ddea01", "comment": "Malware payload (RedLineStealer)", "value": "fe1ff96a56989849fdffb54096a74184a3c9ae03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268836, "uuid": "8b0fdb0e-3197-48d2-ada8-0d0e4bc7dcdc", "comment": "Malware payload (RedLineStealer)", "value": "d664fae41e8cf2196e48dabbfe53a4a3a519b566823317b78e2093a2ad27064341dd6edb2fb1a6b60b26df695635fa90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268836, "uuid": "202a75a8-c7fb-431a-9219-eabda6c403c6", "value": "T1F3B41213A7EC5433E9FA473018FA03D317397DA09D79526B3359A84E1CB2284A9753BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268836, "uuid": "c45b4b9c-4fe7-4474-ac9b-7ca44e2d7aa6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268836, "uuid": "23256a03-8a46-44f0-861a-53f350b26fda", "value": "12288:DMrny90uI00jASANFlLKoGVqkZSetQrrJY:oy2A1LKNckZrtQrrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268836, "uuid": "b2514b2a-86fc-4441-b015-168735bd688d", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268836, "uuid": "f56806d8-5f56-42d2-8e86-ea3b0834c799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268836, "uuid": "d92bf0e5-ff34-42b5-810e-2f09834753ed", "value": "f423a617abb1c3881291402b6cac8797.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97a97e7-2ad8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690282134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282134, "uuid": "3917198b-bb82-4668-ae18-fff99433ee2b", "comment": "Malware payload (AgentTesla)", "value": "bc18d6a35cf2cea53cd315f72b955174", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282134, "uuid": "b8dbeeaa-d35e-40ec-88e3-b9fd0f8fc0aa", "comment": "Malware payload (AgentTesla)", "value": "f97e82a367b6de783c72f569e62c0900aefda467725c425bc6e122db7fbe1db9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282134, "uuid": "ac01fa7c-2dfd-4547-8f73-d807e41fb44a", "comment": "Malware payload (AgentTesla)", "value": "9230ea1a6934d371f1fd6885dce5accd8d38e2b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690282134, "uuid": "84bbf710-94de-48a1-b2e7-82bee20e7e8b", "comment": "Malware payload (AgentTesla)", "value": "937f7f6564af5a2f0fb7c4d771faa959ff55cfe154611395c4a3cbf2470b6ae682365b6ae3ad3f2eca05f3fa1724f02e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282134, "uuid": "a4b6e38d-43e0-44eb-94ca-a90fe725b8e6", "value": "T1B1E412117A686D63C17DAEF2442098042374B655602BE3CE8CF475CA3DF9B463A69FCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282134, "uuid": "433ffc05-d98f-42e7-bee5-b62bf295be3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282134, "uuid": "6a23ac62-2b85-4cc4-90bd-7649c068e543", "value": "12288:AWc/bUYIsYolneyudZJJ9QtlVrFdBcKzMM6jH6LIJOU+dM1KWAGW5DF4D6g7:biXrYo8tdZz9AlVrFIa6ja8Jb+ug3GW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690282134, "uuid": "f8c618d7-eefa-46bd-a12a-c713d38e45a2", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690282134, "uuid": "902f46bc-feb0-46f2-84c1-e970d5c9a721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690282134, "uuid": "90e2fd9b-4128-4159-a347-c2fe8f106e21", "value": "Transferencias a Cuentas de Terceros Banorte.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4a3eaf-2b45-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690328737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328737, "uuid": "69b182e2-2bb4-47e7-bacb-9df8f989757b", "comment": "Malware payload (RedLineStealer)", "value": "899756f47edd02727fca00b607b6f955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328737, "uuid": "9f43f2e8-bccb-4672-9a83-8a42d2e209f9", "comment": "Malware payload (RedLineStealer)", "value": "f9844a8fefa896d412f9090b0af60f50068ab0982199a500145483d86c9d2de3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328737, "uuid": "b43c5c5b-aa94-4046-9801-40f4ab9c53af", "comment": "Malware payload (RedLineStealer)", "value": "3523bb61c84d192d24698ab540073071007fe228", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690328737, "uuid": "0912c95b-ce8f-4b50-8ef3-7cdf82a1a929", "comment": "Malware payload (RedLineStealer)", "value": "84cf9e573c8b0a54522cab661024d4df581b62bb55decddd272a2a7e41883e48f7cf6ec14432ddf7e1c8d01f06b2432e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328737, "uuid": "8f772b1a-2cb2-4463-bcea-e0abfe133f6a", "value": "T1CC840213E3E98033DDB91BB119FA17D32B357CA55E7497AB2742988E0973680A931337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328737, "uuid": "b3f3c04d-42b5-4580-8984-a9e056ad0b11", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328737, "uuid": "be68787a-6f9b-41d6-85b0-d9ddf29c257d", "value": "12288:UMrdy90qOhhvxyGacXBiSDsSayvA4n3+3:ZykPyiRikwI3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690328737, "uuid": "e38887b6-365f-4171-b134-3e002bfaebac", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690328737, "uuid": "003c1e65-9ca3-4e93-9692-2c6686e937de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690328737, "uuid": "e858f50e-43de-4587-bfe0-244c114d17af", "value": "899756f47edd02727fca00b607b6f955.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad76a54e-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690267887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267887, "uuid": "c658e483-eb75-4f20-8588-98360f3a3f53", "comment": "Malware payload (Amadey)", "value": "1606b2ec96306a2afe774f1fc7dfe198", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267887, "uuid": "9a82dfe0-7fee-45af-8f4c-226e1d054c9e", "comment": "Malware payload (Amadey)", "value": "f9993b9e81b8696e1924222695f77eb24dbadcd7268ccf85d5fc90088419782f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267887, "uuid": "63229a75-6166-44e2-93c4-2aed00024308", "comment": "Malware payload (Amadey)", "value": "66ebc7c1531ee7537d417e19473db39c6d2db70d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267887, "uuid": "b9660d13-6589-4fec-843f-236f02248a7e", "comment": "Malware payload (Amadey)", "value": "0196ebbebcfabb907b84dcc515ab5e269392c7bf006f243760fd5e3aac5f3f9ded8b51d2789db85166aeac51529c3cb6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267887, "uuid": "08663809-52fc-406e-95bd-d94abec37504", "value": "T1032408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267887, "uuid": "5060a40c-be7d-411f-b3ea-9956f9edb797", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267887, "uuid": "9f5015ee-d132-4e3f-b01f-6f3a9039c57d", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267887, "uuid": "28d900d2-f4a5-42e2-9bd8-10a59a5bc187", "value": 229329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267887, "uuid": "e4fc1be1-24b6-458d-b765-818d521168a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267887, "uuid": "97ff5f78-95c2-4fdc-ad75-934640e9d6c5", "value": "1606b2ec96306a2afe774f1fc7dfe198.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea43085e-2ab6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690267559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267559, "uuid": "068e2cb7-bb90-4c43-9b2c-050f5090e5b6", "comment": "Malware payload (AgentTesla)", "value": "6c5c0474a74fb13e836d1f366d7a454b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267559, "uuid": "d9fb47bd-e8f6-4e92-a352-f9811df6573a", "comment": "Malware payload (AgentTesla)", "value": "f9c4bbc7b6a427a5fcd5d462d402456e604e7fcf1a21d350f3cc7f894f0e4484", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267559, "uuid": "49ca6d13-1f6b-4426-8dda-422f39ae5525", "comment": "Malware payload (AgentTesla)", "value": "53768838628d578b4e3b198c8466be10e56fe902", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267559, "uuid": "c50be626-e09e-4341-a95f-ec808340eb5d", "comment": "Malware payload (AgentTesla)", "value": "d490eca09f74656da84a4a5194c2c343a7ab32a4f480436949c78397d8d3aaa102b31ebd0b72535f2685fdd956da5d9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267559, "uuid": "2a302d39-c9a2-492e-9a99-0f83f59ffbd2", "value": "T1F3257ED1F150C89BED6B06F1AD2BA93024D7BE9D54A4410C599EBB1B76F3342209FE0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267559, "uuid": "6315865f-af40-440c-919a-420dad8c083b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267559, "uuid": "4c236226-241d-44e2-b896-1bfb297d2fa2", "value": "24576:VHIcTrGCF+TivrMmAcUJUtUz2BLFLTo8a:VHIkrz3zthOUtUz2NlFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267559, "uuid": "dbfc389e-9258-415d-be90-c5f13fdc9b5d", "value": 1040896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267559, "uuid": "b3378710-0ba9-4f30-8cc3-ab4a1c5e3575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267559, "uuid": "fbb65404-b994-4b2d-8f67-da44b0eaa4df", "value": "belge.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99fcedff-2abc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1690270002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270002, "uuid": "5f757640-501e-48b8-ad4c-4cbd1043e25e", "comment": "Malware payload (IcedID)", "value": "bd080cf7f5908ceb5a1728707dc22e2d", "object_relation": "md5", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-724", "colour": "#D0EF82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270002, "uuid": "93efa731-7bf7-45af-ba2a-d149c923e817", "comment": "Malware payload (IcedID)", "value": "f9c64923abc4372676bb4e2c53a11c1eccdbf39cd64b0c46c8489b2c2825d6ac", "object_relation": "sha256", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-724", "colour": "#D0EF82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270002, "uuid": "6dfef00e-d2be-40d8-ba73-f3fed69b1e3c", "comment": "Malware payload (IcedID)", "value": "8f7155d2648af4c8d7a6594334f941320d5d3a20", "object_relation": "sha1", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-724", "colour": "#D0EF82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690270002, "uuid": "00fd6f35-0dd5-425d-b773-f8824d0dedef", "comment": "Malware payload (IcedID)", "value": "41e5964f3d2568223819687c3e32659c626cda41dc10d38970c6181176b5778fcf0c657a789a3d8aafbefcc01d8fa281", "object_relation": "sha3-384", "Tag": [ { "name": "1561373935", "colour": "#77FCC8", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-724", "colour": "#D0EF82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270002, "uuid": "4ab70ac6-fd6c-4b0a-9c99-56636bafcccb", "value": "T1E9041331B9CC6B4E7E57589E8B268612B4183FB7B64F3142DD5FD105B10F032BA5126B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270002, "uuid": "b47ea88c-64aa-484d-8323-fe255979b75e", "value": "3072:XgUQwF6VWPNYlbgH4dLe06w43b0Co7+T3IZxjUib1c5Qg9rn1QLeSOk:QntUylsYV96wDaTSVU13Rn1QL6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690270002, "uuid": "7c1133a0-a35d-4ced-99bb-24e8547cda09", "value": 185992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690270002, "uuid": "793bb934-da9c-4596-9150-6251cb67071f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690270002, "uuid": "3a1012c5-1c63-4534-a5da-8e8d20db2656", "value": "INV-Details-JUL2023(179).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6400bd-2ab7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690267913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267913, "uuid": "01ee6e7b-a186-477d-b315-d9a2fdbfcef6", "comment": "Malware payload (RedLineStealer)", "value": "17b1fd47dc602f6d829b013bc84c3902", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267913, "uuid": "03775c16-63bf-420a-b597-40f144b0cddb", "comment": "Malware payload (RedLineStealer)", "value": "f9d3deabeb4e5709723d0a5a8a4f2cce8fc17dbf94947f40007bda62078fbb54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267913, "uuid": "f3f23fe8-cd57-44d2-ad31-61d4fcad731b", "comment": "Malware payload (RedLineStealer)", "value": "41bb0c19d3a7146a9d913bb2dc4aa4b49807ba7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690267913, "uuid": "3b288927-dee7-4cb1-a1c2-1cb136d271a3", "comment": "Malware payload (RedLineStealer)", "value": "1c0a1370524fcada50aff85cbb5cb8cc7f3bd41d4e2099f86e7da41d5801bc97cd7bc25da287fda175160f9d47e4280c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267913, "uuid": "d450df8c-e16f-48ec-a3cb-53e7c3415bc0", "value": "T1D1A46B4792B17D55E9279B729F1EC3F8760EF2508F493BA62219EE2B04B11B2D273710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267913, "uuid": "583b2ece-7b1e-4e17-950b-b6fad63b230f", "value": "288497572d529233d7fe65807fe0c26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267913, "uuid": "3ea0e30a-f4ad-48f9-81ba-820038f649b9", "value": "6144:5DkdLiAP1bvwfFFsdvnofn2nnl/Tmf5Y7xDsA5ylF8lrvtFvLS1ETj:RkdeAdbMFIvnofw/tBsABBVZSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690267913, "uuid": "26d3b7d1-c393-4b31-9fa3-c0ddcb1da0cf", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690267913, "uuid": "96741d1b-bddc-4dd9-9aa9-14291cac72f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690267913, "uuid": "f5232924-fbd7-49f8-8888-49d3157accd4", "value": "17b1fd47dc602f6d829b013bc84c3902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083c4cb8-2afd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690297674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297674, "uuid": "60e5816c-8547-460e-893f-49b24a757b98", "comment": "Malware payload (AgentTesla)", "value": "c4a959052f68232975b40553c51d45d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297674, "uuid": "bdfb9c44-afc3-42b3-a5e7-8de7046f9994", "comment": "Malware payload (AgentTesla)", "value": "fa135191856c7e01a2fc89ee8cfbc37bdc6ba80bbd780644ea94183457597412", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297674, "uuid": "b730dd27-6559-4f80-8655-e71a733d4a03", "comment": "Malware payload (AgentTesla)", "value": "43c3d0f8d76692b6222f74c03e22e0211785673e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690297674, "uuid": "b2daf0bf-275a-47f3-b3e9-113fac75861c", "comment": "Malware payload (AgentTesla)", "value": "cc5849eeaa3f0df7fa8458cdb67661db2a337f94d9de9cc94c6fa8e2e1e18ff51a2014f71f00a20df59dafea4a31a032", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297674, "uuid": "0f5ab093-3471-41e3-9992-007e211d7d8e", "value": "T1CCF4124041A5DB1BE1E493F95B70A746A3F99FC12923D3288FD3EDC9F46AF241214A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297674, "uuid": "db8ee657-be33-4542-9dfe-96da2fc78286", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297674, "uuid": "c802b5de-5443-4d75-8acf-44b77a0e2670", "value": "12288:kMaIkPt46c7ujzCWSD6IYkzu0hBX8akVzvwRdqSw0xbiFVsmW//5Hq7N8MnUwhIk:5aIwwQCmkzbfXvyM1besvxshxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690297674, "uuid": "9fd15491-4a15-437b-a32c-ae75906edb72", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690297674, "uuid": "271f5565-e6c6-4e98-831a-be1920910245", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690297674, "uuid": "949becdf-07f6-4855-ac39-d9f3894ba785", "value": "rITEMORDER384774FHHFFJ-4847FF8FN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bba6c73-2b1e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690312041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690312041, "uuid": "0decf0ea-39b1-4ff2-8d63-c8c73c934d9f", "comment": "Malware payload", "value": "1f908791eea12ca316e17d0127788bcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690312041, "uuid": "34771028-f213-468e-977a-81e20f974817", "comment": "Malware payload", "value": "fa212567cb826ef3ce6f6fe5189f923b73d1af1411206d14184cbad3eb2da524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690312041, "uuid": "7114832c-9e85-436b-80e0-77b64235e976", "comment": "Malware payload", "value": "7bd511452f43450de3e64f75d724e069756c76f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690312041, "uuid": "5335b9d5-a1ef-46be-bf98-437b56c5895e", "comment": "Malware payload", "value": "1401b5200120c40c429b0c2cbab703daf32c3eba6d5544bb315f5c38f506e0f5ca6497fed055369e732bd364086865b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690312041, "uuid": "87f5ab47-0cc8-4dd5-8cb8-22e51b823d6a", "value": "T167E2F6467BA58219C6BC6AF89CB313110772E3478532EB6F5CDC88DA4B676D00641EED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690312041, "uuid": "81f2a8b5-add1-4736-91e5-db985eaf097d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690312041, "uuid": "80f9509b-e6ca-46f7-9f6c-eca0407c5731", "value": "384:C0bUe5XB4e0XfODeANuiEO0YaxWTOtTUFQqzFtObbW:bT9Bu26guiEYyPbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690312041, "uuid": "341de104-6d1e-47dd-b3ef-cbd0d6d7d8b7", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690312041, "uuid": "e1e78c38-dc20-4488-89a5-2d9ae59bbf6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690312041, "uuid": "b2560266-e287-4db9-b522-a32745d5e64d", "value": "bO2P.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c6183e-2aec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690290471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290471, "uuid": "2a4cf337-53fb-4118-95f7-9a245f8290a1", "comment": "Malware payload (RedLineStealer)", "value": "d978619f0eba8e15ce841d9a759d44b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290471, "uuid": "c9bea34e-93ea-4b03-839a-99f2ce5c3fa1", "comment": "Malware payload (RedLineStealer)", "value": "faa0280b386e475a854b6aee01a81bb8ffde73c74d60a37a78501e3e657b3ce7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290471, "uuid": "c3f5caf0-650c-4cbd-89cf-26180de824f2", "comment": "Malware payload (RedLineStealer)", "value": "2af51d6e5d1d35cfaa82f0ddd39981333c187398", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290471, "uuid": "7d7015f0-cc2f-41e7-99db-be95cde3bf8f", "comment": "Malware payload (RedLineStealer)", "value": "447a70fb888d765f7e99c759981cd519881f9a7d3ae68d4798928f73a739fb2eb020d1bce6fc0e038af51a939b9e051f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290471, "uuid": "c5a98565-060b-4eed-a04b-22de0ad03c91", "value": "T15C840242FBEC4133D9B617F418FA43870E36BD71896883AB2345AD461DB26D4A87173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290471, "uuid": "85770e3d-a5df-4118-9d4f-00d706f67272", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290471, "uuid": "9cac1693-1722-45f0-a53f-31235fd302bc", "value": "6144:KEy+bnr+yp0yN90QE6Mi67Mo8+9B8ZRTRFixdQLQBY0z4mypmKhF0nsn47Drgal:YMrOy90hFs+gZqy+nlDrgal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290471, "uuid": "be8ab28f-3076-42e3-8830-df19a6aa225e", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290471, "uuid": "8177ed52-a4d2-4e6a-8012-41299817889c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290471, "uuid": "a9e732f8-a9cc-400d-9a43-41e97c919841", "value": "faa0280b386e475a854b6aee01a81bb8ffde73c74d60a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d694549c-2ab9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1690268815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268815, "uuid": "9b0c1b8e-2b27-430a-84a3-e515c1796fe4", "comment": "Malware payload (Amadey)", "value": "cc96b35c2af218ad08b2e704c92537c2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268815, "uuid": "472db5f6-b2b9-45ea-8008-64890865c127", "comment": "Malware payload (Amadey)", "value": "faa718c6bcc081bcba04005535885db98cffe363b4162bdb1479f13c34a519b2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268815, "uuid": "dcb45ad7-0318-47b2-a27d-e42d7dd711be", "comment": "Malware payload (Amadey)", "value": "6d8d754bc82455d0ee5110a422215176c05bd452", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690268815, "uuid": "41422085-9a8c-48b7-8490-f71b71171395", "comment": "Malware payload (Amadey)", "value": "e014f8854ed65da3d54e1f8c7dfcb7fd170ba66476e6b03b0864c585f75d4e72d009abd500f27af9846a9124b6b614a6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268815, "uuid": "d27d4259-3f40-4ec3-ae64-9e2a63ac1f04", "value": "T1F3840242FBD89563D9B527B069FB02930A367C629978822F2649E54E1C732C4A57233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268815, "uuid": "e6176045-0574-48ed-9e18-86bcea5fc735", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268815, "uuid": "2ec2caa6-1b12-44c5-929b-cf0d0ed3a7ce", "value": "6144:Kzy+bnr+Fp0yN90QE5Hl0j/hAY89gCZBE2hyQPZ0tgBZ+t4RDCYnPCeabrmINv:NMrhy90LF1YKg+EQsgBYCRnP/abrZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690268815, "uuid": "3a765643-cb1c-45d5-a915-93948850354c", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690268815, "uuid": "b7d1bfb2-dfef-4276-9bcd-1420f35ea837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690268815, "uuid": "b0052a24-4d52-46c8-b707-b8800b2e9862", "value": "cc96b35c2af218ad08b2e704c92537c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d295322c-2ac5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690273962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273962, "uuid": "d9649218-c205-4888-a430-e38058ea1dcf", "comment": "Malware payload", "value": "7f395deb9ee1059afd1346e30398109c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273962, "uuid": "97a9f2fa-9e30-497f-adb6-ac6cef3a634c", "comment": "Malware payload", "value": "fb326be98f23fb87856923d38676ce2357813f0bbc23d5508ecff7d3bc044db9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273962, "uuid": "e3c07b8e-5218-4357-97d2-ad0e91372541", "comment": "Malware payload", "value": "c477bca07bca01e8293600110d49a35aaed294e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690273962, "uuid": "bd71b47c-2e17-4a70-9bd8-dc19d761554a", "comment": "Malware payload", "value": "d6fd5f3299a7ebc528d8819803ef2768a0790040a384d1e695ab325fd4e0ff1a92b8983a0798b7fcf95b5ef0f930c60e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273962, "uuid": "4a505830-0864-40c3-bb88-4d29ed4e2719", "value": "T1C0839E227580C472C456543058A5CBB26BBEF83147B68D477BA81B7D6F303D26B7B34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273962, "uuid": "22175510-c371-4402-ad25-c7b7585463bc", "value": "5891cd3ae02424ab8fac5dd1162765a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273962, "uuid": "de9ad6c8-3091-4351-9e5c-823478c27392", "value": "1536:ubm6itK2l1RPl2PraJdUWNuiuoUnAfLkyW7lfJt5Dj:j6MRPlsHeCEhWNP5Dj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690273962, "uuid": "aaa6f19c-9f60-4cfe-bad6-88e5d15de387", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690273962, "uuid": "1dfe3944-363e-44f1-8ec9-25bad637885c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690273962, "uuid": "106aa01e-6c30-4ad0-a48b-2c9f32078ff6", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Farfli.12090.18254", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb8b1bb-2aed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690290944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290944, "uuid": "a394e878-d68d-4b49-b022-4dcf76f7de46", "comment": "Malware payload (RedLineStealer)", "value": "44e5ea88da9bef39445da639deae417c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290944, "uuid": "c83e939b-b2d4-403b-b18f-71a5408e1b6a", "comment": "Malware payload (RedLineStealer)", "value": "fb79180256004f1444242616f76df0de457835bb2feed439bea9d7365dbe45cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290944, "uuid": "98cec669-5ed8-40db-9c78-3d1582e7959a", "comment": "Malware payload (RedLineStealer)", "value": "0a272fd463cc97e0532982683161d4334da739cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690290944, "uuid": "4b7eb0cb-6835-4350-a9fb-9a158bd84f29", "comment": "Malware payload (RedLineStealer)", "value": "36859bb47717475c5b9229e6ee58a825c2e955910b85186874caf76ba467f5ae67a7bc66453ebad107dc72a1cfe3403e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290944, "uuid": "de9700d1-e395-4cd5-91da-dbb4d75f2b09", "value": "T1F384F102F7EC8473E9B12BB058F703C30A39BCE1583957AB6746581E4DB2594A97273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290944, "uuid": "7bfd992c-9723-4f23-a8dc-89be042c6a21", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690290944, "uuid": "72441c7c-8415-450d-b69d-a63725b26b16", "value": "6144:K8y+bnr+Fp0yN90QEo64TLoKlHc6e0ZaIYhSwdYPauvyKtXW9igbjV3Cyq3qDzwQ:kMrVy90S64N/anzdYhXm9i6VyP3Y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690290944, "uuid": "9b5b3a4e-d8be-4844-befd-2b9e690344d7", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690290944, "uuid": "5f9fdfd8-30c5-4657-ad01-efd3b5309d0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true },