{ "Event": { "published": true, "date": "2021-07-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-07-14", "timestamp": 1626307382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e8841760-e855-4588-bf3b-cee4d567c25a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd238529-e45f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626238567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626238567, "uuid": "42037a2f-2842-40e2-ba69-f6440b9d9c45", "comment": "Malware payload (Formbook)", "value": "1050db21a85b8504d97b6d326dfb9a04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626238567, "uuid": "468fcf7a-dcb1-4f9a-9795-f352d10f15d1", "comment": "Malware payload (Formbook)", "value": "024737a28fd89827c354f327a55139d53d31393e6fce0453063aecce11fd1485", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626238567, "uuid": "ef21dde9-bbe8-4b0a-b316-cf0b012486a4", "comment": "Malware payload (Formbook)", "value": "b3d0259732135628c03d00d785dcfd94142c322a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626238567, "uuid": "eb9a7670-82d2-447e-a399-28ba3690d575", "comment": "Malware payload (Formbook)", "value": "cf3a2d9d82a883b70515090df43d29be4faad8975487018aa7b7be8396c381902470d8c52be32509bb3cac0b02b73dd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626238567, "uuid": "9e5f27ad-b66b-4a42-bca8-f5f1129f187c", "value": "T1B09402342DE91059F57BBE7959F436468ABE7F233727D02C25D2035A0E23B40CDA2A79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626238567, "uuid": "fc6103c9-fdfb-4b6d-8d9c-895d96974044", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626238567, "uuid": "156f4b04-d0a2-4909-9ba2-3bdfb795f4c2", "value": "12288:6G2cMyx5lHtcco8Wchsoa4tQOcz8SfukTxjKKNj:92cXx5lHtcl8VtQeSfRTx1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626238567, "uuid": "f01695b9-72fa-488f-8b15-d6b6d965fc95", "value": 416768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626238567, "uuid": "cdc50626-c9ee-407f-bc3f-494cf448336a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626238567, "uuid": "034b0078-07f7-45ae-9b13-77e8c1a6efd6", "value": "OmhPINdzDvWAv5I.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341b3791-e4c9-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1626283837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626283837, "uuid": "007fbf8a-05b6-4a04-a162-bb230ab3f11d", "comment": "Malware payload (AsyncRAT)", "value": "4c6beca417e867b4a2c07355b82fd00a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626283837, "uuid": "f84ede27-4614-4191-a6bd-d102c9ac4526", "comment": "Malware payload (AsyncRAT)", "value": "0328b715326b840047bf68f173681c61020967e3cdff78283290dc2c50914c1b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626283837, "uuid": "2064eb54-9b7c-4f13-b755-e0503fc12cd5", "comment": "Malware payload (AsyncRAT)", "value": "333dcf21e951c7c15882d7f5ee23c7e860fcbbd8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626283837, "uuid": "97baccf3-2544-438f-a4d3-b610c46c5790", "comment": "Malware payload (AsyncRAT)", "value": "e4f157730c7c3e3fb1212ab6f6221f07f8a9b2fdbeba7f87c8095bc137fcd178217e511c5966f3109aa93b2b250b8c13", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626283837, "uuid": "09cab99b-3180-4d87-a5e5-b57bc2777897", "value": "T1C8E4F1253781B70FC62A8E7968911C14B3E0E7778717E3876CF336ED458E6A68F21192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626283837, "uuid": "f8b370f8-5675-4ec2-b725-86e7cdf2a30f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626283837, "uuid": "58303366-4e3c-4867-a17e-7fd0f65c4358", "value": "12288:y+m8LltHU7I4yTCJ7Ekh+voh7oB0x6Gmo2HvsfQSZE:B/ltHUMBy7hXh7oB0BdUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626283837, "uuid": "3ebde192-d57f-4f3c-8094-45db375783fc", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626283837, "uuid": "fb89e64d-1c9f-4feb-97d8-6d9b120d560a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626283837, "uuid": "281a70b3-b84b-4724-8a8c-6e420dd14cc4", "value": "Order0045439090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc65e18-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626246001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246001, "uuid": "84854292-700f-4aab-acae-f7ede8af3440", "comment": "Malware payload (SnakeKeylogger)", "value": "35ba060d1ca4ce012da59e5045371c5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246001, "uuid": "48802a53-8da2-4de3-8e84-4153cc828673", "comment": "Malware payload (SnakeKeylogger)", "value": "03967d677c32f73140c751257e6786a2144bc10cdb5856e0280a8105dc68ab35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246001, "uuid": "4b27b9bf-e09b-4c7f-bfad-e82f1bf503ba", "comment": "Malware payload (SnakeKeylogger)", "value": "a1700b56aac3ed0be40e3f93d8e6363d66f75c52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246001, "uuid": "3fa26a79-5697-4e39-958a-a80020d66e6b", "comment": "Malware payload (SnakeKeylogger)", "value": "4ab4a5d2527eef2a6693d51429bbfa2f850fecd58709b1200ab8bd4cd7a0e1b87ed64c27e3cb625c3f90876f5f1c0817", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246001, "uuid": "7376ba91-d397-407c-a760-0c87f560cba6", "value": "T1A7B4121472989C6EC1B54A720EA3A25407597C80B9D78647262CBF8F70B6FCD93B3B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246001, "uuid": "43dfda21-97cd-437b-a832-b33acfa3939e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246001, "uuid": "34d11047-1859-416f-8f82-fb273900c466", "value": "12288:QyAjWy3BGVTgURve8mL6h3j/kfbqHov+QuE6lo9L:Qh5RG9gUvp/kfbqWuE+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246001, "uuid": "2f94be49-fb90-495b-98cd-860366fad234", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246001, "uuid": "327fad69-57cf-43fa-9f87-9eb9b09d5dcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246001, "uuid": "1c8472c3-b9e3-4033-a017-e66e572904af", "value": "New Order Requests 15162006-RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e0a5e9-e467-11eb-875b-42010a9c0053", "comment": "Malware payload (Kutaki)", "timestamp": 1626241958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626241958, "uuid": "70d4240d-4f7f-4080-b121-272b0cccef1e", "comment": "Malware payload (Kutaki)", "value": "1ad183dc8fc9963155890aa0e268b4e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626241958, "uuid": "5b85e35b-10b5-4d20-9382-a6d182ebac33", "comment": "Malware payload (Kutaki)", "value": "03e649c10b7695e2884b7a356f96953e94814d2a77a678ac714a82bbbed70647", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626241958, "uuid": "62bdacd1-ea7e-48ef-a664-6c243daf3d5f", "comment": "Malware payload (Kutaki)", "value": "34bdb3cd2134b026e93c1ff0c3c795ebe83e04c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626241958, "uuid": "7f03013a-2eb3-4341-9835-8b8d5180ba9a", "comment": "Malware payload (Kutaki)", "value": "69252f77c8fe8609189f6156b92b645411ebddd6830bdcb3ef57ac639f9ec07e0e4b16beee72c94a0acffe32e9c9a6de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626241958, "uuid": "fd530b8a-d55c-4429-8e30-7c7da700da25", "value": "T12A350722F590A48DD9D64C70DEB1BA7A2C3D6C7614409A07B3D06E8835B26C3ADB5F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626241958, "uuid": "3cc98281-b4c0-4ed3-b6ab-051c192c6174", "value": "016ce302551cf81e7ac61a874e49da7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626241958, "uuid": "7b9cbc7c-df79-4174-9ff7-32dd4b999fba", "value": "12288:fovTacfXmrXm+NPsejgmFQ84yL46A9jmP/uhu/yMS08CkntxYRf:wvTJM2+NPsezFQ5fmP/UDMS08Ckn3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626241958, "uuid": "6860af62-848d-4254-907c-7345a062f004", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626241958, "uuid": "406e9a25-cc32-4eec-9e8e-713f10f6b207", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626241958, "uuid": "37cd3845-d344-4f99-b44f-3544e95d7885", "value": "transfercopy.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2337ff-e4c3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626281274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281274, "uuid": "b7173071-c4ad-4bc0-9717-4aefb2508a0a", "comment": "Malware payload (Formbook)", "value": "7fa7ddc6957d2b24810e70ea30f7ca12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281274, "uuid": "70467788-3cff-4c9c-bb06-93d3325b7a03", "comment": "Malware payload (Formbook)", "value": "0482660453d954673e8737d1b72241f69344fddc7ad4288e94f544cc2c6c5130", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281274, "uuid": "448a4406-f197-4498-833b-cdefa1e1d766", "comment": "Malware payload (Formbook)", "value": "ceaa663f29c23a3d792dc835c4f062eaebdde66e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281274, "uuid": "3fa77305-0ea0-40c3-904e-f3a4e33004b2", "comment": "Malware payload (Formbook)", "value": "3c3da4014e57d23ab4fa36bd297f034a518030a3b27e0f66f701656e5adb64a8d8305948ef70f684c8f351416ca74b26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281274, "uuid": "7b8ca1e7-5504-4096-82e4-705fbbbe3822", "value": "T1D4157C2923BD961AF233FE319F58E6445EE67EB55215DC0D28C4320B0471E41AEABD3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281274, "uuid": "bbee8120-64e5-415b-a141-1c4e0ffc04a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281274, "uuid": "dc540596-ae95-4bd0-9b4b-7febecb11456", "value": "24576:PlMfm7gq7z0xm1xYhBSYyDHxitaJxHJV9ccP:YqExqsotiGpMcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626281274, "uuid": "5b57b7d2-54e6-4f22-92ee-c085b9f46ee4", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626281274, "uuid": "0fca4dca-ca4c-4d1b-83ec-af97c30671b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281274, "uuid": "f93e9e8c-9487-4e1d-a059-d6dd6aca98df", "value": "7fa7ddc6957d2b24810e70ea30f7ca12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d53497-e4e6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626296222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296222, "uuid": "ad5165d9-2c85-4774-9b48-674bb8e9522e", "comment": "Malware payload", "value": "a7575dcc4c5a83b20e7be92429e5fff3", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296222, "uuid": "053acf38-7f62-40d5-a8ba-d4effa7cbda8", "comment": "Malware payload", "value": "049c1872e0355d768fab2bdbb1759527ff8074e0be5652f6fbada81d23f705fe", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296222, "uuid": "8e1c7bd2-f60e-4c0b-abcf-831fffaf546a", "comment": "Malware payload", "value": "e2c5d88b7b61f219edd229065ba0f17aa7edfec9", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296222, "uuid": "1c4b76f2-79f2-42f5-b872-ed10d60a2964", "comment": "Malware payload", "value": "bca46c03ddf08c6c06a2b97346b4175631c248c6a4a7fd9feb63cb2adf237bf07186f37fc69c896862120ebcd8e93d3f", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626296222, "uuid": "8184a508-bbe2-4adc-8dc1-091eb1bb2e9c", "value": "T1F5F458E5ABA4CDB5DB41C2718C9D1A5463B4CC118A09AFC77255B038FF3BB798E881C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626296222, "uuid": "cfa7f7c0-639c-4665-997f-a8c4cb3a4707", "value": "12288:HRYbXrlUc6XS/CwRl+4MW1H5onZHBDznxcp/c0UGtkbByxlFYd2DrpdMw:IUc6EjDMW1UrDjxcNcfgZI2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626296222, "uuid": "88e92417-db33-4a46-8e43-e47e8128e567", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626296222, "uuid": "3f24d8f0-0d27-43b3-8461-5447480b90df", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626296222, "uuid": "dbfe645b-5d1b-4697-a478-c2f99508b126", "value": "a7575dcc4c5a83b20e7be92429e5fff3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3608505c-e4aa-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626270526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270526, "uuid": "373adcff-82ff-4474-ab71-3228ed987d8f", "comment": "Malware payload (SnakeKeylogger)", "value": "1ca77bf28a6c972883350a1de484ab7f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270526, "uuid": "b6d4b54c-97d5-4227-bed2-84aa50fae832", "comment": "Malware payload (SnakeKeylogger)", "value": "04bd9194b93c6bd779d9506b6e0fa01a57d09e34abbb2a94563206f621611a73", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270526, "uuid": "7c20a480-8e90-48bb-adf0-738ed9ea1e33", "comment": "Malware payload (SnakeKeylogger)", "value": "65185838f0988c97ee6f3c691ff3edf0c8d96550", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270526, "uuid": "3be62572-a587-47a6-bcda-1131b6d40ec7", "comment": "Malware payload (SnakeKeylogger)", "value": "a16856926b36faa4a813255af94ec10392a38abf13e138387f6d9c18cca983fa8fefe6a314272c2389dea04b7c60ecd9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270526, "uuid": "f0bc3217-5dda-4008-bd97-2eeb4344b68f", "value": "T1ECF2A3ACD49702D88F05BBB86B0F6F41054D3A6EF798A672363C97356BC5CBA501283C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270526, "uuid": "f47e4798-fcd3-4421-bd54-dd6ffe43cde2", "value": "384:p0wPz8KFm+Aei4bYhjxc3lmmaFWFYNIkDZ:prJJiZzciFWFwDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626270526, "uuid": "ef798d00-2006-4b8d-a7fe-e5bff75d1c6e", "value": 37490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626270526, "uuid": "40e18f3c-ddf1-4b03-9ace-9e0396afd73e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270526, "uuid": "db2b5c15-2142-4279-a1a0-0dfd4b09974c", "value": "REQUIREMENT-DWG-454888_2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f930e011-e4e2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626294905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294905, "uuid": "f8e30f94-941a-4a57-aace-69388249fcde", "comment": "Malware payload", "value": "6eac93f907e5b905676bd99a7f947552", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294905, "uuid": "0262de7a-a6c7-4f18-b583-48356efe19a2", "comment": "Malware payload", "value": "0780d67931c09ff7844aac62d057c059ff029b93c35c436038afa65420f83a9a", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294905, "uuid": "37b254fe-b590-4eb5-8b53-7c99148438f8", "comment": "Malware payload", "value": "3d3d6e68d3a646ae0055ec7e2c90333800727689", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294905, "uuid": "be7e102f-ee8a-4fbc-a962-f4f55c84a13e", "comment": "Malware payload", "value": "13f6938aae7f54dc8296dee92b87579d7452c7f339f569f711717111991fdf0acc8759b6d01896f27683b494eba3398d", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626294905, "uuid": "4bb97102-1db1-41a5-b8bf-3f4e6603f656", "value": "T137F458E5ABA4CEB5DB01C1758C9D0A586374CC118A49AFC77255B038FF3BB798E881C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626294905, "uuid": "ef8dc8aa-ec31-49b2-afd0-5a12af01877f", "value": "12288:cRYbXrlUc6XS/CwRl+4MW1H5onZHBDznxcp/c0UGtkbByxlFYd2DrpW:XUc6EjDMW1UrDjxcNcfgZI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626294905, "uuid": "758d5fdc-c6f6-482b-b933-8a01403dc370", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626294905, "uuid": "15a6df85-e538-4718-ba66-9853e35c6dab", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626294905, "uuid": "719e6a62-b9eb-4723-abd6-8fe3b736a7eb", "value": "6eac93f907e5b905676bd99a7f947552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7b2d97-e46d-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1626244415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244415, "uuid": "72890e99-f020-4b2b-b8e9-ccb8ba3351b9", "comment": "Malware payload (AsyncRAT)", "value": "a208dc9a774f7ca9f5b258267183953b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244415, "uuid": "566c5e5e-3816-4d08-ad84-5f6771798a25", "comment": "Malware payload (AsyncRAT)", "value": "07afaa692f9b826c080cd9b1dc846bb8d6dc5404710241012f5c067d464692d3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244415, "uuid": "15e10b4c-68d9-474f-b8c8-2fcf727dce31", "comment": "Malware payload (AsyncRAT)", "value": "c1d5ccda7b0dcd9fad25b88123a7158b417fc698", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244415, "uuid": "051e2382-acd8-4018-a8d7-88ec534dd950", "comment": "Malware payload (AsyncRAT)", "value": "3d068d82230ecc350aeb645223547d88a59243fcb583838603dbad9fe07df16698076c25a4f472b54025a244847b9659", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244415, "uuid": "8a8e4e3d-1282-484f-b4dc-6233e3c79773", "value": "T155B4E0107784EB27C26A01F4C930D0F4C7B26E54DA52C25FDC9A7DAD76BAB858F26243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244415, "uuid": "e4a8ab2f-8293-4298-aa05-045931249f5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244415, "uuid": "f17bd804-cf6e-42a8-9683-9a29dab5a352", "value": "12288:ygwvLSl7RC5Q8XPobjqfk4PK0QKQgD7sckzmvn:eUsQQPoKMV9gD71Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626244415, "uuid": "f078d05d-e994-4064-a614-138191930314", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626244415, "uuid": "bc1822e8-32f0-484f-a032-8c59b32fcaa4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244415, "uuid": "25cf9ab5-4be3-45be-8181-75758ae305ec", "value": "a208dc9a774f7ca9f5b258267183953b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ca0c4d-e4b4-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626274960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274960, "uuid": "0b8815c9-ea93-46fa-98b8-b0a49b623c57", "comment": "Malware payload (Smoke Loader)", "value": "74209a168cc291c3e5502cc9637d5874", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274960, "uuid": "fe4054d1-4e62-4d01-928a-c81fa22a7676", "comment": "Malware payload (Smoke Loader)", "value": "08158e947e60d291cb15ea3f5d34dddaaf596225ee75f21b8789bef807e8c65e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274960, "uuid": "8de17829-5c20-462f-86f5-92f0a4d26f72", "comment": "Malware payload (Smoke Loader)", "value": "1b02b4ef81de9cfbcd4d1ec85e5b5a0b7079331c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274960, "uuid": "06dfbdbc-b734-424c-9b7a-d1cc0057ec9c", "comment": "Malware payload (Smoke Loader)", "value": "3081fcb96ecd2542886ec7751e594dbb385ca25958d3da2a79859e50535b6354c393cc8f48f49f95bb9d8c1a556069a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274960, "uuid": "dc213168-1957-4ab1-91d3-6443ed39487a", "value": "T10114AD2076E1D432E6E345346475D7A02A7BBD3226B0858F375323EE1F312E19A7638B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274960, "uuid": "c78ddcf2-2475-4f2e-867d-a0f5cc7d7cdc", "value": "cf8113cdf9d71dde8baf28192dd4ab3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274960, "uuid": "efbaa70c-e03b-4447-80cd-79279e72d07c", "value": "3072:DBNm9TXnW3Ot4EHKJ7TTKVrXJ0ogm5dHtJHVbN:NajWCqNT+NXiotHtpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626274960, "uuid": "0db2334d-d2eb-437f-a136-39fdf9dd687a", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626274960, "uuid": "551f42df-7028-485d-b618-d5544d79e958", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274960, "uuid": "c121aea9-f738-41e8-b523-775292be1012", "value": "74209a168cc291c3e5502cc9637d5874", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbad6ae0-e4bc-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626278508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278508, "uuid": "4856d463-2ade-46d6-94f1-8c7288ea5bc2", "comment": "Malware payload (NanoCore)", "value": "eb79049267ff4136078752873a808fe0", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278508, "uuid": "7fad3fa6-97c4-4fe8-b925-99bb5b04d471", "comment": "Malware payload (NanoCore)", "value": "08850fbf72cfca13717b548debdd9da9ddda61bb0d059c1242e72604ce076051", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278508, "uuid": "d0895b3e-f5d5-4d87-809e-d0b9b924f800", "comment": "Malware payload (NanoCore)", "value": "15219b14c3137e70ebd426bdd15197c08943406e", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278508, "uuid": "af35196f-c00b-43ba-b2a5-48768e643809", "comment": "Malware payload (NanoCore)", "value": "8ac2c044771e5bd5a5c00926b74d7bf6378d1e2891a17a074369196070e57ec8eab065eb193ecc183ee5ca3acf4dfd56", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278508, "uuid": "663b23dc-4421-4a12-bed9-83fe7d771e79", "value": "T1066512318D83FCA01B3C9631B18E7EED2D402D4F98F4A9AAAE5B319D199D5F1417BE10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278508, "uuid": "cf370d74-db28-4c88-abb6-5cd4137065ce", "value": "24576:GiS2n7MAjBigqF6WvkfAmf4isVOyefGDj+KQ8Gdze4Hplb:+2Y6WvkbAUyJJQzzeWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626278508, "uuid": "0c4fec27-032e-417a-8fc1-e558d890e8e9", "value": 1536451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626278508, "uuid": "5185cb1b-14db-468c-98e4-e2c658a4a6ee", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278508, "uuid": "683bf2e3-e6e9-47b2-b92a-e2f4458f87e7", "value": "Payment Order_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86eaa8e5-e4c8-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1626283547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626283547, "uuid": "3cb26ec7-28f9-4a74-a853-a15276390e90", "comment": "Malware payload (BitRAT)", "value": "b9af21495c0918c48a3b6af9d2683598", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626283547, "uuid": "45af7395-5aa7-4d2e-944c-adfe09fc13cb", "comment": "Malware payload (BitRAT)", "value": "0954364fc93fcfcc1ec2518eb732d150544c05ec5960667da080da7a08f9dc2f", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626283547, "uuid": "ccf7f367-2218-464e-a8e9-33b6c6b99a9f", "comment": "Malware payload (BitRAT)", "value": "3a42c010afc37d6eef5d590d4004cdbb6a105daf", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626283547, "uuid": "cf604180-7adf-43d4-8127-a6a1c0147ed1", "comment": "Malware payload (BitRAT)", "value": "35e3d9b7e520cae778d3e6fb038c567e2b7e3a9d0329777e3b024e4bf02047b04bd227e9c32d4da089c327aeb37f7ab1", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626283547, "uuid": "162d1745-f096-4176-b8cd-9b0f97029949", "value": "T19FF49E73A2914437D1731E399C4FB75A9D26BF012E28948A7AFC2D4C5F297C1392A393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626283547, "uuid": "11d43df0-6330-4ab7-8c58-43027fe23e94", "value": "38d16b2c37539891bdbf379fbde18675", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626283547, "uuid": "18154eee-16b5-4f54-a774-755f8ccf6b99", "value": "12288:MMzACYeU8tDGC/xRXzpU2YeJHsOHUgqBFDRVGt4qOeAhFK:MMMCnMC/xRmeJMQVqdVGdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626283547, "uuid": "73d3b959-3c00-44c9-9c22-031cd25273ae", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626283547, "uuid": "cc47fc8c-d392-4268-93eb-90d78215e6a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626283547, "uuid": "9978748d-df47-470d-9f5c-b3ebb598a4b9", "value": "Gpkbiihvipxqrytliykbcwvlsjxdtzpzai.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55109286-e4bd-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626278739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278739, "uuid": "803092c2-7def-44b7-9520-872deb62d3a6", "comment": "Malware payload (Loki)", "value": "dc03579868a3fe11a3562b610ba8f3b5", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278739, "uuid": "c8f6cad4-18f8-4e37-8eee-051f218f7627", "comment": "Malware payload (Loki)", "value": "0a52cf8d493d245aef7e0c311f5c69d5885212473ca6001d76860bbe2fa7abf6", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278739, "uuid": "6342af3c-8267-42b0-baf1-040f37548c2e", "comment": "Malware payload (Loki)", "value": "ad6655d6df04f05ce0a74825f9df4628f80924ea", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278739, "uuid": "d9189d70-0d07-466d-b05d-9af70faaf210", "comment": "Malware payload (Loki)", "value": "e33ff23221fd2c1b9981da9e63d2529a64245b499c2e1a585353b4584840f4469830041a959c0f87dc6188ecdbdfbf18", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278739, "uuid": "efebf402-a1e7-48e1-aa94-d928af89537b", "value": "T1A1D4232142CEA2AE6535F8A00C7C3B4B93519FC059CDCF73AA3512B1D4F1967B6AC29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278739, "uuid": "8248677f-5a76-415f-96e8-b323b89b767d", "value": "12288:KhbJ8klQxUCUMJllZSVwiBmvDVGlW/coPC4/VhlMH6XYQ6v:wV7yULM/3WwiBG4locoPVlMG6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626278739, "uuid": "841b20b5-93b8-44af-92b6-7de2291e08fe", "value": 651739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626278739, "uuid": "9b279b4f-bc39-494f-b5ae-22730dc4132f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278739, "uuid": "f4e59378-1476-45f8-af98-7f9fc104c2b4", "value": "Order request.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc8d3bd-e469-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626242753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242753, "uuid": "bf534438-6061-41cd-9d13-4cb4eedf48aa", "comment": "Malware payload", "value": "12482700bd76b50129acfdf1a5dbcecb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242753, "uuid": "f87ac94e-478d-41b6-9434-ac55c345eeab", "comment": "Malware payload", "value": "0ad1d13a0a43d140ee49060e2f20498e0bc42c8be9878e4e5d60ca5546191b25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242753, "uuid": "acb6d65f-2789-4676-8922-406e7da5afaa", "comment": "Malware payload", "value": "3ac1a26420308328be6a334a5f32009a12ac8b41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242753, "uuid": "328612c3-3dd4-4de5-8116-5817480773c6", "comment": "Malware payload", "value": "2785b3b2f696a70621d9f2b8ae3f1c84d58c95edd3ee7c9030f7fd4f176e1d544710861127c1d97d388e430a207c0aa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242753, "uuid": "6a515d3a-4c38-4942-81c3-61340dffd660", "value": "T179057B2C23FEA509F637FF719FA0F2449F66667A9229914E1DC4031B5821D80FE76932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242753, "uuid": "4c421aef-7f3d-4af9-867d-bf2de22f6c67", "value": "12288:lKW4FCpYM/dQkdU5p7V+JCEKnbWl+FBDQMnBzh1dXN5GnTOdU+CHpZsPjG:0LqR/dQkdU5p7VP/nbWl+HEQF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626242753, "uuid": "a740d1c7-94c7-425a-9c58-b15e1fd23c6b", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626242753, "uuid": "5951ab37-9cc0-4844-bd3e-c4a2849263d7", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242753, "uuid": "8176a07d-bd64-4c23-899d-d1df335342da", "value": "Quotation for named specification new order.tar.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5e681f-e4df-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626293325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626293325, "uuid": "bb4a6209-2e49-46fb-a94e-0388e11d1950", "comment": "Malware payload", "value": "0006e15486d33e1e6e6a8731e5880612", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626293325, "uuid": "0e742cb9-5203-4ae0-b835-26b440f870db", "comment": "Malware payload", "value": "0b95c91f6e73b5c87727bba93de2f435e6695ad884b9faa932df5cb3357e0d47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626293325, "uuid": "1ce5594d-42c9-4365-aae8-34142400eb7f", "comment": "Malware payload", "value": "2860186797c3167e80d9c1b87fb1e5799af13328", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626293325, "uuid": "aaab1f3a-d576-4cc6-94a2-d75c238946b4", "comment": "Malware payload", "value": "c50fad14258cd78d583c72103ac0aa68ed060a50b70369aa209bd342deae208240744243811a6bf4570e2c6cf2187399", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626293325, "uuid": "3af60704-ab2c-4e7f-bf8f-71564345c2c4", "value": "T1B3A49E12B8D1C032C17222700D69FB759ABCBE20293545BB73D92D5BFE711D1BB2A663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626293325, "uuid": "87cde919-b4bd-4a73-9002-dd070c7d2e09", "value": "409f5d6d64eccf1b9873a7c796c3f1ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626293325, "uuid": "3c4a1906-618f-4db3-8ee8-ae5a2d8b3e27", "value": "6144:Uc53ezqVrhiBZ84M/k22nZcrTEfCNV0cjd2shWR5dhTAOZZ8jXCSrcD9Fu:v53ez1HzMc2k0EKNV5dlE//Z8eSou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626293325, "uuid": "78325dc1-c52f-44a1-8529-b46a7872c6bc", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626293325, "uuid": "e53dc4e0-620b-4956-b456-1fc0d9ab9125", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626293325, "uuid": "97372bdd-0b1c-47b4-8f77-c659b742b6c1", "value": "file2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c5c8b9-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626245996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245996, "uuid": "bc345660-cf4b-4e39-b449-f31d519dbcd4", "comment": "Malware payload (Formbook)", "value": "07a608b212a9c742d09eeb06fc5c9c33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245996, "uuid": "3a090bde-f270-4093-a1f2-365ce14500bc", "comment": "Malware payload (Formbook)", "value": "0ba21a458c54d5e18218ee2cbdba20f6130fd55ab0951db770b3882e773a8917", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245996, "uuid": "ec7ce4ac-a12a-4ac3-bea4-3a1da477f6c5", "comment": "Malware payload (Formbook)", "value": "41eb18e40c3e1b1ad64094de545d161577c6ded8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245996, "uuid": "2c79000c-a1c5-4209-8b1e-581f8344bfbc", "comment": "Malware payload (Formbook)", "value": "04ef709c3dea1bb1ff6c4645d7b5b29c03993c57f49ee94e51350644f6e97cfe1afb93284584b7dbfde7530fe79319fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245996, "uuid": "dd94fcf8-24ba-4b35-b3c1-7de00855fc5a", "value": "T1E7057C2C23FEA719F237FF319FA4A7449FA666B59215DD0D2DC4020B4821D81AEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245996, "uuid": "854406a8-3db6-4cdd-98d6-b02ff7d30eab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245996, "uuid": "76980a14-7041-4063-ac97-74e6c94f2b20", "value": "24576:f5vt4Qc7kYVyDyuU1htqs5Ix1uh8IQMn:yQYVM/0jEx93Mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626245996, "uuid": "fc5cd84b-cffc-475f-80f5-a0b4378ed769", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626245996, "uuid": "53328c6b-46d3-4483-871a-4ef49e3db573", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245996, "uuid": "8cea27a3-b47b-43db-b6a2-5fc44fb93b12", "value": "request for quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ce5ed0-e48e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626258421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258421, "uuid": "436593fe-5b33-4589-bcef-8df3de1467bb", "comment": "Malware payload (RedLineStealer)", "value": "ee8eaf19a7dc7566de81f80704649d3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258421, "uuid": "630033e7-3c9c-4e8c-88b9-548dcf310062", "comment": "Malware payload (RedLineStealer)", "value": "0c482db22cf1dc6dbc6ee7b678f98275db291fedfe42c4c0413141e00143a882", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258421, "uuid": "ffe90381-8bfd-4067-ae09-2dfdc26cc55c", "comment": "Malware payload (RedLineStealer)", "value": "89075ec02747fd84f36f532244e77ee105893b92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258421, "uuid": "af8298e9-ac49-4806-9704-aee331d86bf6", "comment": "Malware payload (RedLineStealer)", "value": "172b4f0e99f4902d299f64154cb31967cee20f1f6292eb4da8e39b2c56dbfae7cea3ff79a3017ab7d33d7397ba19944d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258421, "uuid": "cd6f01e7-6142-405b-84a9-3e3fb02ac020", "value": "T1AB345A89A3D46E59D7688B7994D1F27E47B89C011289E30704C03CE73E79BE6AB059F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258421, "uuid": "33620e0d-3919-449b-a15c-24d6ae2df2eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258421, "uuid": "52b385dd-42a1-4e4d-9d6b-d2364c2edb6c", "value": "3072:9+n4IYU5ImowjbfeeYXxCa8/0lQY+IRYpeLRYpsWK8JdZvti77UaDvSU33D5:9+4IF5ImowHWeYb8clulpee9DvEND5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626258421, "uuid": "292c015e-9800-4060-a588-1920af5f560c", "value": 244440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626258421, "uuid": "0d0272d2-d15f-427c-8a1d-b3187b3d75c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258421, "uuid": "ff22b9b1-8e24-4d0e-bcd3-c08553d85e86", "value": "Minecraft_ver3.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f78cfd-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626245956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245956, "uuid": "dc345385-4126-42f9-bf6e-b2a4b3e041c7", "comment": "Malware payload (Formbook)", "value": "5ff606d405a300a6db97d4566ef964c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245956, "uuid": "03197876-adb8-4f45-901e-ff67d71a2139", "comment": "Malware payload (Formbook)", "value": "0ca2057436fdbfcc1ca65bd6a9742a7f810c06f3e4e382d8306c4ef96da5a42c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245956, "uuid": "a4c8d4b5-84a3-4705-84b4-bdc19b2d1d29", "comment": "Malware payload (Formbook)", "value": "3e64165edd0f550b245d3b68cf094643f4d625ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245956, "uuid": "debf92b3-a423-49bd-9dc3-fe07ad6e6b71", "comment": "Malware payload (Formbook)", "value": "aea741d6abbafa45abbeae456a416dab6e0d1810199ec7335d57f865f213d132635a6674534f06aeebc1675fd0cc28e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245956, "uuid": "d59e964a-e868-4b14-b37d-cfee66cbc060", "value": "T11D058C2C23FEA709F233FF315FA4A6489FA676B59215DD0D2DC4024B4861D81AEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245956, "uuid": "78d69d59-2336-4d32-a557-0f95ba058172", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245956, "uuid": "917c0d0d-95e2-4b16-9a20-ca6029282cdf", "value": "12288:FP+tUNfrNls9XOd4+QCYZip9kCZEEuP8wMZR+fbXSaLIKzInyEnCTKqDzu0wJ5yk:FPoSKEuP5Mb++aLIK8tnCTKqmtDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626245956, "uuid": "bb5dbb8b-86f4-4131-be5c-b4cdaa67cf60", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626245956, "uuid": "b2351b83-19ca-440d-ab8d-d6f577cd0424", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245956, "uuid": "7cb06b92-fdc8-4f9e-80e9-9d1c30913a17", "value": "Requiremnet -Jun-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd634bef-e4b4-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626275048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275048, "uuid": "ef53ab49-97af-48e6-a263-3f53ffe0528d", "comment": "Malware payload (TrickBot)", "value": "e56d997f6ccb5a0fffce55209505b534", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275048, "uuid": "a31f1d24-9d97-457b-9c90-6c40839a7c23", "comment": "Malware payload (TrickBot)", "value": "0ce35408efa7b3eb61f3f1c777c7de9c460528953abe34b4753f4666be6fd9fd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275048, "uuid": "3ad8dd4a-d271-4078-afe8-9072ce3c8544", "comment": "Malware payload (TrickBot)", "value": "bd43a71f70a7b432052d8a5e8199999387c532c7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275048, "uuid": "7aec0e19-3455-4afe-830a-03274392c0ea", "comment": "Malware payload (TrickBot)", "value": "bf1bbcede176faa105b41d50d5c4eeae1d3f84606d7d0a672558f08cff72e291123d896aa6fa80ad3ed865ab3c68cdbd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275048, "uuid": "61647382-e4c5-4f8b-a294-9ec5fb9bff30", "value": "T108D37C91B3C034DA064277F7ED1B70E2E8BE5441625D005AE44939ADAAC5EBCC3FDA39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275048, "uuid": "4ba87d89-7f6d-4d31-a7f0-72204156f520", "value": "3072:H/XXadpqzJs7v/TD+CRJew0Ckg4loTe8fCKJYL7oqazOkBNL6mDPxkG3bBCqIXKx:H/OEzItDkBWzIwqdkCmD2G3tCHKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275048, "uuid": "85a28119-22e2-4ed8-adca-4aec9f9e2afb", "value": 135524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275048, "uuid": "5aa9ed20-5e71-42be-b990-00b89573c20a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275048, "uuid": "d91f82b4-a65d-4208-8ce9-55375500e3fa", "value": "Vio_Reports_694974332.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ab8d29-e4e4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626295698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295698, "uuid": "c4dd8920-5948-4a12-80c9-0f9520249290", "comment": "Malware payload", "value": "9764cda4e04b0760f9bb11cc35c1e079", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295698, "uuid": "34c5be07-5c8a-43f7-a536-0354b16f1d6a", "comment": "Malware payload", "value": "0d764c637b4517a676e542e309df6f0df0c0013d6029e1618a5026716f60280f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295698, "uuid": "c35e2a06-d3f1-4819-9c31-2f5907bd6bbc", "comment": "Malware payload", "value": "8f55e1f56929b8fdd0068ba7c6fd47606fa3036b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295698, "uuid": "8f755dc9-ad58-4151-991e-9729d974d80b", "comment": "Malware payload", "value": "55a304f415fea466d0916b0c298f02a9166dff05be2051b6aadb96387796f6178d2a79e2819d73a2680a524da6c45261", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295698, "uuid": "815ec47d-07e9-4ea1-bab6-786813ad8a27", "value": "T169A31A5AFB808F07C0D22775BADF42513323DB55E7DB23065628ABF43F867AA4E22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295698, "uuid": "bd89b698-6822-4fa9-bb6c-ef6c927176d6", "value": "1536:jAnA8J5A0E/UdhO0kWs4alfEiVTWfBGeiBT3AJCwPwzzw/9bK0vmsifgs:QJ+0E/UdhO0kWkbTUKBT3jwoM/9yIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626295698, "uuid": "64a5a576-27f0-4407-9e13-705132aa655e", "value": 98353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626295698, "uuid": "9dc9701f-5b7a-460a-b4b8-e137d6316130", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295698, "uuid": "8ddadec1-44eb-4845-bc6a-35c18f6348db", "value": "9764cda4e04b0760f9bb11cc35c1e079", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebd6c33-e4f4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626302511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626302511, "uuid": "540f115f-f950-4b23-8487-8a65bbb61c12", "comment": "Malware payload", "value": "c48b5c85e36d3c42ad221f1a245a765c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626302511, "uuid": "d00c11f4-8d04-4a87-9190-705347c94571", "comment": "Malware payload", "value": "0de463f33f9f9aaa92f3440b1d17eeb4e42366ac8e5ff664349c5d54f97fbac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626302511, "uuid": "e699b344-bb8c-4de4-abaa-d6ff62b0dd12", "comment": "Malware payload", "value": "7434a2c2fc5993f8771993da4348e4fcd0f322f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626302511, "uuid": "d356cf11-78da-4d6d-ad84-23bbf4cc33da", "comment": "Malware payload", "value": "0374cd1bda5dd7fd8030d3deb3200a31dcd4840e17c8ce3b21bbc016e6c0c67835b1d914910c624efbd154dbed558faa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626302511, "uuid": "74773ba7-1141-4d0a-9ba0-bcbddb260c0b", "value": "T10F15AE2D23FEA649F63BFF31AF95E7449FA627B942159C4D18C00A472420D82BDA7C35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626302511, "uuid": "52101522-dc67-4809-9a04-dd7e189497df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626302511, "uuid": "af4cb0c7-cc15-4bce-a094-244b71cacd6c", "value": "24576:/XyNUgraQurQHfJZ0zS2YGzc263AsXs/:ON1JZedY263AsXs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626302511, "uuid": "bda96756-2d4c-4004-b799-277d5bb83b83", "value": 933376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626302511, "uuid": "0a4d3c02-c26c-46b3-a9a6-3fa116544486", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626302511, "uuid": "2570d804-1f17-4e0c-87a0-7ddd7e433c37", "value": "SecuriteInfo.com.AgentTesla-FDAHC48B5C85E36D.20365.24995", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f04aea-e4d3-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1626288377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626288377, "uuid": "e61d82eb-d618-47ba-8952-d10ca543ef70", "comment": "Malware payload (QuasarRAT)", "value": "479fbbee11e96a6c1051204071ddfef2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626288377, "uuid": "42949218-2215-46a1-aad7-c0ee2a55cfe7", "comment": "Malware payload (QuasarRAT)", "value": "0e9337afa6d108d1f0b317f03d48195c5b163319bd9858a96081dfdfb1fd5269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626288377, "uuid": "89fd63f3-43a3-42c4-b397-828b6db632be", "comment": "Malware payload (QuasarRAT)", "value": "13db779ca29e73b0c04866381a08f2b7afcf4e2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626288377, "uuid": "801f9a2e-bd03-4e24-8d27-d8806709c992", "comment": "Malware payload (QuasarRAT)", "value": "a2c234678de8df193e2a76e80bfe25f6cc0e4db3abb0e33ebfd92ae0bc6e6329293f3e11eca9d6b81a86ff2f27157161", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626288377, "uuid": "3279883b-7149-4217-acbe-f05035e8be75", "value": "T11AB47B4063F8862BE17E5779E97104209BF5F42BB267EB8F5540A2F92E667038E40773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626288377, "uuid": "6ae508fd-e1e2-469c-a32b-fc623641f202", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626288377, "uuid": "e6c56085-8746-40f0-8fa6-7f8b683cd28b", "value": "6144:MTEgdc0YiXAGbgiIN2RSBBQ11QhKG78hMHisBVEcEtGb8F9UHFs+XcTR36:MTEgdfYYbgStGAr4WdBmls+Xcd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626288377, "uuid": "54ce7c3e-64d8-4f8d-8160-e37c17ae122a", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626288377, "uuid": "9ff8c683-face-45ec-8a45-55bc908cedcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626288377, "uuid": "cd5dfd54-dd15-43e2-9658-b0475179d535", "value": "0E9337AFA6D108D1F0B317F03D48195C5B163319BD985.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a472b13d-e4ad-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1626272000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272000, "uuid": "61bcee80-245c-4b52-98d2-01fc7562e72a", "comment": "Malware payload (DiamondFox)", "value": "4ab86ecf57745c9e783700043a906716", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272000, "uuid": "c2b0b5da-f910-4725-a34d-4991418dbff9", "comment": "Malware payload (DiamondFox)", "value": "0ef2423530764d0f9a745e60c251176c903929d958ce3ff1c22a6867c97bbc13", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272000, "uuid": "470eb25f-dc93-4d0e-9c13-3aefc0bb1b96", "comment": "Malware payload (DiamondFox)", "value": "a393fe0edecbd9f8595d9994a6d72a8f72cc78e9", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272000, "uuid": "b710c963-23c6-4aec-8b83-68a22dbbd2bb", "comment": "Malware payload (DiamondFox)", "value": "54d86c59a53a72a74fb5681415d95cd3a22f610f8e67e0359a4100516d8717a6ec00d090d77edbd68476d2620b505f25", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272000, "uuid": "59c18689-029d-4d6b-b8de-9dfb3c944945", "value": "T1B0F1E70AE7E50733EDAE4B3EACB3132053B5E7095C53DB5E68C8425A5CA33441A92BB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272000, "uuid": "eb5f6dce-2ac4-4e80-b660-1a08397f234e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272000, "uuid": "6462eaec-a2f5-463a-a1da-d53de8daaa84", "value": "96:ZyJOuTNNLXqqCWV2sLZS4kdtKozt15Lf3BKEzNt:Z0Tj2qH39Gt35Lgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626272000, "uuid": "3127692c-59b1-46fc-94cf-b696a1bc289c", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626272000, "uuid": "519887f0-2835-44fc-9ef0-d1ca019c28a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272000, "uuid": "f29fd227-f3bf-45e2-ab7d-a89faf4503f2", "value": "sahiba_4.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa858999-e4a1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626266990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266990, "uuid": "4511ce78-2f07-4cc4-a7c6-9549f818b570", "comment": "Malware payload", "value": "88df8fe04bd2455edda904c184e76bbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266990, "uuid": "41fbc593-da36-49e6-b5bc-a5dbf0d896a0", "comment": "Malware payload", "value": "0efede052fca74dc235bb22dcb3881a21653b95e115d3badf0145fd5f2bf0f3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266990, "uuid": "88edf675-9be5-427b-8fc4-a811ddd96bb0", "comment": "Malware payload", "value": "bab8399ee5641a2621eea182fb4ccacff1caaa5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266990, "uuid": "fb0baab3-dc67-4f48-a669-c8a8d20e8420", "comment": "Malware payload", "value": "c86899e79c839ce34416bfae86f7e897fd40a14d4f37b78403487f5a6ae3494ed6933a5bf6915a1daecc79b87055d00b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266990, "uuid": "f42f17f4-ceb7-45e3-bb72-3df145f49cd8", "value": "T1002172A3B580AD59CF18E73C89B146517B02E934C10FE3CF4E0852BA193B2CCAA900E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266990, "uuid": "f869e24b-0890-45fa-a7d5-95ab795f4e5d", "value": "24:wqLkAdGtSnUpzzbBWpzmIdWKBB5gDrmyvGokC7m17/3wNfm:wqL7dxnUpzzbBWpzmI0NDrmyvGo7727X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626266990, "uuid": "1667cbdb-667e-4b77-abe4-6130f676563e", "value": 1200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626266990, "uuid": "767ca9a4-7618-491d-8b94-ba76f1f591a5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266990, "uuid": "00a8129b-5f49-493b-aa74-4b859a800dfd", "value": "88df8fe04bd2455edda904c184e76bbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1fb49fc-e4d6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626289632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289632, "uuid": "75c85093-06fa-4c11-a753-8a272523866b", "comment": "Malware payload", "value": "f21da7e3e7593be2c70759c67c95bb66", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289632, "uuid": "d2f6c023-4e0d-486d-8e09-a9e2ba675948", "comment": "Malware payload", "value": "1082724aab36b71b4dc71685776a7c8f5069dd4c269e514eed362af80e1e1450", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289632, "uuid": "4a1d17a9-35dc-4e78-a6f0-798cb6843fab", "comment": "Malware payload", "value": "7c404193ea15880cd26f1d55dcd6ff392662275a", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289632, "uuid": "992404ba-4e0b-4c8a-bb9a-9bc4303fa975", "comment": "Malware payload", "value": "9736dd0aa14689ed2569ca0ee6ce831042ac4b902e77527d7eed824f8ea2c252be1729f3707ab42a45d79250404379ac", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289632, "uuid": "a6e0a013-c0ef-4c37-ba53-02589df3885a", "value": "T1A1F458E5ABA4CDB5DB01C1718C9D1A586374CC118A49AFC77265B03CFF3BB798E88186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289632, "uuid": "f3288473-e2de-4792-8a52-578d06f06c66", "value": "12288:4RYbXrlUc6XS/CwRl+4MW1H5onZHBDznxcp/c0UGtkbByxlFYd2DrpjA9:bUc6EjDMW1UrDjxcNcfgZI2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626289632, "uuid": "1f86cac0-a513-4f45-aed5-6ca4482a9f4b", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626289632, "uuid": "b3cfdd30-5517-4a3d-b833-b91ab1b92d4f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289632, "uuid": "b098e741-f3f8-4679-a288-b4a47586fba3", "value": "f21da7e3e7593be2c70759c67c95bb66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc77dbe-e470-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1626245949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245949, "uuid": "831f5071-90c8-46be-a579-c27a7f9a1d10", "comment": "Malware payload (RemcosRAT)", "value": "997cf191ceee4db3d8ef5f7b09ec6dc5", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245949, "uuid": "5d1610ab-ffd1-413b-99ed-7231a9fe9d2c", "comment": "Malware payload (RemcosRAT)", "value": "10b545269b6812f82c5b633bf97292a76069619e72bb6b4eaae315b874d4d6e6", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245949, "uuid": "43925b0e-49c2-45ae-81fc-9dd79b0a06f0", "comment": "Malware payload (RemcosRAT)", "value": "eeb937060f988f8d05939362212f9a0317bc5cc1", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245949, "uuid": "4ee8b0cc-f0c5-48fd-90e5-c12cc1432ead", "comment": "Malware payload (RemcosRAT)", "value": "521cc04a904861304e3baf40fc79703997cef08442691b3549464a0cc4b4247556878e18e3e1d21fbb6035cc03274bc2", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245949, "uuid": "0da0b936-7f85-441a-ae8c-d0453ce0ae99", "value": "T11BE4127953647AAFC37E54FE2402360000FA8556A253F797EED425BD83CABD397442A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245949, "uuid": "e587f49b-e20b-4623-a36a-17181233fa8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245949, "uuid": "83266817-53bb-4486-ba40-361e130948eb", "value": "12288:n/2iNVarKd43vXUqtJ8k3d8JlNf0cPF0G3ayjp28umOA+qfw2y6Dq:/1famK3vXUqnlsfpPxxx/7Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626245949, "uuid": "453b4c50-90a3-42de-93cb-4491aab59d73", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626245949, "uuid": "ae73cbdf-744b-4a1a-b9af-f6623ff38615", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245949, "uuid": "a5ad5e55-f685-476d-b617-5a6dc0ba9da9", "value": "Extracto Serfinanza_01825005_23830568_4944438178301257_63213297_87082788834282550874_223975030908.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a948981-e4d4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626288626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626288626, "uuid": "e3557b70-9bac-4802-affe-df94814cbcde", "comment": "Malware payload (Mirai)", "value": "81c7e73c28bc3c9c93a946a90b8ff2cc", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626288626, "uuid": "5ac3db86-65ba-4912-b99b-0db968e0b386", "comment": "Malware payload (Mirai)", "value": "126e080be90c41a3197675b10d712b1aba3d93a941700275c3314b602f89c394", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626288626, "uuid": "a283aa00-3743-4585-b4c7-d6208eec2637", "comment": "Malware payload (Mirai)", "value": "2c1d0c499e142572a722f01f509af7b240f1f612", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626288626, "uuid": "79f403e7-fdc5-474c-9896-8f556ebdee8c", "comment": "Malware payload (Mirai)", "value": "3a129996a7486178a8aa77452ea727fb3343fa734e4abe3a7d0d8562279d0c76727bde55ca27ee47a385b58fe2a0f53e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626288626, "uuid": "66cb8b23-7c76-494d-b161-f063aaa69cc2", "value": "T118530747B44180FDC149D03443ABAA76C8237EBD1B3AF39637D4EE3A2C6AD221E59C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626288626, "uuid": "9f4e1f58-92d4-41db-8410-e792c7469cb7", "value": "1536:anF9U0FferGtOW4/RWo4Pz8kkRqwdhJOlQ5M7WR:0FK0UrUO3JWvyRqwdOlr7WR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626288626, "uuid": "acba53e4-5fcd-4e40-83dd-de8e63c79cab", "value": 62720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626288626, "uuid": "b9b32346-147d-4f13-8a85-d77f7e48face", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626288626, "uuid": "ea453836-cf91-4bad-8042-e4db0497f79a", "value": "81c7e73c28bc3c9c93a946a90b8ff2cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbfbad83-e469-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626242834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242834, "uuid": "29875044-aba6-478d-bcab-9ddfa757d561", "comment": "Malware payload (AgentTesla)", "value": "de808aeb61d13e184d0df2096585d9d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242834, "uuid": "9c91b95e-8c65-404f-88a4-06f05687651b", "comment": "Malware payload (AgentTesla)", "value": "13405733452400f608c46a12b2fd877d1e56e81dc63ed52ac384efd0da6320ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242834, "uuid": "fdd7a848-62b3-4bae-aaf4-279520ca65a7", "comment": "Malware payload (AgentTesla)", "value": "c44298a2cb95ea3faf1cbd5cbc08d19ed1e91214", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242834, "uuid": "780ebf9b-6428-48cb-9065-5937f4f12b57", "comment": "Malware payload (AgentTesla)", "value": "8f6e848a5b6bbd19d3b16e81f5d173a9abd98b7c8f1d396237c047df83d1f0fc23c4d77fbeb7f2b347c69445de7f91c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242834, "uuid": "e13e22d5-6d9c-4060-a5e3-008cf633eeeb", "value": "T1257319CD965837EAC22DFE36349EBF1273A052336594863F1184718377527CA1ACCB6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242834, "uuid": "9e7c91bc-1512-48ef-9de7-ce016e8f8385", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242834, "uuid": "c444610a-7711-4d1f-8de3-e0afc067f351", "value": "768:5SvgoztM5Dq4iZlRLc+/PAXALNV2jbYp1A0cCxJpUGflVtTntE+hYT:u1z+5D9glB3YwWExdZni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626242834, "uuid": "478c30b5-73de-450e-8cb9-afb2a19fea6a", "value": 77560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626242834, "uuid": "8f102ab7-7620-4309-8ee0-3458e1a1fad1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242834, "uuid": "8c5b2ea0-49f7-4076-acc1-6ec381bc6b31", "value": "3278_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f961fa48-e4a3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626267847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267847, "uuid": "7c58f375-da57-44b9-af7f-097cb62d66a1", "comment": "Malware payload (Formbook)", "value": "e09b0dc54b0f1a0503c10a1795a250b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267847, "uuid": "1e00cfb7-07e5-4de8-8e11-c0f64675a09e", "comment": "Malware payload (Formbook)", "value": "1357e85e839e2ccd1128c409855469cc8367fb33ad606e3bd1ebd5eb08de39da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267847, "uuid": "101f7c42-090d-443b-9a5d-6fe714067c97", "comment": "Malware payload (Formbook)", "value": "186cae0deac5b50cbbbab1ef7c1e905094f39d7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267847, "uuid": "b467440e-64d1-4eb1-a7b7-ccc11d1e134c", "comment": "Malware payload (Formbook)", "value": "0d8824aa94cc1045bbb7ccf5a83d354b6d481f3e3c582f6d49409a4aeee044c45f399b2da4a2f91278990ac26ab17253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267847, "uuid": "b716de34-9f37-448d-8767-96856acf8460", "value": "T168058C2C23FEA719F233FF359FA4A6449FA666B58215CD0D2DC4024B4821D85EEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267847, "uuid": "6b3a21e0-ae45-4dd6-af8a-388e960e0c1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267847, "uuid": "2758002a-12fb-4cb3-8b51-b25bf7a79df9", "value": "12288:yMgrtarNls9XOd4+QChzx7SV+iwGT9ojb0x7FLq6o/dt9Ggyr02XPNCtRU:yMx9S2GT97ZLBAdvGlrnXPc7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626267847, "uuid": "3b68f60d-fb61-43a5-aea4-f3981d3944a9", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626267847, "uuid": "77e2d748-655e-419e-b632-4fdd0db3c567", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267847, "uuid": "6dfffce9-0027-4969-beab-5305fc025833", "value": "QU7142021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca09461c-e4ec-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626299121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626299121, "uuid": "173167e5-f15a-4707-81d0-632419fe3f70", "comment": "Malware payload", "value": "f92a895f8781cd98115c3cb123301e1c", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626299121, "uuid": "6d64ca24-88e1-47ff-ae6e-9648f0e5a2b3", "comment": "Malware payload", "value": "13a8c58e52aba7cfb98f7efc413e91cb707fae63404821a678a15d671d00b944", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626299121, "uuid": "0959a004-2ae9-48cc-ba94-50f2242d2a1c", "comment": "Malware payload", "value": "22a605bcef9fccf255ed0175beecaa3cf70426f3", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626299121, "uuid": "0c07322e-5779-45a1-8d30-ed8bb818d6e2", "comment": "Malware payload", "value": "930c3bcebc5f11149dfc80a5692bb94414bf7f6dadf70eaa22a4fea4f64599d66a2d910060174bf7b7fe9e68c55fa01a", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626299121, "uuid": "a0a46396-59d9-475d-b2c2-d84ea6560979", "value": "T185F448E5ABA4CEB5DB01C1718C9D19586374CC118A49AFC77265B03CFF3BB798E88186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626299121, "uuid": "fb5b3f47-015d-4c9e-a245-3b3efd758707", "value": "12288:XRYbXrlUc6XS/CwRl+4MW1H5onZHBDznxcp/c0UGtkbByxlFYd2DrpGsPk:4Uc6EjDMW1UrDjxcNcfgZI2LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626299121, "uuid": "3085c090-6d92-4167-8d85-4c6e9de5d326", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626299121, "uuid": "7e472663-a6b3-4777-965c-fde75b1cbaa5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626299121, "uuid": "ea10a294-4c75-42e2-8c91-894191a846b5", "value": "f92a895f8781cd98115c3cb123301e1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218f49f9-e491-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626259754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626259754, "uuid": "1b514e0c-045d-4327-91de-7ff516959182", "comment": "Malware payload (RedLineStealer)", "value": "57f367e007e1d4ac008b2cb2b9acf69d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626259754, "uuid": "450c03e5-69cf-463a-a12f-d54cb2c2fbcb", "comment": "Malware payload (RedLineStealer)", "value": "14754f307601049ba389cf7b9536db2049193b31f05330c7b6d4cb5cd8fa081f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626259754, "uuid": "aa1c3961-fcb7-4375-86ea-aca5633a87ed", "comment": "Malware payload (RedLineStealer)", "value": "f374b9f2e2109c721f61bdbd62b6580803a7fd2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626259754, "uuid": "76743971-8d09-4bdc-970e-934e4aaef7f6", "comment": "Malware payload (RedLineStealer)", "value": "d1b609483b046b4191410a47d94f46f2f649b6f49d335adcda056f7da4febeed78d7c0d6a0b918e42cc3eafc138b9b3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626259754, "uuid": "4552afa6-0c6a-499b-83b3-59d68ab0674a", "value": "T1B6163319419E8EABE1D8DC3DA0A1D73FB9886F55037D4154E3E63327CAFE6640927B20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626259754, "uuid": "7173e349-d52c-4d51-b1f1-bcd6156b1e4a", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626259754, "uuid": "4c911403-7924-4b33-8b05-77f6674d7204", "value": "98304:HPQ9jxNqxUIj9nULSI0nQkn1u2HeEE3pGiWcGsySDfyw6YHCcFPwSvdiLY:HW3mSyQMM2+EE3pGgkS2gZ4gMLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626259754, "uuid": "56a8521c-ed7f-42aa-8174-1d46334dab2d", "value": 4098989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626259754, "uuid": "cca4cd3d-02bd-4c25-ad6c-22ef8307b4a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626259754, "uuid": "391201f1-5aaf-4b4a-afe9-fbd807c736f3", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb9d224-e483-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626254054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626254054, "uuid": "d65f0b2d-bbcf-44b3-950f-f67f4052a989", "comment": "Malware payload (Mirai)", "value": "e0541087726f2cfc69d1228f7474a27c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626254054, "uuid": "25a008db-e08a-4352-aa83-0723b18124b6", "comment": "Malware payload (Mirai)", "value": "14d74154c744cdfe43ef0843e7aedb85593eeb0bed46ae63f5f2f238c273c524", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626254054, "uuid": "8dd4d0a5-6de1-46b9-9eff-db872c7e2798", "comment": "Malware payload (Mirai)", "value": "744ea5ec888ab75bf54183d6fd6a310215f7f0af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626254054, "uuid": "5c76c292-0efc-40d2-a94e-1187b6922dc2", "comment": "Malware payload (Mirai)", "value": "3c61336567d7b626935a184ea455ab70af75c5743f477efe267f63a2ac0b5243f1f6ccca92d6333ca3ee420f5585c47d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626254054, "uuid": "6bfe8ee1-e53e-4f78-b568-fb839bcb424b", "value": "T118732A35FD392E26C0D1A47E21FB8705B6E2278E26E4C60E7D720E4EEF156446813AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626254054, "uuid": "625392f4-ddbe-4f23-bec8-949410b05ed3", "value": "1536:NL6CiqCBdYU4oI7vSS/kkrkiWTO88KbC6vE95z+iN9ztb:J6UMO7UHvEHrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626254054, "uuid": "4bbcd01d-bbce-4fdd-a582-3b80cec77268", "value": 80072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626254054, "uuid": "968ac8f5-5027-460c-bb81-584be46bf0a1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626254054, "uuid": "76b04621-8e57-4c27-9b13-504c3a43a340", "value": "e0541087726f2cfc69d1228f7474a27c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e96b259-e4a8-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1626269843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269843, "uuid": "3db6cd84-7d42-401a-bcb2-32f4217403bf", "comment": "Malware payload (Gozi)", "value": "9f0a6d9aafadb96a71a49e83c981c7b8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269843, "uuid": "aa164a3c-9035-4896-955d-f8c8b2e6c444", "comment": "Malware payload (Gozi)", "value": "171c18f740641ffc0e1ce486feacabb367292d01627a7103cd614e9a746a9b9c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269843, "uuid": "716174f6-d205-4f94-b4ee-d8f85287101d", "comment": "Malware payload (Gozi)", "value": "462199537e90680d68d8ef75aa44ed81e90067e0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269843, "uuid": "6d83bd36-daf7-4b53-8127-a84219e1b263", "comment": "Malware payload (Gozi)", "value": "79d7c9d9d6f8ef8fed41e10ce495c8cdc88fa0e7520882101c4392faf9a1f756b5ffc7a7040280e606909cf7ccd025d9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626269843, "uuid": "8d6d718f-de73-4611-b3cd-eb18b2446afb", "value": "T1E8A4AD103650E831C6D6A2314F21D6F4176937B01B7054CF76E87EAF2F6A5E32A3A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626269843, "uuid": "19cf4b82-bcea-4af1-be27-70290b972826", "value": "00fb3ea211c64833592a3bd90c60f939", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626269843, "uuid": "e6978f71-49e6-4f39-8198-32281d113f49", "value": "12288:0zpGlmmfZ9mro1S+FUUEMK/WEOEX9V11yS:qAZfLm01S2EMYOk71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626269843, "uuid": "85c4ddbf-c833-4570-a0cb-f5c5ff3ac9f7", "value": 464896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626269843, "uuid": "6ca3b29b-617a-4562-a8fa-e35a44ff4dda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626269843, "uuid": "f3a98080-c420-48f8-a1fa-811d76e669ca", "value": "171.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f57c2cf-e48a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626256825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256825, "uuid": "c25adfe8-bc40-4c87-ab80-7b6d80ee0afd", "comment": "Malware payload (AgentTesla)", "value": "aa3e0d61e8cc30acc922cf9c8af961a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256825, "uuid": "2286e3b9-c1b3-4392-803d-45495fcd3368", "comment": "Malware payload (AgentTesla)", "value": "17d14760f141c587d0511b1771ad60b10722a358d497669f88cdc83609ab2ad6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256825, "uuid": "415a074f-6709-44ca-92df-af2015a0cede", "comment": "Malware payload (AgentTesla)", "value": "bb9d2f3092404c3961f986eede03f506b7af5586", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256825, "uuid": "ac88e6e9-ae82-416f-b1f1-f7a1008956fa", "comment": "Malware payload (AgentTesla)", "value": "f80e9f6d8def64f214573aed583839b0788a64c9bb7a8e263b9397fb9fd7f45d7d23bcd48a1fa95b7dcf9e1882254b1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626256825, "uuid": "c7db4365-d959-43a8-a170-5f4d06ae50c7", "value": "T1E5B423C6321DF739251780BBF6425BE8E2B58D2FD5BD1C0BEAE13B18D5101A6C3DA984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626256825, "uuid": "b8fe1ee3-3dfb-4783-9b28-e83fa4f4dbbf", "value": "12288:aW1ZacKm+jIZl80EVgU5RCzmoTRExt/8nNFs/xb37WLgdCZ8ruUc:fGmvEVgU5nKRMUNFspakdCZ86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626256825, "uuid": "5bff99c2-b481-4319-82bb-1a74af1e8cdf", "value": 520433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626256825, "uuid": "f94e582b-33ab-4123-ab19-7ff4e258ae58", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626256825, "uuid": "7e7b7823-e48e-4552-970c-711ed514a65e", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0bb394-e4a6-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1626269140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269140, "uuid": "8d86d3f1-c95a-4ae4-bc7c-cd66739cc590", "comment": "Malware payload (GuLoader)", "value": "c2bd7483bc6b3f52f1a2bc9e26f38f35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269140, "uuid": "5d1a4019-2e9e-448d-aa28-3feb5be6133d", "comment": "Malware payload (GuLoader)", "value": "1942767aa808c15413e31d945174cdea44f4eeed5da3d5831aff879c90eb7609", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269140, "uuid": "02ccd64b-1a0a-486f-981e-c92a1add443d", "comment": "Malware payload (GuLoader)", "value": "467cdefde11cb29b45dc6ae03f5f51e44b6ba04b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269140, "uuid": "7db37616-b572-467e-8e39-26dac5c37ba2", "comment": "Malware payload (GuLoader)", "value": "8bb6dd61254568c2f2be3709158fe1ca7f311b9a91a8add6009d1c5664696cf22cefdf5c736db2ec17d56276a78e85ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626269140, "uuid": "449aef55-21b7-4918-bb16-8f21e6c1d497", "value": "T174A3C9B5F430E51BFB4AE032E095DA70C59B908DA3C7F52A705AC9E5D6A327127086CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626269140, "uuid": "eef8089d-b93e-4b87-8855-df994092c277", "value": "eccc13a0539495d61b4a3d603db3b16f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626269140, "uuid": "f0d20662-73c2-45a9-976e-d1579e08a6bd", "value": "1536:AhZ6hScOAXYmL8PsIyEsJD+/wjnLaDPQc3F1ws:UwSfAI6t8a+/Dj3/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626269140, "uuid": "1f093f73-b865-426b-b17e-5868a933bc8d", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626269140, "uuid": "43792365-8277-4c57-ad86-994b43c91ce2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626269140, "uuid": "87049c68-cc12-4a1c-848d-8ef58e219e50", "value": "nContractNo-0001-BLT-2021-22_Purchase confirmation_JulyShipment_2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84567fe3-e467-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626241881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626241881, "uuid": "b7ef27b3-590a-4872-83d1-932a6bc16a1f", "comment": "Malware payload (Formbook)", "value": "8feb8f9c7c79a029f8085bab91f88425", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626241881, "uuid": "2d58713a-118b-45ee-969a-395a6d7da073", "comment": "Malware payload (Formbook)", "value": "197e54bab57ae1b6662d9e2354a4859e2c426a48f53dc6ef3d16d627188d8903", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626241881, "uuid": "e6598063-0f60-458d-8539-a10e63114a9a", "comment": "Malware payload (Formbook)", "value": "7b0744427b7a3ca7142ecae355355a40e526fb99", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626241881, "uuid": "39c7b167-d4a4-4d37-8f35-7af30be8db0d", "comment": "Malware payload (Formbook)", "value": "e5e9287f8240184e7e399ca0fc6a584651b9497d120216f9206db01cf91d6d1bdd3477350bb710f65104b79ee3f08b45", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626241881, "uuid": "750c78e3-c208-4722-9b6e-6a645ca2d633", "value": "T16AE4232CE5F9032482BB980EADAB937BD4B1152407F51CEAC0FE1B9244D1216ADFB49D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626241881, "uuid": "9d9c986c-6433-4505-8e27-8398390f502d", "value": "12288:zZ0ta9VJt9e4M6EVLhvgPnAHO7r1AK7ma06u+R/qhxvc0hL01F6+LHThBYVbmQ:zZ0i/t9e4MFLh44udpI+RScILUF6+LHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626241881, "uuid": "8b7eea56-18a8-49d3-940c-244a6735d213", "value": 669634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626241881, "uuid": "26bdd219-310b-45b6-b01d-ea5a68c33980", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626241881, "uuid": "bdfabb22-c016-4e86-819c-f54c588445b6", "value": "FedEx Shipment.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c64038-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626246011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246011, "uuid": "ed6afe39-c033-4518-ab0f-a86d870e19dd", "comment": "Malware payload (NanoCore)", "value": "2d2a8d87659b727caa9db2dd24aa2afa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246011, "uuid": "021e58ea-db98-4ac9-91b6-4f309e75cdf3", "comment": "Malware payload (NanoCore)", "value": "1a281bb2454d0be70d86c780ae64696d2f8249d3148584ee48809579778eea1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246011, "uuid": "a68a6a66-f1d3-4970-92fa-be08b7668d60", "comment": "Malware payload (NanoCore)", "value": "a466e6aa7ac9aa2f159b343491a35bd932987d83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246011, "uuid": "56262b3f-d5b7-4f3b-a2b8-4b0f3c5c77b8", "comment": "Malware payload (NanoCore)", "value": "18c134e39da7019c2d45a62bba638bd430ab62e5e989250b40396ece87948cd9edefe74845748e1c687e7850de94b439", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246011, "uuid": "aaf5d972-073c-470a-9562-9162dd0b9a08", "value": "T1D205DF2733840B27CB7E82B9B655E490F761ACABB701DE0F1AC372D6556B70094C6D2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246011, "uuid": "5ed69ac0-c8b5-4223-87e6-fa62e9fb3dd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246011, "uuid": "e98e3750-dd4e-49a7-81b6-ae09b70da5a3", "value": "12288:ArQUCQTo7vR+nQlYbxPUlsjm90v0KW2G8P0I7Z1xBgcRdcL3dnfl4:ArQUnOPeBS9Jz2mI11xKxjdnfl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246011, "uuid": "7f0bb540-2146-4467-bf6f-123da0fe1d0c", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246011, "uuid": "056801e2-3b2e-49c2-9b95-dcb4239f23c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246011, "uuid": "6ede9fa8-e81e-48e8-aed4-51f5419903c9", "value": "H194 \u5146\u57fa - Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4683e0-e4ad-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1626271990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271990, "uuid": "c1d8000d-791c-4128-b69f-694469a2033b", "comment": "Malware payload (ArkeiStealer)", "value": "181973fec45c6155b0880f08b5cf1bf7", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271990, "uuid": "8b7f05b5-bbf4-4ef2-a35e-3f9c079f0ff4", "comment": "Malware payload (ArkeiStealer)", "value": "1a76ae32e83cfe20ca2979be25f68f2e3853d3b46172d641f4b7148134a4d09c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271990, "uuid": "a3368b42-c717-44fb-a6e9-70e3a56ce1fe", "comment": "Malware payload (ArkeiStealer)", "value": "fd7d474bf5f3205aca24d2c9c8769fa023732435", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271990, "uuid": "03521beb-a520-4dc5-a62c-f8d32438d692", "comment": "Malware payload (ArkeiStealer)", "value": "468d2386e6ca953a6e7aa9ef19c022433f9d79670f321780ca330eb862a29db214dc3c6ac0cf0aff27b8a2b4f1a30a7d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271990, "uuid": "f17cf669-8688-4b6e-9f74-820da404d788", "value": "T122C402117561C235E6E736301976E7601EBBB873E5B6898B33942B9E0E303D0E67631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271990, "uuid": "75b294a8-3912-4128-92f2-7e422d7e0361", "value": "cf8113cdf9d71dde8baf28192dd4ab3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271990, "uuid": "dc76cdab-bb57-4bbf-8eab-9664f934ef41", "value": "12288:k4Qrh44bRsnRQOi1trXfmHJ/kdOg1ghyFbviYQFHU52drN/:k4T4bpOmtrek4g1gh+mfB1N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626271990, "uuid": "40b3f2f7-2b84-4364-bfc9-aac7511bbc3f", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626271990, "uuid": "5f517a11-55e0-453d-8da1-63ca3b90fec2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271990, "uuid": "4419d4f7-6bfb-41af-8b86-4a4cef6d0789", "value": "sahiba_3.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac39023-e4bc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626278480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278480, "uuid": "3cb49336-068d-40d7-86d7-aab7f77b892a", "comment": "Malware payload", "value": "9cb412b64dbd503c0b8478f66fbb2e2a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278480, "uuid": "91bbc690-d1b6-4c6f-809d-f19040895868", "comment": "Malware payload", "value": "1b0f9072826db3de51252297e95dee3d13699fe13f3705b205b6babf67914053", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278480, "uuid": "7d050851-54f3-4caa-a5a3-8ae5c0102b90", "comment": "Malware payload", "value": "496ab317975cfd001834f1defcefe39e9057ccbd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278480, "uuid": "45d2cd8e-c34f-4c67-a7b8-e2489b3c0c61", "comment": "Malware payload", "value": "8bcfdf2ba7a348ee73be5f28c14faf7f07c3fd38c6662b966860db9dbf0ad527ab728f7b429eb301dfccdd4acfe546a2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278480, "uuid": "c37794d5-0563-4024-8b99-61e612321492", "value": "T11E8423FFE377758ED6EDBACD0CC31C299171F28B619988B02A4227D02E582E2549731D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278480, "uuid": "15bccea6-7a28-4aa5-be5a-d44212be4e6a", "value": "6144:zVXSYHxaziV/C0u9HIkIXeflqfvhCc9gtnYpP73+4WA5gkLWEPZCbTteAr40pYk8:J/+iJTUokIuflQl2h8z+lY/PZ+eOdY57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626278480, "uuid": "5df03ae9-8912-4f03-941a-cc34d57e94c8", "value": 379298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626278480, "uuid": "e1c6ec93-e79a-44d7-9a46-df20ba11f22c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278480, "uuid": "a7a459b0-af63-45c3-9abe-ec86c5c0607e", "value": "List Of Products Q002-O417729.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214eec8e-e4ac-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626271350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271350, "uuid": "bbe551a9-e09f-4360-badd-e5f9d35e4786", "comment": "Malware payload (Gafgyt)", "value": "da450eb52f31f226d6dba6904f9055ca", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271350, "uuid": "1f6b268b-20d3-43a0-a056-141ff8983fc2", "comment": "Malware payload (Gafgyt)", "value": "1ba31deba8fb47f7686944f9c481f91d7563f2668a2ff6f725b928cc25fbd513", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271350, "uuid": "64efdbf3-ee5b-4a37-8412-93148deee160", "comment": "Malware payload (Gafgyt)", "value": "df33f7b5ee6faa01e21dea11326cfbfdfd5fe44c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271350, "uuid": "e4d47b6a-9dd1-4519-a1c4-87ba3a1586ae", "comment": "Malware payload (Gafgyt)", "value": "d7c8e1831e730a8c3e445d401a42fae4cfbc0983bfdbb88c32fd77b5c44d3a4f0b015c708dd124d0e2bdbe90ca92255f", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271350, "uuid": "265796aa-a9c5-4661-ae8b-97e77c7913eb", "value": "T16C31DC91A7D05DBCC8E411BEAE5B4314B379AF44E1CA7223832C63586D2AE3CAD37546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271350, "uuid": "0b35870f-b65a-4cc4-b771-7de0078a7c52", "value": "24:uAd9KGpa7Urz/jlf/JdAXK1hH9Vev3gRGaJ9i9BBuLly3N9gD10yd:uA9KGpa7UrLZL/I+J+Buw3NE10yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626271350, "uuid": "76e64163-9c02-4dad-83d0-f77e1cac1aa0", "value": 1500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626271350, "uuid": "ef0abc48-8f5c-43f1-8801-710c6514abfd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271350, "uuid": "e02e031a-2fb0-40f3-9b49-d9b1d25ea167", "value": "miraint.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcf5a1f-e438-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1626221768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221768, "uuid": "c5669061-0cd1-44dd-98bd-5898983acd48", "comment": "Malware payload (DiamondFox)", "value": "8f9013c73cc76c427a2c59703a239c13", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221768, "uuid": "87f554c4-f953-4376-a9e7-3a948b6826d2", "comment": "Malware payload (DiamondFox)", "value": "1ba812e8f200b18b8f04bf694314c9b5127aa8a3ce5351ac389639fb69d6d528", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221768, "uuid": "deb6ddbc-a338-4b67-897c-39827def5419", "comment": "Malware payload (DiamondFox)", "value": "56c5f2398f561ba502de467d25a7c1f9c90135ab", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221768, "uuid": "7649d69a-94e9-42ac-ad96-add4fcd6e358", "comment": "Malware payload (DiamondFox)", "value": "6dd0d44cf53e85eaf0a05d084186a5a163d879e455f6f87bf11569400a6817aaa6d6db4ee8beb8124cc6b9074951c135", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626221768, "uuid": "2198f2d3-d47e-4865-ae08-961563931c7c", "value": "T1A06633427A919172C1A65E3649B5B621AD3C7C200E74C5DF97A81654CB3F0E2EF32FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626221768, "uuid": "dde929f9-3893-4732-b3cb-4b772a1ec530", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626221768, "uuid": "bac58eb5-7bb3-4eb9-af0d-d0ba709e87c3", "value": "196608:UZKixHDATdA82svku1f42SuLgsn2bMlCnahYF7pS0ii:BihYuIPrL2bM0KM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626221768, "uuid": "8c0cb7f1-8f07-4441-8c5d-71f6de865261", "value": 6995852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626221768, "uuid": "928b340c-e3d1-4542-9d4d-a5e5004b74ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626221768, "uuid": "d1fda9e9-d14c-4ee6-a2d5-d98c79bc80f0", "value": "8F9013C73CC76C427A2C59703A239C13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b0d0e2-e4ad-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626272032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272032, "uuid": "438e218b-42cf-4a4f-89ae-ddd013843b20", "comment": "Malware payload (RedLineStealer)", "value": "b39e86e18969386d5e6ec1ce166ed497", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272032, "uuid": "b4cce5f1-c4ba-4c63-a2c2-4044886d4cbe", "comment": "Malware payload (RedLineStealer)", "value": "1bac0d7b5cd2e972e2f32f091ba3fb548709d54194b86f54315cbec0f0246c2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272032, "uuid": "b0637ae5-71c6-400b-bfd9-3d24323c1c1f", "comment": "Malware payload (RedLineStealer)", "value": "09b12e06c817a90e2ce7ffff77f6b9ad47bb7b8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272032, "uuid": "2ca1b06b-1fea-4aa2-bf46-939cd1488d98", "comment": "Malware payload (RedLineStealer)", "value": "2f439c16380d8d7e89ecbbf25439c76e5be58dea577a387f39da72b67640a148713f2c3827310154618e60c797d266ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272032, "uuid": "778212bc-8542-431c-91ad-19e819bdbbdf", "value": "T1E234E02137A0D032F7F34A355979CFA12A3BB8332B70864B7650666E5E313C1A966773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272032, "uuid": "7198f7d2-5961-4c6c-9a9b-1330e403ebb2", "value": "ec4c0162d073b18ea1313ad8f925de02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272032, "uuid": "bed700fa-1055-467e-94f8-230369ef0f05", "value": "3072:/K3HJ5imoXXToiFoBaGYiP0dVF4jXHHk/veiVecea7J3BR5e15mOal:/KmmIooM8FOE3eika7J3B6mOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626272032, "uuid": "bd72bf17-184c-4f82-8d98-6de43683a286", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626272032, "uuid": "d8cac6e7-07ce-4bd0-85d4-a5ea25c3ea8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272032, "uuid": "4518aeb6-4172-416e-bf74-f55673c5b049", "value": "sahiba_7.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378f75f0-e4ab-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626270958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270958, "uuid": "308896e5-90fc-4912-ad6c-b854b4b6a00a", "comment": "Malware payload", "value": "dfdce3b2a5c46bcf35fda38283236359", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270958, "uuid": "0edcdf0d-b807-422e-90ef-62953ef86bf9", "comment": "Malware payload", "value": "1bb7fcec52a8f446aba18db2d057077065eac57392bc91f817d8ca05dfba0ec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270958, "uuid": "00628e01-44aa-444c-b61e-5c951c3823ec", "comment": "Malware payload", "value": "0386c07223fa24b0b3224f77920d327f251b2996", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270958, "uuid": "e19f593d-679b-47c8-8980-b72852804b4b", "comment": "Malware payload", "value": "226b6e693e20dbcee7c7cad7ccfb8b28e593c6c0f7148e1a96ee82c6ec99bc1ec2032c37509a1db534298fed167847c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270958, "uuid": "685818c8-6908-4156-ba0c-2a8c7bc84299", "value": "T1BA65B51BE8E610F9C6BEF0248256A323B87234A983347FE75ED446A61764FE4763D314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270958, "uuid": "b1304c03-0a21-4a0f-b9aa-a304006e23e7", "value": "12288:6Fctz6oTHQHG00pQzBosOMX7o4ebQJ+Jc/LHA6Tv4HH97m5IyLDbyg:EctFTmG006iBMXae/DauIIDb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626270958, "uuid": "ef886ddf-c295-43eb-9588-a4569544d380", "value": 1417216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626270958, "uuid": "7a8fe932-c6a6-4c6b-a417-76244fd9e43d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270958, "uuid": "683d6d02-aee3-4c00-9615-ccc5e66088b1", "value": "SecuriteInfo.com.W64.Shelma.H.genEldorado.30879.20476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca2d004-e4af-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626272953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272953, "uuid": "6f1ed4ca-249d-4110-8b1d-88093c7898c4", "comment": "Malware payload (Loki)", "value": "c33594d164e9f797d99f6161199f46ab", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272953, "uuid": "c23063f5-7240-4421-adbc-1b8d0fa2b610", "comment": "Malware payload (Loki)", "value": "1c02e78f3a7c4877f770d291e341f1c25bfc824161d0a4101a8a061c4c1e40e8", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272953, "uuid": "4986cac0-a5dd-400e-a3f0-e4c35388fbbb", "comment": "Malware payload (Loki)", "value": "5d69c96d9b8c44386d56093b9f2b0bf2810885f2", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272953, "uuid": "551ab0ba-d732-4965-b16f-345565b5bd06", "comment": "Malware payload (Loki)", "value": "92e56ed8ff8e4058c9facda6c66f67aee2a4525b4d5dc92f0ed546b7fa97e5913075b8a7fcd91d496813a006aa27ed35", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272953, "uuid": "7f1533f4-a780-4eee-877a-209fb56b1593", "value": "T13BC4E0F5B7BCAEBBD31E83382DBC818E25566F4483E6542117077D50E67DA0831CADA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272953, "uuid": "be548476-1932-4fac-ab7b-48514e4e8852", "value": "12288:KlDk4hmmfRFvPfdNTl/sf206SJbyUMfKp7+7c4jdBJEzFMmK6L:KlDk4JVNTli206SJrMypKc4jd0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626272953, "uuid": "8eb43d04-dddf-40eb-ab5c-a9b9ac0297e4", "value": 566888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626272953, "uuid": "4c401749-dd90-4ed7-a505-5a67978cfa9d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272953, "uuid": "abfb334d-0566-487c-b3b3-ff5d868c8c63", "value": "TT PAYMENT CONFIRMATION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2655bf-e46c-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626243985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626243985, "uuid": "a2ddc768-88a8-4a10-b482-196fff48053c", "comment": "Malware payload (Loki)", "value": "0e3cac62373d4fb90f604d30ee71cb3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626243985, "uuid": "96672cb4-f53f-4e56-8af8-15363951d397", "comment": "Malware payload (Loki)", "value": "1c8c5e4239f09ad0db4f45e5c6db61b03e7d86e397bebd1d09f39940f1a6b79b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626243985, "uuid": "a584e942-fac6-434a-924e-91e0b21108e0", "comment": "Malware payload (Loki)", "value": "7d67a29a2b4433fb93477f86ffb410486d70c11c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626243985, "uuid": "2b5b314f-546b-4325-8bb7-97f4c0b46cc2", "comment": "Malware payload (Loki)", "value": "ba7968b8e68d635e6aa682289aa76986b7f86833f8acb561c12938aa5a3624e014b1ae5dbbdc1e50c63c4b4d2bb0da78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626243985, "uuid": "40967624-e32c-4db2-844c-d44cd1a6a8ee", "value": "T1D7F4BDAD325076DFC96BCD3AC9641C24EBA0B877830BD243946311AD9E4D99BEF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626243985, "uuid": "5282689f-0500-48b8-bacd-0daf47d2bed8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626243985, "uuid": "39af6f71-b6df-4701-8c78-17e0aadf5454", "value": "12288:MV0raRJCHSfBcedeF1RuPksW5DrPM2sayC2erOkXhk+DcFYM+XxtBcOGThXNn8yJ:LSjfWedeF14PksW5vLsayC2WPKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626243985, "uuid": "44879258-e418-4029-af21-ec02455d5cf7", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626243985, "uuid": "82512ec5-b2c8-4eb3-97f1-bd7d746cb83c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626243985, "uuid": "c5f2e7fb-c508-4a09-bab0-c78fe0f845fb", "value": "PO2021.07.14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8bcd91-e46e-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626244687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244687, "uuid": "ae28fde7-3800-4914-ba5e-3e76a4c05256", "comment": "Malware payload (Formbook)", "value": "e816a3ca32773b2dd92244bab0930401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244687, "uuid": "5b6f9edc-db3c-4ccc-b872-ec2a319e7e56", "comment": "Malware payload (Formbook)", "value": "1ccdc34a2258984fb0df40dd979f71d4c11bce12cb6e840e90fbd9281254ade6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244687, "uuid": "9c2afa07-d5a5-4f8a-abc4-b51813e60418", "comment": "Malware payload (Formbook)", "value": "8cd46a8627805261e95f99198fc8f446fb03ad2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244687, "uuid": "f5ea9cbc-772b-40ed-859a-2c7745e58e96", "comment": "Malware payload (Formbook)", "value": "5652fb61ce8aca7b4777be173e428671ab2ebef5f9a9d42568c7ad7ffe65dcd3dabeda381dfe0adafbb8e397ffd32ef7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244687, "uuid": "353454ac-2dc7-499b-880b-91eef07f2161", "value": "T12E54C0A1F195C8DEE85252B14C6FDC212263AD9DD071461F22DB3F3EA9B334311A7A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244687, "uuid": "da16d5fb-62cd-4e30-902c-25c8b166b4cb", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244687, "uuid": "e23c2e68-70a5-4aba-aeb3-48e6dc5e8ea0", "value": "6144:WTqjFrT7Q5qKt4mDPQ4JIgiR2VDkQKkKzDBx:KkT7Qbpk4JdhD5ADD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626244687, "uuid": "ac4f2e26-1fd0-4d61-96db-3395a2008a8f", "value": 297189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626244687, "uuid": "747310d0-06ec-49a5-a0a9-84139362e98f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244687, "uuid": "088448ea-5da6-4c98-982f-814643fe4a7c", "value": "8944848MNBV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c84cce-e4a1-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626266739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266739, "uuid": "dd8fccd2-8308-491a-b27c-4703a70b0bdd", "comment": "Malware payload (Gafgyt)", "value": "9db29833fca78f2b2dfe0ff76624c7b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266739, "uuid": "1e446e22-b2ee-4dca-84c9-bc21bd36deb0", "comment": "Malware payload (Gafgyt)", "value": "1d6739fb49cca08a9fd54eea349d0a9b0338fe435e6fc1f130b0bf9da1dfa6be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266739, "uuid": "7871f05f-9f67-4454-8c89-01685025dddd", "comment": "Malware payload (Gafgyt)", "value": "05d60df9f4690f821b06dd9a0d60031a55e6ddeb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266739, "uuid": "707e883e-8250-49ee-a4a4-ec93c155a789", "comment": "Malware payload (Gafgyt)", "value": "26ea65ee3ab96e433b90bb8641f7ac8ff34ad0569cab7f7bbe1ce9cc1f0872be2bb6c14a4fcf92be13b69a47cb42b25c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266739, "uuid": "4e1eff51-c7c6-4244-8fd3-a4ce52357389", "value": "T164312191A3C05E7CCCE4A0BEED5643107364AF44E0C7B36396087794BD29E7C9D27046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266739, "uuid": "16f9d99e-71f0-4e61-a4ad-92308bbc8eea", "value": "24:lpKGpa7Urz/jlf/JdAXK1hH9Vev3gRGaJ9iM3BBuT3T7lxrR+zP6eF0:lpKGpa7UrLZL/I+JhBuT3/lxrsPLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626266739, "uuid": "8916b8f5-c79a-4e1b-9412-b2224664ffbd", "value": 1456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626266739, "uuid": "445388e0-4106-4c31-b12f-4c013c09f3e2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266739, "uuid": "38287af8-942c-40b7-8120-8c007912be6d", "value": "9db29833fca78f2b2dfe0ff76624c7b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025a780f-e488-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626255837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626255837, "uuid": "329dc5b5-d7e6-47cf-a20e-c68395ebae6e", "comment": "Malware payload (Loki)", "value": "43a2d565134def5390af96f6a8205239", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626255837, "uuid": "f056a5c5-7175-44f0-87e6-a31dfb12f8bb", "comment": "Malware payload (Loki)", "value": "1dd6a661509dd9f169858a794701e58e375df9950600a69cb80a095cf484df29", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626255837, "uuid": "8034abf0-c6b4-42a7-8f5c-530387b7d300", "comment": "Malware payload (Loki)", "value": "454bc2ad65f1e90383177f7aa875af9b5a11f188", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626255837, "uuid": "5790f166-fbe2-43f6-89ee-deacfd8a5b57", "comment": "Malware payload (Loki)", "value": "8ade306c022ac802af199e89f08d898632f25d878ce7442a7977ec0bc234979e137fd8158b23c08736fab65083c22c46", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626255837, "uuid": "3ca2166d-6a13-4271-89a6-124c500b3fe1", "value": "T1BD228E38D646FD1AE122053DE11841F4FB265193E662B83B2099379C0F613CB4B4FABE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626255837, "uuid": "1a4ffd14-e732-4de1-9056-289133f36c58", "value": "192:ScIMmtPIeG/bMOxGWFuMp2oQD80Ni3D8N:SPXgNMOxGaDI2DE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626255837, "uuid": "e846301b-12ad-4437-8ac9-901942b571d8", "value": 10336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626255837, "uuid": "a54c0a16-5471-4723-b13f-f06d0acf8536", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626255837, "uuid": "6f0c4634-92d8-4f8e-a4d5-737a02552e62", "value": "lokibot.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ecddc8a-e48e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626258434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258434, "uuid": "0d9bdf6e-e329-4c0f-baf5-dfdf1366f971", "comment": "Malware payload (RedLineStealer)", "value": "a8b7fb197929a202aa41091129fc8bf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258434, "uuid": "10bb9040-e636-4be4-ad05-105a8d35e899", "comment": "Malware payload (RedLineStealer)", "value": "1e1a379e4d17d0fc66a4bf0b42d8ff26cca7c0ccc3c452a42a4a21db4aa16467", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258434, "uuid": "e7b4bc8e-b9b4-4fc1-96c4-18828d5f6824", "comment": "Malware payload (RedLineStealer)", "value": "9aac742a886eaf567d1dca64ecd6f2b6c8667010", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258434, "uuid": "56a90834-799c-4968-82c9-4c47df6f12bf", "comment": "Malware payload (RedLineStealer)", "value": "82895eaa31b3014fdee645354fecfbbb98552480f76ac292701a7cf2bae1ac9761084348999aac2fc3cffb3358018502", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258434, "uuid": "295fcf37-cb22-4561-a7ce-87d1f77ef34e", "value": "T177A5AED45114F087E3948DFCDCA4E77A73FB3A359D50411231EAF7DC9A1AB2A6827222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258434, "uuid": "3f24d6f3-9cdf-4067-8e09-85a15fc61c91", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258434, "uuid": "36d92123-3ed2-439f-904e-af9da819c901", "value": "49152:IfHsaEW0BcUfhB2qiAitKYdXNFWmRBIuAd4Zaq2oRR6E:IfHjqpoFdXXCdPnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626258434, "uuid": "0a900a0a-67bc-43cb-b80c-08ba602cc923", "value": 2252816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626258434, "uuid": "c0231815-8913-43cf-902d-b42b80480169", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258434, "uuid": "1c8f2d18-1873-48ce-a795-28fd019c5de3", "value": "Collapse.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f36e42-e46d-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626244521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244521, "uuid": "06e7ec33-67c2-46a2-8a5b-d65217339b69", "comment": "Malware payload (Loki)", "value": "779327e9dd07f31407caec48ac9687d9", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244521, "uuid": "1beb6b47-1fdb-41d6-8d48-95cadf8ae1e4", "comment": "Malware payload (Loki)", "value": "1e789a79710ac2448e9a84fa888d98cbe1b94c46e1396e43061e9149d1e5c517", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244521, "uuid": "bdd149f6-b5dc-4933-a69c-af8d48e056e1", "comment": "Malware payload (Loki)", "value": "358e36d8d651f15d725b2c663c1e1eb3511fc071", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244521, "uuid": "8db202ca-a913-4018-aeeb-4cf66d962b8e", "comment": "Malware payload (Loki)", "value": "45e4280994ba6b303e7e88d18d97c143385b4b58b3710d6928d0aab72f9d2199a4a2a526f7ca9c272f29381cf3585ed1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244521, "uuid": "4d619464-0b21-4638-92c1-18557c319fb4", "value": "T1074512F4A4DE4A89C066C272AE8643F7E52A8CD8F943D5753540335B2B71EE93070BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244521, "uuid": "96504d70-fe34-44c5-88ec-2c6431d70e6e", "value": "24576:KH0jTwz2ihqc/pqLzQCYOwUOf+ClL7/SnD6x7AdRPAYKz5sE:5jwhqchqLQdUFClXQI7Adg1sE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626244521, "uuid": "7e8655e5-ef09-42f7-8ae4-5af3dbe2ea7d", "value": 1171352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626244521, "uuid": "45200fe9-1a2b-48c9-a896-3a5b76d62916", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244521, "uuid": "234ceb5c-4933-4fa6-87f0-f853969a1d1a", "value": "BN.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02c1ee6-e4e2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626294890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294890, "uuid": "b9f265de-b9de-4f75-9b79-01639c8c4513", "comment": "Malware payload", "value": "878e2c1c10548a5abbc85cc1334c3aa4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294890, "uuid": "883486f5-27a8-436d-8227-0c335fa13e77", "comment": "Malware payload", "value": "1e7cff422cd9fda456283527e027500af16f9ceceeb23467d55839286b14a8ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294890, "uuid": "61949f41-db84-483d-a539-e2bf82b94d5f", "comment": "Malware payload", "value": "d8877cfd0fa7a9d4c5fff74145f4d254d3085094", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294890, "uuid": "18434604-c8bc-4aff-87c5-ea31b09fe052", "comment": "Malware payload", "value": "149ec21d970647de662c783e63562b1982908b1fc258e6090ebdfa8f21a73c393c3ef878bb9aa157d9f4cb58ca41bb4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626294890, "uuid": "2cb1f85b-2345-4758-97f2-57827be432a2", "value": "T139F302D1B39A11FEFD1D6470960BA9A612A70D29C37CCAE7E110DC917DE48F7243512A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626294890, "uuid": "26d096a4-1829-4af0-9748-b5ac98db0471", "value": "e92132005097daafddd51d9c4d138d88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626294890, "uuid": "0c0ef4f3-4319-417e-b47f-9360c6c75c06", "value": "3072:V7p3dQo86PI7e2seimPWy6Ox1uTQjY48+STfLbh9w47sIs:f3dyj7NsedkOx1KQU5TTbbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626294890, "uuid": "78985788-5281-4433-ac57-f9d1ca46ab3b", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626294890, "uuid": "c6ca35ba-590a-41c0-80ed-7db5747b58e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626294890, "uuid": "fe41f402-a66a-4f65-8558-91204b67baf3", "value": "878e2c1c10548a5abbc85cc1334c3aa4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3b94a3-e4e4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626295447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295447, "uuid": "c03fc762-4c78-4a69-a8c9-2b913324d713", "comment": "Malware payload", "value": "62afdef68d38af130a08f1ca2f48e3e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295447, "uuid": "5eee8145-9c74-44c7-93cc-97cdd59e2fba", "comment": "Malware payload", "value": "1f3eb89e59e6e663d518a931ec40719e504c1188a928f3ba3ee5fed793a8498d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295447, "uuid": "337ae5f6-2e82-466b-9e1d-662275c548a0", "comment": "Malware payload", "value": "4c55c6846c40faf3f23135ba0fd0f7f88d857069", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295447, "uuid": "1d2bde1e-8935-463f-907d-f1fcee29d168", "comment": "Malware payload", "value": "844fce447af27e5f4ac0d59ece38fef8901837b721124e3a7c5275ab37540749c434621792449d39664c7742f2d13402", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295447, "uuid": "16cc699c-dac1-4b74-b572-9dbd15941763", "value": "T1FEB20902B20D0947E1672EF1393F1FD0D76EEE9121E5E584795FEE898176E328282E4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295447, "uuid": "0b7b9103-4563-45d7-90d9-9169da107566", "value": "384:DSDVA8LD539uBkLyYIRiZEqoTWJJGxvsSpq5AvFP/hChVTcZ9QtUhK+6RfZ8c06b:Y1kWLAiSqDg0SgMDZ+OhK9q1qhXpau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626295447, "uuid": "2f9ea50e-10b3-4801-9a9f-f063670b4bbe", "value": 25676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626295447, "uuid": "04d78634-81c9-44df-9ca6-5211cd74d895", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295447, "uuid": "e2571d87-2ed3-4414-ad18-74087a806703", "value": "62afdef68d38af130a08f1ca2f48e3e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7fa2703-e4a3-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626267845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267845, "uuid": "b88abb44-bc67-43e9-9f6c-cb1d8a5718d6", "comment": "Malware payload (NanoCore)", "value": "74def82cf56e4b9aeee0af699c636adf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267845, "uuid": "45020728-ab79-45dd-9067-0e723b31ed59", "comment": "Malware payload (NanoCore)", "value": "20abcc84d40d1b7314e3f293c510ee4f5199d43db15074aa79705c98bacf5ff5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267845, "uuid": "2daccac1-61b6-47b1-a0b5-8906bf417b0e", "comment": "Malware payload (NanoCore)", "value": "e6a2c0fdb314243593548cf03239ba90d87cb2e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267845, "uuid": "e2e125e9-348a-4867-95cc-f0a41f90fad6", "comment": "Malware payload (NanoCore)", "value": "2f5d84d40ddb7fb11d3f5c576bb666862d6ff0c80091a5554ae10a5fbc0e661cbb5a1e4884d92dedfd7abdbdfb89894c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267845, "uuid": "0ec5a30f-9960-497a-a6e7-50dbc6e6f8ca", "value": "T10B35120273D188B2D57319355E2697106A7E7E201F38EF2FB3C4299EEB35580A535BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267845, "uuid": "a18ba5c5-64e6-4a92-bf6f-b4090a3cebfc", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267845, "uuid": "c01b40e5-067e-4587-900a-e0836640047e", "value": "24576:BAOcZpJmgUG6AP7qCEXaqtwQetTlLkqtTtSUA2:bFMPOC2aqtwptbPc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626267845, "uuid": "0305459e-8c20-4761-806f-fe6dafe1a738", "value": 1133141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626267845, "uuid": "d64990e3-9b55-4a60-8596-038e87442968", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267845, "uuid": "3fa4fa70-f56f-4207-b741-838de163c80b", "value": "HBG1504997.PNG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1442e752-e473-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626246847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246847, "uuid": "fecace42-b7a2-444f-a972-3714b79aa257", "comment": "Malware payload (AveMariaRAT)", "value": "6797b19e6f2f174103c00f1fe84b3016", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246847, "uuid": "78710899-9c58-4d24-913f-d7bad46e8f0b", "comment": "Malware payload (AveMariaRAT)", "value": "20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246847, "uuid": "67a87669-3271-4d5c-98c7-ace027acf011", "comment": "Malware payload (AveMariaRAT)", "value": "86db4e27becc779ddf5769ff861cadf72bca6a1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246847, "uuid": "12d62153-7f95-48c3-8137-3fd45c7788fe", "comment": "Malware payload (AveMariaRAT)", "value": "0cafb212d69aecb9dd094a9f174c64df3d9f1bc158effba4035416a5f18cea96eae2896c7edd3009efe8e50c463bf32d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246847, "uuid": "91f70605-4faa-4a83-a476-55a22352e05c", "value": "T11D74238630DC492FC03847F514933441137AB6E966DADDCF324AA58F9A43F6A8B4BB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246847, "uuid": "e22a1d18-eb49-49c5-90c8-0509dd60fff6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246847, "uuid": "297dfc5c-38a3-4ed4-bcee-e5c8600cf920", "value": "6144:XU4Po+UBNifzGn1xnNpDrLCLcNCROCVkmMds9eYOJfj+LdNE8T:EAzUBNifzG/nPD/N6ev69eYOQLDE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246847, "uuid": "dd68e31d-fc4f-4ac4-a9a3-aadc83aa3a85", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246847, "uuid": "5519ed9a-b5d2-4883-bc73-4fc4800ab82b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246847, "uuid": "0f34086a-1c62-469d-a7b1-384c14196519", "value": "6797b19e6f2f174103c00f1fe84b3016", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de202d6-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626246004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246004, "uuid": "07683f3f-3c35-4479-86f5-750f65348b80", "comment": "Malware payload (SnakeKeylogger)", "value": "1bb5c448407236a3d19fc7a5f32f2436", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246004, "uuid": "e0202e43-e51c-4726-92c5-ba28e84dfcb6", "comment": "Malware payload (SnakeKeylogger)", "value": "21b388eab73d616288845e539ca31fc4ca8ed48ab7d17f89da8120e771e93119", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246004, "uuid": "a78302b6-3ee6-4d79-b474-fbabd971e209", "comment": "Malware payload (SnakeKeylogger)", "value": "6778c7930b6552dd153f66715aeb3059cb137280", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246004, "uuid": "94fe7cfa-d6d5-49c9-bcd7-2048c8ead98c", "comment": "Malware payload (SnakeKeylogger)", "value": "25ceff36a8f76800b13d98fc38d4498672c4721edd752cacb0e537db582ce56d0e392181d917619d561ad5c17f9ee51d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246004, "uuid": "65b12518-9896-47e0-a35d-887f9892679c", "value": "T157F46B6C23FEA709F237FF349FA0A6449FA676A95215DD0D2DC4024B4821D42EEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246004, "uuid": "484ec2a3-3f33-476e-9a12-8cbba8ac4442", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246004, "uuid": "108120b8-8eb6-4574-8b18-6a7a50ddd5d0", "value": "12288:LvAcHvorNls9XOd4+QCLBata9Dm9bgLyMYjKsnq4u0YuQzSUS:LvfU0om3Msq4uPnZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246004, "uuid": "69056400-ca5f-4ce2-b8a3-bbe0cc8d8291", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246004, "uuid": "af02be68-1347-4856-be0d-dd8e132b31de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246004, "uuid": "788d1fed-9687-40f4-a82f-cdebfd26da2a", "value": "Enquiry_Scan_Doc_001100900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eda9421-e474-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626247268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247268, "uuid": "b044a330-f80c-4a07-8928-34778b8c2e77", "comment": "Malware payload (Loki)", "value": "f3640943e3e7b3e3e33049d91345d27c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247268, "uuid": "fe5b88ff-6822-4839-998a-9a95fba1ade7", "comment": "Malware payload (Loki)", "value": "21bd15a49a0feee20817448701fcfc05370735470fedc3bce1165dbc6c556769", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247268, "uuid": "81e0ce28-c7c2-429e-9ce2-33e75d1d81f0", "comment": "Malware payload (Loki)", "value": "b168089b720828b1497697415178cf445383bd96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247268, "uuid": "fe1f2d8e-a41f-4b84-8ca4-b9664171b14b", "comment": "Malware payload (Loki)", "value": "6c6e620e61b420f1e038b00dc27e1a67f26bbfe0cbe6027fef213f0b8eb84d61aaa9865ce84eacd1062ce544cfc8d0f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247268, "uuid": "965aba91-0cbc-47a9-947c-420984a10fe9", "value": "T131C3F26E37A1C273C7A102B0097D2B23A7FEE51111BC0B0B9BA49FD7BD56AC6461F152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247268, "uuid": "1c1e7687-9fb3-4fa7-a528-c60d1b519528", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247268, "uuid": "c6778272-2a94-449b-adde-98b5d53b2f46", "value": "3072:iBkfJpRXATwMdFCcGbeoxbuYBqLXRnay6gr4wycr72pLlILh74M:iqjIKmYBO0C2c2Shf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626247268, "uuid": "a9394d0a-348b-4889-94b0-739af04a7b19", "value": 127174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626247268, "uuid": "2cdfe8f0-0390-4ccd-beea-558543c8b2df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247268, "uuid": "91b28d0b-141e-4883-8904-443f14ec9f51", "value": "(TWN-2021-036W) #401896.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50eea87-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626246312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246312, "uuid": "f485eff8-f97e-4908-bf07-b063f6255dfb", "comment": "Malware payload (AgentTesla)", "value": "85cd54236b98169083d8b0c1eba12237", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246312, "uuid": "38615efe-c499-48e3-be87-d4d66c9da657", "comment": "Malware payload (AgentTesla)", "value": "21c6a0da7c808437b150c1e8328f765efa4918a97a71f3319dddb419e66360af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246312, "uuid": "b9bd3b39-1f5d-4587-afef-d7e620a83847", "comment": "Malware payload (AgentTesla)", "value": "29bf0ae77f07f83266d55489dd61259670fa5164", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246312, "uuid": "665ff065-9091-48a3-9fb8-9fa382944e05", "comment": "Malware payload (AgentTesla)", "value": "a84dbf9e731abd2a4f9d0a8d6fc13a0999ebec85819b0f918d88182316fa2a1909a5fcf910bc7505d47422fa5cc2ab1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246312, "uuid": "482eb16f-ba7e-4224-9b0b-8ad3fbdc285a", "value": "T1D815F448EB80209EEC16B9378954FB3097335CF6461F8D0650F3359A593A5D6CEB8BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246312, "uuid": "30b67e50-1778-40b0-82c1-c894a76b71fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246312, "uuid": "a9f706f6-c8ba-45c9-8085-9bdeb5d30eac", "value": "12288:0OfO7ASomxXD4Dho2ECR9H5nv/w3HIYIK1GjmXGwA0mNzNLE85ArtiS0kPVQYMMB:xyASxctD79HN0HPKKGw7mxdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246312, "uuid": "b06134c9-5585-4c03-b22d-0ef85d414496", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246312, "uuid": "c061755a-614d-47aa-a522-1ff414a7d9e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246312, "uuid": "e30fae11-bf10-4899-b5d9-993f356e6dbc", "value": "DTDWiry8BaWEN21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f8e30d-e4a4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626268004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268004, "uuid": "e009c36a-aedd-4559-9a53-09bb39e335a7", "comment": "Malware payload (Formbook)", "value": "0418bafe96c8a5d0c14b19c304a555db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268004, "uuid": "e4709ffe-4eee-4161-aee9-8132e4df11f2", "comment": "Malware payload (Formbook)", "value": "2239e9738b2618a22115aa25c1016a01ffabd0bfe9a405f3b87cfb5cd9f42458", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268004, "uuid": "7d32a7f5-2da0-4ebe-9a14-269339ceed83", "comment": "Malware payload (Formbook)", "value": "93e8c4010bc805573a93b292d1bee537ff3935eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268004, "uuid": "baa5aea1-7085-4315-938f-88c29408cd5d", "comment": "Malware payload (Formbook)", "value": "9539119b28ae912fbb6c80af4fa5a5734e7987e96f5ec6df802a121d9cc6ae46798d86bcac51fe2ada54cfc17261921f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268004, "uuid": "6730c6e5-54dd-4dce-81c1-69ead3b063bb", "value": "T113F4CF3323844727CBBE52BABA50E090F761ACABB701DE0F5AC372D2556B70151D6D2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268004, "uuid": "684cac49-1c59-4da5-b27e-7df0cdf5501e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268004, "uuid": "ef5bc9a0-c0e2-47da-a523-48bb1cdc851d", "value": "12288:urQUCGQA4GRWtAK48suvDS2o42G4DE5X0QLAzmjpaosSqZ7n:urQUN4GwxDSRTY5HjLsSqZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626268004, "uuid": "5b50bc33-aa34-4cf8-8b11-e9551b8ef05d", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626268004, "uuid": "a14280e6-5caa-476b-b0c3-cdb98c67be86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268004, "uuid": "b6274ce7-06a9-4584-a378-1bf44b6f7009", "value": "PDF.Requisition itemspo1123pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e4e05d-e4a5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626268430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268430, "uuid": "947b04c2-f9e2-4f8a-98dd-a43f5cf07e1d", "comment": "Malware payload (AgentTesla)", "value": "7cc3ca67c637e996647cfbc11604c9ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268430, "uuid": "f3a47eb5-155c-41cf-b37c-4d9fb95c1e1c", "comment": "Malware payload (AgentTesla)", "value": "23dd123c4d9d1f03de9e4be882da193333de801c1b86f7be357e34a516d43f85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268430, "uuid": "2d38c499-0eaf-4b7c-bdd2-ad3590943d3c", "comment": "Malware payload (AgentTesla)", "value": "d45fa5b531ac42c8b517d494d3764c57cfa0dbb9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268430, "uuid": "33a34e1f-b726-4acf-b42d-06c5e3f29928", "comment": "Malware payload (AgentTesla)", "value": "b2c8a99e5d38f01361c5fbb13cf551a5a92af3057bd3c92b05b207aabefe236e04769f4e482a3ad9444e733bc09f7a28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268430, "uuid": "738a43b0-a9f3-4728-a952-4720f12b9241", "value": "T1EA058D2C23FEA719F233FF359FA1A6489FE666A59215DD0D2DC4020B4821D41EEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268430, "uuid": "60c806b6-ef24-469c-847d-2d020c66e061", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268430, "uuid": "38fa8ae3-62e7-4feb-a638-91446291e1cd", "value": "24576:4bsdR74wMpQCJTGyP2TwPAAD4ZKTO1TQ:V94wMn3sia10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626268430, "uuid": "117e0bcb-2c02-44da-8941-97389844e1ae", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626268430, "uuid": "e80eebe2-846f-4ed3-b1ee-59137cdc131e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268430, "uuid": "e34aa4ee-19ba-492a-aa29-a9fabe68db86", "value": "BTSPO21516 DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016e0a02-e4a2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626267002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267002, "uuid": "afdd5b72-5106-48d9-9c9d-daba575d1ffd", "comment": "Malware payload (Mirai)", "value": "88e6883b39455fe9f6f1475e7dfa93b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267002, "uuid": "541171b5-565e-44c8-8028-9716b61e16d5", "comment": "Malware payload (Mirai)", "value": "23ec406f854a120d3560d4fd980f38c6917d1bbf5823da9ffbcbe3064c390db5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267002, "uuid": "8d64ab63-7d25-4013-817a-cbc95e9a5b9c", "comment": "Malware payload (Mirai)", "value": "1f9d0cbe61c5211797c0c9d6416f96dd750387a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267002, "uuid": "412255ac-3a75-4b60-b908-a439f540a432", "comment": "Malware payload (Mirai)", "value": "10e72cb8575dd391ebf0bfd072210fe95a827d88796462d33c5c6742fb0b3b7e1ac455c3527e57608f8ba43a14fe0c11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267002, "uuid": "ad8a4762-02c2-4d36-b582-df789bac9590", "value": "T1893319D6B402AD7CF89FEABE80160E0AF62123551053072B67BFFDD37E322549952E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267002, "uuid": "a689af1b-5052-4694-bc9b-5a4ac40b5cc7", "value": "768:bMehvKgc46P1QbVQczoJgFHc2d8LujWeXzpUGRJTsOMdL88pIFF:wIK34GWS6FD8Sjp1UGRJgOMdw8uF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626267002, "uuid": "fdbb4d2a-a382-4a9c-b4b2-bf4dd6013e1e", "value": 52800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626267002, "uuid": "587e406a-4052-4044-8ef6-9d887b1ef8e8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267002, "uuid": "b4f76785-5000-4202-9a7a-024486fee5c4", "value": "88e6883b39455fe9f6f1475e7dfa93b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05896a4-e4b5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626275456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275456, "uuid": "4232f656-8245-42f4-9e55-e16452e1916c", "comment": "Malware payload (Formbook)", "value": "a4231c7431f34ce5f1aeecd2c366008a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275456, "uuid": "09d897f2-9518-4329-9177-f6daa385308d", "comment": "Malware payload (Formbook)", "value": "24133d4dad6ae66b6b08df65dd8e1d66e589c0fbc2ae770320eafa4d7079231e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275456, "uuid": "a844ed86-ca3d-4586-94cb-a813aa3675de", "comment": "Malware payload (Formbook)", "value": "c30be0ff8f0cfdb4eb8395119e58a647c9ae2495", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275456, "uuid": "28d323c3-ff67-4f09-aba2-e92335a8af77", "comment": "Malware payload (Formbook)", "value": "a151fd386fccdcf04066cdb8d6d8a4b66e28b7f5b08eaff33a1b802ccfa4c429bdaba6ecf887b605658c1aadd20b9204", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275456, "uuid": "0d9e76d8-6baf-49f0-8f00-62c13cb3f0f6", "value": "T18D058D2C23BEA609F633FF316F94E7649FA66EB952159C0D59C40A077421C82BDA7C31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275456, "uuid": "871962cf-6327-4be4-ae9a-b9aa1b88b60b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275456, "uuid": "0fbd1041-e446-4e86-a6e0-5e8117099209", "value": "12288:KhxrNls9XOd4+QC1FQl2XKp07+IS2iN7O+4ugIFiRTwOxsIrnDLjSWtIDLbvhSvn:KhptS11zxFiuybnXCDMLiqAlfMBtT+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275456, "uuid": "0a5e9d08-8c6d-4727-ad4a-fc274c4ba97f", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275456, "uuid": "a0988f04-eb75-42e9-a016-aabc9eaf8069", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275456, "uuid": "4f75b97a-a42b-4f78-830b-cf8c17c292b3", "value": "a4231c7431f34ce5f1aeecd2c366008a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987c002b-e4ad-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626271980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271980, "uuid": "d3198515-e92c-462f-a78c-dd23390cd4b8", "comment": "Malware payload (Smoke Loader)", "value": "834286f3fa0f3299939f1fbcddef9128", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271980, "uuid": "bad75156-75d5-41b1-90c9-8364cbc9eca7", "comment": "Malware payload (Smoke Loader)", "value": "24d6fa696646fdc1c90def2fad3396aa7eae4929f1b7e52e5db07f959bcf885e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271980, "uuid": "2f4a07d8-10e9-435b-b437-7ee664dd03be", "comment": "Malware payload (Smoke Loader)", "value": "98388e3ca7dde580d14448c2f0d727ad5b50abfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271980, "uuid": "ca1f9385-79fc-44a1-9598-6c9716cc3128", "comment": "Malware payload (Smoke Loader)", "value": "f797b69a8d94bfa7ac36ce3066a60a8660f7c026fe1f72b166dcad652496b3357a4467ee115ffa8722d3b71c3a38620c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271980, "uuid": "b283c65d-8096-4dab-8c77-71e7629304f7", "value": "T1C9048C1136A0D43EE5E7C9305C75B7606A3BB9322670858F375817BE4F302D1AAB674B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271980, "uuid": "11c13aa8-288e-491e-ab7d-894217940f47", "value": "cf8113cdf9d71dde8baf28192dd4ab3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271980, "uuid": "8ea45a06-d9b5-40f5-9505-6b8285b333e0", "value": "3072:qvBNmNAYM7z1/AyclFwmAFm5y46D6Fis0Hlz:MpF7z1/OvXAN46Dj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626271980, "uuid": "0bcc6221-11e5-4478-8ba3-167a0a1f0b2b", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626271980, "uuid": "9b8762ab-e9b1-4419-a90c-ee59b7234b43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271980, "uuid": "d9212010-7e4b-4b56-b955-236b6a101cd2", "value": "sahiba_2.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888c0f60-e4d5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626289133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289133, "uuid": "1513f3bc-b10b-4bed-b690-436f8f190c96", "comment": "Malware payload", "value": "622f4aa2d5e82438f3a40a35ab4902d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289133, "uuid": "153fca6a-5ef7-4612-baae-b2a4cdb5f804", "comment": "Malware payload", "value": "277089cb78a9c493cecd8f5fbe70df0577d4f9557fb8b55ff5f7c2505308ca3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289133, "uuid": "a7e84c3c-7a9b-44e9-bff7-83662ff8a633", "comment": "Malware payload", "value": "b486db47021575c47e7b130bed1ad70b8bf6a719", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289133, "uuid": "007a5324-df75-44ef-983f-f1766837bab7", "comment": "Malware payload", "value": "9c694c6b2892aed895716637d8604f60bd7b5126783bc40d212f7a63f2477299b970c5e7fc3bd0f3b5a485c608bb83c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289133, "uuid": "4edaf948-8046-4c86-81cd-cede3a988c56", "value": "T1A6F3023272BB5AFAE276FD72065FD931273160480308DA6F7A119F86D95E0A34C6FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289133, "uuid": "5e355231-230f-4a7e-9d50-11eb071df0e6", "value": "e9cbee8358b331a128409a4d26e3e347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289133, "uuid": "6612612d-a765-4697-8591-bb515e9dfd05", "value": "3072:4WiJzQu5JD9ko9WY1wzxWrPAYNF7L5cWlvsRwmhnxONgkf:4LquAkPAYnX5WncNgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626289133, "uuid": "14c00b11-74d7-4510-b288-255f7694f8d7", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626289133, "uuid": "1ffc16cf-c7f9-436d-93c1-1e596053a666", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289133, "uuid": "9e4cfc3b-315a-42d0-9f84-80573678f71b", "value": "622f4aa2d5e82438f3a40a35ab4902d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8557ebe0-e4ac-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626271518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271518, "uuid": "28d3e53d-343f-4ca6-8165-53e614f2fc01", "comment": "Malware payload (Mirai)", "value": "8eb428eda6b8f2d2a67d16f7f8de59d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271518, "uuid": "fd665e74-a98d-4a29-b24b-8f7e50bd3ecc", "comment": "Malware payload (Mirai)", "value": "281131a9c21e59fcc661499fe2a94c8cf1f7ed0ac3c510b6902c8c5835b58e19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271518, "uuid": "339fcdc6-786d-44dc-8779-6a5dfe4a7a7c", "comment": "Malware payload (Mirai)", "value": "0ff4165d4a550362a64f93c6f74d3f06a9913cfb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271518, "uuid": "68a71381-d40f-44f9-8aea-f00296915e3f", "comment": "Malware payload (Mirai)", "value": "396711a489d503b1c7c640941f950def855dbd07ea9e6af3f81be2a37f3d0d333b82c3e86e870db699000c1edcadb055", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271518, "uuid": "23600241-efe3-4fd3-a82e-5d6eec15de2c", "value": "T18E734A0232680F47D1924EF0293F17F587FEE96121E5F689290F9B278639E37154AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271518, "uuid": "b00be089-74b3-4e45-922f-419abb132c5e", "value": "1536:nox2Yvp11Oog18/3IVn/3f1d1WhWseJ7KDzunJPY1DXqCG7:UpbAB9/t0u7rJUDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626271518, "uuid": "8b44c5e6-4b59-403b-a99f-1bb35ecb9f5d", "value": 80216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626271518, "uuid": "843fe639-084c-4535-b449-af0b6aef1f60", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271518, "uuid": "cd2cee5d-71db-46ec-aecb-aac830e98a30", "value": "8eb428eda6b8f2d2a67d16f7f8de59d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f00975-e470-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626245909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245909, "uuid": "7460764c-e563-4f21-9bb1-70dd11ba904e", "comment": "Malware payload", "value": "77bb91f1bf740216eb95a46bd59acafe", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245909, "uuid": "4a612998-4ac5-48b7-b54b-e64d1f6759c6", "comment": "Malware payload", "value": "28363015619ba05b557c7e22e66a9869cdd02311fa9d04b5d7887083fd2eca03", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245909, "uuid": "c5a68d9a-e13d-4fe3-b138-a65894d495d9", "comment": "Malware payload", "value": "042fe25f0ea542edb55242d062c233de8ef86a24", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245909, "uuid": "dd00995f-bb9f-4593-af9e-fef61e2af955", "comment": "Malware payload", "value": "24e62671aad8ddde1f7ff6b0100e1806cb40b2a655125ab5742720a8e3221a1958064e8f04ffe0a4d3d39f9e312f116e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245909, "uuid": "cc5630ae-b923-4fa9-92d6-9ebf24a4302c", "value": "T171E433D326F388EF2C0BCA39027E4ACBF95609761E6D555DC04644E53EB7C06B7918C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245909, "uuid": "dcc307fc-e492-42db-b895-cf3f4c98068f", "value": "12288:gpYmdgkZKQWRGDl2QyC2xq4rv4OQ75biVgcqVSVMPznpdfrTzj4uA0z1bU:gpYmdzW48C2Xj/Qt6erbpdfXBd14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626245909, "uuid": "5dc5e40e-67ef-4dd8-8a93-175caa7ce462", "value": 696093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626245909, "uuid": "51f491eb-df12-407f-828a-94820eb92f0e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245909, "uuid": "a977adc7-d33b-46da-bd7b-aa192d6a404e", "value": "Payment to bank details.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10ea0dc-e4b2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626274195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274195, "uuid": "de1a95f0-57c5-40e9-90e2-663feb0b8cd4", "comment": "Malware payload", "value": "8594c8ce5e07ba7f0fcab2eb74067389", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274195, "uuid": "d5b37d6e-aa97-41d0-8bfe-1f7b007d01c0", "comment": "Malware payload", "value": "28a134624b20ca70d298b0658dc49681fd7d62a5100c48808c63c561f3a25ce6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274195, "uuid": "ad4b8ef8-7c78-41cd-9318-11865373036b", "comment": "Malware payload", "value": "cb0be4305c288509f7566fccb24c7530653b0dd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274195, "uuid": "50f8e542-3073-4f70-bf61-1d597cb9d28d", "comment": "Malware payload", "value": "7ac93c4f69acb63ac3bd0f58b20fff88cc189ed5e91ae4cf0a1bb06c3385451ebba01bf89845e1512ebdae5bcce1a84d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274195, "uuid": "34bf29e1-35a7-45a3-84c9-553c0574a00d", "value": "T18D94AD7A579C0A27C7BEE2B57AA0F00AF7909C933B11DE0F4BC755C2556B60225C2D2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274195, "uuid": "b3eaa54f-dd52-4591-8f6f-8e2fc5e3a48a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274195, "uuid": "ca13ce7b-c689-41c0-a06e-e3ee198ee084", "value": "6144:S5bcIEikhFLKvC8TCWMvV21bJ71w/BWnhL3mmgcveLWhbuNdAbU:YcnkTeYRwCkgmJNdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626274195, "uuid": "ced56b7b-9fb6-4258-9814-516fdd586c83", "value": 438784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626274195, "uuid": "3f574adb-3696-440b-8a36-8bfb6fbf6429", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274195, "uuid": "4a2a5ea1-6e51-40c6-a1af-ae8310b72788", "value": "money $.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01969ef3-e4a4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626267861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267861, "uuid": "33e28ea9-8a2b-43d7-9dfe-fbc6f05a138b", "comment": "Malware payload", "value": "19c0023d4d2fd009b3cc77cf54deee0a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267861, "uuid": "2f5da8ab-5263-405c-b9cf-fbe3a3390d36", "comment": "Malware payload", "value": "290131c98b135a60ea4814830c3c745bc0cd0fad77a0af909db472c11fde33f4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267861, "uuid": "86b8c6be-793a-4733-967a-f17f25a7ee09", "comment": "Malware payload", "value": "d55be98f3386546bf8b2d5767d7f6fce87071e96", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267861, "uuid": "499c80ab-7cb7-40fb-96f0-d736ca5b4848", "comment": "Malware payload", "value": "e7efd59f5f6423b52af217473d86036d3ef116b0839d53edf838854b2aa024162d345e329d581a8a0bbf34f5c3d5b848", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267861, "uuid": "0bc208a9-3940-4fc5-ba71-b777efcb8920", "value": "T1F2B6BF62724DA2AFD05B0639BC7BDE42943F27B11A118C43DEAC587C9EF3CC4169A746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267861, "uuid": "4a20a50c-aa92-4731-9235-adfe2ff95abc", "value": "29f4f8f8368b26ac6d75757c03ea538a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267861, "uuid": "69f7dd77-a13c-44ee-a205-0dd39731c04e", "value": "98304:P3EhxFlxTj2wNP7kEMWAae6C1S2XL0pOw4Kd/+dZ4ELxW2dc8m8EKLK+9nvOrsy3:PUfN17pZxolKXsnmQLOsdTT1WIqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626267861, "uuid": "0572c96e-1662-4598-ac64-f994d9468f42", "value": 10714624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626267861, "uuid": "b31a347c-24f2-4cad-879a-1074b35693e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267861, "uuid": "db05826e-535e-4420-9509-794c6540db03", "value": "nPedmpo9g5KtYx6x4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659dddd3-e4f1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626301100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626301100, "uuid": "831377d9-7415-4f0f-bda4-443dfadac383", "comment": "Malware payload", "value": "e82ce292a4c410c44c1f4da25d02a167", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626301100, "uuid": "a39a3c01-80e4-4113-af8e-cb111d8a68c8", "comment": "Malware payload", "value": "299dc3bb613a10e1a2d96c3e49d62d42145b1a48fbd6a087da6cc56661e82546", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626301100, "uuid": "fc786978-5a9e-4700-81aa-67416f1b38c3", "comment": "Malware payload", "value": "61d4f9a1ea9457e667006bb8c8911c91ab00c487", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626301100, "uuid": "d74582d4-8a24-4286-a3b1-b3357faa4f74", "comment": "Malware payload", "value": "28af02d320b4c24215d75084bf79377ab7982cc620a8bd76094a9521e4059cca25f5d06e5c351123d3edbd2b3ed3a7d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626301100, "uuid": "5908a64f-133a-46b0-bbeb-644ca1eeac31", "value": "T1A484242864BFC01985E3EEA12DDCA8FBD99A95E3640C743701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626301100, "uuid": "3ef593b4-06e8-474d-af33-2064ead284c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626301100, "uuid": "5c8d3632-e2bb-487c-adda-3cd805510731", "value": "6144:rVwKqovbf+37cAc2FoYj08mnkpFLTmf5fH9:ZwK3vbf+37cAc2FoS08mnkpFLTmf5fH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626301100, "uuid": "d2ce224b-764e-4486-a87e-d38bcaa08580", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626301100, "uuid": "fa7a068f-f9e3-48ab-b815-23116f12782e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626301100, "uuid": "984f01b7-535b-4401-8e82-bae21bac0843", "value": "e82ce292a4c410c44c1f4da25d02a167", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b3f863d-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626245973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245973, "uuid": "d8f5a76d-943f-44c5-a362-91590d391843", "comment": "Malware payload (AgentTesla)", "value": "5f89c3ecd440749a81805c22fd8e0290", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245973, "uuid": "b73ec42e-f281-4b4e-96ab-9467c9165dc4", "comment": "Malware payload (AgentTesla)", "value": "2ab9549c33a603c9c5fb061308f00aed45381483b8ffd4d897d73b2d6e002074", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245973, "uuid": "0ce061dc-4e92-4d27-b5ad-39392daba03e", "comment": "Malware payload (AgentTesla)", "value": "64eb2fe9735e04d4da4ca9596407a01962f7bcc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245973, "uuid": "964409ef-1888-4001-83f2-51165a21a476", "comment": "Malware payload (AgentTesla)", "value": "c8e57735877a11e5d7d840fb04b92680eee7bc2c02fd5c6ae7a82b1bac1ccc405d63190d0d56fb14fa1d2ce984a6497c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245973, "uuid": "d50257e1-d028-4f96-8e4e-2b5da19c3f98", "value": "T133158D2C23FEA749F633FF319FA4A6489FA676B59215DD0D2CC4024B4821C41AEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245973, "uuid": "75568fe1-b996-4a45-8782-34fcda701a7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245973, "uuid": "d407f24e-cf8c-4b72-8b89-730cddf6b3a6", "value": "12288:OnIFwwhrNls9XOd4+QChllhVnp8GmqTN4FXDHDfQzyuwFpDj1FLZ34DnYiyGlvRh:Onil1npDmqTWDjfQuhFRbezucGdEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626245973, "uuid": "4b441583-af17-4047-90ec-bbba289b068a", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626245973, "uuid": "6e62257d-1433-46aa-890f-351d436b1dcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245973, "uuid": "cacae899-86a8-4780-b3e3-b968681cccb7", "value": "ORDER#2349875 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58f7358-e4b2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626274230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274230, "uuid": "656f9c71-b645-4df6-bdc3-2fecaab27181", "comment": "Malware payload (Formbook)", "value": "6904aca678b3f26c76cf49f6e29273be", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274230, "uuid": "81fd9d8a-6565-4d64-9c93-a2ed37d56186", "comment": "Malware payload (Formbook)", "value": "2ad97ebf742720f93f46d8ca3b05f270e4366b1de222d8998e341d5ad431ca4d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274230, "uuid": "416ebeb2-9241-40f9-963c-5a661a7f34f7", "comment": "Malware payload (Formbook)", "value": "68a232a0fcdf27f880c68bc11447d4100ca79a7c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274230, "uuid": "df1101d4-80fe-4238-a283-7fda98aa3943", "comment": "Malware payload (Formbook)", "value": "651c05f40b6393d4bdd2c158ff44db7134b2840153d01d3a2d3025a117168b3fbcac6fe4597d432223ddfde6065a2021", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274230, "uuid": "7ea02e00-d0ab-4c4e-9732-8f2ed49f842d", "value": "T1FFE4233E7527AC19C80BDB7DFC22709BBD52C1E643B42228A953DCAF54E693BC605742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274230, "uuid": "a868be6f-9413-442e-b239-8787201f1d76", "value": "12288:g4yzDO+htk1uYyJhfKM+kx6Sux/Raf/JJwRkEUJrA6EE4XhR:gLKq6uYyJUDF/+2RJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626274230, "uuid": "aaa1368d-4456-4186-80fe-cec912f8bd17", "value": 657845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626274230, "uuid": "38317b03-59e0-433b-a4d1-35772500a9e7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274230, "uuid": "4c865383-854e-4546-8b21-e94ef771bfc7", "value": "AWB & Shipping Documents pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8956807-e4e4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626295710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295710, "uuid": "f33292d1-82b7-4a30-bf20-2e802cc692c9", "comment": "Malware payload", "value": "e5f3ea34422cee906bea0b1a91694894", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295710, "uuid": "641edddf-ac34-4def-8ffe-5ca41048277b", "comment": "Malware payload", "value": "2b09b6af635303708996106c6da642eac0206a5f381b0980d4d45dc9d9aeb1c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295710, "uuid": "1ede2477-0c40-482c-b5af-fdfd45d6d5fa", "comment": "Malware payload", "value": "58dfad976c3c267252416dcaa172ce0fa5dba382", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295710, "uuid": "a30e21a2-a2db-45e0-ad98-aedf30859314", "comment": "Malware payload", "value": "6b94a1b6314613e1691639761ed0284ef6759ca42e621d75fe37a65bcbf2ee100f4a3f82ce6fb65587b7ea67bbc57cba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295710, "uuid": "7f67d02c-a0df-433e-8b70-522ff24b8bff", "value": "T114F296462A365FEDF729C6358BB34A30A75833C566E1E184D36CD9004FB034E686F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295710, "uuid": "c0a89203-8e2d-4675-b823-cb9fc0eb423b", "value": "768:gpoNymYqc+44htCpAfWcLgEXgZMnMN9xMFNMVRL2rXdWvZFSSp2W:TomFS+lGSi1CXdWvZsSp2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626295710, "uuid": "45ae678c-9d82-4e4b-998b-b158f4886d20", "value": 34660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626295710, "uuid": "a0ea8539-204a-4f5e-9c2e-6f768205fc56", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295710, "uuid": "ad919d68-9d5d-449a-a058-ba844255fd39", "value": "e5f3ea34422cee906bea0b1a91694894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a9caed-e436-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626221029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221029, "uuid": "acda5050-67e8-4551-b996-ed2dc5d4f3e6", "comment": "Malware payload", "value": "ad60b38052189512e0af9aa6eed086ab", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221029, "uuid": "33234659-e40a-4a7a-ab9d-1c0523ec955e", "comment": "Malware payload", "value": "2b2d95265dd8d2fe5931cfefb732a253128b12bca0d4b087abfa61342a732b7d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221029, "uuid": "fa053243-b928-4c9e-8347-61db01077253", "comment": "Malware payload", "value": "c62555e85bffca91bd94b165bb45906569a57390", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221029, "uuid": "244d59a4-5246-4e31-ab7c-45cfcd8c40c2", "comment": "Malware payload", "value": "036e27fc89b55bde66222490072b24af70fa64a4046a545f4068d731a7b345f5815d2ff159645969c44acc4b5a8f91d0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626221029, "uuid": "7b01b21f-ac87-4332-bfb1-f10afc93da84", "value": "T177D312ABCCBB89CEFF6A8FB516170D1F1EF6A1D5E5843D68452B108027F8242A514B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626221029, "uuid": "283e4750-3d13-4ba9-88c0-fb72b4a784d9", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6cop:7O/QJHZweEL/NOjCHm7FZZncw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626221029, "uuid": "0d357410-2c4d-4b73-b77e-542a0a0f490d", "value": 137480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626221029, "uuid": "bcefc2cc-6fdd-4a2e-acc0-5e85a40a3692", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626221029, "uuid": "0753a02e-621d-4457-bd15-0f6ad3831912", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9101dfa-e4bc-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626278558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278558, "uuid": "99026654-eca4-4840-b22c-b4b58f8e9a58", "comment": "Malware payload (Smoke Loader)", "value": "1f39167eed0282920d66cf36d31150d2", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278558, "uuid": "eccaec88-39fd-4f1b-9e6e-9bc08ed4e35a", "comment": "Malware payload (Smoke Loader)", "value": "2b4e74f6d31e2ce71fa3de3caba5fbf6b070885d43c956aa57deced79e79826b", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278558, "uuid": "c16c626e-5144-49d0-9d43-7d98be84e270", "comment": "Malware payload (Smoke Loader)", "value": "57c153fed1aaaaa334c7467232721e103bc530d8", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278558, "uuid": "880359e7-c095-4ec4-8d4b-f665f6d0f8d4", "comment": "Malware payload (Smoke Loader)", "value": "3fdfa3462caa6fa7be3370ee1ea698871ae7edaa9dd840a24355a4db30e26933189827795ebda30a0645e1fb494d87db", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278558, "uuid": "6f9fbb58-167c-4edb-acf1-6d7aa3791e26", "value": "T16E14BE2232E1D032D6F745306874D7A12B7BBD336A70858F375427AE5E312E1AAB6347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278558, "uuid": "36b53ea7-e3d0-4249-9a6b-24def3f04cdc", "value": "f9c1cf1b2cfb3ee96a94f56e9a89c09a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278558, "uuid": "68008387-401e-4a02-9b1e-6061403e890c", "value": "3072:QBNmIeRM1GpAVWyz14QcaFGTuVrY8VoMm5OhL8YAPHL:44MIE7KQDGSNY0ooAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626278558, "uuid": "01666a38-7aa9-4f3e-b5c3-6890a053f8be", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626278558, "uuid": "e061bfbd-978c-406b-9f1c-0d2ca04a35c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278558, "uuid": "ba0ca50d-b157-4762-9517-497721dd235f", "value": "1f39167eed0282920d66cf36d31150d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd704df2-e4ad-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626272042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272042, "uuid": "d2e67edf-877f-4d5e-afad-200f4c920cfa", "comment": "Malware payload (RedLineStealer)", "value": "a02b1751aa8ad687cdf14a4f3fa6fedc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272042, "uuid": "f1925e4b-f4c2-43ac-a326-b2c2f334508c", "comment": "Malware payload (RedLineStealer)", "value": "2bf5bd2d97946faf0fae3e44ad8baed8b81d12b7d42cebbff743a839180b7df5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272042, "uuid": "43583744-3b28-4a13-8770-60fe5bb186be", "comment": "Malware payload (RedLineStealer)", "value": "52a3a5658084cd8af7adff5d8a36f561880ad369", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272042, "uuid": "7bcd2002-f9fa-4841-b3e1-0f91d6552e92", "comment": "Malware payload (RedLineStealer)", "value": "be4e5a0c158c791056b8ab2df0195d46e3d43ad3063c686b66910bb666ab257eca512a69f89efdaa0b010443ad92c54f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272042, "uuid": "535c569d-0671-4ba9-8d0c-92dd94e0bc5b", "value": "T1DD84332864BFC01984E3EEA12EDCA8FBD99A55E3640D743701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272042, "uuid": "e9f74626-ccd9-4ace-b563-20c9f9f760ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272042, "uuid": "1a030dc3-918a-4824-9527-7f164178441e", "value": "6144:QwKqovb6eB37r3c5/B21EonFNLTm+rDO6fm:QwK3vb6eB37r3c5/B21EonFNLTm+rDOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626272042, "uuid": "a850a0dd-48d1-4b50-9940-87069f2e6d81", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626272042, "uuid": "1a7d90a5-b6eb-486f-a354-afd76ebd0526", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272042, "uuid": "0508cd1b-26b2-4c27-b264-f4e148cbacf5", "value": "sahiba_8.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c168901-e44b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626229707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626229707, "uuid": "a0593fd3-d0fa-4d86-82f5-9075df4dbdd8", "comment": "Malware payload (Mirai)", "value": "21cccb60c112f9c6874c5e8608c57008", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626229707, "uuid": "9c5adb33-44f8-4f19-8205-9e54833d2465", "comment": "Malware payload (Mirai)", "value": "2c90d3e240fa075396b906452f52aceb925727d668cc2e05de034e7e41ed6241", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626229707, "uuid": "960a6f5f-d2ed-45db-b231-7d570bc9f862", "comment": "Malware payload (Mirai)", "value": "b983af93501e90a8c6636db972b9ec7dbb2e3886", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626229707, "uuid": "aec843a9-7480-43fa-b2fb-f45d23881d45", "comment": "Malware payload (Mirai)", "value": "d25061d89acfde6c1aac86de5558d22ffd4fa52ee5e3da8825cc7429ff6537253b08d61f09b278cf229eb75a40a09e7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626229707, "uuid": "49e90dc8-5ca9-43e7-af77-de240f78ebcd", "value": "T128137EA2C42DAFD4D1488674B9284F781B53E401C7536FFA9AE585A68083EECF61C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626229707, "uuid": "689b3170-4f96-470a-ae7a-6f8ed29e36c8", "value": "768:2aqp2wtrGLR/U0JoePTz3BVbgrqqx29//qUCnoqs8CL:2aI2wt660Srq025/qUbP8CL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626229707, "uuid": "6bf9a90d-63d9-4770-acd2-e4c19af318f2", "value": 44332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626229707, "uuid": "4dcfa026-19f5-4b25-9cd2-f4eba05662ea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626229707, "uuid": "932e362b-db37-49eb-9704-9b5b14a695bc", "value": "21cccb60c112f9c6874c5e8608c57008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8997531-e4af-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626272920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272920, "uuid": "97b5db15-30a4-406f-88f0-b17c182f2ecf", "comment": "Malware payload", "value": "1172f39d2fc1e1407eb42e57020f35b3", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272920, "uuid": "efe7e221-e965-4150-98b8-4d38553d4107", "comment": "Malware payload", "value": "2cce193df6bc2688519c7afe09b9f4ce6dc7b35178a787635d7d3e3705023f66", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272920, "uuid": "2ca21ac6-51cd-4011-853f-c2f5f45488d8", "comment": "Malware payload", "value": "dea6cea14aca7f8951b5551cb84cbe69804200f4", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272920, "uuid": "49253546-925a-4e28-9e00-98a4afdae919", "comment": "Malware payload", "value": "f57f916d2c4fd79bae5fa53adcc35971895a9b085033340004e0ae5b35fad88e03b34c2422b26c8a39494df372e409da", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272920, "uuid": "45338e67-09d3-418d-a47b-735e5bb8dae1", "value": "T1D6551283F194CFA1CEC600F7C772E4BD81D0EC58223AC59E0AA83D6561B1DAEE75265D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272920, "uuid": "4d57ce5c-cfc9-4a47-b6a6-c8e04e3801ae", "value": "24576:gw7jBM+VWqCS84Q7n/RSNFYUvpTI0gWVIX+2oElMDdrjyYQyKbTFRYDxSw8ESSSi:h79YqCT5rLUvpuWVI68MDd6FyyTF0h4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626272920, "uuid": "5a7ed0cd-57a1-473d-a2fb-c965d0f75d0e", "value": 1289144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626272920, "uuid": "6b10900f-3f0d-417a-8d7f-0ddbb3a4cb61", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272920, "uuid": "ce3c0a1e-062e-4eb3-9bf1-4c7cf1eb98bc", "value": "Inquiry.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794182bb-e4b4-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1626274934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274934, "uuid": "c9781ecb-5c42-4aec-ad40-ddbe53c10439", "comment": "Malware payload (FickerStealer)", "value": "7dd29ec27b1dd12ff912e22e3479aa30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274934, "uuid": "1150639c-f05a-4ccd-8f7d-7a89a943c05f", "comment": "Malware payload (FickerStealer)", "value": "2cdcf5768194724dedd99ba265e12becf5c89aa6e7ea311e36cddf9d89c186ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274934, "uuid": "40e67e53-eab4-48e3-8b94-94447dc6aa1d", "comment": "Malware payload (FickerStealer)", "value": "5b1c0237b015ed6d8550b7ff7e8181d0d13dbdaf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274934, "uuid": "a16574aa-43ea-4d21-9c05-d48997d09193", "comment": "Malware payload (FickerStealer)", "value": "3c5cf838127b98dfd5a924e8de54700e7d77a9454fe76baa9ce6d3d3d196af1bab56d12c4479f7391b69fba272d24d92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274934, "uuid": "78064ffc-7e04-42ec-acfd-54a87a8bad8b", "value": "T15145F01236259610D7959A7D859F843D0782ED63EA32B78F3FECBE4A39732F10951382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274934, "uuid": "bceeecd9-11b3-4884-b12e-19ce4badab51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274934, "uuid": "39a224d5-aa31-4af3-b890-7caf15d9b59f", "value": "24576:Nv1fgWa9FXbPjgnYq5+wCMNvCbQKsIgQ+S5pUj3wHRx0zsopp/q:FAXbjgYq4wC4kQK1gQJLUj3w4zDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626274934, "uuid": "11925167-cf35-4d85-9312-98c0321edc52", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626274934, "uuid": "17ee59ca-09b0-4c21-a39f-cc305caf1fcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274934, "uuid": "72ef278f-e578-43af-87e0-6f57b9aa9e50", "value": "7dd29ec27b1dd12ff912e22e3479aa30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e9bab7-e49a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626263674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626263674, "uuid": "1ad4bafc-e522-4128-be66-1f4634b69a95", "comment": "Malware payload (AgentTesla)", "value": "28e7930316f1e0cdcb8a34b9a9a233ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626263674, "uuid": "a15e540b-5516-4b31-ac2a-4a2dfe186137", "comment": "Malware payload (AgentTesla)", "value": "2e8f1d1e22c5a36b95634aafb27418f9d1fd9000ec81e859f327588a70d402b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626263674, "uuid": "933a8cb5-dca3-4520-8af7-8344c1f635e8", "comment": "Malware payload (AgentTesla)", "value": "412442448d7aeb121ba3c0f2255883901196c92d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626263674, "uuid": "393f953d-4b9a-4fcc-88f5-fa7be72eaf42", "comment": "Malware payload (AgentTesla)", "value": "a1e316b09cd254362248d3800c761c8d74cfcf5ee41a71ba283fa45b424fc482acf13ad6bc87473e6a7945355fa219c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626263674, "uuid": "a0ff1539-cb2c-44e7-a2f0-3a41817320fc", "value": "T191158C2C23FEA10AF637FF719FA0F3459F66667A9229914D28C4030A5921D81FE77532", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626263674, "uuid": "2728d0cf-d7d9-4855-9a9c-803ab92fe5ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626263674, "uuid": "034440bd-e98e-4b2d-ad9d-64aa53af874a", "value": "12288:4ErcBPoOJQwVSLWy47XcTFwUpwxfVb+iF3q7Gl59G+XXN5GnTOdU+CHpZsPCA:aBjHVMWy52FZZF3q7s59Gu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626263674, "uuid": "ceac6aa7-03d4-4351-a5bc-d6588fd76297", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626263674, "uuid": "4bd39c08-ff60-4d3c-b042-5be720a79324", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626263674, "uuid": "38fbefc9-3d9a-4e5d-82aa-3e55e445d815", "value": "28e7930316f1e0cdcb8a34b9a9a233ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d35792-e469-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626242609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242609, "uuid": "0123bdaf-26e8-4670-8e80-4d19b8fd703c", "comment": "Malware payload (AgentTesla)", "value": "cc6b791a4293d06e1e72f1d830d5a1da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242609, "uuid": "1c5289de-3c99-419b-980c-ac6b80596dcf", "comment": "Malware payload (AgentTesla)", "value": "2eb4a6d6c862c2c885d510992183534887334fa9b2b5469f27e84f92d49065c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242609, "uuid": "aff41416-5594-4f46-9e33-9139570ebd39", "comment": "Malware payload (AgentTesla)", "value": "3c0ba7d6b59588d3273b1d513b10b7ef0648a30e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242609, "uuid": "fc0fa103-6a33-43e6-872d-e4f7e31980a3", "comment": "Malware payload (AgentTesla)", "value": "dcee29df6e8bd2fbc533f1789080f7f2514b5766bf5be59dbfbb91c43b31e827b8e5a6d41d222d925e3c9d99e3cb641a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242609, "uuid": "cb5bb546-6cb2-42d6-9fba-10b7c9d9b98e", "value": "T1ACC4235B939190A4C64E1394024A096750F38FBE171828ED78EB42971FD5EBEF9CD8F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242609, "uuid": "761d8b2f-92f2-4d08-b7a9-62b33c3af58b", "value": "12288:hvUjlEkoj8uxgPpsmL/q36GdGmhLpV97BPHuYxaPosHWfqsR:hMZuk+qGAmPzBOahsHCqsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626242609, "uuid": "ca1c8bf7-0b87-450c-86d3-d5d56b4e91a4", "value": 569947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626242609, "uuid": "543677f0-8a05-4953-a4b5-c2ba8951acb4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242609, "uuid": "c434c796-62bf-4628-ab1b-8f79903bc5d1", "value": "UPDATTED S O A -49565467G.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0cb15a-e49c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626264446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264446, "uuid": "eb0fea1e-8f1f-466c-a055-73b416df67f6", "comment": "Malware payload (AgentTesla)", "value": "09c2d15aac6f9caa7f9147bfc8270c9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264446, "uuid": "22524c76-d7fe-45a3-b727-0a02d8abfa33", "comment": "Malware payload (AgentTesla)", "value": "2f985146bd48c99dda0c7152c41faf644c1bae7c62d57b0c28d918879d38a943", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264446, "uuid": "8c582b6c-156d-4124-b366-58730a576765", "comment": "Malware payload (AgentTesla)", "value": "ddd8b67d83c70e353d07f877e673acc05a987676", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264446, "uuid": "596f23f9-b8e3-4d9f-a700-89fb84734684", "comment": "Malware payload (AgentTesla)", "value": "6a94bf9f7f4010387fbb31c7617814a2565fbc236af4b1836a8fd4e21547de2150db413af5c7de46b13d1f81eee69b9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626264446, "uuid": "50fe7e4a-3e19-41aa-a980-f02ac1876c43", "value": "T181258C2C23BD9239F6F3FA315F90A6449F9666AF52159C0918F0CE067433C45AEAED31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626264446, "uuid": "b4329264-2b1e-4728-a8d7-8f1f1917c4ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626264446, "uuid": "c3aaf0a3-363a-4506-919d-eab5e8231941", "value": "24576:bh+tS1l5qAKKpp8lT0btD+QWIXSImZ7sx1Oq:bhSSrxKKQlTOt6QBCVZ4x1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626264446, "uuid": "0ca7d755-6cfc-4d1f-a825-6254d40643c3", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626264446, "uuid": "455e3548-a020-4f88-b8d5-b317b150c02d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626264446, "uuid": "3334ab4e-8f04-4721-81ed-39f2689c427c", "value": "09c2d15aac6f9caa7f9147bfc8270c9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee0f316f-e476-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626248501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248501, "uuid": "f61975f5-19f1-4536-a129-8017c18ec68e", "comment": "Malware payload (Mirai)", "value": "2524751a0fef892101db6b2136e094b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248501, "uuid": "b10ab144-c767-43f5-9185-30fbc84693b0", "comment": "Malware payload (Mirai)", "value": "2f9d22158a9d403bc62730f54aa4d237a553c2cf81d6f426e870c933fc0257e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248501, "uuid": "a84db7a5-0fe1-4851-98d6-d1effa898898", "comment": "Malware payload (Mirai)", "value": "04c638ed336b67d49a704891e18137f825c3bfd7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248501, "uuid": "a5baa7c8-579a-40e4-8ab4-ae0d10a7fa40", "comment": "Malware payload (Mirai)", "value": "8e7a9c85958c813a44b845c7a0f96a795d0bdcda9d4070cb31bc593c248a78abe2ac3e996d18f5305458e1520b100f8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248501, "uuid": "b3e3efb9-4710-442c-99ed-69425d476a0e", "value": "T18EC2D0DFB49A7985CC1C5CBC219D5AD1166DA2C3234B9F0837102DCDA6B645FF89C4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248501, "uuid": "7c8ee6f3-7b93-4ab9-bcdf-4b818fc581cb", "value": "768:w4CUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdBpLWa:/CrJgHiOJrfwmQrcth/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626248501, "uuid": "a8756bdf-3f0d-41b3-bb8d-e91bcbde2d75", "value": 27236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626248501, "uuid": "e9ca67a8-b1bd-49e4-9e98-9adc79c4884d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248501, "uuid": "d684b651-53c1-4c17-b780-3cffaff36aae", "value": "2524751a0fef892101db6b2136e094b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4deeb286-e4a4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626267989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267989, "uuid": "68eb90a5-c7e3-4a53-ac7f-045a397904c5", "comment": "Malware payload (Mirai)", "value": "dcb7fbca24a0ceba192c48fe5ee5d249", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267989, "uuid": "304a92b3-2215-4cf5-b95f-735838b675ff", "comment": "Malware payload (Mirai)", "value": "2fc2a2e326040bb809a32526c5135515e64a524a92f65f08988a9b27e1345706", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267989, "uuid": "29493d20-7693-4237-a941-b621a3d1e4aa", "comment": "Malware payload (Mirai)", "value": "78f333624ccfe4c02a239d6e105afb5e2a419286", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267989, "uuid": "0de6cf02-9f7f-438e-85dc-927df939a6a3", "comment": "Malware payload (Mirai)", "value": "73ee38adb1edf9b87b58acd93cb6a66f17817e7a1cfe946942c6831637d9bf5be7b54b1929eb7efcaafe03d75b6ba304", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267989, "uuid": "7ee5d89c-85e7-47c5-a407-8675fbc88b0e", "value": "T1AA63961A3E219FBEFBAC863847B74A219658339622F1C5C4E15CEE015E7034E745FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267989, "uuid": "df77bd9a-4e1d-4eb2-8cfa-db73476e603b", "value": "1536:AHNFnXDuPq/SyZBp9tsCI0v6bqfg/Kkz73o2x8qW:gNFXDKGrJI0SWYz73o2O5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626267989, "uuid": "24e18923-8588-4424-8d21-23338d41ab37", "value": 69080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626267989, "uuid": "1528eaf9-5b87-4197-869f-49cd16fce288", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267989, "uuid": "ec0dad79-205d-4ef7-805d-dc27c43b8d58", "value": "dcb7fbca24a0ceba192c48fe5ee5d249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1103c4-e4e4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626295689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295689, "uuid": "68e824f6-9d0d-4f92-a315-92462744d9bf", "comment": "Malware payload", "value": "135b1624149b32acd2216af5e9a8fd8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295689, "uuid": "776e6607-abb1-4538-ab7e-327d7e5ad59a", "comment": "Malware payload", "value": "305dcb74e0df5875776a015866e579a5366e2d54cad7910fde5ecff1385e944b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295689, "uuid": "33eadaac-c167-4059-9020-4b8614a5c53f", "comment": "Malware payload", "value": "3101b43d7cc15bc3d4c607ffbd43e27918df4b89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295689, "uuid": "4e577761-f3b3-416b-a6fd-1f63360cb80d", "comment": "Malware payload", "value": "4ec6ba2c1bf7d89e98dab5a097024bb8e3751257961618980159a3e393de31b4e3f1aeba2f6ddca271bd893edbec8ceb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295689, "uuid": "45fe535f-768f-4b45-938a-d37c43d1bca2", "value": "T123B25DA38A792F18E258C5B4A011CF385753E516E94B2FFE6436C3665043EDEB14A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295689, "uuid": "e874b275-9c9b-4b54-922d-753c612b3319", "value": "384:f3A4kyyPD21mC/5gGoIfDGHVjrP7RfMT35oJ/NqBAbC5/oCSe:f3qpiVmG7bqVyo5NQZoCSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626295689, "uuid": "461d8581-fe25-4abc-933f-5e40f608d2d9", "value": 24208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626295689, "uuid": "a4b5a5df-7b5b-498e-b9f6-6cdc9bd62ca4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295689, "uuid": "aa1905b6-19c6-4f41-a400-64962472e21c", "value": "135b1624149b32acd2216af5e9a8fd8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756caf08-e4e5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626295973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295973, "uuid": "e64caa85-819e-4ded-bf89-5a056b3864b7", "comment": "Malware payload", "value": "3b747461ff095fe8d4164e238a910ee1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295973, "uuid": "89f88a70-a082-4fd7-9edd-e389287028ea", "comment": "Malware payload", "value": "306affddd2386dc84687b2c10677209d60bce0e090f6f85c2823c1e45fedc086", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295973, "uuid": "dc3b08db-34c5-491d-9304-ecbc7cfa7cb6", "comment": "Malware payload", "value": "e99fbdbe51f434a6a4e0707e3ab3ab6ed3060b3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295973, "uuid": "f30f6983-9a69-42c9-a71a-00e5f30f9fef", "comment": "Malware payload", "value": "a0a17ffc962f6e828fbf80d58e14a3743e01180ce14b8795c1d7f7a39f834fe9a676c777657a29db2b52c5500764df96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295973, "uuid": "bc416fd0-9345-459b-83ea-c1a29ab8217d", "value": "T168B22A82AA83F9F5F824C7B5D837AB727372F42F2459ED96DB5B1C34A842001D25329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295973, "uuid": "aec02b81-4121-4bfc-9877-a00325620fb4", "value": "384:fIDU0VIjqfLKKor1aKMztkxI9489HdTwLvPV5l01yXA1duJq:wDU0qjMKKA/mJbdELvNr0EQ1duo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626295973, "uuid": "93c7500b-c5a1-4bb0-8a6b-da9c59e57c8a", "value": 23592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626295973, "uuid": "4e8f463e-cfa7-45cb-9dfe-72d3b50f623b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295973, "uuid": "aa37fff0-47df-4993-8f74-cd9b3f17183c", "value": "3b747461ff095fe8d4164e238a910ee1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c861e5f-e453-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626233144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626233144, "uuid": "0b76c0b8-a59d-4d76-88a1-734b381c4d5c", "comment": "Malware payload (Formbook)", "value": "d63397631fb1e664a3459ddd47e08100", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626233144, "uuid": "7f4ed0d8-eb0b-4130-a62b-d9f7a065e4cb", "comment": "Malware payload (Formbook)", "value": "30e3ae78d7104db0f2d4efa2d4588b1dce2e37a5f2a51968add9337108e1d610", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626233144, "uuid": "8b637579-86df-4f45-9214-296dd8576607", "comment": "Malware payload (Formbook)", "value": "df537e52ff6c8dc5ae354f61daff955cefcf8c2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626233144, "uuid": "6f95aa78-52da-4043-8413-81ad35faf3ca", "comment": "Malware payload (Formbook)", "value": "22f5a0808d7842cbdfcc6ab08c5b78caa995ac60e7c267ab9f9f095da21eeaa6e5095bf889c88e22d4951d4f913cee1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626233144, "uuid": "df9af927-fdec-4487-a347-67f0785445eb", "value": "T13A158C2C23FEA109F637FF719F90F3859F6667B99229914E1DC4020A5861D80FE76932", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626233144, "uuid": "313db129-b063-4ddc-8740-2caa10ef6831", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626233144, "uuid": "4eaa6356-9e7e-4f8d-8805-7d1b6436f19c", "value": "12288:3XNvm/zJ1F6kvdie4aBRWA2bwDWhfRdCZ9SY4uOJdQDbY/J98UXN5GnTOdU+CHpI:39vm/74klirhAwEw5dCZ9S5uO8Wvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626233144, "uuid": "159d7347-811d-4b46-8005-81911ff20966", "value": 881152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626233144, "uuid": "3efe45c7-44d0-41ff-b60a-8a52074fdcb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626233144, "uuid": "6e251218-8017-465a-8a16-50020f2e0fe8", "value": "d63397631fb1e664a3459ddd47e08100", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fbae3e-e46f-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626245166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245166, "uuid": "964adaf5-c628-46ee-980d-e1485cbb2ad7", "comment": "Malware payload (Loki)", "value": "270df3a9e934293fc5969f722f3e1611", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245166, "uuid": "874aa69c-f601-47ef-860a-747ee7fcb1c2", "comment": "Malware payload (Loki)", "value": "318f320b2aad6ce2be54a45efb8cb065bc33767ce6029f952c26d96ec08076aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245166, "uuid": "d8a6470b-8a7d-424a-83f3-47041fb82590", "comment": "Malware payload (Loki)", "value": "a21847e9a9cd6304edf3340fc55e16327d686a13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245166, "uuid": "388312a2-8018-46c0-96ed-381d7a506488", "comment": "Malware payload (Loki)", "value": "d44c8e57367c3288581a48f14fb850cf1b90a7ef16d9e1e926d7dc3c01b563562b46b1e89e2902f50234befb3ad728a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245166, "uuid": "2f04fbc1-f183-4117-ab0f-4ae054fa1dc5", "value": "T150F46A2C23FEA719F233FF359FA5A6449FA676B59215DC0D2DC0024B4421D81AEA7D32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245166, "uuid": "dc77aa9d-9a08-4706-b077-e1ee130c7ac2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245166, "uuid": "616613a4-7926-4cce-9b8f-9d497c28aeeb", "value": "12288:o+IFwpwrNls9XOd4+QCAEClM/0YiBDNHFha5wWu9mh/sUAgGru3utmjsSi16XaiT:o+PECl19NHFhzrwEUAlru3utmQ+aGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626245166, "uuid": "7299d5f9-1d0b-46f7-84cf-4043d749e48c", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626245166, "uuid": "8f6a887c-7e82-415c-9307-192aa95e22b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245166, "uuid": "cc27df51-3a5c-47c8-bcb0-2153a8778397", "value": "Account Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ababff8-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626246106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246106, "uuid": "8baecaa1-c120-4349-ad17-6b98efaed374", "comment": "Malware payload (SnakeKeylogger)", "value": "2f863da5ca0c5d317d2ae12cca845cc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246106, "uuid": "8a89710f-1874-4005-8d50-2bf777ee6710", "comment": "Malware payload (SnakeKeylogger)", "value": "32215f4653e9703cdf46d43dd3d042f74cb60bd53b4caf2e634c448984f0869b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246106, "uuid": "7fe29bc3-a0df-4493-8e15-d028610b5d63", "comment": "Malware payload (SnakeKeylogger)", "value": "f6d2a2cfb8863d418f7eaaf2c9cbaa593f6f7df5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246106, "uuid": "4adbd1ae-4afa-4fc3-a62b-97876db77743", "comment": "Malware payload (SnakeKeylogger)", "value": "8ba5a27d52c59c6f8a81041a34cf2ba6670ce4c61c874b2573c43fa585cbbc6a6dff33335dc4702ff56219ac01904c76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246106, "uuid": "d91392f5-a430-4e4a-b3f5-e68ff9d1452a", "value": "T1CE058D6C23FEA209F637FF31AF94E7459FA666B952299D0D19C4020B4421C42FEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246106, "uuid": "f94e2cff-1828-46ac-8652-614f04012e10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246106, "uuid": "61bf72a4-9d0f-423e-a260-44e4e46f4de5", "value": "24576:RhdtS1lpKTIjJXsYU67r7CBwMLK71Ony7CKD:Rh7SXbJaAr7CSML4syu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246106, "uuid": "ec1661b6-c622-408b-bfb6-7368df9b723c", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246106, "uuid": "8075e76f-5f8d-418c-a32c-adbe64e23cd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246106, "uuid": "a97eb617-a42c-440b-bfdd-7f80c9bc6603", "value": "Orden de la semana 27 .doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220c7162-e484-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1626254172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626254172, "uuid": "f0ee6a3f-6ed9-44e2-be00-31f2d0a05523", "comment": "Malware payload (AZORult)", "value": "fcbde06bde3730901f1b2c2cfeb18ee4", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626254172, "uuid": "d539bed1-b7b2-40a4-92cd-b00435cc9af9", "comment": "Malware payload (AZORult)", "value": "32d8b8a96f27bf6dff52401327d6486d98e8ab30cef755ef6e76f123c013a27f", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626254172, "uuid": "adb4df90-6271-40d0-84ba-4eccf8228b96", "comment": "Malware payload (AZORult)", "value": "c414be884b08846048431d1a6fb7fe7f92afd588", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626254172, "uuid": "deba37ce-eb21-4366-a782-2d672f5de0b6", "comment": "Malware payload (AZORult)", "value": "4bf0e78901f70baa14fade7bf092da7777de2a0a8ef3ccf618337caeb6053538f614997f0c37db051c3bf5e37baab33a", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626254172, "uuid": "a7fd07d0-f12c-438a-9222-f87d72cbd2e2", "value": "T1D405BEAD3250B6DFC96BCD36C9581C24EBA0B477930BD247A05314ACAE4DA97EF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626254172, "uuid": "a85a1f3e-38f4-4998-a0a1-576171f05fd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626254172, "uuid": "e3c51cdd-e3a6-407d-86b0-45d53015bf5d", "value": "12288:aWt/ilcgnPhAzXlLfjgBi572kgxuwzLPKHhbm3lTYomEQIZpfm43QDFzWeby72Qt:a+Jz1Lrg8572kgxNrgBm7ZY43YR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626254172, "uuid": "dd4aac5c-02e2-4675-bbf1-170e1823f40f", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626254172, "uuid": "53d86e53-4261-4683-b20f-a44cee3e70cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626254172, "uuid": "c9534d36-7c80-4f36-8e8a-ad3f502dca1a", "value": "e-dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94db1c9-e496-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626262264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262264, "uuid": "a3d5e70c-2009-4e73-bda2-80dade22b3ba", "comment": "Malware payload (Mirai)", "value": "d2f485d56c58e6502236b11cf2fdba21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262264, "uuid": "c15cea11-742e-49dd-ad0e-1518f248da2f", "comment": "Malware payload (Mirai)", "value": "34a898840165d357f34b67332c492d0db74483d631a1de36146f8d81236427bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262264, "uuid": "4696834d-46bd-4cd3-aaf7-4d3c5a41d889", "comment": "Malware payload (Mirai)", "value": "ba6ae12ab90521361fe48f4c941ddaf83dd80ecd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262264, "uuid": "81504ca2-e6a9-4775-8496-37331ae59ec1", "comment": "Malware payload (Mirai)", "value": "b487f290173b03db6025b59263e5cffdf82cfc503a0b05f4f697017e7850233cc8df5944c17162bc2df801b63ab1230d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626262264, "uuid": "fe7b9019-b416-4962-ad65-d95efb3161b5", "value": "T15703F1B202E78E7493B82EB1AD9B10C3E90B0335C2E143867EE581CE75942636669F57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626262264, "uuid": "9de252f0-49c1-445e-8896-4e67d57a36ee", "value": "768:hcxFZqtwpIOWSOy/oiBdrnla/7i1iO3R6H/RQcuEibBWVfaq3UirF:h+/DOOWSOy/vC7i0cRA/RNi9WVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626262264, "uuid": "67b946ee-7d6e-4161-99ab-e9120dc4e2a8", "value": 40176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626262264, "uuid": "78e25d60-3641-4ff0-bcf2-190baf541d66", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626262264, "uuid": "b7e940b1-0b99-4c45-86f5-1183443105e5", "value": "d2f485d56c58e6502236b11cf2fdba21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003ef10a-e476-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626248102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248102, "uuid": "fb3b687c-0a76-428e-a7b7-baf9f4be4ec9", "comment": "Malware payload (AgentTesla)", "value": "633004983b547ded7c05b0ff9ab6c3e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248102, "uuid": "d4304fc6-343c-4e7d-b63f-ee5268873ed9", "comment": "Malware payload (AgentTesla)", "value": "34eac697323d1d2407c9d730ee4e4739f03b6fb48b7d1eaeb27e989316e28846", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248102, "uuid": "c466e9a4-10b9-41b6-a31e-a34e22a32cd9", "comment": "Malware payload (AgentTesla)", "value": "c3529e1953d4c7b2286629c77a22f23bdaa58d46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248102, "uuid": "0b8c237c-8f07-4b71-9620-2ce91646db5d", "comment": "Malware payload (AgentTesla)", "value": "40c2786915c4c4ff51af78f1f8cdc36cfaf1c1e5edf6ed5e41e48445cbc47da8f677c5033c9a96709cdbb083f1c8db8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248102, "uuid": "ee817bc3-d8e0-432f-89e3-b87c72f0808d", "value": "T12405E07A179C0627CB7ED2B87A60F006F760ACA23B11DE0F46C771C5646BB5129C2D6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248102, "uuid": "944b3719-3b5c-49d1-b4ae-56aa1a0cb03b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248102, "uuid": "e9c56cad-ecb0-4fd3-8e6a-cb40a5a80cbb", "value": "12288:tNa99mxX1vjEuRImXRfx6+MiXoEqHOWhwmM+A2D4EdeY5Bs3OMDGMqJbw:tNx5RImXRoB/hJnlAyPoe82Js", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626248102, "uuid": "c5735f9e-91a3-4a5f-a588-207aef77bcd7", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626248102, "uuid": "4eaf762b-ea06-47da-af6e-522ffdec4ef2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248102, "uuid": "e818c94e-a560-4b00-b6ba-5273abe2f7fe", "value": "swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f96f7b-e4b2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626274261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274261, "uuid": "15878651-b482-468f-ba00-6a7ce3c5d23f", "comment": "Malware payload", "value": "e8f43ce8f7f7a4c53756afeb6df3fb18", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274261, "uuid": "4398454b-a96c-45a0-93bb-9720e552e469", "comment": "Malware payload", "value": "34f8fcd41b90282f469dd0bd1253c962fd9417b072229d2139b9a7bff45c5d3d", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274261, "uuid": "50b11afb-340c-406d-9eb5-945b706b8382", "comment": "Malware payload", "value": "45a3bb8a69f7a31dd5709af05c05ae8af5d79bbb", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274261, "uuid": "592eb3aa-67c9-4c23-82a4-3c93d9601304", "comment": "Malware payload", "value": "f9432f798bed477471b200b54bcbaffe40b5f4cdb77148263ec4b51e84961f9277f340cb546e70e9ab4b7d1423521c83", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274261, "uuid": "21a621d1-02ac-41b2-98d3-863d8e20e387", "value": "T18AB423E4B05377329F17EE214328E96F3F2FBA5B68241F12AF25355325293848942ED7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274261, "uuid": "c6cda0d7-e37d-4a6d-b81e-8eb885b546fb", "value": "12288:FJYqth0Hrl54rhA8RI57bE/p4eTw8NgaVjwiYYET3pvLc:nBUHZerhAx8zQMLBK5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626274261, "uuid": "de50cdef-a62c-4c88-a6e7-85db2825b97e", "value": 522191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626274261, "uuid": "11eb755c-fe6f-4fef-950a-a58e8fc70a2d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274261, "uuid": "b24716e2-a28c-46ed-af56-d081047fe71d", "value": "BKQ82872.LZH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae41a98e-e4cc-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626285331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626285331, "uuid": "2e17547f-4332-4eae-b2fc-9d3bd7021bca", "comment": "Malware payload (RaccoonStealer)", "value": "1bd71c308fe8a1dc8bcd05c011d19f97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626285331, "uuid": "ba190518-95d3-4aa1-9f86-840ebdb2030c", "comment": "Malware payload (RaccoonStealer)", "value": "356e6444780389e9a1432eb575cea622a01bab5d8331f1c3b13046ca8209d06b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626285331, "uuid": "105e22e8-9576-4dea-94ff-b349b9cce291", "comment": "Malware payload (RaccoonStealer)", "value": "79b7d25e1bdce5b535e04383a9d2d96a8c668f96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626285331, "uuid": "bbf40696-745b-47c9-9f61-6f2c3ad28a6b", "comment": "Malware payload (RaccoonStealer)", "value": "0bd2b5a5b9d26cdb614995f2b08da14b04233df8611c118a74057feecd669b769e3025a2c77c96b23469d2d11e0276a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626285331, "uuid": "99f7d1e1-4112-45fa-bd5c-a28bc9317e20", "value": "T1E4D5333F5AD440AED18243B1897957A84F6898D3A45E493B7332A9683DE73D0CB4BF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626285331, "uuid": "72d88c9e-e61c-4497-9e0e-9a266668382e", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626285331, "uuid": "fd25ac00-9fe9-4b14-9e9a-f8db901b8ec8", "value": "49152:Eg+2XxYo2dCc8jbc+2/5LtqkBEY4F295VFKyZZtqLsl1xuL2gnOf5mtDIKk5wva:JPX0dC53cv/NtnBP3Z7q+PgOf8tDUwva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626285331, "uuid": "98f471ab-9d16-4f1b-9519-dccf258a7a1f", "value": 2880526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626285331, "uuid": "f97ad588-bccb-4e45-a3ae-d47fc85e80fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626285331, "uuid": "150cd102-30ff-4bff-9a80-7c7ce84af46d", "value": "1BD71C308FE8A1DC8BCD05C011D19F97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e747c36-e4ba-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626277439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626277439, "uuid": "924c2555-19a8-4d07-b108-bf5f99a23df8", "comment": "Malware payload (TrickBot)", "value": "37c87f4176987954e5d50e7aa8ed3472", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626277439, "uuid": "d89773ea-9aef-4123-b091-6989d33efd48", "comment": "Malware payload (TrickBot)", "value": "35e8a9d6a344fc280259cf5a6329bdc0e3d9b415f424e4dfc24cf5f76e12a06a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626277439, "uuid": "b9c33226-0f12-4c61-a688-13b5e2191cd8", "comment": "Malware payload (TrickBot)", "value": "3e6fa2512a2bae1b402cf4d12f9788a2d8071951", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626277439, "uuid": "d096a103-4c5b-4c47-9fdd-322abb9d314d", "comment": "Malware payload (TrickBot)", "value": "287c164c1b660fca748efd633984c759e4bf8af81364d91813cef8e905def6df22b946454e8785e072c2b0cd140bf87c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626277439, "uuid": "77b479cd-4cc8-4bec-8dbd-526bff3fbaec", "value": "T14343F7D573D038DA02427BF7EE1FB0F1E4AA2881252D445BE4807C68A9E4E79D7F8935", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626277439, "uuid": "0acf8f1f-6f7f-477e-bbc1-491e659d5bb4", "value": "1536:jBHQRxpWR5EX6X/XXadpqzJs7v/TDriCRJew0Ckg4loTe8fCKJYLcbV:tOeRX/XXadpqzJs7v/TD+CRJew0Ckg4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626277439, "uuid": "4fc4f2aa-3010-4903-9e26-15480f3a16c1", "value": 57763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626277439, "uuid": "eb1cdc02-6b5f-4352-bdbe-106f17f3d003", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626277439, "uuid": "d996cd86-c2f7-4674-8b10-ee2a79a0b8c1", "value": "Vio_Reports_547536188.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ac64ed-e4dc-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626292056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626292056, "uuid": "13980866-468a-4678-a681-a7d3c2039ef1", "comment": "Malware payload (RaccoonStealer)", "value": "d7f0e7382a50544f271617647794a604", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626292056, "uuid": "5d7eaa6a-9f01-4bd2-b331-57cdf8632364", "comment": "Malware payload (RaccoonStealer)", "value": "36fdde9d3f6ec56437f2fd7b84d85a7cfca072ac195e4beb362bb7aefe50043f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626292056, "uuid": "a1429c74-f48e-45fe-ba35-dd8940a4b696", "comment": "Malware payload (RaccoonStealer)", "value": "9d06738368449a665583345da1d0e9fa4d4c15f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626292056, "uuid": "f7d777f3-0482-416a-bfba-8f9bd40b5089", "comment": "Malware payload (RaccoonStealer)", "value": "8af36e1b6c976ed12bbb1a1d2eacd1483ec1bc728c5458d04296759a441b57e6e86784a8f8411d8560d742aa2266f694", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626292056, "uuid": "aac567a3-5b85-485b-bfd3-a21ab748cbfa", "value": "T1D1A4AE9C762072DFC86BD8768AA92D64EB60747B931F9243D45316ED9A0C89BCF050F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626292056, "uuid": "3ed9b917-a08d-4b17-b673-4c9f1c25b844", "value": "12288:Dd7Pql6rlJpXKHmfUtjmjat6tEMozpDt7JY+zAvoU:1PK65+4jat9Mo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626292056, "uuid": "86d264ae-07a1-4f3c-8843-37f24597b523", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626292056, "uuid": "83487c31-2ef9-4554-a626-742766516202", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626292056, "uuid": "8be493e0-bada-4d30-a654-2fb8448259c9", "value": "d7f0e7382a50544f271617647794a604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d058d3-e4a9-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1626270333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270333, "uuid": "55f7800b-350d-4b6d-b779-2befffb07d1a", "comment": "Malware payload (FickerStealer)", "value": "e468b2fcb6aa85287a831fddd7ecd4d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270333, "uuid": "8fdc6058-e200-4084-92e2-71ee3dc818dc", "comment": "Malware payload (FickerStealer)", "value": "374e79d7601a7ccab601d7c64bbffa573a94e0e3cd270c9046156c5025a341e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270333, "uuid": "41ffaa8c-9e4d-4570-865a-864f8caa4baf", "comment": "Malware payload (FickerStealer)", "value": "1e361db008e09c25a832e986712a6c4ab72c7ba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270333, "uuid": "3ec39683-3cb2-43f9-89fa-0a396c5bd265", "comment": "Malware payload (FickerStealer)", "value": "fcd0175a1ff656127563f132f34d60840b0b6502ff90d2ad326bb23c8c47e5451782841904dce4d6e0b461dd44d747d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270333, "uuid": "1f1e574c-33e0-42e1-bc0f-d68fc3e20967", "value": "T12AD53321BBF3C0FBD6422238A9883F7AA2F5DB9C172044DB7744E35D4E74C9A902B955", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270333, "uuid": "91d5c0af-834c-453c-87f6-bd9ee49210b9", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270333, "uuid": "b77df265-3623-4eec-8bc6-f17aebf79531", "value": "49152:xcBsPkZVi7iKiF8cUvFyPmDb3p95tQOxAZPJQimhYQWSXREwJ84vLRaBtIl9mTVF:xyri7ixZUvFyP83pNePQTvluCvLUBsKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626270333, "uuid": "182b993d-2ab0-4425-941a-019c61f224ac", "value": 2972067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626270333, "uuid": "5e566dd5-f2be-45f8-93ad-c2b4748068ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270333, "uuid": "538a3d81-d53f-4fa8-a5de-3e90b2eb67c5", "value": "E468B2FCB6AA85287A831FDDD7ECD4D1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeeec6fe-e482-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626253549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253549, "uuid": "487b8500-1dd1-4d6b-ad56-665be5085bf6", "comment": "Malware payload (Mirai)", "value": "fc71e99650bd4d149ec85b3b80f80aba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253549, "uuid": "17273699-12a6-4ca6-b1cd-250878d3cca0", "comment": "Malware payload (Mirai)", "value": "37dec3c310871df78605bd09bc8bbd8858850aa739b25f6db1b97af7ce115f48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253549, "uuid": "fdef738b-d1ed-4f7f-b2ab-36c275b39e59", "comment": "Malware payload (Mirai)", "value": "8f361bddf1d47a7847c805b0a10bb2c1ab17f201", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253549, "uuid": "ee22a401-9356-4c50-a936-cda44244000a", "comment": "Malware payload (Mirai)", "value": "3122b97cb8b769cf661e0eba43e9822db87ccf57fb4447e8241d694c1f816b41d40535e722a3afb468234209bba2302a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253549, "uuid": "da8b4052-e7e1-4146-b10c-2588e661fc59", "value": "T182634C99B4028E3DF98BE5B994260E15B930238096E30F27A7AFFDD37D33168B911D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253549, "uuid": "16e8cda6-0919-4165-8c80-39a7888fef81", "value": "1536:kbksXfvy1gb3jnV+thCoIzXeJ22TBc9NkWnXFn++X8A2GYK1ftSye:kbiBSbx+Gtbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626253549, "uuid": "26dd2a4c-98f4-4813-8783-d3550f3014d5", "value": 71312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626253549, "uuid": "c612fba2-29b9-458b-82de-4f95356a3dd0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253549, "uuid": "d769b375-9129-441c-a58f-1b15e1bab219", "value": "fc71e99650bd4d149ec85b3b80f80aba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d366b89e-e4af-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1626272938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272938, "uuid": "db407acd-ec58-4e27-8ab5-aa427085c8b0", "comment": "Malware payload (GuLoader)", "value": "870a4c72bccd58de144c7b845d56c626", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272938, "uuid": "aa012a2a-8b6c-4bf1-8c51-9c97fe0a6f40", "comment": "Malware payload (GuLoader)", "value": "37fffcbacca59290a7a3b6271ebf475a50b9e17eba113459cfc00508a7268b68", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272938, "uuid": "b4bb0523-ec0e-47af-9062-0d76010c0749", "comment": "Malware payload (GuLoader)", "value": "482681f75180bbb1286e1f93ce44dfae0b6b0007", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272938, "uuid": "b5b565a6-4eb9-4ee1-9da4-259dac837738", "comment": "Malware payload (GuLoader)", "value": "3ec829ee319538daf4004c0fc3a43ec86891e29c18f16a2b1ed0eb4e4590d27d75cdf90b0cd3ee813fb7049278b03d61", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272938, "uuid": "0a2b16a9-3a34-4e01-b1e3-d9c1581e6857", "value": "T1F44512EB28A8EFE5F1D2DFF785B84966506E9D437094805D49C9B1A937770F8028C2EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272938, "uuid": "1d478848-61ac-4031-bfa3-0c49180ebdb0", "value": "24576:kux4KztYcWgmU+Y/6bHtPVa6dneKiAqI3RW6Myfhc:pmK6ImUP8tPVa1Kcjyfhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626272938, "uuid": "4a47ed6c-7e83-40ae-86d9-6c5b69652d1c", "value": 1221992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626272938, "uuid": "e06a9884-84a3-487d-8441-a4c7c84239c0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272938, "uuid": "5542d890-840f-45c9-9c04-28d2204c3a14", "value": "Booking Confirmation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394364a9-e4f5-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626302744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626302744, "uuid": "60c2abe8-c9ea-41bb-97c0-8ef2a25b725d", "comment": "Malware payload (RedLineStealer)", "value": "9ed9d2543910e01707fad071b76e52a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626302744, "uuid": "d37bfe6c-124e-47e9-819b-0b83d5f0a00e", "comment": "Malware payload (RedLineStealer)", "value": "384b35bfb6d07dda3ea948bb9aa47a3024822ff40d21a13932381d6386643acc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626302744, "uuid": "14c5c86c-c2c8-4a06-a913-f2904a04ffe4", "comment": "Malware payload (RedLineStealer)", "value": "95c7867404af5e2d8d93b145dc254816192ab640", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626302744, "uuid": "10b6bca6-b6dc-4998-b722-7dd434129d78", "comment": "Malware payload (RedLineStealer)", "value": "6c72b93ec915a88852838fba19b711c0937ba2eb1643c5af3cc0d7c28709600af93c67859d6be3c4227ad2a7e0baa8a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626302744, "uuid": "7541b7c4-859c-45a0-b7ac-19522bb42a5d", "value": "T1016633427A815572C5665E3648B4BA21AC7C3C200E74C1DFA7A81A55CB7F0D2EF32FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626302744, "uuid": "d0643165-f9ea-42f8-aee7-f21d2351a257", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626302744, "uuid": "02385a36-4702-465b-9997-002867bf1d2e", "value": "196608:UBK7xHBATdA8xsvku1c7ZG2SuLgsn2bMlCnahYF7pS0i2:N7rYpIs7ZpL2bM0KM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626302744, "uuid": "fdc28e02-d568-4384-9099-257961f24713", "value": 7018131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626302744, "uuid": "eff43afe-480d-47cd-a9cc-66c1113e1f7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626302744, "uuid": "35c02818-1b05-4edf-b925-014aaba66993", "value": "9ED9D2543910E01707FAD071B76E52A1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06f98e7-e4c8-11eb-875b-42010a9c0053", "comment": "Malware payload (Pony)", "timestamp": 1626283616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626283616, "uuid": "8a906f53-8ee0-4290-9440-461c749e9719", "comment": "Malware payload (Pony)", "value": "180512f19b80562669451bd32a14e7de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626283616, "uuid": "113e7af6-5d24-4ddb-9cb2-9b5786d4d7a6", "comment": "Malware payload (Pony)", "value": "384ccd374a7b0ad96c05c598a8805af2c0171554a8caa56b383b60f7a847e26f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626283616, "uuid": "77f825b2-92e0-4c0a-bf50-1dff6ce98a07", "comment": "Malware payload (Pony)", "value": "41a81a5b383f2fa8936cff9c1c7d00096f202243", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626283616, "uuid": "f26b041d-de66-4328-9ef7-e76d6ccd2d6d", "comment": "Malware payload (Pony)", "value": "6a9e30b00cca2f9783936a671e233d6592b7f6f7cdc3b490a45d07ee8344b89ba5f26bde22183e4fa8dd8ffe386cc379", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626283616, "uuid": "35d4f64c-c25a-41c3-9b53-a2b6a56a1dd3", "value": "T1B0B4E01380A66ABCCEAB46FFD510F142F25B558A1EE05C3DD0C91F025D619EABED482F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626283616, "uuid": "921b9982-b3f3-48ac-b8dd-66cba442d4f0", "value": "2f33b931ff1d50f0cef09aafbe4eadc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626283616, "uuid": "c91a79cf-83a7-4d77-b6fa-65bcac8b030f", "value": "12288:IxGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGS:IGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626283616, "uuid": "744cc8a7-696b-4205-bb2a-b2932d0ad301", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626283616, "uuid": "2b1cb2e2-cb60-4efc-9d6e-6a8db309d5a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626283616, "uuid": "904c364f-8129-4c4c-a5e6-b00bdc4f7064", "value": "384CCD374A7B0AD96C05C598A8805AF2C0171554A8CAA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932bf22e-e46e-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1626244913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244913, "uuid": "3420fc99-1cd9-4c78-8367-994c03ac1489", "comment": "Malware payload (RemcosRAT)", "value": "3913b77292f796d9ad9c152042eac79f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244913, "uuid": "505cac5b-88d5-4cec-bad9-0789d8e662c9", "comment": "Malware payload (RemcosRAT)", "value": "38520db387146a005345d7862edcd4a22d3b4db1c7ae863202fa60b0eab42166", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244913, "uuid": "0116e3ec-8068-48f4-8191-ec940ef53440", "comment": "Malware payload (RemcosRAT)", "value": "0f6f524702022ee60d3fb8af2c94ca03b498d951", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244913, "uuid": "283aa8d8-3135-44c9-8811-986a04af8a1d", "comment": "Malware payload (RemcosRAT)", "value": "5888f209e04c82b24107ceb6664b60124d7230a8f4b766de66c8c9594b502361a66e1b50526ee4c27b8a325d1862e8b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244913, "uuid": "6a11d90b-dda4-4cdc-b7ea-74dc0684908a", "value": "T18A152264E2A34D5EE0999D72731859B0020E5ADB550A2F33359C9E7B3F00F872F965F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244913, "uuid": "39955919-9f66-4ddd-bd68-c103b2d8233b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244913, "uuid": "724a533a-0b70-471a-8960-4eabfd398fb0", "value": "24576:iDE1yr5y2Mda/BkOhCQBMNq0wOSN/4du9JauD36hTSWHse9Ry2CQLV:ig14y2MdaZkOk+MI07SN/TJauqS5+I25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626244913, "uuid": "3c364085-d522-40be-863d-91c3b45de249", "value": 908800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626244913, "uuid": "834be2e5-83f8-4956-a4e5-c4762ead2645", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244913, "uuid": "99e1823b-74b7-47a2-9b5f-4984a8ababf8", "value": "3913b77292f796d9ad9c152042eac79f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b24241-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1626246078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246078, "uuid": "732d2c93-e622-4b28-8374-3a569dd73b88", "comment": "Malware payload (AsyncRAT)", "value": "15039b776088a08c05886783cd8a3253", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246078, "uuid": "47a7104b-8943-44d3-8a4c-7c3e7ded62b7", "comment": "Malware payload (AsyncRAT)", "value": "3a587a0735cd4576114cfd8929247557e4332cd001953ef1ef86ee3118fdc5a9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246078, "uuid": "c1117b4a-1b97-4c60-ade0-5b065689811b", "comment": "Malware payload (AsyncRAT)", "value": "d6ba051680d3bfd89a95e3e17e9f91915bd3eee3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246078, "uuid": "1d83aa8e-c716-4e49-ad36-6343726ee3fa", "comment": "Malware payload (AsyncRAT)", "value": "c2bf8aec422ffa370b8e6982d871fbda3b9f934359464fbe8dc6e3b4bf057fb7e0248e8aa0ecfe2877299cef234bfbc0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246078, "uuid": "0e4278a5-3b89-4d0f-bed8-3e68b8e695b0", "value": "T108E46B2C23BDA709F237FF329FA4E7449FE666B54225DC0D28D4024A5461D81BEA7D32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246078, "uuid": "8466e96e-901c-481c-8f99-125508c880b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246078, "uuid": "49dfa17c-ce4a-4a3b-b8f6-edd61a58f583", "value": "12288:boZQXkxVKkBciNsVnHwa05IAwZkN7Xw2bPH4CzZTS6TKSNjrNls9XOd4+QC/Z:IQS8V8bN7Xw4PHNzbLNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246078, "uuid": "0d2766ea-037f-4a1a-8de2-c6915f1194f8", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246078, "uuid": "751d927d-899a-495c-b1c4-1f164e37736e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246078, "uuid": "4985361f-2595-48e9-9c3c-834a52f311ff", "value": "new po222222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12542bd-e4a3-11eb-875b-42010a9c0053", "comment": "Malware payload (MailPassView)", "timestamp": 1626267834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267834, "uuid": "fb7d85cb-d106-4bd2-8d6f-af205215285a", "comment": "Malware payload (MailPassView)", "value": "52dcc6c9b5596fbdb7539295597a3fce", "object_relation": "md5", "Tag": [ { "name": "MailPassView", "colour": "#5EB499", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267834, "uuid": "fb9fd974-520b-4875-a4b5-6f90bbf7b4ca", "comment": "Malware payload (MailPassView)", "value": "3ae3f205fee785313804de8c5460c731cabeacc2f49c8cc2b6345c7771041bd8", "object_relation": "sha256", "Tag": [ { "name": "MailPassView", "colour": "#5EB499", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267834, "uuid": "18dc6099-8427-4b33-831e-fbbb06911825", "comment": "Malware payload (MailPassView)", "value": "f9367bf332d65cae3c53fbfaf08623d6089ca701", "object_relation": "sha1", "Tag": [ { "name": "MailPassView", "colour": "#5EB499", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267834, "uuid": "b37f2330-58ab-4bd1-ae3c-70eff80143fa", "comment": "Malware payload (MailPassView)", "value": "716dc7d02c4c6365bba67778af5fdee8f007b00fb2f9649a28df8cde8fbfd761c0e8c6ec9d213234c91a51c1a1f89daa", "object_relation": "sha3-384", "Tag": [ { "name": "MailPassView", "colour": "#5EB499", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267834, "uuid": "e06ebdc1-7507-4752-a109-119b1448f0db", "value": "T13E3353AD7D08C6C15D1AB0C3595E709DD3B0CEB69870E5A0FB30D5CB6B20276A7846AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267834, "uuid": "a191e647-444b-4110-9063-d449e5573a94", "value": "768:3wXT90tdM2feQwg8fdfDBUJ4+RAFy75tM9gLp:3A4dM2fN4DBUW8BogLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626267834, "uuid": "b0551f13-e809-4453-bc69-2f547a497834", "value": 53105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626267834, "uuid": "079dce05-bd07-49e9-85ee-cec578a5b887", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267834, "uuid": "0009717d-6e30-49f2-b02d-f4bd77aa6c05", "value": "spei_1_24_vs71.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c50384-e4a1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626266748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266748, "uuid": "0774f320-5a7a-4a75-b45d-785da23a230a", "comment": "Malware payload", "value": "1f9c54f56be08a4f42d44d96aa10ed57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266748, "uuid": "c2fd5452-964b-40f2-86b9-3e18d227a783", "comment": "Malware payload", "value": "3c4a05bf97e45c1848ead007a452290f61220a20be0e1bc1ca312b563ac15d5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266748, "uuid": "eb6c9252-c443-4228-9c48-40d2927ba610", "comment": "Malware payload", "value": "325b7d2881fef8484d10f17b38eaaad21b8cbd0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266748, "uuid": "b6d997f2-5495-4f39-9dbd-6f464f3b855c", "comment": "Malware payload", "value": "3ad33e509326b8bee2f1dd0b96615793c5c81dbba6cc5335ba0779e08822e03840a64cd7edd31c92bc85ae41e43e651b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266748, "uuid": "1eab3426-726b-4b31-a5ed-d614fa778896", "value": "T17B21CE6667E36D16CC550237DCDF6710E322AF84C69FF513E35112260C2E22A5F22159", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266748, "uuid": "f6fa7464-f659-46bc-9869-b9eb61366b88", "value": "24:JnJ/0gP9qD0at6EoKGb9rUlFSy40VzLCkIddgHYQIxb3zNfC:JnJVFqDPtsrkFSy4CzLThIxb3zN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626266748, "uuid": "123195f5-7fa8-4615-9874-56991e1357cd", "value": 1164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626266748, "uuid": "b949e46a-038e-4b96-bdea-46fe7eecfc5a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266748, "uuid": "63f3bcad-1688-459a-931d-ab954cec792b", "value": "1f9c54f56be08a4f42d44d96aa10ed57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98614b06-e477-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626248787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248787, "uuid": "f811b2e0-1cc4-4c56-ac7c-c1f2cecc2273", "comment": "Malware payload (Mirai)", "value": "ba018a49228e2ed7c073d1657e75b0f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248787, "uuid": "427efaff-5009-4bd0-bd2a-33f8e136e769", "comment": "Malware payload (Mirai)", "value": "3d1fefaac9af5b5acfad3863bf5ac114569432546d650d53fa6181d5d3bf78a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248787, "uuid": "3eec7905-ddfb-44b7-8236-a04c2c060ebb", "comment": "Malware payload (Mirai)", "value": "9972162e51aa9b87c330e23324c58c3fb78da508", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248787, "uuid": "3c48c330-ef73-471b-bd43-2a269d8bdee5", "comment": "Malware payload (Mirai)", "value": "5d60aa9b041f33bd242fb0351ce9461e3452a283143260a7a765114dd9193b6577a209ae17c8882c47c7cd00f99a0ba7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248787, "uuid": "2ab3ccab-2131-4e8b-ad98-3c1222762cb3", "value": "T143337CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248787, "uuid": "07c31fee-cacb-4aef-a2f2-70ab70f9b9a1", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvk:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626248787, "uuid": "c6fcee1f-458a-43ca-bfd4-408f44cb9c5d", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626248787, "uuid": "b266b2fd-aad7-451e-b89e-a3d4148330e3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248787, "uuid": "b950ad39-b41b-4d04-8a9b-e25da4bc1888", "value": "ba018a49228e2ed7c073d1657e75b0f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5647b00-e4c5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626282417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282417, "uuid": "205af0c0-671f-4ca1-931f-d1e73750e7ba", "comment": "Malware payload (Formbook)", "value": "91d8196250f6d51e6f08f15276f5130f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282417, "uuid": "530c702c-9c71-40a7-9a80-3e6b2e326eea", "comment": "Malware payload (Formbook)", "value": "3da43dfd3613eeaf2ed56f10624f2dabdb80948c842c98fd0e26688fe55728a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282417, "uuid": "5a5d487e-c08d-424f-bf0c-d881bcaf9733", "comment": "Malware payload (Formbook)", "value": "a23eb68a2c968d4e370694627c1c76527b7e7f54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282417, "uuid": "6d08d1d8-6fcf-4110-b39c-3ab0bcbb3587", "comment": "Malware payload (Formbook)", "value": "6e95d457f9b83f860858dac8e2e2c590c3d059ff8deb590da8b4b312f74dbaa2dafbbbbfde7a8d425d312af527fb5a12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282417, "uuid": "14676932-4256-4c45-8ca3-12c13776bae8", "value": "T166153C95A283E036CD262934DC4B79A67B38FF010E6855D34ABAD87FED29BC015573C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282417, "uuid": "7ef7e0e1-455d-42d1-8568-892dfbe2464a", "value": "6b6bdcb3a4c5bb7dc631dfb38608b01b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282417, "uuid": "da995d08-4840-46b3-8e90-44892c11c2c3", "value": "12288:DLy92fz9+FYS+mxJze6kLEUdPQ870I82hn9ylmvovlqOeAgzxYGqqOeA:DLySgdxlcDogD9HvI2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626282417, "uuid": "59e3ae9d-35c7-4035-9e6a-6aba58bca889", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626282417, "uuid": "17687b44-9286-4919-8ef2-ae0dd88316b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282417, "uuid": "f2da241b-2f82-42b3-b2f7-9939f70b104e", "value": "SecuriteInfo.com.Trojan.GenericKD.37233660.24043.1865", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5ce8d5-e4b9-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626276897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276897, "uuid": "6c7e0a06-ec8c-45cf-bfa2-9dce766e7463", "comment": "Malware payload (SnakeKeylogger)", "value": "e2d417467699dffb7971eb132c9a3a8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276897, "uuid": "d6c54106-148f-4cc9-97e4-8ef4c2e6e9f0", "comment": "Malware payload (SnakeKeylogger)", "value": "3e1b4bf644f36778e4b8309d78e20a37747b5945e94b33f5ba17f224e041e6e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276897, "uuid": "a1b1f17a-6364-4f48-892b-36a50b6ff534", "comment": "Malware payload (SnakeKeylogger)", "value": "0d8b31ab86ec6bec011dc19d772b79afbf546a69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276897, "uuid": "c82ee1f4-adcc-40de-8abf-2039691d4132", "comment": "Malware payload (SnakeKeylogger)", "value": "ce3a787851b2b9270d80ada4135a73f0eff5eb9e36a2b3489b10071f5021f7f974d0759b9c0b61fc636863e141af9187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276897, "uuid": "c9980f26-00db-443c-a4f3-6c061d97de71", "value": "T1C5F47C2C23FDA709F237FF319FA5A6489FA676B59225DD0D2CC4024B5821C41AEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276897, "uuid": "c0cf802b-d363-42bd-879b-cf91ca79a216", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276897, "uuid": "487997d6-acec-4ce4-9de3-820bb6d85cec", "value": "12288:bTYCkvprNls9XOd4+QCaD1lsnWbwSjpxnj9ex7aaJcNRCfHjsM6w/rA1gFzPoViu:bTSuDYWbwuj9eRaae2Dsnw/rA1glPCiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276897, "uuid": "5531600e-416c-49b1-b2a9-538ef8d98ce1", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276897, "uuid": "2de33b45-7681-4a9f-9c71-fb3a67f82245", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276897, "uuid": "47496fdc-beaf-49e6-9ac2-e41bf82fae69", "value": "e2d417467699dffb7971eb132c9a3a8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a22ec9f-e469-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626242777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242777, "uuid": "9516311f-602f-4bcf-a86f-96be93436e2b", "comment": "Malware payload (AgentTesla)", "value": "1ee389a2328f783e25f03147ee3e2d37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242777, "uuid": "72d1e39e-133a-420e-a3d0-7058119cac7f", "comment": "Malware payload (AgentTesla)", "value": "3e46e3f9e2106336a775eb58ef19df08b37035ddb27eceb9e7581fbd8d134055", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242777, "uuid": "10b7a66d-1418-4c67-a03b-ffa180ee5e0d", "comment": "Malware payload (AgentTesla)", "value": "56389812363eb36ac5fda2311915861049022950", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242777, "uuid": "1c937ff8-14b3-4aa1-b0da-3a8de736507c", "comment": "Malware payload (AgentTesla)", "value": "406776911c56dc47e0691f28a0ace9f6305c8118c4fea6273ce413c604e1025aa39f5a6d09082c96525df129e509ab0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242777, "uuid": "7841f82e-d431-4546-b996-eac96be54315", "value": "T112C4235B939190A4C64E1394024A096750F38FBE171828ED78EB42971FD5EBEF9CD8F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242777, "uuid": "874945e4-3952-4f52-9bb2-e9f799e2fa7e", "value": "12288:kvUjlEkoj8uxgPpsmL/q36GdGmhLpV97BPHuYxaPosHWfqsU:kMZuk+qGAmPzBOahsHCqsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626242777, "uuid": "64a4974e-8fd4-4510-9e43-a2fa701dd3be", "value": 569921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626242777, "uuid": "45f8c885-d568-42b0-ba28-47db1bae4776", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242777, "uuid": "3c6742f0-27ee-49a4-b693-16b0d90329b5", "value": "BANK DATAILS (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c80cad-e4ad-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626272049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272049, "uuid": "9d761412-5a54-4a4c-af31-f2d2e38a9b5e", "comment": "Malware payload", "value": "89257954c32c009d3f8a181ee2483ace", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272049, "uuid": "55a0f464-73d7-435f-b8df-d1b346843ac9", "comment": "Malware payload", "value": "3ed2292f2e052ad02e502f8aa9b383004b829f7e641666098e4fc3660833725a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272049, "uuid": "5fd94835-0155-4d08-8da6-f01cd68b2839", "comment": "Malware payload", "value": "1d8bea0c2e15c5642b96a28f8675a9314adb5c25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272049, "uuid": "08d6dcda-752d-48f2-a9d9-58439d0cf6ae", "comment": "Malware payload", "value": "1b3d2f66b3e9f2a76d81aba9559a8b38946ca61fa905e68bb9e660ac869e58ca676639d4baf4f7e4a0f8a2cc1f749ae5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272049, "uuid": "09a996e6-abe0-4884-b885-c1c065977a74", "value": "T1CE54236E4669EBBAC77E0932B521DF11E513C724F292DE1E5BF1AE10293494324321FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272049, "uuid": "fd6da0b5-3e61-45b9-bcbf-ede0213aea91", "value": "653b22334b5d599379eee27ab5acf1b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272049, "uuid": "a5f48fab-dfe9-4e3a-a0dd-0a71d0bf6ee7", "value": "6144:bYpaGycfXDAPlnbVbNBI0VZm7vP6ryW38g+ALS+877Ll:cwsX8phxlPQPo38g37E7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626272049, "uuid": "be5ff9d0-6da7-4407-b3b3-0e5d44ff4681", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626272049, "uuid": "b82d124c-d973-4648-ac79-feff9cf69001", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272049, "uuid": "d62e4318-9537-409f-82c5-64d3e557da1e", "value": "setup_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb41da2-e4ad-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1626271856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271856, "uuid": "39a94856-dcba-4006-a826-fc6eddb73f80", "comment": "Malware payload (Hancitor)", "value": "7080fb5a647c157e18123d8589d014f4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271856, "uuid": "1d240a5b-6d6c-4d84-a336-995bae7fceca", "comment": "Malware payload (Hancitor)", "value": "3efaec8a140db1bb2ca16483b7be9ff7cab4b10a7004e5dfecf3661380319363", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271856, "uuid": "aa09bdb8-22d8-4491-842d-131de78d96b3", "comment": "Malware payload (Hancitor)", "value": "eb5060806368361a0c9c366b2fe1f06a52342c9e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271856, "uuid": "193f67ec-1647-44be-a635-b34976213daa", "comment": "Malware payload (Hancitor)", "value": "4c7de125937846ff42c3b4c02e62a0b9d5648aa5a155e6597053c4cc9666c9fe34dc63beee5a3ea01be7e46a7472e3ce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271856, "uuid": "ea7f3399-a47b-4dac-8c47-5122969d350b", "value": "T1B7748D047A599C32C1D366310716A711276D34752B2086CF7BEC7EAE2FF4192367A3AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271856, "uuid": "3d373c34-8371-463b-8050-f621d6856561", "value": "9f13d8dd4f9d63b3e95879ef0b618f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271856, "uuid": "1427d156-cb6f-45c3-9510-7ffe7e2031a7", "value": "6144:4BVb3xVUfgQloq4xJILh8m/MLAYs6nkLHOqXLhWVMAkyv0mkgQ8HUKQ:47kF94xJyh3/MLxrnEXFWVMAkE0mp0KQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626271856, "uuid": "e448b26a-ecfd-465c-a993-be56140db65e", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626271856, "uuid": "e8af34eb-0ed5-43d3-9aef-e27335726b05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271856, "uuid": "e8e76e82-8c08-4563-ae9c-50cbd592268a", "value": "ter.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902e2f63-e477-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626248773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248773, "uuid": "a68ee955-91cb-4c95-bfea-e08b27c71077", "comment": "Malware payload (Mirai)", "value": "4dac6b2bde5053a161270808a5eb8ef3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248773, "uuid": "b9c548b6-578e-4066-8e78-1954cbbcd182", "comment": "Malware payload (Mirai)", "value": "3f01f8d6618120461c2ae42cae2f5be4c24ef019450a5bea3d43035e55a632ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248773, "uuid": "e7617abb-2478-4b8b-bddd-62f44a7d127f", "comment": "Malware payload (Mirai)", "value": "e40fdd66eaeb5767a17dc83d509e547878c2ed8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248773, "uuid": "71787c12-e371-4185-98e5-8663f1052698", "comment": "Malware payload (Mirai)", "value": "2cc1e32488de1d4c2f3d4bb6822f07f8c59b7df6dbd63a95cff58e325458b18d93dd599e9d72aed3a37f986c6ab29879", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248773, "uuid": "f4d3f622-029d-4b88-ae94-f5c03794ba84", "value": "T162C2D098174929EDD2F9C17807B81B6C1CA80B6AF809DC8578F8F7519D8E4743067ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248773, "uuid": "cbc085ea-af14-4128-bc58-42924a746ba1", "value": "768:W2G214DFyosXqgvV9o1ndB08niQJgGlzDpbuR1J+:W2GdDgosaaO1ndQQVJuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626248773, "uuid": "3e81cfa3-aa46-45f0-8bce-8ae55f84af9f", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626248773, "uuid": "37fc0ae6-cd89-4850-ad2d-d0c70b194894", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248773, "uuid": "a76289a3-2d7d-498c-b7d1-fee7db4e5793", "value": "4dac6b2bde5053a161270808a5eb8ef3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788a7ba0-e4b1-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626273644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626273644, "uuid": "58a17724-3bd9-41d5-8993-24480c0b745a", "comment": "Malware payload (RedLineStealer)", "value": "c967c0f03185ddce3718e11221cd9dbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626273644, "uuid": "c373c3af-4fe0-4e7e-a4be-a199780b8c51", "comment": "Malware payload (RedLineStealer)", "value": "416a5680b7a1bb7ade8ed80b8002ee97e801a98aef49f3dc214d5acbdda14819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626273644, "uuid": "77ff0562-a55a-4642-bcfd-546baddba0e3", "comment": "Malware payload (RedLineStealer)", "value": "6b6405d92662b4b34ea58b1fb9c733dd3d54b390", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626273644, "uuid": "4d25f200-2c1c-4bde-9697-e42aaf5a03fd", "comment": "Malware payload (RedLineStealer)", "value": "fb8e11d02d2c6044c96eb04527506bffd0a55a1b72a63e6002268280bfc691515ec4ba7319d9b8e6c18cff87e7bf524d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626273644, "uuid": "5fb27a01-023d-4759-8d4a-212a82f6107c", "value": "T1C934CF2176A3D037F6F78570587587A46A3FB8736B70894AF350227D8E316D1AAA7303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626273644, "uuid": "5ca5153f-1f04-4d15-9b21-26323944ec93", "value": "5b3884de71b123899b8795a31fe5464d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626273644, "uuid": "ab41f3dc-68f0-47db-a374-cbbc3bfc7273", "value": "3072:jGTXuVmQ45NNt0WF/UMgaxia3SrLvShOxvqZOHD5T/LuLUp775l9YlJ:jGqV0Nt5WakaMvS0xiWFLH7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626273644, "uuid": "427b2280-6323-4d77-aee1-cd2f561bc52a", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626273644, "uuid": "70f3e896-76cc-4c8b-be09-9543c830ba4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626273644, "uuid": "94a03178-c19f-4bfb-81a6-21a2faef414d", "value": "c967c0f03185ddce3718e11221cd9dbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa8d0df-e4cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626286568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626286568, "uuid": "14bc7f14-9d8b-475a-942a-8ea97c8b12ea", "comment": "Malware payload", "value": "d1abbf0e20c3f525718852e81ce851db", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626286568, "uuid": "dc9e6d63-7814-4392-9de4-b2539a4a6fbe", "comment": "Malware payload", "value": "41964f83f08f20923b9a983568ba14a893a3f612bfdca5d79727e7bb1fd7ab8d", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626286568, "uuid": "2eec1ae8-3973-49ac-9939-5796d1aafd5d", "comment": "Malware payload", "value": "0a85ed1701f19aacdf66cd66b42a9ec79633ea7a", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626286568, "uuid": "ee5a2f30-ec79-47cd-af9e-e882a273fa06", "comment": "Malware payload", "value": "2a58b38a0233378f63c51d61fabed2c82bc2fc94041e189a4b92dd2cb428170d011e21737f95373320b13f4bd4abd867", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626286568, "uuid": "3cbc1aa0-1b25-4577-adbd-c37b0b249eb3", "value": "T12451751AF947D15C9B79236BEC978962FF1B801B9DA2104875ECC2495F30809A6ACB89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626286568, "uuid": "6ac9f3cd-a6a0-4883-8e20-887d17a242b6", "value": "48:Ax14jiLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozlp:7GhrffvIypvK0elkEYZ85zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626286568, "uuid": "8f873263-6f84-4257-a195-373c4b3dd0fa", "value": 3137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626286568, "uuid": "925a3d5d-0aae-4ea4-beae-c3f4eefb4730", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626286568, "uuid": "a2028708-d7d2-4515-bf4f-bfe0f02e3bce", "value": "4fvYppTf.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc9d357-e4b4-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626274940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274940, "uuid": "f60dcf47-db25-43e9-9d36-32cbaea82499", "comment": "Malware payload (Smoke Loader)", "value": "6752c1877ed00a640ce3b175b85dcc0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274940, "uuid": "51b97c38-1e5f-4b00-802b-7b0e0eed09c1", "comment": "Malware payload (Smoke Loader)", "value": "42409087896ad827ca16b713215988bed28560c5fe0c929f7c30294854b5bfc2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274940, "uuid": "1d91b844-9897-4e17-aa1c-47ca6003e273", "comment": "Malware payload (Smoke Loader)", "value": "1b18e681c722aa692ed3d7e814d297a49221cf87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274940, "uuid": "170dce20-fcd3-4d21-89fc-20ddb77523e5", "comment": "Malware payload (Smoke Loader)", "value": "fb79c613d0325824a239fc6c00903eb95b6102c91774adb1faf4077819e47e8f82bba1715c60c501b65811ae221dea0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274940, "uuid": "89c59693-5b87-4ec8-9681-a125f0aa2bac", "value": "T1DD14AD2172E0D432D6E70AF0247497A06B7BBE322671864F3755175E7EF02E19AB630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274940, "uuid": "7315ffc2-94b1-4746-a84a-1d3d933b88d7", "value": "cf8113cdf9d71dde8baf28192dd4ab3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274940, "uuid": "7d173bfd-3cb0-49e4-a35b-485d25285a59", "value": "3072:6BNm+m+ebHnoOYTgYglX033m5EfwxGxjlHu:OW+ebHBYURlE3Bwoxjlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626274940, "uuid": "d3c0d78d-6274-4d64-baaf-6f5dcb9802c0", "value": 194560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626274940, "uuid": "42534108-a8be-46b9-9410-c2e6b5ac2437", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274940, "uuid": "41f3b30c-42fc-41d1-bdf8-99ef145fdfa5", "value": "6752c1877ed00a640ce3b175b85dcc0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84152430-e436-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626220836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626220836, "uuid": "29046dd5-119e-4587-b764-1cc7375ef549", "comment": "Malware payload", "value": "65d7049f4479a072aad0c0632dea9e14", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626220836, "uuid": "dce3031e-188c-4ed1-973a-88fab9ef3047", "comment": "Malware payload", "value": "42604ff1ed592c99173ed7b53356dc748769b5a0eac49d6ae4eb767eae9fe2ad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626220836, "uuid": "2d33f646-4a63-40e4-9ff4-4df1738f1f8b", "comment": "Malware payload", "value": "5b2ad53c7ddef425c17715de2e86f4da9fd677f2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626220836, "uuid": "22165104-33c7-4553-9632-bfd0fc3dfcd6", "comment": "Malware payload", "value": "fb2003e1ccf3b44416e4bcc880852317b7ecb46a0e88e4a71de7c98547f00c09835437094669d864e5ed9a04bbe2f228", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626220836, "uuid": "ef417e8c-8804-4a80-b184-d35eb2a421ec", "value": "T17CE2E685AC8285668AD813BFF93D41CD3312B3B9D1CE7152CD115F08B6CAA4F0DA7A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626220836, "uuid": "e53e032f-f7d8-425c-8af6-520abdd5199e", "value": "768:CMn1EjZA//+1vTRfRiOC7wYqT4JqsWA3B5d7I9ybMioW+n:CMn12A//SrRftY97WARbIcbboW+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626220836, "uuid": "13546873-aeef-4a00-afad-accebb3db8b9", "value": 33312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626220836, "uuid": "f3bb5afb-7837-44ae-b04b-14d0f2a4b4d8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626220836, "uuid": "1982691c-a1a6-4edc-b3e6-17e3a4798f04", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b35933-e468-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626242098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242098, "uuid": "82c7f312-0a8f-494f-b7ef-4bd0a3e0155a", "comment": "Malware payload (AgentTesla)", "value": "02078c3a55a8623115dacd03733141e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242098, "uuid": "3258a159-2e8d-4165-b45e-e4c5faf2ff3e", "comment": "Malware payload (AgentTesla)", "value": "4278427d1a7819ed67c8f15db7767e5c81402615449b99132831a2fb4abe2b95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242098, "uuid": "163fe28e-06be-4dd1-8251-f8d33e75de1d", "comment": "Malware payload (AgentTesla)", "value": "2355905df5790bbba9feb4aa1048047a60762b00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242098, "uuid": "ae51156b-862a-4d59-965b-6dc0078465b6", "comment": "Malware payload (AgentTesla)", "value": "0aeb42cc523c5d713bdf96c07493242ea81f8dcb3ba4461a0efc8b3d66a3ee9718c6bc8c53fb208c7e6372b2fa1c1c4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242098, "uuid": "36ae3171-aeed-4124-810d-5e87b021a4ab", "value": "T1F025AD6C23BDA609F333FF319F90E7589FA62FB956158D0E18C4224A5931D42AE67C31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242098, "uuid": "a94687f8-1d09-4c0b-a0cf-a2e6e12cd263", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242098, "uuid": "ec1342de-2df6-47bf-82df-82b05d51fb0e", "value": "24576:XhAtS1E1Eb/e+u+6OxHxUB60MC9LdsvCqdCvLeJ:XhESgQ2BWH260b9LdcCqdCvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626242098, "uuid": "fe0b6de8-f2b1-4fcd-96e0-59bac731bc39", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626242098, "uuid": "ae3db837-edcf-4553-8333-b88f58fb4fe3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242098, "uuid": "4f91e936-7c49-440f-8747-fb97a24d7413", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a90f186-e437-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626221222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221222, "uuid": "2b3b3f79-efd4-4afa-abdd-dc518d22e2f4", "comment": "Malware payload (RaccoonStealer)", "value": "ade23e9e34bd204105d670115c82c979", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221222, "uuid": "b7cf93fe-c48b-4679-b61b-7384aa2dbe5a", "comment": "Malware payload (RaccoonStealer)", "value": "4286fc8a5df90759f761ff7c238541af2504327c46855c81f68fb28563969975", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221222, "uuid": "7f97731e-391d-404e-819b-40ca72e15391", "comment": "Malware payload (RaccoonStealer)", "value": "33edebbc8024d3647e79321e32e5865b668260b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221222, "uuid": "b296c65d-c3ad-4d6d-9b11-da4ff0625656", "comment": "Malware payload (RaccoonStealer)", "value": "bf33e65318bc53c126ae58117178195c654828e692b88fba6ba15dbbc3e8d430dbcfa2d14fefe791098fcafc6625089b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626221222, "uuid": "95d48d8c-cad0-412e-a409-dd4e04a54962", "value": "T1A5940221F2E1C432E4F751712938CB211A7FFD33A57182CA76905A2E8E313D1EA66B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626221222, "uuid": "e7d3140c-b58b-4a76-84be-68aeff736c55", "value": "743d5e3ef77cdeb459cdc4beffed62d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626221222, "uuid": "cb3c7fb4-7dae-4730-a81c-84145d4c2b46", "value": "12288:jnaLt7Cf7ChGiU6BJh8jNV1IsudvEND4:jomfPMzKNIsudvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626221222, "uuid": "36402794-485d-42f6-bfc8-6a566c3b43db", "value": 427008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626221222, "uuid": "d734ded9-9a0e-4142-81f7-aefc4184bc69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626221222, "uuid": "f03e49e0-3edb-4ff9-a690-37824d28995f", "value": "ade23e9e34bd204105d670115c82c979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d538e33-e4e5-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1626295879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295879, "uuid": "e67f697b-c9a1-46a6-a721-37e369355c6e", "comment": "Malware payload (AsyncRAT)", "value": "721ff84477014e090e68dd438f612289", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295879, "uuid": "dfbd4b17-f177-432e-84d2-cf2efc8a905b", "comment": "Malware payload (AsyncRAT)", "value": "42c75d53acd263ff2b2dad511e40e0e40e9a6119baa6844978c40e67df24839d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295879, "uuid": "623e36e9-4e40-4d05-87bc-df9a29b55493", "comment": "Malware payload (AsyncRAT)", "value": "0e8a11c53df72327743ae84a06a8101e9e412f85", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295879, "uuid": "4455acf5-3f02-459d-8305-80eb6932592b", "comment": "Malware payload (AsyncRAT)", "value": "8860d0c442e0805ba46d51acfae69581c858c3358ba52b772b95e8abdc84f72c9ddfb58aa5485af53e8653198d8f5e6f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295879, "uuid": "7e064528-8743-415a-9f71-cecbf8d5c104", "value": "T12E232B003BE9812BF2BE5F7859F26141467AF2633603E54E2CC451DB5613FC69A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295879, "uuid": "302c7705-e8f6-4f36-a566-ce40df87b66a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295879, "uuid": "31cd3e15-c235-4f24-b4d4-23a6319172fe", "value": "768:xuiGNTdFHLBWUZiGrmo2qrjO5QyJ4PiNjPISzjbwgX3icyydQMHjcTPz8kqjBDZj:xuiGNTdBR2IO52iKS3b3XSvoHcckqldj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626295879, "uuid": "d031585e-dd3f-4d27-9704-4f6e574c0542", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626295879, "uuid": "9329fceb-d79d-4278-8cc1-975226565f83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295879, "uuid": "1d1c86ae-ab64-49f9-a25c-8624f45b1eac", "value": "42C75D53ACD263FF2B2DAD511E40E0E40E9A6119BAA68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46711354-e4b5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626275278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275278, "uuid": "5ceb0fbe-8ea6-4040-9b5b-f486f82885f5", "comment": "Malware payload", "value": "7d7cceff02316a1f6e699d195fb82c30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275278, "uuid": "e4bc385e-3ce0-4f64-8088-e80aa7f5631a", "comment": "Malware payload", "value": "4303d17edf15296312d93ab470d51a4f9995e85b6645ea977da71060a9b0eeaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275278, "uuid": "944b1cb2-11cf-4f74-b4ec-d37a254fb284", "comment": "Malware payload", "value": "e66e023a32c1f0af99f1f151a0d9cb8d22004de0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275278, "uuid": "53440f33-c906-469e-ae5b-fa8aa8155fc6", "comment": "Malware payload", "value": "5be81d31c6fcfc2fa0b0fd8fbf4e337c3d8fe3f82114489b1f614ab770f9f2ba1975d8ac5fcf809926b2329b6979c347", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275278, "uuid": "ed477e06-9a8e-4294-b13a-46c8b343904c", "value": "T11021DA09F3452D5FDDAB2438582F023630307A49F4039412E3669E3B6E7B5D4221B18E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275278, "uuid": "8d9dbcb2-6fef-442a-902b-c234b2d1d2ca", "value": "24:38jaAa8DzSWPpbP78Pwy74+CiCTHShH5JkD8ECAfGiioxjfP3DpdNT1tCQ:MjaApP3hb/mkTShZJc8DAfM0zPNhtCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275278, "uuid": "9b4227af-130d-4023-892c-5bd7a03d16eb", "value": 1248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275278, "uuid": "7672e3c1-7e6e-4793-b766-f6b02b035060", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275278, "uuid": "49499ee0-4031-41e9-acbd-5f242bc3cc59", "value": "SecuriteInfo.com.Linux.DownLoader.532.26782.5900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a53373-e468-11eb-875b-42010a9c0053", "comment": "Malware payload (StormKitty)", "timestamp": 1626242125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242125, "uuid": "cf349493-458c-47cc-983e-9c7bfdb2b68c", "comment": "Malware payload (StormKitty)", "value": "014ab849062b35196cef62addaa5335a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242125, "uuid": "f440a3e8-3d8a-4b66-ac58-6a44e667e06b", "comment": "Malware payload (StormKitty)", "value": "444482bde8f2bb85add3dc622db0c1a7a6974a78be2039ee8d08cc32af48f951", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242125, "uuid": "f25b496a-e83b-442a-a0de-1e2b2736f45a", "comment": "Malware payload (StormKitty)", "value": "cc7ea1ca876a4ef7d6b2e58b1175fa3816e54ed5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242125, "uuid": "0a5d8677-c50d-45ac-b38f-4560b7b529e9", "comment": "Malware payload (StormKitty)", "value": "f94847241274e1e7a7c0b90fd1c470b4b38a94352fbe5fdd3703b11876a9fbef3af6df974ce30d785ffc55544bb79c73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242125, "uuid": "05362163-582e-4920-a983-c9e045c9033b", "value": "T145359D2C23BEA609FA32FB319F94E2B59FA66EB552159C0D19C03E067431C81BD67C35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242125, "uuid": "e4462b5a-872a-4c31-94b5-21282f0eb820", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242125, "uuid": "570fab0e-4ac6-4bbe-aa83-870313914aad", "value": "24576:ChZtS1xmzIWqERPypkrJfX8I+EWY63Kp5+t5hLKy92N:ChnSrBWbRPypk1fHAH3KpM5lxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626242125, "uuid": "024588fc-7c79-4d43-ac5e-9389da9805dd", "value": 1080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626242125, "uuid": "1d89d080-758d-4682-b7f7-68fb54fe784a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242125, "uuid": "2936a776-97c6-4609-b0c9-ecf9d90f3fce", "value": "OUTGOING PAYMENT MT103_WA00049739_______________________________jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d4f561-e4b8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626276638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276638, "uuid": "b767475d-f9ec-4c7c-9ffb-8f0f99e37d5f", "comment": "Malware payload", "value": "364813ac694418d961eb59f68120b5df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276638, "uuid": "3c8d026e-a46e-4ef3-81cd-cad529c09632", "comment": "Malware payload", "value": "4475abafa4a6818ce8d3a044298d3ee969e864ea341e0e2cbbe885e0dacbe1e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276638, "uuid": "c62f8d78-bc4c-49f7-85f6-e683b8202d37", "comment": "Malware payload", "value": "5a8a623ae34088b25d99034f5631a475c39e5337", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276638, "uuid": "f5aadd1c-607a-4a6e-ab19-0c070de26c42", "comment": "Malware payload", "value": "09a126cb6949da9ddedba2ae095edd64552e52e997292f20e86efb9c4cef3c67598bddd544bf45ac7a8d6fb9e0acb32c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276638, "uuid": "eaf7d62e-b9ac-4661-82ef-ff8f9a0e3b36", "value": "T14B530913E602C66BC05390B108A7E76B78ADBE752359E8C3F3C51E5A9AB85D17E3110E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276638, "uuid": "51d68aa4-12e5-4d0a-bc23-97a9030b5eb3", "value": "ed6fe15f7e9be1304118813e02b4c88d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276638, "uuid": "480b78ff-75f4-49ff-b99e-b26773c520cb", "value": "768:d38eM/VAmaROwSf4RyMES1+ObgmqIUgRfxIYpJeg:xMAA84Os7qXl2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276638, "uuid": "79d7b535-d4ee-475c-8be8-e9fb425c241f", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276638, "uuid": "4cdd25e3-d116-4b99-ac73-0769b9fd40cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276638, "uuid": "13e6d060-8987-4045-bd25-d3bf4bfeb485", "value": "364813ac694418d961eb59f68120b5df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7b1ea5-e4b5-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626275501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275501, "uuid": "77ebd6b8-bd2e-441d-b4ca-f40d4a335b59", "comment": "Malware payload (TrickBot)", "value": "014a15caca151701a316b09e75c5a2ff", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275501, "uuid": "f15f0133-3a80-475a-8dcc-28b9feca4c07", "comment": "Malware payload (TrickBot)", "value": "458844d1edad3253667e6eea0dc735a748e87ff784cbf12c80f05c15e96ec3d9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275501, "uuid": "af55e473-59f9-4a6e-9369-13dd7ffdd50e", "comment": "Malware payload (TrickBot)", "value": "56c3f841aa0459e8eb93df55eb6f7d5e3e4437a9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275501, "uuid": "775e81ff-9329-423c-b4f4-15b10ff9c823", "comment": "Malware payload (TrickBot)", "value": "df3952f774160f979ee17c0629ffccd61760d8961d5434ab7158fff318266dd72bc4b41a3e7ddef56fddbd9dfe525fd9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275501, "uuid": "f1cafde0-9078-44e3-a631-a45ce9fe8778", "value": "T1A8A4CF1033C0C036E6BB037A495BDB5962A5BC608BF5C28B7F947E9D9E312868E35753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275501, "uuid": "36f9d967-6544-440d-b2fe-fc1c8bed5704", "value": "285edb96a4eb2f97aa48802e35f98fc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275501, "uuid": "acbd116a-d1d7-46e6-a3ba-ccc8c49c1591", "value": "6144:cIzlI2lTAbw3TTIaThNALS0zn61hTF8PW8yLvBYQ8YiXCn6muSL7Cw5O547fEACA:vT8wIaThNv8n63LvBYtYuuX/Ci78hH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275501, "uuid": "1d910d35-d043-4d5c-b0df-c9ca083a2b79", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275501, "uuid": "4d699b66-e2ef-4b71-ae3a-d5418c38bb31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275501, "uuid": "f49d38e6-8698-4805-bb66-3b57d6ba044a", "value": "014a15caca151701a316b09e75c5a2ff.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f301e1-e4e2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626294898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294898, "uuid": "f9b3dfbc-2c5d-47e8-b3b7-260f065e41db", "comment": "Malware payload", "value": "a3cdbeb1d41c114bee6784c02ca42cd6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294898, "uuid": "b47b88bf-b5fb-4d1a-82a5-28d97c4b599f", "comment": "Malware payload", "value": "4600e7951a48232623a4c9eaae2209d2a56e6d174d9a5da837fcc4be143f67fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294898, "uuid": "ce883bdb-02b6-47f7-a2e2-3f22240ce1a1", "comment": "Malware payload", "value": "dab99e5990cab0c9eb2cabd7fef6bd489d53bbd4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294898, "uuid": "6841e875-8d77-4709-98a3-61a6fe36e5b0", "comment": "Malware payload", "value": "b65746bd9bb2b3aeed1b2c6d728c0e2aa0e795f8b79abecce42d6696289ba390b9248d1e62030e6fcdf84deb5e077e32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626294898, "uuid": "ac684ecf-20b4-4342-890b-d35d26ef905e", "value": "T12CF302D1B39A11FEFD5D6470960BAAA612A70C29C37CCAE7E110DC917DE48FB243512A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626294898, "uuid": "ea7e2a43-fc46-44b8-bb16-b42fa96fd552", "value": "e92132005097daafddd51d9c4d138d88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626294898, "uuid": "54da82e2-523e-440d-8bc8-3d888672fc9e", "value": "3072:77p3dQo86PI7e2seiSPWP6Ox1uTQjY48+STfLbh9w47sIB:Z3dyj7NsellOx1KQU5TTbbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626294898, "uuid": "8c8f3a2d-9c57-4178-a505-1bdfd52303ae", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626294898, "uuid": "3b7ce0f0-8d43-4042-b164-b20deb0506f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626294898, "uuid": "8db90b0b-69fa-41d6-a19e-3cf7114b1b95", "value": "a3cdbeb1d41c114bee6784c02ca42cd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f707933-e4b9-11eb-875b-42010a9c0053", "comment": "Malware payload (StormKitty)", "timestamp": 1626276904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276904, "uuid": "c186daaf-71f6-49e5-87f9-ef8b60084ccc", "comment": "Malware payload (StormKitty)", "value": "f99fd17cc305e25cae93a53c5d7b5741", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276904, "uuid": "5d066ed6-068d-4283-9817-acaa8e8c49cd", "comment": "Malware payload (StormKitty)", "value": "463ace81e13b8db2ec0d6ee4182e27a7a91c9c65555006ad064cd1e27e92a46c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276904, "uuid": "8991ecd4-a6a9-4ade-ae04-d88c956c0e3c", "comment": "Malware payload (StormKitty)", "value": "f02ba6a83b0b52301e4e6d5ce486abcc88ef0421", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276904, "uuid": "0f75d8ff-232d-47c4-9c0b-f674aafeb2e3", "comment": "Malware payload (StormKitty)", "value": "d7535db3fb5b87dcdd48528868649e8e15c7d91ab7eb612d6e0c0da30fb13d5c44d1f037004aaeea3bed06b8aa689448", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276904, "uuid": "fb8cd3ba-c9da-441b-891a-f2cf6267e429", "value": "T1B8159D2C23FEA709F233FF359FA5A6489FA676B58215DD0D2DC4020B4421D85AEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276904, "uuid": "2b269f5a-3d22-48fc-aa38-0881a1dd762a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276904, "uuid": "74ef0f05-4ae8-4e57-b07c-6076e49b7084", "value": "12288:DrUtrlIrNls9XOd4+QCiOxt1ZKR7f0MW7QZvKr5yP5FbPMlEthO0HwVYGgDnVuJA:Dro/mxoZWIKrcfbPK0DSlaYSxFvFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276904, "uuid": "bcf2a030-4b4f-4cd6-9215-32b1e76e5d84", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276904, "uuid": "e2bc8f80-4fd7-4f76-818b-b024be0038e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276904, "uuid": "54348ea3-fe2c-453a-b4b1-f8356cb6e7b4", "value": "f99fd17cc305e25cae93a53c5d7b5741.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c1be857-e475-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1626247880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247880, "uuid": "0f22ed52-eea1-4a28-85d3-60fe77213f02", "comment": "Malware payload (QuasarRAT)", "value": "02a39c85b278c528bbf74fc30a151116", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247880, "uuid": "8c2c0f28-3af5-430e-a0be-c26348b56bf0", "comment": "Malware payload (QuasarRAT)", "value": "47289b55b4f6e59cbf9fdd1944eb47229179d50b6b8e236e88662859a2be9d9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247880, "uuid": "faf590cf-75b3-435e-add6-274852ab5cc8", "comment": "Malware payload (QuasarRAT)", "value": "3c9935a9523acd328e0e9cad637b670d733981c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247880, "uuid": "4cc9cd5e-eb1a-481e-9c07-8085f168a72e", "comment": "Malware payload (QuasarRAT)", "value": "851620fa13b9b01ebbc80b5fab2db8caebffb58076b6e0541bc56c5c6fdc4bfbb3404f69799e9359a5b4c9267bf2466c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247880, "uuid": "98640ae8-051a-4d2c-aafa-5871f07564db", "value": "T122B45B8123FCC51BE1AE57BDE4B14421ABF4F407A667EB4F4940A2E92C567429E807F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247880, "uuid": "3af5b91f-bc49-4e71-bd2d-3a00082f677f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247880, "uuid": "4f16111d-c6cc-4640-a11c-d464f0e3cc45", "value": "6144:BTEgdc0YYXAGbgiIN2RSBAnDCm4fq2g5Etqy+yw4cUcEyOb8F9CchhVDyyOcTR3i:BTEgdfYqbgUDCpp4bywuip4c5DyLcdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626247880, "uuid": "66440581-4a24-4994-8af7-fb9b6f4244fd", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626247880, "uuid": "fc8104f7-93a1-4841-ae28-f1e76fa27c34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247880, "uuid": "94248eff-8979-4bd9-846d-05b7f0ad9302", "value": "02a39c85b278c528bbf74fc30a151116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694015c1-e46e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626244842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244842, "uuid": "700d5c09-5e31-40f5-be96-e0e962428458", "comment": "Malware payload (Loki)", "value": "65d918dfc4ef42d834986464ff737645", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244842, "uuid": "e43eee22-4203-4719-a7f6-33334db408a6", "comment": "Malware payload (Loki)", "value": "49bda02d360d6c5a7b5a340a72a8a32d5da1afe5e07653a781b0a3f610f8c332", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244842, "uuid": "0622017e-f225-49d2-9521-bb9abce00c9d", "comment": "Malware payload (Loki)", "value": "8b93b2742d6acfe461c157aaad5c830ced2391bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244842, "uuid": "8801ec97-4d57-4769-9626-3a0aefccd559", "comment": "Malware payload (Loki)", "value": "bc43f75d18ca973e1fc3de56c00b63bad3e0c032492cbb394f29d5f06dfd8a0c185e7a3653b35f1fdbf17e1c3dbaf638", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244842, "uuid": "61e6a3ad-0aaa-4f60-b831-646df34312a1", "value": "T131F46B2C23BDA749F237FF319FA5A6449FA676B58225DD0D2DC4024B4821D81EEA7C31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244842, "uuid": "8e2827df-0356-4a35-ba13-f9bd7137a557", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244842, "uuid": "31103018-15b8-4638-8da7-ac50e4607fac", "value": "12288:VWYnEVrNls9XOd4+QCqX5ZXLPqoEGma74YUaHNqI6VBGeKvrl6cW/nnKSLplDmLP:VWyXzn3FxHs1Mea8jnKSD47tSWVxbcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626244842, "uuid": "bbd45d84-c6da-4bee-b8c8-5c827f3730ab", "value": 777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626244842, "uuid": "ff89c394-b588-41c3-8710-45e268a7c3d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244842, "uuid": "b6e5c303-68c6-456e-81d8-3b6595210ae7", "value": "KkZcMbkz78JtbR1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92f0ab9-e476-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626248493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248493, "uuid": "bba601d8-c581-493a-aba5-4ab267611140", "comment": "Malware payload (Mirai)", "value": "c21c65c12eaa91ae12b20b0f2b7fadf4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248493, "uuid": "55bb1c4d-da1c-4bf6-a445-0fd2ae290014", "comment": "Malware payload (Mirai)", "value": "49df4462173c53d08d2c1ca33be2bd55cbbd368bb4a3c721a8c06f9bf9d0487a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248493, "uuid": "500a212f-b3a5-4ab8-ae61-4b156b38db82", "comment": "Malware payload (Mirai)", "value": "8f862f0d6511ca15d7f5854d7e9839c9350f86e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248493, "uuid": "03eb46c4-adf5-471c-9e60-993e65216382", "comment": "Malware payload (Mirai)", "value": "9aaa7d746aea3056b6d1b276d570e7c7410aa546045146397a449a2427ad6cb11865ac761991ab0ba2c015660d9e9d81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248493, "uuid": "7dfbe444-03a8-4df4-8e81-0ec5587bf243", "value": "T1C4333BD6B902AD7CF98BE67E80270E0AB53123541053073777EBFC937E321949956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248493, "uuid": "99d5f2f4-559c-4d72-b07c-f8545e6b094c", "value": "768:8CeKEfhe5Xdrben4I1fN5KQnaodgFHx+iPuvWeffpqmUJT6r6Lu380D1:dsfIBZeXl5nKFx+imvppqmUJQ6Lc84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626248493, "uuid": "a7c95649-6de4-4cc9-81a7-1bb57d0805e1", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626248493, "uuid": "35bbb238-60eb-454c-bcd7-76a21511575a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248493, "uuid": "20f5468f-b6fd-4151-bab5-07a991a89b9d", "value": "c21c65c12eaa91ae12b20b0f2b7fadf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d86580-e475-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626247737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247737, "uuid": "336538e3-ecc2-49e9-994e-5f28ff125257", "comment": "Malware payload (Mirai)", "value": "5345c3693fcaba9f467eb2ccab6480cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247737, "uuid": "1c398ff9-5441-49d7-a5b1-c130644203b7", "comment": "Malware payload (Mirai)", "value": "4afc18dd49a1109fac1bc7c547d0014f32ab9cf9cec30bbd31a0cc2d4f432cb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247737, "uuid": "33bb5bb6-d1ac-4c25-ab59-c76c0ddaddbc", "comment": "Malware payload (Mirai)", "value": "8c6bec469b8e53c0dcc2dbefa20e3fd611518332", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247737, "uuid": "653e52fe-a5bd-4078-a676-e9b6828c8360", "comment": "Malware payload (Mirai)", "value": "e29e1b32b6405ad0d07a29e1193ef3e3da98c85466fb74b706af4dfaf6871f22078569833cbdff46282a1973892c597b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247737, "uuid": "d1421b75-9ca3-4be5-9ca0-0e5da88539be", "value": "T1FA832A817891A626C7C153B7FA2F018D331597D8E2EF32529D281FA477CB91E0E3764A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247737, "uuid": "9746fe46-c6a0-483d-abd8-68f9c018486c", "value": "1536:C7EBS7lT0zz9uhW55G4Gi3AQT0+WsfmcMF46rE1KHhW657tJ55yTK2l:C7eSZYgiwQiseFXrEgBb5z5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626247737, "uuid": "a1cc8760-8a7c-411e-af2d-c0ec7f38121c", "value": 82948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626247737, "uuid": "fa05f5cd-d224-4e0b-a9b0-051d4bd38202", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247737, "uuid": "269fc8d0-38f2-4b4d-a8ee-b8132b352c2a", "value": "5345c3693fcaba9f467eb2ccab6480cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae53a8d-e4a3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626267850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267850, "uuid": "3556651a-5e91-4b77-ba9b-02798e5ff4dd", "comment": "Malware payload", "value": "8f9993984cb40de4915224d61d930b45", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267850, "uuid": "0d2a5eb1-42a0-4150-bd66-9a405ad5cce8", "comment": "Malware payload", "value": "4b33f6c9a3308ad1636a8d7a7d0609d0a8895c438339e237f50e2e282a7a2ed1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267850, "uuid": "b629de8a-124f-4f71-8e49-973ed48a13da", "comment": "Malware payload", "value": "fc6c46e204d5a59af188c9cead81310708a47490", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267850, "uuid": "b4826878-6cfc-4b62-8739-d7174752d98c", "comment": "Malware payload", "value": "d7fcf740a74d916b922db0d802e179856da24441f6895ccdc29e00c4655d976376b3c6788521fc5e4fb9facd52b5bcc9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267850, "uuid": "e387792b-85ca-4ab5-a35d-ad17d3fd8837", "value": "T131A1DBBE49C1AE5934CBCC7EB566B3950F4590FF124222D8701072C271DC298BAA6D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267850, "uuid": "647edc9f-b67a-4147-a006-130dab2f19ca", "value": "96:93Pf3sT3Pf35hQLVBofl2RSKJggtomvFHKNmX32GSSrD5p8pB:NULxhQxyMJfoaFH8bT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626267850, "uuid": "a0679996-9d63-407f-9ede-0334ce33d7af", "value": 5063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626267850, "uuid": "7c607dc4-3fb6-423e-90ee-be18f061f476", "value": "text/x-msdos-batch", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267850, "uuid": "ae51d210-7a26-4a01-9c5e-097837a28d93", "value": "Contactotjjwremzww_M_x9X_f%46SAJ(21164251Contacto.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddea3727-e4a4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626268231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268231, "uuid": "ce902cf4-538f-4085-b814-7a16b553cbc3", "comment": "Malware payload (Mirai)", "value": "9cefa9fc6f44024ee05b47331191612b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268231, "uuid": "74d57547-f84a-49dc-aa63-d236a7d21673", "comment": "Malware payload (Mirai)", "value": "4c4c212524fe0d459ee1d49bdccddf9060ca22f796b7588d7cdac8599260dac4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268231, "uuid": "37c126c4-8995-447b-8807-276a28eee4cf", "comment": "Malware payload (Mirai)", "value": "37055d296e453851c85e17400d13f473d7f3a0b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268231, "uuid": "4d5da26a-308e-4276-a489-8a4902dbec88", "comment": "Malware payload (Mirai)", "value": "76db09c2fb8823f876b967581fe2edb845e79355912209f789021683923bc98628194e2332a5b4e6032942f1c62f2323", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268231, "uuid": "76ce7beb-364f-4a92-8f58-8bc9ec7bceeb", "value": "T19F530985B8819A25C6D113BBFE1F018E3316576CE2DE73129D141F607BCB95F0E2BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268231, "uuid": "216e4cae-b618-4485-8dae-7e6bf7f2d9c7", "value": "1536:wdnIYoZXnYkTAcASlquASBAFzVLl1kHQwOcL/IBikcKJKWx:FFnRUcvlqCuhLlUQcKJKWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626268231, "uuid": "6d2c8f6a-4d95-426e-a82a-608eaf4da460", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626268231, "uuid": "4218448a-e921-43ff-8862-d3cdadc1322d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268231, "uuid": "9921fd45-f651-46d9-82a2-33a56383cb32", "value": "9cefa9fc6f44024ee05b47331191612b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b844746-e4b9-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626276978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276978, "uuid": "78610d48-8e00-4531-9325-9b0377a51482", "comment": "Malware payload (Dridex)", "value": "0d3e86171d4980d63304aa3a12c74c45", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276978, "uuid": "3491fd3a-85fc-4d50-b8cc-68770a606a4d", "comment": "Malware payload (Dridex)", "value": "4c56a5a7e49b23fcfab4b8d469d42e583497178b9b237374db3e14289f2afc64", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276978, "uuid": "07b3f999-50dc-4360-88d7-41f019bb5a50", "comment": "Malware payload (Dridex)", "value": "eea7d73a46c9d2c9826e63f634a044a986659b67", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276978, "uuid": "c7b80faf-1ba1-45a9-8c12-56945e650c0c", "comment": "Malware payload (Dridex)", "value": "2b12eb27136f7f339b8ea4209cdf9c678251fa7081471ca988b8b40af74cf896499294e5df8c42124cc20a3a732f1ae2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276978, "uuid": "511c341d-267f-46d0-a3c8-a689506a0207", "value": "T18EF459E5ABA4CDB5DB01C1718C9D1A586374CC418A49AFC77265B038FF3BB798E881C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276978, "uuid": "09a9d73a-4285-49b1-922e-dda3aefd5a2b", "value": "12288:NRYbXrlUc6XS/CwRl+4MW1H5onZHBDznxcp/c0UGtkbByxlFYd2Drp2s:2Uc6EjDMW1UrDjxcNcfgZI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276978, "uuid": "1a7d2dc5-9dd3-41bb-a2e6-41aba98a60e6", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276978, "uuid": "4aa20e50-d574-4965-bece-5bfea264b84d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276978, "uuid": "0ac7ce3d-e044-4109-b4c5-2a1265f1af64", "value": "0d3e86171d4980d63304aa3a12c74c45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd824f2-e475-11eb-875b-42010a9c0053", "comment": "Malware payload (HawkEye)", "timestamp": 1626247726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247726, "uuid": "fe0d619c-cfcb-4ed1-8991-5754391ce10b", "comment": "Malware payload (HawkEye)", "value": "e35a0bdb66b37b80c51a1559058e326b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247726, "uuid": "993e78eb-cef4-4ec7-ad16-ac78368a79d5", "comment": "Malware payload (HawkEye)", "value": "4d16ac850f443e678e5cdc8c104f9369a97e8347c3a64f3fce173329072fee53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247726, "uuid": "efaaa395-6cdc-4649-b3ee-f9461151457c", "comment": "Malware payload (HawkEye)", "value": "42d31ffa8a8a38d5073220550cae44d3e91bf9d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247726, "uuid": "2568a333-5a05-44a7-a111-7e30bf22e8f1", "comment": "Malware payload (HawkEye)", "value": "d38dc834fe0cf5bc6c4ffdc7309310e1cbc47d5228b131a2d0aca0439628f4238547a636e57e8dac2e196cbfce0d5f64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247726, "uuid": "c4717615-04ef-4225-99f3-bb5e2320376c", "value": "T1C545BE2C23FEA509F637FE709F90F3449F66AAB99229914D1CC4420A5971D80FE77932", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247726, "uuid": "3e1bb296-d925-4731-8839-c0221d65cb32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247726, "uuid": "57401262-0d40-42f8-baf0-8417859ef1a3", "value": "24576:J57dzqnUYOCGSfCuuBIRzCa6RMdLAEDv+tgd3gD:hgN97ugl6sUEHd3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626247726, "uuid": "3af100e0-dbaf-45eb-89b0-336eb18a98b0", "value": 1261056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626247726, "uuid": "1143e847-12a0-41a8-ab9a-6b7f99fb9895", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247726, "uuid": "02049832-5a63-42a1-b6d8-e610d12737d5", "value": "e35a0bdb66b37b80c51a1559058e326b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a995d6b-e4cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626286586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626286586, "uuid": "2d455683-c30f-4714-8317-735b755c95f7", "comment": "Malware payload", "value": "5f0c34b051ee2b1aa93d57a7abc158c2", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626286586, "uuid": "b70b396b-1c1f-43d9-a78e-22f94de66cea", "comment": "Malware payload", "value": "4d35671ed468c3d8a6fefca75c05e479b4117d993645318283667261c5984dde", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626286586, "uuid": "eec126cc-bbd0-46c0-9085-03e4da80a7a1", "comment": "Malware payload", "value": "d5fda244e3e7d55f19468b7a9a785ee18bc6ad4b", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626286586, "uuid": "20029a8f-db0f-4d77-8e28-f867f932ddda", "comment": "Malware payload", "value": "33023e2ca4ec7e954909088fdcbd1128e304aca6422bf95e76d7c961912c16a8390d3297d9d9cef42181e1005c9c12c8", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626286586, "uuid": "fb10281f-91f3-48d5-b18b-fccd40e9bb34", "value": "T1C0518619F947D15C9BB9236BED978562FF1B801B9DA2104C71DCC2495F30809A6ACF8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626286586, "uuid": "c5f626a1-fb22-43ec-8547-e6a16ebaee2f", "value": "48:A3h48iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozlU:mGhrffvIypvK0elkEYZ85ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626286586, "uuid": "677d161c-4d24-44bd-993d-6039a301b948", "value": 3144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626286586, "uuid": "860b7e11-f821-488e-8d63-ef49fdbd1826", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626286586, "uuid": "ff42a688-ad7e-48a2-b4a5-c258043d1b59", "value": "u59eEarf.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb30bbf2-e453-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626233383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626233383, "uuid": "8a4447fa-36e6-492b-bc36-2bf57d395b62", "comment": "Malware payload (Mirai)", "value": "9a144d01e3451f7812bda3015b3dabbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626233383, "uuid": "e41d232b-3ad4-461f-8a92-5f4d34da3027", "comment": "Malware payload (Mirai)", "value": "4d59f7d61590cebf46f5176a95162a697990f3953424dca4a8a9b718fd6ab6fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626233383, "uuid": "8540fa56-2b73-47e4-a64a-c83b922ab6d4", "comment": "Malware payload (Mirai)", "value": "34f48847cf839be9f37645d53b562cdd022575bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626233383, "uuid": "e17c4c88-5eb4-4abe-8023-c0b257481b7a", "comment": "Malware payload (Mirai)", "value": "a2b69769ab89b00b897fd7625ad4c16eaa3b5eb34cef0341052846c06b662f900f52f2ead8bee8210e35106619749bed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626233383, "uuid": "753e35b1-bfe4-4668-a3e1-e43985426cc9", "value": "T1F6236BC0A543D9F8EC150AF52173EB329B7AF07A2129EED3D794A532D841702E64729E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626233383, "uuid": "8bda6bee-aa3e-4979-8356-f4116ad6456f", "value": "768:gjo8WnBsux3TUi32+4qbBYSWLbc9QnbnXYMbJoSVO+Meb4aE:gWBsux3TUiG9qbBYSWg9QjY8JoSVO+1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626233383, "uuid": "e922517f-c6ad-40d3-8ed7-680e1982bc7a", "value": 45656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626233383, "uuid": "ccfda832-4b10-48ba-8bbd-1cbbbb97740d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626233383, "uuid": "17b53687-bee2-4e2d-a36a-6b2fa08b9323", "value": "9a144d01e3451f7812bda3015b3dabbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1fa2fa-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626246028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246028, "uuid": "e4c3cf1d-62a7-4c84-901a-1b6e44a5f212", "comment": "Malware payload (AgentTesla)", "value": "7dbda766f4641d93dabcdb30cc00032f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246028, "uuid": "a84b795f-15dd-4255-bda2-306f41d561fc", "comment": "Malware payload (AgentTesla)", "value": "4ecc91d01c7a1c9846a5ae3d051771f98273f4250a621feec1094deae2b9920a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246028, "uuid": "186f57ec-ba42-492c-9919-a21f9b5c6d77", "comment": "Malware payload (AgentTesla)", "value": "a8424fd59b1bd73e6c76747c910bc33837d6cb5a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246028, "uuid": "d1a8ade3-40b8-45a6-96ca-3b1e12b198c8", "comment": "Malware payload (AgentTesla)", "value": "35e1f2aacfed9d6b80b9239851caaa60a04df3678711d9097818c7f210e170fe13e6e7d33dab9108c6282df36d0b0307", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246028, "uuid": "0896ed8f-446d-42ce-8ac4-9c9e91702b65", "value": "T17E058D2C23FE9709F237FF319FA4A6489FA676B99215DD0D1CC4024A4861D81EEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246028, "uuid": "c087130d-cd81-4203-8a7e-39d7f8468948", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246028, "uuid": "de18001f-e071-4fba-b0da-4e6cb93c8a58", "value": "12288:HujD/g4rNls9XOd4+QCWIMmlGNO/P3siNfJw3e7961MjGumnI+/WMFq8McDUX:HugdmA8P3Xfe8/1SzFacDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246028, "uuid": "91b63e2b-cd9b-4489-9b9d-79d8d2bce3d0", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246028, "uuid": "b47f8061-52be-42c9-8524-60617255c774", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246028, "uuid": "a86fd935-0646-4b4c-a5fe-346d1f70b2a0", "value": "INV#339BT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90dd9a2-e44b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626229944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626229944, "uuid": "763e6f8f-b836-47bb-99ee-5d1c6a53a7d4", "comment": "Malware payload (Mirai)", "value": "0f51cafb7d808e73e288c485ab7814e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626229944, "uuid": "904fbdcc-c167-451c-858b-14db7d6266bb", "comment": "Malware payload (Mirai)", "value": "4f3a4c3315ee4ae57ccc5e0e6122a6d4591b09c721720d8717a9b02bb47da140", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626229944, "uuid": "9129b57e-dad9-4914-a95e-ba887fc22e45", "comment": "Malware payload (Mirai)", "value": "bc3ca7ecd0cf01ad4275636198562032d7128a06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626229944, "uuid": "3c979c93-8bde-4d67-81f0-e1965f8eea57", "comment": "Malware payload (Mirai)", "value": "7f81210fc10cf7232f4e953e61e76e2d983ebf5b3d5708aaf35372f3b455668f425b0497db774834e7e502e16bd6b4f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626229944, "uuid": "1167d6da-b026-462d-ad3b-66a8fc5e60a5", "value": "T1DC332A91B8919A12C6D4537BFA6E41CC331563A8D1EF33079D266F107BCA92F0EBB641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626229944, "uuid": "919fe02f-77cb-48c5-9ed3-12ff6ebbc4fa", "value": "768:w7Mc+v+gcmDE6mxmm0Ba4emNiC8sa0bwzRgBCEVuXmgsvYPfjA/hck3D89RRTPNg:lcBXmD1h8s3uXTsIfU5WI1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626229944, "uuid": "47df6a13-111d-4bbb-a546-3ba06a9b7f32", "value": 50300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626229944, "uuid": "03834464-5337-46b9-963e-63a6f06e0361", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626229944, "uuid": "33707117-e81d-4a4d-9cc6-c2f3b6525857", "value": "0f51cafb7d808e73e288c485ab7814e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbdf542b-e4b2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626274240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274240, "uuid": "40dee290-3785-46a2-931f-df528e6f199d", "comment": "Malware payload (Formbook)", "value": "bf4180a92d18e2779945be58c17fa065", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274240, "uuid": "05f75de4-4599-4c0b-8bc5-fd40199feace", "comment": "Malware payload (Formbook)", "value": "4f588080c3618162c1bd0337092af0ba118b7277de6c2043a988562efdb0cbbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274240, "uuid": "e9ff622e-60e3-4df1-bd3e-3f72b6ef09fd", "comment": "Malware payload (Formbook)", "value": "9a5d25e8ba973c5d289061c62ebb08bb03a87f36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274240, "uuid": "8c667077-c035-4741-88ab-fe4c6c49a809", "comment": "Malware payload (Formbook)", "value": "e7b37f44396eb608ecec99d353b5917da346c22f174323a72290a7619838f24c30ba5e506d7ca71c865d7142a532b793", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274240, "uuid": "015a2664-279b-4367-ac9d-5c2831919643", "value": "T199057C2C23BEA709F233FF319FA5E6449FA676B59215DD0D2DC0024A4861D81BEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274240, "uuid": "e2e5ade5-9543-4a2e-b954-4c7f7acec180", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274240, "uuid": "c3800c68-e278-43d0-b466-97e2efe7909d", "value": "12288:MHmGsl0drNls9XOd4+QCuKXlebh8uCwD7DF+EyQz8RPgplU094E+v/r45SykV:MHO0+K1ebhIwD7cERQRPoUq4//kSym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626274240, "uuid": "4a625758-c055-4f49-8540-5196c20e9ce3", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626274240, "uuid": "b26119b9-20cf-4b7d-ac37-3d3f83e63967", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274240, "uuid": "7f1a4fb0-ee70-461a-8289-cdf70ecb0feb", "value": "AWB & Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56b1b56-e4b7-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1626276323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276323, "uuid": "f846c85c-716c-4285-867d-973513efab7f", "comment": "Malware payload (QuasarRAT)", "value": "1cd60e5192988ae5841a861ef8c45a61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276323, "uuid": "e96f51aa-84f0-4309-a675-5b981ba68dce", "comment": "Malware payload (QuasarRAT)", "value": "4f5eb87739916022c23a6291aaac32e86cef1d92cd9bcf67ec0ed357f1672ca1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276323, "uuid": "3ea105a5-5b18-4ebc-99bb-32c0f6a0412f", "comment": "Malware payload (QuasarRAT)", "value": "3c6fe7b6885dadd5820710082b5e07f0f0c31a8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276323, "uuid": "f5441d2e-576e-4670-bea7-6d5e81c4cfa3", "comment": "Malware payload (QuasarRAT)", "value": "f4d10b4c3a942df54784b014e9990191576c48c246ea7ad75409fb084605160802f9819eb9d0153bdc29e63a1c88a7b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276323, "uuid": "a41a1141-c737-4994-a114-be40abf2584f", "value": "T178E407027F44DA12F04D123BD19F15684BB19C81EDE6E32F7DA93A6D28323A67C1D8D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276323, "uuid": "005fdf6b-661f-48a2-b4d5-c127c2bf995f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276323, "uuid": "8c77f087-4b45-4c7b-bd41-a1824013704a", "value": "12288:+F99ykKFS0ts9luPb4Fk5SfYYPf6M5hk/y2V:+JykotsPuT4XLfZjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276323, "uuid": "9495f598-77cb-4631-b929-c706e24d7b5d", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276323, "uuid": "27a734dd-6a9b-4e04-bb93-4d1095997e00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276323, "uuid": "8ac70aa0-ad67-4380-950a-f32170f6b266", "value": "1cd60e5192988ae5841a861ef8c45a61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15bd0fd-e4ad-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626272022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272022, "uuid": "91986b84-b55e-47db-a350-b8b21943bd27", "comment": "Malware payload", "value": "ec149486075982428b9d394c1a5375fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272022, "uuid": "70312340-01b5-40c4-bf80-5a6782b382f8", "comment": "Malware payload", "value": "53379b36716f384e530dae9ec883c459d0c12f0260116614a0482ded7d9b5ba9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272022, "uuid": "0661d774-99f6-453b-88a2-271a7451e3bc", "comment": "Malware payload", "value": "63c94ed4abc8aff9001293045bc4d8ce549a47b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272022, "uuid": "ff6ee30a-092c-4407-9f57-f29384fafca6", "comment": "Malware payload", "value": "70336a19881f39435b27a0c42115e937f96f2aa35406e252ec20e1978eb4ebdd120a98e324932600bdf7a0b74396076a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272022, "uuid": "b52d35e1-efdb-4263-941f-ba605367f981", "value": "T1C9057C12B782F4B1DCB101B0577AA7D6922CBC240379DADBA3C42F5D99790C27932BD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272022, "uuid": "6aa750c0-c592-4f1c-8cd3-b01d9fde9ca0", "value": "82622a0f8bdba4396a94457d8c2772ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272022, "uuid": "18c7431a-9187-4776-8806-d948cd2dc2e5", "value": "24576:AkRkLis0EC5vKcYEfD14BjI9KzTm6Br8:470nFJ4hzTZBr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626272022, "uuid": "7cbeb9ba-940a-4bb6-8135-e74d20783f42", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626272022, "uuid": "fd2a01da-349b-415d-a9e0-bf27ef411353", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272022, "uuid": "ff83b03c-bd67-4e08-8dbf-6f57209e8e6c", "value": "sahiba_6.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8050aa25-e4b4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626274946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274946, "uuid": "f21a124a-a9d3-47e7-919e-0325da844737", "comment": "Malware payload (Mirai)", "value": "15848c41f47660ebec0e6840be759603", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274946, "uuid": "28583a83-7c66-4085-9163-19782473be89", "comment": "Malware payload (Mirai)", "value": "53faf0573af882af8fbb2daf695b65fe6fa5af57599c233e8d055738cb8bcfc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274946, "uuid": "8d858b04-64fd-43d8-852a-53465c41e076", "comment": "Malware payload (Mirai)", "value": "482c8657c80b85afd50db8645ab26a8cf24402a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274946, "uuid": "dbd80014-f674-41c6-bdac-a61c5ba50956", "comment": "Malware payload (Mirai)", "value": "bb7712f4f5040c1e348342d053c1214f99a3459d1d7de28e30201cb66688c78fab20c5b368fccc24ad63d052dc9b66f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274946, "uuid": "432a0510-44c1-4469-b538-fb3e8e8aaa22", "value": "T15C430752BC818A16C6E0527AF92E85CE3B2123E8E2DF73079D211F6176CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274946, "uuid": "1f4708f4-fabd-4dfa-a6e1-5899c15a7dcd", "value": "1536:Q64i29YzaK1r5mTPAzHcEe7/1suV27cXhMDHs:Q6ia7dM1b27Ihq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626274946, "uuid": "3247b923-8acf-4a10-9a9e-e6d285800282", "value": 60444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626274946, "uuid": "e4cad833-1298-4925-acbc-57ed328e056a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274946, "uuid": "aeab5415-0364-47ab-806d-a3f1d8270aeb", "value": "15848c41f47660ebec0e6840be759603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929a9e5e-e4b0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626273258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626273258, "uuid": "840d1f0a-20c9-4c70-881e-2a281c4bcd82", "comment": "Malware payload", "value": "d17f58c6c9771e03342cdd33eb32e084", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626273258, "uuid": "6fc651b3-3c58-44b2-b44c-0627feec515d", "comment": "Malware payload", "value": "54116752c7b9c219dbf461ccab96573a2973784dc2c1bc858fe696d09ecd058c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626273258, "uuid": "e0ddfebd-ca7a-4136-9c1d-fc4f30197af6", "comment": "Malware payload", "value": "25fadbc01eaa53b1d34fb5169f84a33901dfeed7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626273258, "uuid": "47ad0fd9-ac8f-4b55-86dc-5324e038bf5e", "comment": "Malware payload", "value": "7683edccdb8fe300bfd41c4867814f4d449f9058a85ad9415a6f293cd8223edf1891fada0497d313e6dd558fb8e3c84c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626273258, "uuid": "69ce2e17-6848-47bd-b524-486431aa0cd1", "value": "T177C51217BB801332C6930270958E97D6F379CC787325869234AEA22C35A2D7497BB7DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626273258, "uuid": "c91b8708-ab21-4107-9ffa-bf4a68749c02", "value": "49152:4pHH1j3mpdgRf+us8azmLBVU3p2XR3451TpKPOv05AMQoYGLwnc:4NxmsRf+u8A+4mtKe07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626273258, "uuid": "17a9d394-b409-4b25-a705-a30dba48ee56", "value": 2667520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626273258, "uuid": "da624bc7-8d53-44b5-9488-a56977c54142", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626273258, "uuid": "e1dfdb38-e4c6-4ca5-952b-2de64fb6ca9a", "value": "Clients-Progress-072021-7.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76aae78-e4a1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626266985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266985, "uuid": "fb8c1c7a-ba35-4885-85bc-c006c61f66ff", "comment": "Malware payload", "value": "54a5ec4c116b779ef8d69a75e021d537", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266985, "uuid": "544fd5af-35ce-47bb-8ff4-a2095f85a43c", "comment": "Malware payload", "value": "5476d1e910a8042b488f5f42730fdc9b5ad782d62fd85a069c967fa000310a25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266985, "uuid": "ec0fa36c-476d-4f01-a875-2ff674b29bba", "comment": "Malware payload", "value": "42853c42d2e55bc14a840bc9c17a36ca0bc32214", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266985, "uuid": "3ab5b34f-ab5d-47d0-898b-088fe5ddd58c", "comment": "Malware payload", "value": "32ca20ac85817be286b0a5f7e296ff22683d8cb77d7196cb9d03e9ff4ce6061d16e0f152fd0abe9988f2d6c2128c7e85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266985, "uuid": "5335d9f6-1563-437b-8e5a-48cf881bec6d", "value": "T1BE4116191F901F33DD76CC36415E2B5125CC842FA16723525334DD60BD2E605E7D38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266985, "uuid": "e6f59713-d8b1-4c06-9adf-fcc5a83546d1", "value": "48:APQ2RnuDW3B6df9ce+SMTLWPkeTu3qFeXp:APQgnuqYf9cjSoLW7Tu3h5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626266985, "uuid": "0b440a7d-722a-4778-9f39-8bd99709c612", "value": 2032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626266985, "uuid": "c6cc0025-6c85-44cf-96ac-d262b2e73655", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266985, "uuid": "805ed7c4-0a47-4ef0-99cf-c43d685ff3e0", "value": "54a5ec4c116b779ef8d69a75e021d537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1082d345-e475-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626247700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247700, "uuid": "7d894df5-62d0-4c81-8b6b-aee73562da52", "comment": "Malware payload", "value": "6fa97dff10e617f26d553a5b33d5cb26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247700, "uuid": "93185df1-3608-4084-80e8-ffab777311fe", "comment": "Malware payload", "value": "554a520105a96ab024380ff7cefee29b588cd9e763b9f642a73f75b06a25c037", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247700, "uuid": "9a846df8-e044-4e8b-9347-52fb08317f67", "comment": "Malware payload", "value": "b0bb79ae501e79f057324eea1ebfcc6474c1a7f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247700, "uuid": "2d5000f1-4560-4499-bde7-0a4c99d121d9", "comment": "Malware payload", "value": "7a34e51111653d3029567e6efa35b1e799b5ee5b263db91bc8c1f8d224be97162a682309672aeae2998f3b1fc845e738", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247700, "uuid": "54204147-3eb3-4af1-95f3-574e505c83d7", "value": "T1D603F1E8BA4A9E321730283DD9BDC403F6A99374A5B53AB2675817ECCE93603257DC11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247700, "uuid": "cb8932d0-e336-4c84-add9-39a459f12896", "value": "768:FyvfY6RLFCwSKuBM47MG9QAfQIRXvqhRV0WCq/Wq3U7jw:YRLswSKupfQIR/qbybM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626247700, "uuid": "f8aff75e-9c08-428f-b757-bbcbc3b5ca43", "value": 40320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626247700, "uuid": "c5d793e6-4cad-4a88-bf98-9f60a9ec339c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247700, "uuid": "b80ee06e-7a79-41f0-8430-d06d0ecf47ba", "value": "6fa97dff10e617f26d553a5b33d5cb26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c2cea0-e46a-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626243221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626243221, "uuid": "0a3494b1-9eee-41a1-ad0f-0c35c12b1a18", "comment": "Malware payload (SnakeKeylogger)", "value": "e6166e84a0bfa6457de2ca13fbb78bda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626243221, "uuid": "98df1de7-4f80-4d3a-a2d3-08ec7442b251", "comment": "Malware payload (SnakeKeylogger)", "value": "5553eee2a2ed0799c4b178d90ddc364e8241da84463ed14266bf5f66cdad8e79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626243221, "uuid": "f0f6b6ba-4355-443b-8551-1e2ef1d100cf", "comment": "Malware payload (SnakeKeylogger)", "value": "426fcdc3cbf6d434ce850f0ecdb693283bec744f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626243221, "uuid": "0d91b780-840e-449b-8da4-e02212415e14", "comment": "Malware payload (SnakeKeylogger)", "value": "69e22a2363c0e5c9bfca78866337b3b2e0024133198e35a5a9fa8cab985e5fb315aa2d149d0c492dfec2c1a242e5b0c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626243221, "uuid": "b4dabac3-e11d-45c0-bdfc-70f5ac931567", "value": "T11DB4AF82A4D40766C42E607AE8EC78F902DDF91E6444EDCF58F0E79A907B34FC64B51A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626243221, "uuid": "4c872361-dc7c-4846-bc4e-c6cc2ab39157", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626243221, "uuid": "79936ad9-8be4-42e7-9f76-85366fee4da4", "value": "6144:Pp4L+FeVW+2sbdEHTzkN6N2DtJs3lhUkiAxlPtc9+W6MzGqi5KG1/17L/5W:Pp4LseV5LhEf+JshVP3W6MzGqWKGZ1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626243221, "uuid": "24736d33-8f4a-4f4d-8508-ccdaef5f49f8", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626243221, "uuid": "ec7ab33d-d4eb-4403-9d9c-33dad4d40c5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626243221, "uuid": "e8b8cf59-d9f2-4dec-a091-ae2c8dfc7ee6", "value": "Amend QTN TECH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e651b6-e4a1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626266585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266585, "uuid": "3425699b-ea2e-45c7-9a3f-183f363f4d5b", "comment": "Malware payload", "value": "0ce43e48087ebab43f9074a296daa50c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266585, "uuid": "c7f9c218-c5b6-4db3-ad28-933f5f13ac0f", "comment": "Malware payload", "value": "55bd7ac4e380852f86124c2bbeb962b7e48f2c5c94513e57f921b5a8eb0c9183", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266585, "uuid": "503bf073-faaf-4539-88f4-a6ec6a0f3773", "comment": "Malware payload", "value": "8c3d09c7678adcec97f3b46010a71c19f94663b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266585, "uuid": "64793e9e-1179-4ff5-a997-6ca09e71ba48", "comment": "Malware payload", "value": "0095adbcc772af7e97f7826dd035fd453fc4159b8206780821ae80713880fb8e3ca59a56a7291b4cd1322e9b51087a1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266585, "uuid": "e954de8c-8a69-4706-9d98-ec9092da2ca8", "value": "T1C5B2D0C47A12DF21F71104732D5C9AAC8A6BB7590BAF3471C8E4ED8DC35A56A188F385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266585, "uuid": "49742282-7a95-4b2f-b523-dcece3efddb4", "value": "384:flzEBkDOvTCZuQEkymy/Gf+3pK9pGr39KKD6sq+GJ4kjNBrHKuxTnxl/KEuBmskg:pwkyTc9pHiGJ7bLxlpuYPW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626266585, "uuid": "3bd2213f-1216-4cc8-99d8-1a42fb93fd35", "value": 25200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626266585, "uuid": "1e230d5d-044d-45cf-8c6f-64fdcef0af80", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266585, "uuid": "c5f4e753-d810-4514-9488-64fde4895a1e", "value": "SecuriteInfo.com.Trojan.GenericKD.37213727.8312.12771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f55802-e4bf-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626279765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279765, "uuid": "efe51cf9-35d0-4806-ba97-854d438b7a34", "comment": "Malware payload (RaccoonStealer)", "value": "0140b4f87910ef13e348b28a67aac23a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279765, "uuid": "4dab11f0-c8f4-4be2-973b-2ce249b16bd0", "comment": "Malware payload (RaccoonStealer)", "value": "55dae3a9ea2e8108b1c8552f9605f2a8f8ce7116b055d96cf1c827989ac0efd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279765, "uuid": "b47d7352-9e15-42cf-9d07-2ccc46ce511f", "comment": "Malware payload (RaccoonStealer)", "value": "fbf6e65d06b18eb92f3f8ffe49cb8e12668c0a0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279765, "uuid": "8aaa56cb-1685-4883-a8c7-e25dba6ae45b", "comment": "Malware payload (RaccoonStealer)", "value": "0b6605d00e5a7949093dbc13e61d9ab0132ca598299ed069db74788fa033ae8dae739948eeab40e951eaf1e324190a57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279765, "uuid": "c4bd0efe-e214-440e-9fa1-098ced02b735", "value": "T1A95512217744FF8EC1798E3588519C2067E0BD3A9707E74B6CE33AEC956E3A64B22057", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279765, "uuid": "31e85092-6436-4035-8eb3-3228079385b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279765, "uuid": "bab30e59-ff79-4c6a-98ea-bfedab8e7cad", "value": "24576:IFyyGO0k5HbelzIA+mLYF0iqBJrfNUqKG91AKNXZF5:I6y5HSVp+mEhqfz9AKNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626279765, "uuid": "4755ea95-4e3a-47f3-98fe-c646013ed768", "value": 1307648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626279765, "uuid": "47d0e971-aa22-48e0-a03a-ad99d222be74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279765, "uuid": "abec1e13-b9bc-49c9-bb56-35154908e802", "value": "0140b4f87910ef13e348b28a67aac23a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88d7059-e4b5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626275470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275470, "uuid": "fdd8dfaf-0311-41ee-8b16-a27615ff527c", "comment": "Malware payload (AgentTesla)", "value": "9795e6e7d8dac76a103e49debc702f51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275470, "uuid": "5cfc9ec9-f2e4-45e4-a84a-461438958213", "comment": "Malware payload (AgentTesla)", "value": "55faab724133c2455e0f6d53a97693cc9b5058d3e0a05b34e0f4e7271e0f5412", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275470, "uuid": "2bd2db98-9ebe-4983-9075-c4fccb498349", "comment": "Malware payload (AgentTesla)", "value": "9ec48ffb6582bd143a739010ddbd2ec1dcf74c39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275470, "uuid": "e7d2b5db-47f8-43ca-9963-29abc77075b0", "comment": "Malware payload (AgentTesla)", "value": "0e5fb5287ff36b8a20101a1288e532d3495e1308d0a49d55f3d2f06a4ca8237b482d68189828a686c3211578bf383e36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275470, "uuid": "b5a3d1a1-e3df-49f4-b0c7-6d22f274c8a1", "value": "T1F4158D6823BEA649F633FF315FA5E6449FA66EA98214DC0D2CC4360B5431D42BDA7C31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275470, "uuid": "e47e38e4-cbed-4e97-8398-f4804a0e713f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275470, "uuid": "1dacbb7d-4394-4f63-b50f-0f2a7cb39ac4", "value": "12288:lT2QyorNls9XOd4+QCH4jwrKUse9OHtGUj1qa8vzL4H1IF0wYo6DEaQdigIgAPKn:lTX4srK5e9ytdWIVlp38if1K3he", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275470, "uuid": "c9afcde9-dc7e-41e1-9f53-40f20a4f1388", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275470, "uuid": "ad30c188-3a66-4521-940a-2ef3bccdb10c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275470, "uuid": "69a32a6f-75f2-417a-a75c-5e4febb0e1c4", "value": "9795e6e7d8dac76a103e49debc702f51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24d8ef2-e482-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626253555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253555, "uuid": "1b8bdc79-9a09-4b66-be0a-285c4f1a2ad0", "comment": "Malware payload (Mirai)", "value": "a92144ec7437b93c562e6db5e0f1c686", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253555, "uuid": "0e343529-6687-4021-b087-dc2870299a50", "comment": "Malware payload (Mirai)", "value": "565d6cd77325fa1c3655773509bda9da6ad2c2cadfd678b692e75f24f825f6d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253555, "uuid": "4d4382f6-9d16-4bbd-865e-7a1a8d6ef64a", "comment": "Malware payload (Mirai)", "value": "7832cb7ae28dfb3249e774a997552ccc47a9c330", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253555, "uuid": "ac511466-e6f4-48fd-81b7-b6a271dbc838", "comment": "Malware payload (Mirai)", "value": "f0575e7ddad72f519cf436175873ce45b7a9dd871b3486d38577fadf915eeb1203a458ee3c81a95702cb9bfc1183d4b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253555, "uuid": "ce680caf-3099-4279-9028-9bf03c676d0a", "value": "T1AED2D0AFE9E0687AC5AD48BD19AD1BB45F0921C0B3171B8C23214DC1A579F5E3B8F071", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253555, "uuid": "9e5e0096-3c62-4368-91fe-223c61aaa53a", "value": "768:0Ogi3LnxfjSTWof0fdM3j6ZOSjE0Di/yDWh:jgUz2DeZg0Di/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626253555, "uuid": "72ebabbe-0e0a-43c8-aa9b-94904e8a4ee7", "value": 30084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626253555, "uuid": "e4df1b92-e471-4205-99ad-e85798685092", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253555, "uuid": "195549c2-4e0e-466e-9ca6-40c4b78b5785", "value": "a92144ec7437b93c562e6db5e0f1c686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea1d28a-e4e4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626295693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295693, "uuid": "f15d6369-41c8-4e9f-b7ac-6273f81c1cae", "comment": "Malware payload", "value": "ed2a82e9566772f0c93c5655160a04f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295693, "uuid": "f0278933-3aeb-435d-9f40-208dd98be8c5", "comment": "Malware payload", "value": "569707ca734a6d320c53323e9bf718c9e0777d3531ede12e36b6b941971be1f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295693, "uuid": "6f9f8236-326f-4196-95d4-90b4b5ab1288", "comment": "Malware payload", "value": "1514d4dfedfb7df3c0eb5e98de239d3503d80d2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295693, "uuid": "5c49b800-6675-4381-8a0b-42577b950394", "comment": "Malware payload", "value": "258dfd61539c51718913f95d5f7cdabcaf60e5a9b2d759cfaec93245103416e6adc8befd08e85e196bd061dcb8ed9794", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295693, "uuid": "c68510b2-2a83-449e-88c2-9f790536700b", "value": "T15803064AB9C19B05C5D112BAFE1E124E7313576CE3EFB3225E246B24678B57B0F3A805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295693, "uuid": "aae34781-a22c-4d99-8d3e-dcf43e062dd6", "value": "768:UAnaKAAppS3NKuPkWx79U6miXt4+w1oo24YVTm6mhyZe/GB:UAnaupA0EV7Dmid4r1oo4ewZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626295693, "uuid": "c639f71b-ad87-4443-81b1-880dc2da28f2", "value": 38252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626295693, "uuid": "71e1f4f9-c3cb-4d03-98fd-74ed7b4af227", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295693, "uuid": "2dda9e01-b433-44b0-b35a-45df65cb6ad7", "value": "ed2a82e9566772f0c93c5655160a04f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf94919b-e4e4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626295695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295695, "uuid": "76c9ee68-ec48-4122-9f60-e419a99e71c4", "comment": "Malware payload (Formbook)", "value": "93a5e518f9c0bb7bb684408eb8fab6bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295695, "uuid": "f8611038-3b47-4cbf-9bcb-8a7e36919cc9", "comment": "Malware payload (Formbook)", "value": "5867896adac3cf7577d75715e4002e800094229ebc463413169604baa65dc86a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295695, "uuid": "31362f49-ade2-4329-95b1-6016feb884a1", "comment": "Malware payload (Formbook)", "value": "52dfbd6cc10196e3cfdbb3da828d60b9ffac769e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295695, "uuid": "1e10ada8-bfea-48e7-be85-d97c91420c10", "comment": "Malware payload (Formbook)", "value": "4ca9746efb4d3964459360ee0fbbe505b6da2c90940ac7bc253718060d7aac85f743b57ebfa1070839149ced0c327440", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295695, "uuid": "7e0747f6-de08-46db-aede-59b82925d7fa", "value": "T14D24132A32F1E8F7D27503F1EEB27A06ADF2D115142453472794EB9B36276C1B92F182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295695, "uuid": "3160e5f9-774c-4190-b3bf-1984660c65dc", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295695, "uuid": "98a18530-a680-47af-b6bd-5e7c09097f03", "value": "6144:iqjIKENGNoaxF7mgDpTIe3GzoX/+MGsepOIqqbpl3xuVC:zpENg9F7m+qWGzovepLFlQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626295695, "uuid": "3d7c07bc-0f3a-467e-af40-b6e2d0f82934", "value": 216995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626295695, "uuid": "6df28138-50b3-4662-9d88-b1dea94346bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295695, "uuid": "bceaf71a-f124-422b-87f2-313748ac98ba", "value": "Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164503e6-e4b9-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626276915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276915, "uuid": "48d56699-4f3f-4346-8e8b-ef1077e753d6", "comment": "Malware payload (NanoCore)", "value": "80435aa37453c5bef85b56485ee552af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276915, "uuid": "44959227-8123-4ae6-b365-488a247caf0f", "comment": "Malware payload (NanoCore)", "value": "58e7c1702583c96deff86dea74d58b0abbd68125448cb9aaf25143e82daef3d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276915, "uuid": "466abdae-a8de-41f2-93aa-300e27f77fa9", "comment": "Malware payload (NanoCore)", "value": "07ea3a227068a687c0b43b0861e9e212bef40827", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276915, "uuid": "4a6e0d0b-47d4-4f1b-bf48-3df3d9f4e32b", "comment": "Malware payload (NanoCore)", "value": "c0a0fc53be865ef28c1f78c1c6f63e98034e8f2b9e69cd27ccc7fdf53053070c9028cfa3b6499e8c33c0af16468f4d24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276915, "uuid": "731ffb20-a44d-4d0d-857b-eb99c3ab973a", "value": "T1F005DF3733884B2BCBBE46B9B650E050F761AC9B7701DE0F6AC362D2556B70051DAD2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276915, "uuid": "1969a712-46c5-42fa-a3d0-27517f03dd76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276915, "uuid": "d632de1b-6878-4fcd-b09f-99c30bf10e0e", "value": "24576:TqQUgJ0/Va4OaxiUyqqur3q/1nBtFm+Uc9WfHG:2PgBx9EDq/1tH2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276915, "uuid": "0f873f5b-b613-4e3b-82c7-680e31e1c34d", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276915, "uuid": "702def52-56dc-4d9e-a546-c2d874b067e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276915, "uuid": "6287fcc4-5c8c-4993-b8bf-c4f2f91a0a11", "value": "80435aa37453c5bef85b56485ee552af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4edd72a-e496-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626262257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262257, "uuid": "83bb7e00-a929-4a29-bea7-c34ab749af93", "comment": "Malware payload (Mirai)", "value": "deab045556104732b614fb64a6682a8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262257, "uuid": "58c4d14b-1d8a-4911-9cb8-ecbf6dfabae9", "comment": "Malware payload (Mirai)", "value": "599009ffea4ceeeec1c5a366397b26002e96c9c9b11d8b120ad9913456e462f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262257, "uuid": "05aee0e3-9994-4a15-826a-ced04facfa0b", "comment": "Malware payload (Mirai)", "value": "4b785d25c122949ab6bf08e6613b3c6d4b8e47cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262257, "uuid": "c24769e1-a073-4f58-9a83-43dca3697cff", "comment": "Malware payload (Mirai)", "value": "9a0ac43976d0e139b60e7fe43c4121b012dfbce6b02ca3a41089065d502367ffa1e9f29750ec02ccd00918e4ca845baa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626262257, "uuid": "60c11732-1d92-4796-b5fe-8fa344045ae7", "value": "T119F2F07482003363D7F15E31945DAE4D736BC8A8E2E2B976136022D6A9EA105F3FE4D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626262257, "uuid": "e120f333-3a42-41fa-8127-b82a3bb92208", "value": "768:qXbcwXW2bpqX1/Cg1dKzY+V05eCNusO3U63N:qLFZb0X1/CWdK0+i5DNusO3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626262257, "uuid": "0beea047-ab0d-44f4-9bdd-78b1cf891f01", "value": 35112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626262257, "uuid": "1892c869-4e08-45be-b581-af137610de51", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626262257, "uuid": "b6f3c794-d780-4a33-8cc6-ca81212b7276", "value": "deab045556104732b614fb64a6682a8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682566e2-e437-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626221218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221218, "uuid": "f46c0299-9b5b-4acc-823e-37cbf3f6d4dc", "comment": "Malware payload (Mirai)", "value": "a012e5bfaab5e6b122bf51401ac4421b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221218, "uuid": "6da0ca12-2171-4f5e-9461-702f20027f1a", "comment": "Malware payload (Mirai)", "value": "5a58428adcd0f8f2a1d6b8076aeaf35baa16c6e03364f1ee8ddd4f7a9505081b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221218, "uuid": "479e639b-306d-4943-a652-44579f322828", "comment": "Malware payload (Mirai)", "value": "e3a8fcba653c2e37bc96baeac0689cb2c50e9bd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221218, "uuid": "48189b50-fc2b-4e6c-adc0-09c7e8de36d6", "comment": "Malware payload (Mirai)", "value": "67c6f9d10765c3685260346873dbfa1d2736fe74b298613caa186f3e79e76af9a63dd76604ef4c16e1e2a7325b2925c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626221218, "uuid": "a89e7dc0-c761-4b96-9c38-fd3abdd62052", "value": "T16EF34C46EA419B13C4C62776FA9F414A33239794D3DB73068D18ABB43F87B9E0E17609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626221218, "uuid": "25f6d5ba-f3f3-42b1-9e4a-d413fb7f049b", "value": "3072:BrOlLkbXt/J7Z2aPJqTMk0UbZ37wq7wPT+fM/9CI7FfoLf:dcG9Z2aPJqYklbeiwPT+M/9lFfoLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626221218, "uuid": "3e4093ab-c2da-4fcf-92b7-320e47f9e39d", "value": 165793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626221218, "uuid": "4a7ef0a9-4f74-4d43-bef8-b2c60d60faeb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626221218, "uuid": "9ab06b79-312b-4c6a-b480-47b381195c97", "value": "a012e5bfaab5e6b122bf51401ac4421b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3817794-e4a3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626267838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267838, "uuid": "c0d38a1a-abf1-4da2-b514-5a1c67c07c55", "comment": "Malware payload", "value": "cb82f4fa8927a4d519598c651d9386a0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267838, "uuid": "12103518-9932-464b-b9ee-809e42af28ae", "comment": "Malware payload", "value": "5b0fdc4a2d159e00446194f9d8aab45b20cca1328e10217bc02665a3eb6a0f90", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267838, "uuid": "61e42755-1f8f-4e4e-8fb3-47e5148eeb6f", "comment": "Malware payload", "value": "91478d1bc67b8ddfdf643aefd6d1e87df1fae0f8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267838, "uuid": "17ff786e-7f9f-49e2-9b26-b21264deeed7", "comment": "Malware payload", "value": "bba2be6b7a846fef535cdbbda82d4c227b1f1f11f1208f6dc0f6f2bdfba5beef07937e5893b6419a12630e585e217806", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267838, "uuid": "cb636ef2-4c15-46a4-aae6-1eedcf80f514", "value": "T1D3F2B894B3C1B4E927822BF7BE3EF0F1F4DB18C529844447F041F894B66466AC9B563A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267838, "uuid": "a1c6d313-3755-40b9-a37f-d75fcb854460", "value": "768:M2r0jJdPOV/OkuSDfdP/AvuIkVjPM+SXD/0QlMfRVlumqgyObiB/RsMyVeGwZPf8:9rPElCRYmCoLj/TbrhnFuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626267838, "uuid": "97760941-4951-43b8-a035-eabf1e7a2650", "value": 36960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626267838, "uuid": "cea58779-7bbf-4890-a59a-5c2771ba3fb7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267838, "uuid": "e07bfbaf-5db5-43a4-8b94-ec8a09dcd233", "value": "CFDI\u00a0\u00a0826271\u00a0\u00a036263.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e382e7-e4aa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626270529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270529, "uuid": "3af574fd-f346-42c6-bd9a-44ce575e7447", "comment": "Malware payload (AgentTesla)", "value": "723ae0642ea4963dc7bba926a0dcb458", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270529, "uuid": "e740fc43-b72b-400f-8a16-d5dbb106baa2", "comment": "Malware payload (AgentTesla)", "value": "5c4b9315f802fb6d6e2b21c40e63b9af030a2f7912c4fd97a28578e0cf5badc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270529, "uuid": "4b1306d2-1999-45b3-bb9a-341511768944", "comment": "Malware payload (AgentTesla)", "value": "bbe07dcb2aca64ca2595550fe8470c88ff312d12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270529, "uuid": "812a5dea-14c6-488c-b325-ff3b408e7f80", "comment": "Malware payload (AgentTesla)", "value": "1033c7129b5e40cb66b5d4869c16a7468a00602b506d7fa8ac83a5b84ef2a4821941866ed74c82163fa5125ea7c44deb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270529, "uuid": "2013a88e-a9fb-4a03-9046-9e5db191671d", "value": "T1A623C4ACD1A701A88F0667B8271B9F55058C7A2EF388D632367C97311BD2D7F511293D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270529, "uuid": "9799a908-9a04-4004-98f9-9d5acadb7494", "value": "384:/ySc+xpRacv28nJduZcyc869di6RkHSKn3Iy2Vlvmhwb:/yf+zRT/XUcyctiIW32Xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626270529, "uuid": "0c59c413-7e9b-45b4-b7ba-14b19fb93449", "value": 46743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626270529, "uuid": "f5f47f4b-d83e-4de0-ad1f-92bf6fbe69a1", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270529, "uuid": "096b9b6b-22c3-48c6-9f87-c7088e93aa7d", "value": "purchase order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f07984-e4b8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626276725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276725, "uuid": "de746434-8677-4914-a390-15e466709dba", "comment": "Malware payload (Dridex)", "value": "108bd6abc15acac8fd3d3f23f7b445a7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276725, "uuid": "18dc072f-3377-4749-9be4-f5995539b8ef", "comment": "Malware payload (Dridex)", "value": "5d9c6e1b85b728aa57e6afaefe26c1bcc5bb687b061ebae53a166d9453f4fd2c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276725, "uuid": "ab967a79-6341-430e-a25c-4e4b72859214", "comment": "Malware payload (Dridex)", "value": "697d30e85a82c8fe84c88ecd6427a1f5698955a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276725, "uuid": "d6ec655d-f10d-4f2a-ab1e-cd1916ba9cbe", "comment": "Malware payload (Dridex)", "value": "f692446125d7dd846231f447e6c09ffaa5842da44765bbd2638da314551aabadbe0832ba6f3af0c198784e42f2b29b30", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276725, "uuid": "4c20d5bd-221b-4cff-867b-210d4ae545e3", "value": "T10AF458E1ABA4CEB5DB01C2718C9D1A586374CC418A49AFC77255B078FF3BB798E881C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276725, "uuid": "4718956f-017a-4dcb-a6e3-320a596ca29d", "value": "12288:LRYbXrlUc6XS/CwRl+4MW1H5onZHBDznxcp/c0UGtkbByxlFYd2DrpY:kUc6EjDMW1UrDjxcNcfgZI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276725, "uuid": "cc829f16-ffcc-4301-bf6a-33e500e2f237", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276725, "uuid": "e851f479-1011-4c19-ae66-fc77c31ddc15", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276725, "uuid": "450d707a-9d38-4c5d-ae89-72806495f1e5", "value": "108bd6abc15acac8fd3d3f23f7b445a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d209d0f-e4e5-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1626295905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295905, "uuid": "784f7682-ac45-4804-bf13-5c89a1c8663a", "comment": "Malware payload (RemcosRAT)", "value": "9318c6fa5354e8aeb9ad516c27e22a6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295905, "uuid": "9d81bfc7-b267-47fa-be47-d0f037799eb0", "comment": "Malware payload (RemcosRAT)", "value": "5dd2f8347b2c2a334231ec2167d38514868ebbeede5311ace774c9a4b5375fff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295905, "uuid": "b7c5186f-62c8-4112-8c11-4547d66b7ff9", "comment": "Malware payload (RemcosRAT)", "value": "a4cb3c20e099699d29283022ee797ac7447cfc64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295905, "uuid": "3685ea2f-91fc-4019-89ae-daf83fa599d2", "comment": "Malware payload (RemcosRAT)", "value": "9fa6d175e3fff5043c1c2e0dce40ce31feb6ce6873b9aaeb5353f571bbec29f084410f0ecfe1b8610fe9a5317865b8c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295905, "uuid": "b90e1df2-70db-4c8b-8d6b-796ebb049162", "value": "T181F4AE27A6918437D1731E796C1BB7579926BE002E28A5893BFC1D4C8F3C6D13A36393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295905, "uuid": "4cc2f65c-8ab9-452e-82f8-45cad9cc51d6", "value": "38d16b2c37539891bdbf379fbde18675", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295905, "uuid": "d039350b-fe8f-4db9-a07e-4862252daaf9", "value": "12288:MMzACYeU8tDGC/xRXzpU2YeJHsOHUgqBFDRVGttqOeAhFK:MMMCnMC/xRmeJMQVqdVGQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626295905, "uuid": "29169acb-035a-4dbf-8fd5-cd50fe0062ce", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626295905, "uuid": "e76e3d0e-88aa-48ed-a1fa-9111a3480a47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295905, "uuid": "88398cf5-58d0-4e11-a5d1-fa2fcdf27060", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab031f4a-e4b7-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626276306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276306, "uuid": "ef1b0dc4-c410-4bf2-b084-3371ff603e22", "comment": "Malware payload (Smoke Loader)", "value": "1d2b13ca8358bc5ddb5259b21d54c58b", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276306, "uuid": "b75aa1a4-d33e-4dfd-aab0-1650bc2b0eb3", "comment": "Malware payload (Smoke Loader)", "value": "5e30a88fb1c9a45bd6697990493098ca05e87b2560172ae89e9811ea887ff8b4", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276306, "uuid": "51cd5f30-5468-4ddd-81f1-4594b0dfb901", "comment": "Malware payload (Smoke Loader)", "value": "23ad080a2663d7dfc74ba5ec65d0a898497f255c", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276306, "uuid": "04886653-e230-49a0-bb7f-b076537e7db2", "comment": "Malware payload (Smoke Loader)", "value": "b25eb3115d57d559ac7f818704b22e62a5eeaf2210c752d7286ffbfb404c90591adf80f4c1a4e3854d0c711bc9936bb9", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276306, "uuid": "738a5be3-11e3-4d5f-92a8-cdcafed26129", "value": "T184149C2132A0D432F6F745306475D6A12A7BB9323A74CD4F3B5427AE1E312D19ABE30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276306, "uuid": "e490187e-e578-4ee9-81c8-df9ded477b6a", "value": "cf8113cdf9d71dde8baf28192dd4ab3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276306, "uuid": "ab67849c-22e6-4493-8fc9-2234de81bb24", "value": "3072:fBNmn9w5zAO9QhfTglZl/cwMm59pFo1ODQo/GjvyHv:ZgczAOcfkXlkwRpFgODIvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276306, "uuid": "e79464cc-9895-4cb1-9ad6-fdc0cf0d8c60", "value": 194560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276306, "uuid": "eb9be8fc-a1e6-4d18-a8b8-10fca9e7e882", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276306, "uuid": "fca7e99d-4e3a-44f0-a92e-253703fa063d", "value": "1d2b13ca8358bc5ddb5259b21d54c58b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94371430-e477-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626248780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248780, "uuid": "c390ebe3-a23e-486f-ae0d-f89b2978b9ea", "comment": "Malware payload (Mirai)", "value": "9a71723c62a7e8d98c69517a598fbd98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248780, "uuid": "e687a46b-4be2-4dd7-ac03-137a550fed15", "comment": "Malware payload (Mirai)", "value": "5ef53790ef941371c234088d5fcc8c733546dbfbf8d5c200d994052e925d8a74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248780, "uuid": "02dd2bea-8662-4990-b8da-65731f0c37ed", "comment": "Malware payload (Mirai)", "value": "5cf3f3f7331a896013e8fcbeb624cdf147d32c74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248780, "uuid": "65e8588f-6cea-4d0a-99c7-89dcd3852557", "comment": "Malware payload (Mirai)", "value": "335f9f82c04589df3d0c3808ade0407142097845db03e7f0e9fa802b004ad325aa8f23c49e656810ed6dab9e375570f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248780, "uuid": "a1f549d2-823c-439b-a486-a071f9b44a7c", "value": "T132B2E1D9D6EB1BC3C2A1C336E07C9A4E96725BC10346450E1109B24EA397A4E57FF3B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248780, "uuid": "6d57fe15-91be-44eb-b108-1160a30c4c24", "value": "768:P/QOC0Yhn6ROHWFGrcwNVFCnNBxcQcWci:P/nihneF1wsNBaQcRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626248780, "uuid": "d0c6669e-1f21-410c-ab7d-903103d95025", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626248780, "uuid": "7ca1280e-c929-4311-8fc8-749cf11586f6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248780, "uuid": "38882222-3b65-405e-a74c-bb42b5d06c66", "value": "9a71723c62a7e8d98c69517a598fbd98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7ce57e-e48d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626258409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258409, "uuid": "7c51975f-6f4f-4d01-ba62-df448b3ab2c1", "comment": "Malware payload (RedLineStealer)", "value": "5e4a3d8845f4f31e4d737877f0689b97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258409, "uuid": "84e7cb75-7819-4dc5-8e38-1e282eadf039", "comment": "Malware payload (RedLineStealer)", "value": "60f649f6d971c44b959f6fef2bf1d08c3dbe00edeac7a889e81adc761ba5ddba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258409, "uuid": "1d8e741d-1c1c-4c35-9cb5-7259f7348abb", "comment": "Malware payload (RedLineStealer)", "value": "69bdc176295e7899c4be7125a37bed5e94df051e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258409, "uuid": "3afa2f6c-6474-4c07-80f1-28ec5fc0005d", "comment": "Malware payload (RedLineStealer)", "value": "b080638a28b122658f0c06bef214ae8211552463b605c794defac34807e3e6c1037366dc6620e64ee793987de6ec6c85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258409, "uuid": "4bc2d786-8801-45a3-af54-e1b1292d6df8", "value": "T17D462333315910C0F0FE87769627EDA132FB0D7B8DC198B826E9B6E019717B5E206A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258409, "uuid": "c3017b23-751b-4275-b5aa-5c858a7fd507", "value": "8c972504d70884fca86dde20a90fe5f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258409, "uuid": "ddbfdbfe-3b14-4ca5-9290-55969f55e4e0", "value": "98304:YUC4g3QqSW+UBjBdVAMewDA1TJnpgk/ILFebp6vpWgqUNyhLn3QJlj/KxH:YUG3jGSSJkcQvpRjyhLnClj/KxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626258409, "uuid": "4207b177-651d-47dc-97c0-cd8d47abe7c7", "value": 5624544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626258409, "uuid": "ff1226e4-8497-4e7c-9e84-0960179e6a7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258409, "uuid": "2cf63829-36c6-4655-9fc3-8ad6979527b3", "value": "Sirus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef3fcf1-e4e4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626295694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295694, "uuid": "6168d577-35fc-491d-9ec7-ac7be0735dfd", "comment": "Malware payload (AgentTesla)", "value": "faee77a3a20f82e48f6aead989095222", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295694, "uuid": "c303656b-9b66-475f-8dbd-ea26161f55e6", "comment": "Malware payload (AgentTesla)", "value": "6256cb8aff5a06b858693a93e28fe4a05424c16c07ef2ef5cec2f4c1465bc069", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295694, "uuid": "105fad18-222b-47dc-8a91-42a718884d3a", "comment": "Malware payload (AgentTesla)", "value": "879a36038321926aa7625be5e50fbb7b337a080a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295694, "uuid": "462ace49-6536-42d4-9b8c-4098b50bc514", "comment": "Malware payload (AgentTesla)", "value": "d42b629b621a4d01517bd65ce6a0accf27888cbdf22e07e27005fdb4c3cf87cf0581bc40f82b11c86e5c6e1163fd9c16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295694, "uuid": "e046316a-a725-40d6-9b64-671d0d565cbc", "value": "T10725AE2923FDA649F13BFF319F94EA489FA62E7942159C4E18C036472530D82BDA7C35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295694, "uuid": "348df73a-6ef8-484e-9e49-aa2c772b1334", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295694, "uuid": "9bf79f4a-86d7-408b-8816-3e1d4d8dc355", "value": "24576:BB3pXWvgHdgpGzRNtKTSCyPknjotLsqrizc263AsXs/:9XWICszRNtK14Lsq2Y263AsXs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626295694, "uuid": "09f1a93c-835a-41de-ae76-2027f595c364", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626295694, "uuid": "ec126841-4610-4ed2-ad75-9d8a140a87ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295694, "uuid": "10a26e5d-d459-4ee8-9ecd-1faf93aa4c10", "value": "Revised Invoice pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a675042e-e482-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626253535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253535, "uuid": "fac65e17-8d8a-4f50-8f32-1c95a4fb28c6", "comment": "Malware payload (Mirai)", "value": "a2c5e94b5a8bb30abbdff4a6efd23690", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253535, "uuid": "c8b956f9-1c3d-4f32-94d2-c190b782136e", "comment": "Malware payload (Mirai)", "value": "629a868396ee9b75f90cd338613bef963023367ddd2124c917b0402e84e952ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253535, "uuid": "721db24f-f967-42c5-ade6-a0b5ee3762a4", "comment": "Malware payload (Mirai)", "value": "a799635df7cd374bfda868ba2348da1cc8a7d2de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253535, "uuid": "670d35f8-1538-41eb-b418-e7a56b0ceb9c", "comment": "Malware payload (Mirai)", "value": "32edb65dad9df1bf2c6748ab4e6e43e2701d60a9885f703dad6067b2e42d3bc17bf5d7509c5c36cbce7ea35053abffe9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253535, "uuid": "234db713-d021-479a-ad86-5f0d2058ceee", "value": "T114C2D010E4198ED3DD5FAFF08EF1E0D437A58999B6EC4BC092268F2105A5A6E2B5CDC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253535, "uuid": "ee8e3c15-5cd6-4b21-a5a6-16975bbf4ea9", "value": "768:1rKeUL4Yq47l5KggoLHOqxLz4uVcqgw09W:1684P2oBxLz4u+qgw09W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626253535, "uuid": "51000d39-1b63-43c2-b045-da1617e951e3", "value": 26352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626253535, "uuid": "72252ab8-b668-482b-b582-d245495d00b9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253535, "uuid": "1705ebd4-5c20-4866-8d37-f6f4b4e392eb", "value": "a2c5e94b5a8bb30abbdff4a6efd23690", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13dfb3e-e4ac-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626271619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271619, "uuid": "7a307d84-8d2d-464b-ab7b-bab46f821e9a", "comment": "Malware payload (Mirai)", "value": "f503c0ab1fbd974c154e87b21f42a548", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271619, "uuid": "8e885177-e63c-4569-a88e-7f67de6620ef", "comment": "Malware payload (Mirai)", "value": "63b6df1f8d133dee4a7636c7377d9a16c4e95344c90d66985c54807dcf0f8072", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271619, "uuid": "9c4d4e35-beac-4cf0-a858-2274d82d52ac", "comment": "Malware payload (Mirai)", "value": "94bb2dfc729bb28716279ce5635c46fa46c29bb3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271619, "uuid": "22f91f49-53b4-403f-a7f3-9db4b986e8cc", "comment": "Malware payload (Mirai)", "value": "3a2cee04e278ed1cd3422ace24308e937e93b670661f59277b39aef270c89514ab427cc7c9883b5b1f500410f01fad0d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271619, "uuid": "cc4cd17b-afdb-4951-8ddb-16a85733840b", "value": "T13664E18AED01AF75F9C506B9FA5F074973B38BA8D3D7B110E620C7143ADE64A8B35184", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271619, "uuid": "56d21612-0db5-4a25-b434-cd5e72ea49e2", "value": "6144:7O/QJHZweEL/NOjCHm7FZZncoa77oNsKqqfPqOJ:78QpZsKCaioa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626271619, "uuid": "9dfea6e3-ab76-40d0-b5bd-cc844e2856cd", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626271619, "uuid": "4a33bf4a-ab62-480c-ab15-cd900487608a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271619, "uuid": "1ad5d08c-7bf6-4c73-9893-25b13f68c6f6", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a089c5-e4b5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626275284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275284, "uuid": "c816a12c-013c-49d7-afda-12fab21a8a04", "comment": "Malware payload", "value": "c6037dfee88cbbae4cbc28549a0ec8e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275284, "uuid": "e0a2e714-e87e-45d3-b90b-43a71bae5d70", "comment": "Malware payload", "value": "63f672e49034039a767305e0509187c8b5412d17df65feab54283cd794af8e7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275284, "uuid": "af263ff9-4d9f-4c0f-9c55-c2a4d99af799", "comment": "Malware payload", "value": "6ed811160d4a7eaedeaddc6683a2cd39eedb2bbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275284, "uuid": "525b3ada-2cb2-4780-90d1-1b8ffebb2c42", "comment": "Malware payload", "value": "c4e572f3fb2c871665f7213e89475aa502b1bcd6a45a7678e2532cb6b40273cb0c6d719377142863794a104861141ca6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275284, "uuid": "116c5607-5acb-41cd-9da5-b89ac60e38cc", "value": "T17721DF00F2191823E6D13E70733B2B51577A8F1327184508ABDFE79ED8B8C389A8E49D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275284, "uuid": "6dc68294-111f-46d7-b953-a7e5bd3815b7", "value": "24:3uUpWS9nSWZ6S4/KSwISBd6oTKP5tAFlguqzktqKcvy5oaaTo0YaN23GB69N:eVgZVbXGAkLz2qKcvy5olI3kCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275284, "uuid": "38559307-7cfd-43b6-88b3-224b59a503cf", "value": 1408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275284, "uuid": "a2fcc0a5-f575-4a67-b4d3-5f99b03f4b00", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275284, "uuid": "dd0c5561-6024-4890-acf9-eb0b91f0df5f", "value": "SecuriteInfo.com.Linux.DownLoader.517.29394.19296", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56596330-e4ea-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626298068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626298068, "uuid": "11ddbefd-d642-4058-b712-5840d05b631c", "comment": "Malware payload", "value": "bd922bb3afb7ccd59784774de19d7e7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626298068, "uuid": "ebd18135-33d8-4168-a40e-19a9e9bee9e5", "comment": "Malware payload", "value": "648926c5d9a339ee75cddfe0731bc4c6dad66afbe0171b3d858993ed0f2640a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626298068, "uuid": "8b350159-e241-405d-a19b-65bcae196f39", "comment": "Malware payload", "value": "4a0c769127844b5d7f46ace6f063b15c97f0bc86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626298068, "uuid": "029382a0-7ae1-4b41-a96e-ac6fad47e1ba", "comment": "Malware payload", "value": "13826f375fd512316b6638914a1f036b8c16a8885c9dab382898995b05468d9ec37ea58d32d3234daf9c7643a0e45772", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626298068, "uuid": "c43e82e9-9057-4d58-bef9-31ba47f44d85", "value": "T127B5332090B0C8B3E9F311705529ABE17B3B72622B7486DF773105A54F36A71A6B630F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626298068, "uuid": "f0661789-4d96-4823-93be-6864184e5349", "value": "249389cf3ddc95dbd917b52599185344", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626298068, "uuid": "62330e68-2533-47de-ae18-fa938a2208bf", "value": "49152:UyH1W7GGAaUGTjoyQBZmrkah/qANeBIiK5hAcoJ7nbochWyP:UyVWJTnQBsh/qANcK55oZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626298068, "uuid": "5b461fd9-72de-441b-a8ce-217bcfc7f01a", "value": 2324480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626298068, "uuid": "afab98c2-ac05-401f-82d2-ac1ba70ead42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626298068, "uuid": "c415c7de-972a-40fb-95b4-7c1131b7c9f2", "value": "mixazed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "190ec68c-e475-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626247714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247714, "uuid": "b98fd763-44cc-42f7-a481-9b1dc3294c81", "comment": "Malware payload", "value": "6f46de0d361775275dfec3606c93f22c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247714, "uuid": "d2747fff-cc7b-4914-9b87-410fc9c8eaaf", "comment": "Malware payload", "value": "65095ed4e8c8bc12d6fdf4182970fb6bb8acb115522a8427108ffb8e3dadf6f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247714, "uuid": "8da9ed65-8be8-4bb0-9972-581f676f44ca", "comment": "Malware payload", "value": "3edd584a718d9166b81dc0c949ee9719321f70ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247714, "uuid": "f861b5b8-a45e-47bc-ac3b-390b349ac098", "comment": "Malware payload", "value": "cf5ee57ccd334c9e6ec76e1e4c4e4850ef622546be9b52159b7b6b0de4574bf15f39314e246a81fc2234192e35874041", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247714, "uuid": "ca28c842-90e5-4c10-ae0a-4cf069e72a70", "value": "T176530223904AB733D5F80DBB633264A3D64D7E5812FD37BB77A4C2653AF598A40A9013", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247714, "uuid": "8210e71b-0ae4-42d3-a928-a558d4608332", "value": "1536:7FIr7HuDCgtJQRKrFLwnE2JJNW78Jx7/cZFWzqH:27HuDCgtJQoryE2NJx7/aOqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626247714, "uuid": "402aaa88-8257-465a-b208-5cd44a7920fd", "value": 62528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626247714, "uuid": "3597d626-2531-40d2-ad86-d4533f20c39b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247714, "uuid": "a2aee0a5-91e0-4b78-85ae-81f89484011d", "value": "6f46de0d361775275dfec3606c93f22c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827a42ad-e4c1-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626280533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626280533, "uuid": "76b96780-c820-4407-b065-18f0c2afd14b", "comment": "Malware payload (Formbook)", "value": "54da6f0e11090728404d0f9807ef3674", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626280533, "uuid": "2216caaf-2bba-4d89-9cd9-8e5621db5f8b", "comment": "Malware payload (Formbook)", "value": "6520c8e7f0f0ad32a8599cffd8d908860f6e0ade6fb41104b31657f8a27a908b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626280533, "uuid": "68e968a5-7564-48fd-b63c-677b1aca4e47", "comment": "Malware payload (Formbook)", "value": "83ef151651d67663758973ff83b2d080a3a99ea1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626280533, "uuid": "6b3c3ea6-4cfd-4624-a063-29ea17322274", "comment": "Malware payload (Formbook)", "value": "b134407055a3c315f92064d1597e8cecd53f0fb912e9daa2a910cccb349c4a3e17506963a28f2db94061119a4540b656", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626280533, "uuid": "6a7de975-b1e0-4300-bd88-a87898698205", "value": "T12B157C2823BDA61AF233FE315F59E2445FA67E754215DD0D29C4320B0871E41AEABD3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626280533, "uuid": "fa89bd17-3dbe-44c7-a699-68d24b751d8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626280533, "uuid": "762dbada-834f-49c7-a81c-1d49f826ff1b", "value": "24576:uSwX+mMy3ByqWIZvdwP1DT/q/Xj70LJR2APrcP:A7MIBlWIZ1w9DDYXj7ExrcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626280533, "uuid": "a26aa1cf-a14b-4b38-9edc-95796f33f0de", "value": 921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626280533, "uuid": "1c17694d-c9bc-4069-ba0d-acc7334ad830", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626280533, "uuid": "a9ebff08-439b-4275-ad7c-055339f76e37", "value": "54da6f0e11090728404d0f9807ef3674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3860f156-e4e4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626295441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295441, "uuid": "847bdb56-2acf-4484-9bd5-05e7acc8c754", "comment": "Malware payload", "value": "8ff632dafb88d09c3b7638f7106ded5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295441, "uuid": "f7f8c192-f40b-448f-96da-ab43c45a69db", "comment": "Malware payload", "value": "65e7b1fe1f45e29fa322e16b0b06ddebec9f7426050e4a889654a9ed0b518f0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295441, "uuid": "be16e269-3b28-414d-bbbf-9abe3fd83dc4", "comment": "Malware payload", "value": "797356fe8039e885a79d1ccbcb2158cdcc301e3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295441, "uuid": "ffc90ede-b67b-4d0c-8497-344601a9eefd", "comment": "Malware payload", "value": "67a64d3f6069e801b01c7817b5eee42f3e1558196aa99823089dc45e27ebcdaeeb3c950467c9c5372c9d9cd67c19663a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295441, "uuid": "b754eb18-2296-4eef-a7c5-3439d4a056ec", "value": "T1FBD2F9A2F902FD7DF41DF73FC5060416B0B1B2A642820B3267B3786BDD761A60972E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295441, "uuid": "5d6dbbfd-2785-468f-8e37-bae342a8bf0e", "value": "768:HZbOaoROIzGJb/JNFhsIV6S5i8bdAzsBu1:HZ6RShOIUS5i82zsBu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626295441, "uuid": "68562eef-4ab1-4487-8ea5-a72ede9bfbce", "value": 30304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626295441, "uuid": "d05d5809-45d4-4cb3-af3c-e90ff684c288", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295441, "uuid": "c5e38bb3-cd0c-445f-8ded-ef8b6f49c772", "value": "8ff632dafb88d09c3b7638f7106ded5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d58b78-e43a-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1626222669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626222669, "uuid": "fa563577-e07b-420c-a0b2-2b459e1fbaf2", "comment": "Malware payload (OskiStealer)", "value": "a3cb076877b0203ee694e188c2a1b78a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626222669, "uuid": "f98f45b1-a7da-454a-81f3-0ee7b94ece58", "comment": "Malware payload (OskiStealer)", "value": "660f716cbe8b466a2c9e2cabc0cd923677bf421fdecb58056e7c8fd87091efd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626222669, "uuid": "dcf25b2b-67ef-4667-8596-d9253eb18011", "comment": "Malware payload (OskiStealer)", "value": "34a6b0905abdae3f6922f4f1de0d201ad2f0d9eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626222669, "uuid": "f29051a4-e691-4e45-81a6-2fb097afe332", "comment": "Malware payload (OskiStealer)", "value": "fccf27ae886bcf0aa79bb54913b4e3ad2822091c91aa9bb97b58cd12e0d0c7faf380b46105c0e4eb1a84b0ffe95c5954", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626222669, "uuid": "592c6491-bce7-4ab1-93c2-9f3697e57bb9", "value": "T1FB146D30B690C035E8A310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626222669, "uuid": "3f3ac534-b7c1-405e-b18f-cbb76cc3bcda", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626222669, "uuid": "22b80527-4729-435b-a7ac-3f5d91f3b68d", "value": "3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIx1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pNM1Ljo3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626222669, "uuid": "f204e2dc-4e42-4657-bdb5-f60d62cfd4d0", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626222669, "uuid": "91a9ceb2-2802-4273-a28a-feedae937f96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626222669, "uuid": "8788d8db-b202-415c-9ef2-4d0ba50b8393", "value": "A3CB076877B0203EE694E188C2A1B78A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6bfb51-e498-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1626262892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262892, "uuid": "327a56c4-81c2-4aa8-9fa6-c75b05f05f05", "comment": "Malware payload (AZORult)", "value": "cb1971f78c896a096d8baeb2e17c0ae5", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262892, "uuid": "bae3a3b7-4079-4c4e-8dd2-2a1ce2ef9ef9", "comment": "Malware payload (AZORult)", "value": "6623dbedb84decadb28c4a8a0f5ad8c2d0c14395a4da10fe3ea8a3de4ea30eba", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262892, "uuid": "a7ba666b-ea15-499a-8250-5226bc6774ac", "comment": "Malware payload (AZORult)", "value": "152d22ee6dda57fc0fc98dead7da6b791e77abd2", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262892, "uuid": "be46a388-38d0-4d4a-8de0-646a0745e046", "comment": "Malware payload (AZORult)", "value": "88dc7ee1092b6ae2a0cb55c260c19423cae17c67d5ec90841c5a1e908a14e2eb27fa2848e4253030645934f491406556", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626262892, "uuid": "bbc7cfab-8f69-4fa0-88c9-8418d93e6986", "value": "T106B3028B3626A612DB82C53988E4A37D0F70FD007D51DB1F7CAC61592C63BE91ED0A39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626262892, "uuid": "e156dd08-ccab-48d1-b8c9-7db932f02f13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626262892, "uuid": "36762752-a55c-4bcc-92bd-f34961699103", "value": "3072:5zB7wfPpkcAaRtmpjqkNWSPhigFGm+/GT:j7wnpzypjFoV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626262892, "uuid": "d8214385-086b-455f-87ab-1b154aaf4f86", "value": 112984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626262892, "uuid": "791cf986-6ebe-49b1-b25c-8187f223183f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626262892, "uuid": "e36412e8-66a5-4566-b0b8-409f20026b6e", "value": "CB1971F78C896A096D8BAEB2E17C0AE5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7524288b-e4d5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626289100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289100, "uuid": "c249cf4b-b280-43bb-9d73-235506f2fabb", "comment": "Malware payload (Dridex)", "value": "3a7d9e9c7b17f37cea12b4a9f2c6581b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289100, "uuid": "2465e9b2-a2f9-40a2-ba9a-8da7b902381b", "comment": "Malware payload (Dridex)", "value": "672ace07423b11c65be0e0cfcdea8e8a17517b033324b418a1b92d6139daa18d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289100, "uuid": "13c4b7e4-7d41-4abf-aae9-36f9e94a1c67", "comment": "Malware payload (Dridex)", "value": "7e28c856061e2b23f02b74a2dd5edcae762ba04e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289100, "uuid": "47ad1d80-c358-44f1-8cef-d9994a2815fd", "comment": "Malware payload (Dridex)", "value": "792a067ec71bde6ac4b7199898087ffd4ed0c1a2a0db0c7428f6485597cc5e8dc2982a3604e4bf202ffac26b59443734", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289100, "uuid": "69a797e3-b825-41c1-bb99-02a2b4d88e43", "value": "T1EAF3023272BB6AFAE276FD72065F9D31273064480318DA6F76019F86D95E0A34C6FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289100, "uuid": "94e2ad71-5962-4a2d-90df-1b9b4af2b8db", "value": "e9cbee8358b331a128409a4d26e3e347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289100, "uuid": "ae5fc2e4-e4bf-48c7-ac1f-10a33f5a0a65", "value": "3072:5WiJzQu5JD9ko9WY1wzxWrPA/Nz7L5cWlvsRwmhnxONgk/:5LquAkPA/lX5WncNgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626289100, "uuid": "358ec6e4-0abd-4e49-91b4-bf02608eac52", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626289100, "uuid": "35a091ca-0706-4f4d-8ac1-9a5c2ae9841d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289100, "uuid": "b7bff7eb-77bc-4d96-91a5-0cfc712cf962", "value": "3a7d9e9c7b17f37cea12b4a9f2c6581b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88979ad-e469-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626242882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242882, "uuid": "4014c55d-1056-4391-b6d3-4a697aab1d4c", "comment": "Malware payload (SnakeKeylogger)", "value": "7b94dc016130f5a366f227c9d6871008", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242882, "uuid": "446f4f47-cc49-4c99-91fa-94fa15e41d43", "comment": "Malware payload (SnakeKeylogger)", "value": "689e61e9ee2c53df4e450554a4b4a3fb69af884692bae7ba437de773b2aae0b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242882, "uuid": "0924d39f-e81f-4011-afbf-557167814529", "comment": "Malware payload (SnakeKeylogger)", "value": "fbdd877423c9412647351b44912d37e8f0b3218e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242882, "uuid": "cb591170-e4e6-49dd-a5e3-d4da5f70a561", "comment": "Malware payload (SnakeKeylogger)", "value": "2fafbd5294ee1f2e8c1e1a59d8ede18a35752471bb7c1544ba2fd2a3b0b750bb73a9a61568893a57a46af3676eb417a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242882, "uuid": "5be2c46b-01de-44b3-90a9-84321a41d1b6", "value": "T197F46B6C23FEA709F237FF315FA4A6449FA676B99225DD0D2DC4024B4421D81AEA7C31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242882, "uuid": "527f13cf-cd79-45dc-aa5d-b09e3b5bbc4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242882, "uuid": "adae6179-bdb3-44b4-b19a-b48727ce2ae9", "value": "12288:wmB/5jFrNls9XOd4+QCdcHKYSmCz08Ge25cmzPnIhTU3CJWMiQYsBxGPz1:wm7l3NmCQLepmzfN3CeYBG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626242882, "uuid": "ea3efdbd-a09b-4a44-8231-2cd2e61444ae", "value": 757248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626242882, "uuid": "7bad3fe1-8b7e-44bd-bcc1-3764e724293b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242882, "uuid": "575b8d73-87ed-41ce-ace4-7f53b087cdbe", "value": "bnnCUvpicLaPSsr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b3e6f3-e46d-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626244561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244561, "uuid": "1fd26453-3462-4e6e-9b8a-806d71d34ca0", "comment": "Malware payload (NanoCore)", "value": "344b8240f060cc1ac0f7f4f5065693c0", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244561, "uuid": "0a094134-89e2-4293-9037-e499c3887e8c", "comment": "Malware payload (NanoCore)", "value": "68d4bb394867528c4326a1a058d7457e8d392d26970394bfbf4fd8ff6e34b0ef", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244561, "uuid": "4f1099b9-fddd-45e7-a45c-4203164c278a", "comment": "Malware payload (NanoCore)", "value": "941d27831c53b18ad2890aa77147c7c1e5421b0c", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244561, "uuid": "d1ae7a3e-c797-46aa-8046-8ba5521ff50a", "comment": "Malware payload (NanoCore)", "value": "111e0f374f5a6cd24644ab349f645c2bf59a02e8b6b97b7a1ac7996a2baf7785542bb37c216f629a948e4910f2ba43d8", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244561, "uuid": "2d2bc150-53a3-4bec-8cb3-650dd7aad2d3", "value": "T1115512EA86905F61F25BF9B445D0AD7CCA114E253265E837A73D323C21B7AB032D93D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244561, "uuid": "a76fad4c-953f-47d6-970c-66f485c5e25e", "value": "24576:Gma5+nmYIUoc5q2YsqAvnHInMJxfqR4S3c9fpQn2gMCsvBv9zaLD5BkPMM0mfVL:5vIUocYZsAne9q2S3YpQn2PCsvB1Wn5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626244561, "uuid": "5fbc479b-4f31-483e-a5ef-7475ef63a002", "value": 1304904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626244561, "uuid": "762bf27d-8659-462e-869e-1658434b24c3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244561, "uuid": "6e5e13f6-165c-45ff-8dfd-6244e5362c94", "value": "Payment Schedule.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712dc598-e477-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626248721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248721, "uuid": "fa904748-74cc-4810-92b5-f3b3110e243d", "comment": "Malware payload (AgentTesla)", "value": "3f8204d13c6a307a1c9e2b73a06f2544", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248721, "uuid": "05470607-251b-4af3-9a16-ce80e2f517d5", "comment": "Malware payload (AgentTesla)", "value": "69693be20c99598caae4df27d487e4428d8a86c2b722ad25242ac4670f252036", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248721, "uuid": "42dae9b0-7b53-40c8-b191-d15c462ff37a", "comment": "Malware payload (AgentTesla)", "value": "fd8623fbe685235c79b80ac448ccbcdc1e3645d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248721, "uuid": "194c33d0-3d8b-466c-8669-feed0f7a9806", "comment": "Malware payload (AgentTesla)", "value": "e5d658962bb8d47fb31ad759741f666fe2f0ab2bfddee057c8a816435caab76816ec931a1e5299bd20de9799f0a20e6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248721, "uuid": "a3a609ef-25d7-4569-9cd8-8f31c735eda4", "value": "T1C4E4230157644BFCCDCCAC914E2CCA294E892350ECEFF2C4F6D59994AA607FA04D75B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248721, "uuid": "0a3a59cf-e899-4c2b-98ae-22884670967c", "value": "12288:9rFNX//mYasa9pmf+V/hHvjQ7k/2hVpJSAzi49iHdeDpEJio3F9ZsRMV+pk:9rbHOsabY+VpPU62hV3ni4ed8NEFjwMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626248721, "uuid": "f14a9ece-9ebe-46f6-80fa-9fc641373112", "value": 722216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626248721, "uuid": "c618ecfd-f9dc-4566-8242-86ee361947df", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248721, "uuid": "24832292-2d54-4b8a-8539-38b66179cc2c", "value": "MBK - SO# 0231860.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57ecdc3-e4cb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626284967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626284967, "uuid": "ee3da760-6215-41b4-8e22-9dfe799e1b51", "comment": "Malware payload", "value": "f796ead669bf3d7e056f0b42709f3ad3", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626284967, "uuid": "f90ff6f6-9dbf-4e81-86fc-e5c2a651b17f", "comment": "Malware payload", "value": "6b6e61d4281001c9c434d05320145cfe6bc47875984d9b2aef80170a5583ce9b", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626284967, "uuid": "182ae641-ddca-4e14-b1d1-43650a53c243", "comment": "Malware payload", "value": "da4624c71bc85f8ccbcde37f96e0a60b7168e826", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626284967, "uuid": "e600b7ab-a093-42d8-b1f1-a212da786c89", "comment": "Malware payload", "value": "7eec3d9640c4e0bedf80781e9355892aca8d1e6e2bd2cd9c017ddd2ed0991dad9dcf63a9bbb3ee5f44671cb16d29a599", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626284967, "uuid": "6c0a0cb8-0766-4f27-a117-017b2d88c1e1", "value": "T151F448E1ABA4CDB5EB01C1718C9D1A586374CC518A49AFC77265B03CFF3BB798E88185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626284967, "uuid": "338fae86-3d56-4d40-bcdd-af673467c1c8", "value": "12288:mRYbXrlUc6XS/CwRl+4MW1H5onZHBDznxcp/c0UGtkbByxlFYd2DrpX:RUc6EjDMW1UrDjxcNcfgZI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626284967, "uuid": "a89a4f54-6391-433e-8a4e-a3cc8af1eab2", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626284967, "uuid": "ae7e7fcf-6857-4c13-9b0f-4c3d4a4957e9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626284967, "uuid": "f45ec28f-3fe5-429b-bb90-ccec668e2871", "value": "f796ead669bf3d7e056f0b42709f3ad3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a90bea9-e4b6-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626275634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275634, "uuid": "e4416936-caa8-4099-8bfc-66c74776d251", "comment": "Malware payload (NanoCore)", "value": "64335a05c182d05824a82f83e439693a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275634, "uuid": "8c4f3c67-561b-4860-ac7b-13dc7c81e635", "comment": "Malware payload (NanoCore)", "value": "6be01e50e16e3b04ecc12d5c95265fedd7ed3e2c8b5125aa1eaef1d2ded5aef9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275634, "uuid": "4e3f73ee-e7be-4609-a440-547bf18f100c", "comment": "Malware payload (NanoCore)", "value": "f1fa2740468de0d90409f7e853e34794be918e2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275634, "uuid": "fc9dc961-4f15-42f6-9d82-6bc97647ae43", "comment": "Malware payload (NanoCore)", "value": "1d865c893704288c26a8ef1805f852414f2739d2bcb18be92112ddcd77143a3e608e24d78d409fb605c7301755cabbde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275634, "uuid": "85f73ebc-adba-4ace-9cd2-7e2f940e6af4", "value": "T1C705D03323840B2BCBBE42B9B650E150F761AC9BB701DE0F6AC772D2596B70055D6D2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275634, "uuid": "85de1bbd-25c4-47b3-b5b9-2836a799b8c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275634, "uuid": "63b3d71e-a032-4fa6-b17b-a6768af42cb1", "value": "12288:WeQUCGNuv/6ckgXqfi/D5WKilgv5I071PU5JexwDSsOqxz3QG2ukT:WeQUmH6cX07lgv5d71MzewdOIQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275634, "uuid": "a3c6e385-a6f7-405d-b110-ef4aa86adf96", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275634, "uuid": "e9979bed-f099-4ade-9b60-901e921f6c41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275634, "uuid": "35120580-35f3-4e65-956a-7471a7b7a970", "value": "64335a05c182d05824a82f83e439693a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2644fd-e4bc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626278487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278487, "uuid": "ff47befe-f1af-4186-90aa-bf328b14d760", "comment": "Malware payload", "value": "cf604016a76da3fb59ff1e133a5bcce5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278487, "uuid": "f4d9f7f4-5c81-47c9-87c7-119157c407c4", "comment": "Malware payload", "value": "6e4265775237b4bb28e03c4a6aca1e68693a63ee37193293538940291721850f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278487, "uuid": "76567db0-77ae-46e0-bb9b-59bb25b8f4f1", "comment": "Malware payload", "value": "cc7740e5effe621e8259cab48ffa2853c1b90fe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278487, "uuid": "c90f7d01-bac9-4798-9540-96072c0afa22", "comment": "Malware payload", "value": "b9aa6cd5c9a066384adc0ed61080abf98257fcd387cfc2b0737233b926bea292366110e2deca63c83eed9e4c3876a2e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278487, "uuid": "ef7f32bc-5dbd-4f7d-ab18-be5eb999acf7", "value": "T15AA4BE7F479C4A2BC7BEA1B97AA0F406FBA098933B11DD0F07C761C1552B60225C6D6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278487, "uuid": "73a678ee-cd87-45b1-bd1a-ddefb17f4949", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278487, "uuid": "41fa982f-aeb8-4cec-bfb6-55198295b1ef", "value": "12288:t9xoiJpU8k2ufHMp2181+LYz7ZAeMLYn5c:tv/nFufHhJYxAep5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626278487, "uuid": "d55b7346-698d-41e4-8bfc-3cebc9b3d86d", "value": 455168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626278487, "uuid": "8133276f-66e8-4079-828f-7f20849968e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278487, "uuid": "e273c32b-5b6e-4adb-b92f-7327e54e3539", "value": "List Of Products Q002-O417729.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d80599-e483-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626253799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253799, "uuid": "0c600960-6667-4e17-a7a6-8b3e8d3fbf19", "comment": "Malware payload (Mirai)", "value": "a68c09cce3505e4b1ffcc5a82db76fd8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253799, "uuid": "94d1800b-5a34-4f6c-b7d6-98803472deac", "comment": "Malware payload (Mirai)", "value": "6f588325eaa745cb19772bac9d66363895b5b3fdd1328d31fefe745fc0061af1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253799, "uuid": "d6e84cd1-a5d2-41bd-b44a-e73933209962", "comment": "Malware payload (Mirai)", "value": "8376e89dcc6293502b202ab26273fb09601301cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253799, "uuid": "e45d91b3-6bfc-412a-ac3b-97fc1f2ba08a", "comment": "Malware payload (Mirai)", "value": "340c014ac885b0a1ed6a1c0728a6dff80cb49b34b15201fe8ebd20f3ddd1a838034ed098bbdd01f0570574949c37e36d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253799, "uuid": "7812f092-1a0c-47ab-bb71-3ae96f6880ca", "value": "T152E2E1D0627BC971C670047EFDD75981FAD2AAB4DABE7029071947747EC200B13DA38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253799, "uuid": "c695c946-fbaa-439b-a3ae-d6e3c474972d", "value": "768:E79IhZJ3+UiGLYD7D9/KqN0cyxaI12MKZ/9q3UEL3n:HkDkqNNca9MKuLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626253799, "uuid": "66bff41d-26c3-4ba9-b794-f6ebf437c8ca", "value": 31980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626253799, "uuid": "7e7e485d-a7fb-4a2b-ab44-174e3290ae7b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253799, "uuid": "63d84fd5-1d30-4e05-a364-f1dd70b647e3", "value": "a68c09cce3505e4b1ffcc5a82db76fd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49bcb090-e45f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626238347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626238347, "uuid": "e0a374ec-b9b7-445f-873b-4c9202a8f90f", "comment": "Malware payload (AgentTesla)", "value": "e92d1ce6840c4f2ce691733ae7613abb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626238347, "uuid": "80e126a9-83c1-4be3-bd16-7405839fc0ae", "comment": "Malware payload (AgentTesla)", "value": "6f84a08c1356bcff40995a1573dfe5334a69013845d697a3b4bd3e97e7093364", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626238347, "uuid": "f7a1df32-1ba1-452b-8db8-24763f509043", "comment": "Malware payload (AgentTesla)", "value": "4737209719df099eceb27ab5d5f19a92c3f3f54d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626238347, "uuid": "32f9f1d2-e006-44b7-9e72-7ffac65f955f", "comment": "Malware payload (AgentTesla)", "value": "5d6031c0e89cd863f94e60366e8a9c13ed16a8e4e210397625c6857ee5808831f0d33def0d9f5b31bc27b89fe20f7c88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626238347, "uuid": "0c7a4c29-d3a3-4258-a98d-64f64c16459d", "value": "T13EE44859267D6B05D1B613FBCA70A4C243B9DD92AE35D0763EC637C60AE8B120621F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626238347, "uuid": "907bb763-cc99-4ae3-a496-93c5d9ceecc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626238347, "uuid": "1d3473cb-088a-47d4-84a8-8b46f8bc47ee", "value": "12288:/Yn9dUqxbOD0wjntWw1vSXFLfJb0UUhNe2/TFXh:/Y9df5wjcGvsRRYUUDXTVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626238347, "uuid": "2813306c-10c6-44c5-8731-e2bd6556e5a3", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626238347, "uuid": "aa3a9d51-b9f4-49cd-8172-ee9c18bfc496", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626238347, "uuid": "754217ac-4a00-4ab3-b66b-2a0315b50aa0", "value": "17NU6JrWS5XFe9m.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da9a98d-e4cc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626285222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626285222, "uuid": "6526080e-fee9-4b52-a7e2-1b31bee6ec37", "comment": "Malware payload", "value": "40425d09e54ff26289dd074649f0cad9", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626285222, "uuid": "a17823f7-5537-4178-a0e8-0190b2a9217e", "comment": "Malware payload", "value": "6f8f1b26324ea0f3f566fbdcb4a61eb92d054ccf0300c52b3549c774056b8f02", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626285222, "uuid": "f8137c51-b713-4d2f-803a-234aa5da850c", "comment": "Malware payload", "value": "ae7e4df26092d9acf01b732c8144f0170ccc6556", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626285222, "uuid": "6bf73419-d43e-49b3-833b-b46c2707ca56", "comment": "Malware payload", "value": "f79866caf1d74d41dc895b1be1f4cae4895c6521a0b75f925e358a6c5b0441dfb2fc3a60e7e5de002f6c412db8fef1b0", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626285222, "uuid": "7ee73f44-e44b-4905-ad5f-2ebcf85c4e58", "value": "T114F448E5ABA4CDB5EB01C1718C9D1A586374CC118A49AFC77255B03CFF3BB798E88186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626285222, "uuid": "6d0c3c6a-e3ff-481a-951f-3adc706e67ef", "value": "12288:IRYbXrlUc6XS/CwRl+4MW1H5onZHBDznxcp/c0UGtkbByxlFYd2Drpkk:LUc6EjDMW1UrDjxcNcfgZI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626285222, "uuid": "3996b15e-6517-4008-bdc5-ede5b833a776", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626285222, "uuid": "b744ecab-1c4d-46ce-924e-188b1be5b4a4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626285222, "uuid": "a0aee67d-9b1f-47ad-a9cd-a16f84eb5707", "value": "40425d09e54ff26289dd074649f0cad9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57cd408-e4e4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626295705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295705, "uuid": "0277a02f-9ea1-4d3f-8a04-bef44e66e96e", "comment": "Malware payload", "value": "33892ba5de5391ef4b1ab79f4def9a05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295705, "uuid": "dcc4ae7c-4fb5-47b6-a432-037258215e1e", "comment": "Malware payload", "value": "7006a622c192fb11284c83889d8f155f1acb78fadf92024dce9d863bf4007aab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295705, "uuid": "e7ff9847-9959-4a62-816c-e59e08da1581", "comment": "Malware payload", "value": "006d7f5da3156c5578393495c98aaf153bf3f9ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295705, "uuid": "eee35bb3-830b-4c96-bb64-a968b0f0bccf", "comment": "Malware payload", "value": "85be94ec61330816a81f1314fc92c94d1a32a380da398db2e40d5d55409fd46214ec1a9575fb56d183184f1811d4ebb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295705, "uuid": "a73f55e8-bf20-44d8-b61a-de02a0692966", "value": "T18B72E69C78D7EB1AC1E0D6BBFA0B9BA833A553D8D2DB37138514934C968365D8F12B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295705, "uuid": "e21908d4-00b7-4c7b-888b-44bfab4d9c63", "value": "384:Qzz5XZfdsKFZ6bWacwtd2/PTEWsajfo5BS:4plsKGWwtk/Pa3nS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626295705, "uuid": "114adc38-a75d-46f6-a235-c6d84a88e630", "value": 15996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626295705, "uuid": "d15e894c-85a6-41bb-ac4b-9e440ccd4d44", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295705, "uuid": "26bb1741-432e-4b37-98d2-81692fb01f77", "value": "33892ba5de5391ef4b1ab79f4def9a05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3dccde-e48a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626256763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256763, "uuid": "86634e66-d24b-4896-84ea-ef46db5936b5", "comment": "Malware payload (AgentTesla)", "value": "3eff7ea8c109d0fb85e471405ac8a470", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256763, "uuid": "afded8e7-ffae-49ec-8728-c1a91c37482d", "comment": "Malware payload (AgentTesla)", "value": "70b5c48255e4eaadbf6cc289dbc9b21c46a5fdbf8d2997e232e1960594b74498", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256763, "uuid": "1cf718cd-a5a8-4eee-9870-67529d5b3f85", "comment": "Malware payload (AgentTesla)", "value": "095525e37dd8c2711c6146549b414681fd34d443", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256763, "uuid": "091fe125-7bb8-4fc2-9751-7b9cfd09c9e5", "comment": "Malware payload (AgentTesla)", "value": "949aabde6f2c4666e0199a316470dc346bea8d9fd006986781408141af41b98259d15b82a64df63a9b8e1a3fdd898981", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626256763, "uuid": "698450dc-c5c2-44b6-893d-471500ce2907", "value": "T184156C22A3C045DFCB7D42F87DB0B298FA585C7A66109E8B3FD23185617B62054BED1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626256763, "uuid": "a263772e-24a0-47b0-b06e-4c73fdbb4254", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626256763, "uuid": "24b43b48-b1ed-4195-9bf5-3cab73996f0f", "value": "12288:Z3QUCG9ZHG0LzdfnUP1H1djMJUQdL0NWr8F2Aw2wNsU:Z3QUVmk1w1VdjxQ9APFGNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626256763, "uuid": "bdcc0288-6448-4b6e-a244-23fedb122405", "value": 918528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626256763, "uuid": "a949651d-d138-4f8f-a147-ba2d33c7351a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626256763, "uuid": "fd588722-bc49-428e-9352-d464fa942855", "value": "VSL\u2019S CONTACT DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007d8d07-e4b7-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626276020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276020, "uuid": "df195fbc-07ff-47e1-9118-9ffa3a4192e2", "comment": "Malware payload (Smoke Loader)", "value": "4e2604bc3abfaeba1b0cffacaafc9fd5", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276020, "uuid": "f9fc2e0e-ef51-4b21-aa0d-d0cfb8f2e9fe", "comment": "Malware payload (Smoke Loader)", "value": "71c0a6fb3c31d1fa82fb99ddda7811810d9bf6306ce7e3377547035fe6b512f2", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276020, "uuid": "d38daac4-92ed-4a4b-9800-97714a017832", "comment": "Malware payload (Smoke Loader)", "value": "0e983ef5678dd5ce3b3ced2966ff9be1c7a332be", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276020, "uuid": "dc63126e-e5d1-41ce-9516-62c751937395", "comment": "Malware payload (Smoke Loader)", "value": "1cb0d749f5227022b58b894f9cd25ea6736cfd65a8e4146d841791d214b48c959708f3ac8a4efddce0bdf84f1b96ac99", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276020, "uuid": "73754648-1eb9-43cf-84a4-d49c8261b176", "value": "T17414AE2132E3D431D6E346301434D7A12A7FBB326637864F376426EE5E312D19AB635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276020, "uuid": "2fb4a012-4cb4-483f-bfaa-6e79b60cbac5", "value": "f9c1cf1b2cfb3ee96a94f56e9a89c09a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276020, "uuid": "02c21e93-56cb-4c39-a071-0e54fd11ff9d", "value": "3072:XBNmhnmLGgLnM16WAjC9BTdlwt2OVw1Cm5Bzck4H0:xemLGgLnMBJ9BRutBw1/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276020, "uuid": "ae2b1f55-79ec-459e-ae71-62529662c467", "value": 194560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276020, "uuid": "b4bcaf95-4b72-4716-853f-902e4fadbc0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276020, "uuid": "5dc4bf7e-f8b3-467c-93f0-4c14f47dc79f", "value": "4e2604bc3abfaeba1b0cffacaafc9fd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5189ae7f-e4be-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1626279162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279162, "uuid": "0a00589b-1968-45b3-a22b-1562cb8b7f83", "comment": "Malware payload (BitRAT)", "value": "c20e2f98ea03358cddba7fcab69b2107", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279162, "uuid": "4b780be9-55e4-47b0-a2da-b4b1035cbd8a", "comment": "Malware payload (BitRAT)", "value": "71d0b7098599a1499e71ecfb828eef37868f31e4bc0e64d1249b90bd4404c5da", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279162, "uuid": "8cbe06c4-26d0-43ab-a5ed-c09feda051f3", "comment": "Malware payload (BitRAT)", "value": "88298d11ea6caf59b33e175aa64052d6f239000e", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279162, "uuid": "e13453d7-d336-4ffa-9d51-6810768d6b7c", "comment": "Malware payload (BitRAT)", "value": "3afc75d2241e1999711362ba3512f075739e5232c6168478118a65d4aa509b0906941821b75690ef93061f692f6a3497", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279162, "uuid": "90a7f2f0-fd40-45ed-8cb9-6ca3a1cc6be3", "value": "T14F46333C41518636C2DE1AF398213715B7A98C92E2F8C99E750BFF8B427F8C7589E641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279162, "uuid": "7622e7d8-046c-4d90-9abc-4d4377c765fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279162, "uuid": "65476ae9-75f2-461a-ac70-edfbb463291b", "value": "98304:bvO/2CCAUnCU6BMk7op2Zn8eziTVHb2/AV8RtWLsjVZ4V+PKfuegT+Y:NpCRaCG2ZyVHK5sR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626279162, "uuid": "681aa633-1058-4d0b-ab39-31efa518195c", "value": 5365760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626279162, "uuid": "68a6819a-9682-4bc0-b6af-4eb6a85eec09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279162, "uuid": "a67f06d5-4caa-437b-ad82-e8d586f04993", "value": "Anarchy_Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fdfdbed-e47a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626249954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626249954, "uuid": "00fbec20-d64c-48c1-a877-fd848f5889db", "comment": "Malware payload", "value": "734568211f8e7bc72d274eb2f6c228c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626249954, "uuid": "3e5aef96-bdc8-4baa-ac9a-723a10c42384", "comment": "Malware payload", "value": "72a95b00ba80b99575abf8916edf2a77f07467890c0035fcb0ff40a2aeb0b667", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626249954, "uuid": "34c02faf-cbf9-40e9-94af-87f7daa8cac2", "comment": "Malware payload", "value": "2e8f42fd484c83b749a2b888a375c25d82b419da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626249954, "uuid": "9efca579-ca04-44c0-a47b-cb9b0c2ed7c3", "comment": "Malware payload", "value": "efad8079d0d48a7d70978bcda547a37d6bd8ce633dac50d3ec82b1ff978350c7c3677d88e196c40da6d807c8c0c12c07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626249954, "uuid": "5a12e12c-f6b6-40a3-9fd6-d54449be9397", "value": "T11EA48B5516B45C02CA2A0E7A8CB5DC30F562DD5329D2E2F635C43EBB7EFA7A940013B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626249954, "uuid": "25ee2b9f-57c2-4648-8800-f9b25ef1a424", "value": "6144:AM5FWIdi0yfdtf29zUepGqsd5OwThdZo6bTng+dl5j0dM0cuX9ujNQE0:RFP6dJwUeoqsd5OwTrnNd3+6A8Nn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626249954, "uuid": "b09e4557-3987-4037-b347-d9af598f4523", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626249954, "uuid": "7180917e-b2fe-4899-b1a5-0f8dcd262fc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626249954, "uuid": "b7c89bb4-cee4-4980-83f4-f4ad578de2fb", "value": "SecuriteInfo.com.Heur.Corrupt.PE@1z141z3.19587.22440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d82528-e4b6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626275671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275671, "uuid": "2ad3a8a6-1831-40b7-8a21-dd178a76320c", "comment": "Malware payload (AgentTesla)", "value": "100ed816a33f33cd87993d1b77c14192", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275671, "uuid": "15f89e18-b89d-4d8c-8c3a-24b87d19e762", "comment": "Malware payload (AgentTesla)", "value": "7320273731dbce41f47cc62a196383cbe81764c7285277c153498818d1135b8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275671, "uuid": "ece22c45-4516-4bc2-8d3a-5716e0a17403", "comment": "Malware payload (AgentTesla)", "value": "3b7ce894ee0498a631e2a93ff7225dbcf63a5e4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275671, "uuid": "2b0298dc-13d5-405a-86ba-d909d23e605c", "comment": "Malware payload (AgentTesla)", "value": "bab7772b90a34bfe4c7e6d68afe8509bd3ebacfc5b94f9970acab05ed6aedc4d833d324b928b01cc901f2bb83fc8cf2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275671, "uuid": "5ba47a4e-4109-44f6-b29b-076b834d1e07", "value": "T166F4CF3723844727CBBE46B9B650E050F761A8ABB701DE0F1AC372D25A7B70055DAD2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275671, "uuid": "0fc71527-1947-4c1a-98ec-915a6b4258e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275671, "uuid": "c909218e-5fc0-4c56-840e-d67e4aa5c331", "value": "12288:gEQUCGHiZaArhu+8+XWGRWL83205HPp1f0ve5yOaIfMm7F:gEQUMaAI+8soo205HPp1kTOasME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275671, "uuid": "64ed090d-23ad-469d-bff7-6d2ccaa8f01d", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275671, "uuid": "c1d7b718-49e0-401b-9788-eeafb4d3dae9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275671, "uuid": "173e01ad-0383-43ad-8583-42e4996cf9e2", "value": "100ed816a33f33cd87993d1b77c14192.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b73db8a-e469-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626242618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242618, "uuid": "2ed48fc5-8901-4a8c-a383-7eaa2ac30bb4", "comment": "Malware payload (AgentTesla)", "value": "6f135efd582f0778dff4820e18b8aacf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242618, "uuid": "4d164502-8e64-4da5-ad5c-f1d3b1c5aec0", "comment": "Malware payload (AgentTesla)", "value": "73f59e4a55e630ad4d2d4d1ad2c1c918a0f71bd8a0a8b6aaba5cad37cb913a06", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242618, "uuid": "53cf6c1f-6a85-47e1-8dee-e1dc24f6c4f2", "comment": "Malware payload (AgentTesla)", "value": "4ee4590a9e770a6b1c6060d72fc6c32cd6cac221", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242618, "uuid": "78319d1a-7964-48f1-835b-e42adf391f2d", "comment": "Malware payload (AgentTesla)", "value": "406ce6779ab5662495ab079f92a822fef9b4ba85e2aed94b692ca051420a70a29e90ad723c7e3a0c978dd510b9c00131", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242618, "uuid": "e298cfbc-fa34-45f7-8ea5-8e02ad0466bf", "value": "T1B7F4CF2733844727CB7E42B97640E091F7A1ACAB7701ED0F2AC372D64A6B70195D6D2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242618, "uuid": "b2dda491-d070-478f-ba9f-4b38bf45425f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242618, "uuid": "5932895e-ff2a-46ae-98de-d5b8ac9e2dac", "value": "12288:RZQUCQSmAojYGrYBpsmJ/i3wGJGmrLrV9pBV/cYxuPu27WNqu:RZQUiGecAGsmjzZEaL27mqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626242618, "uuid": "d6f5ba04-dcdf-4f55-83ec-5b3fd9b8af31", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626242618, "uuid": "240f74b8-9c2c-49db-ac27-9c93180c2523", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242618, "uuid": "20530a13-ecd0-4b18-af1f-b8e064ff63a0", "value": "UPDATTED S O A -49565467G.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34437e9-e4d7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626290171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626290171, "uuid": "c739ad9d-7cf7-444c-84c9-71683fc00333", "comment": "Malware payload", "value": "d07a6a28431175d0d6d9e968f4227478", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626290171, "uuid": "3e898d0f-6f59-42d3-9301-e3fa2a2326b4", "comment": "Malware payload", "value": "758b9507bc1f55377b15abb76b3a415c6ba02cc24a9b95c73fdca4653f94b136", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626290171, "uuid": "6f2822ce-0b37-4414-afb7-e60ea06f67a2", "comment": "Malware payload", "value": "1e589c6d24f96ba2905bc4cd556d9e448ea7bb4b", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626290171, "uuid": "a44bd94e-a992-4c08-b762-7f286869892b", "comment": "Malware payload", "value": "ff063a387e3465c46e781b0cbe319fea224c4dc079803ae234eecc26ac72736a9040e5bf4508e95284d306bc3f3a1a99", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626290171, "uuid": "b17827b0-4f05-4116-9f47-2d80323157cd", "value": "T107F448E5ABA4CEB1EB41C1718C9D19546374CC418A49AFC77265B03CFF3BB798E88186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626290171, "uuid": "3dbd2330-6870-4879-93e8-c70fbe7ec6af", "value": "12288:mRYbXrlUc6XS/CwRl+4MW1H5onZHBDznxcp/c0UGtkbByxlFYd2DrpR:RUc6EjDMW1UrDjxcNcfgZI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626290171, "uuid": "fa8d50db-d327-4480-80ee-0c74e11f6af1", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626290171, "uuid": "f029d888-762f-4e67-b4f6-9d3c38fa645d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626290171, "uuid": "823aef78-7682-4cd9-b20f-270344c7ef1d", "value": "d07a6a28431175d0d6d9e968f4227478", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15f51fa-e460-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner)", "timestamp": 1626238950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626238950, "uuid": "cb00e2bb-559b-45e2-9f6c-fa88f8711bdd", "comment": "Malware payload (CoinMiner)", "value": "9dbcf183762872d8917b8a19535a0c65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626238950, "uuid": "f84e94ab-5163-442b-9c3e-3e9d142f1e5c", "comment": "Malware payload (CoinMiner)", "value": "759d3e20098353e73c0c417ecf755a3ab24cdf7ead10df8c5a4aab549d7423f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626238950, "uuid": "0ae47fa1-b26b-46da-a191-ed349fe5bcc3", "comment": "Malware payload (CoinMiner)", "value": "94d27127f8ffbebec6ad803599ed3c0477a15e3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626238950, "uuid": "84837a98-b5db-41c2-90cf-fb6412ef8557", "comment": "Malware payload (CoinMiner)", "value": "d7e632919a9bd49f745f2ee1059dbed4390f3c269b374f12036aa553b5cf463a881345613c1930bb1b6c556b0af0938b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626238950, "uuid": "0736bfc2-3df9-4f94-8350-489a8adc5803", "value": "T19AA53370AB448A10E316EE3E30775542D30AFA4DB7E4B1A9C1C36F882A61F47D376A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626238950, "uuid": "c2a718aa-c914-45c9-b602-e28c6ea1b3f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626238950, "uuid": "24c2cd2e-3717-40f4-8b15-a75b7f1ac41d", "value": "49152:7wFpwLN5DX5ecu7O4jrimxMHDUrY+BPOIz8uJxLWuXoK:8wLf8qHa1eunvXoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626238950, "uuid": "bbf5f163-a530-4e79-91ac-499431aa5214", "value": 2241536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626238950, "uuid": "974f79b2-ffbd-46c4-841e-f8732cf51a0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626238950, "uuid": "6176afad-0b3b-4a69-9ee4-e4032d835c0c", "value": "9dbcf183762872d8917b8a19535a0c65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e363920c-e470-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626245906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245906, "uuid": "e2812bfb-a961-489e-9b07-eed42a87f14b", "comment": "Malware payload (AgentTesla)", "value": "43b9ad66a6a70867ac220849eee4a470", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245906, "uuid": "a05c33f0-d0a1-4154-a08f-84cc2f1f9fa0", "comment": "Malware payload (AgentTesla)", "value": "75b5fb4ad3ead4091a83a4dde5e6b328196f62a529817ff705450a47dc94a3c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245906, "uuid": "c1c2123e-0088-4d34-b5f6-14f6ff0e024a", "comment": "Malware payload (AgentTesla)", "value": "c495b844d81a5d1fd517c73c487914268a16f607", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245906, "uuid": "70cdf8b9-c19c-444c-9720-8c9fb9a9dd5d", "comment": "Malware payload (AgentTesla)", "value": "74698112d184cb8aefd48cf234495cc0a88841285ef82df44f826c5f0a79d43aec7108afb0a484d478ad92737407044c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245906, "uuid": "4f92e309-7a19-42df-b323-681a887f4e43", "value": "T1CB157A626784C62FCB7D46BD7950A091F3619DAAA3C1DE0B3B837392D57B2013097D2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245906, "uuid": "ba39a354-1faa-4b48-be95-03f3af9a843d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245906, "uuid": "14baba7b-f7de-45c1-8e72-c7a1e29b6fd1", "value": "12288:eaQUCGMFxNFHDsGXDURjysclcL6aFCkUvM5Oq+dAdgRBsequKKs+:eaQUiFxPjsGA99V7CkgM8peXnuKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626245906, "uuid": "66191901-5d32-4ec3-93a6-18b15573e5aa", "value": 901632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626245906, "uuid": "e3154bdb-add3-4c19-a319-f1fc9311d2cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245906, "uuid": "14b7a8f1-2077-4edb-b6ce-0ca4385a4f29", "value": "KOQxv7Wlz4aLVgk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8ca857-e475-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626247720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247720, "uuid": "416bd668-1b45-473b-84a5-263c4efb300f", "comment": "Malware payload", "value": "0e9d551a58219eaa713c09f42b2e2a8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247720, "uuid": "a0780881-2522-40b8-895f-f66672ff383b", "comment": "Malware payload", "value": "75f8964f8c9b03dcb310d71f8c08c589d1a9bc5f4701038f830c737931cdb64f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247720, "uuid": "125725f0-27d0-4089-b28e-f372c35f8aea", "comment": "Malware payload", "value": "13de03f50590c83ffc4f02da81f858090ae33d73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247720, "uuid": "338d3225-979a-402f-8d9a-db01d9be61e7", "comment": "Malware payload", "value": "4750bb6d720eef89dee0510261c0dcd51a25d6a0b514fabc8d4b9c80c0f5a59ccf3cf322004f347ef2696c9b0afc2faa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247720, "uuid": "aee34389-2c29-435a-bb7a-67d04b289d09", "value": "T148F2F15099017451C6F12E77C5ED5260976343BCF9DF3049108C1EA87AE70A725BE25B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247720, "uuid": "b95d2b6f-06d3-4ebb-8b6c-26673a255e78", "value": "768:fk1Ad+hrTxdXhyT1vSj7sA5U/lIMnYRxJ5VARoaPSRXLD/9PmA3Um:fk1AdGrTxdXh4vSjZgl5yx6L0P8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626247720, "uuid": "d486f197-527b-4a9b-861f-c1b8640639a6", "value": 36452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626247720, "uuid": "131b126d-6f1b-467b-86ed-69a12cc85d9f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247720, "uuid": "8186f31f-452d-4203-a62b-a873392d483d", "value": "0e9d551a58219eaa713c09f42b2e2a8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da98b77-e4a2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626267237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267237, "uuid": "f302d6f0-fb01-46e6-b42c-af30bb3652a9", "comment": "Malware payload", "value": "853c1c6bbf85dfaecfd5d96a1073ee11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267237, "uuid": "6d3c3eb9-79a9-450e-bb10-0adada1c7c91", "comment": "Malware payload", "value": "78d6cdb28ecd490f546f10262c2b1aa4f8b0a35982795dc929113582496d4441", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267237, "uuid": "6100296c-2540-470f-8efc-43c568681231", "comment": "Malware payload", "value": "032034b35a27110f1ad70ef91012204d2a5c4091", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267237, "uuid": "776616b8-23cd-41e4-9889-33e10511ad0f", "comment": "Malware payload", "value": "63b7a19bda6b66c5633486ee8afe5794e42b815d473dbbc4f2161cf0bbda379984c5763fd0953b5aab3a35d45c0ec313", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267237, "uuid": "dcb156c4-c194-415d-b584-9608f860878e", "value": "T1FA41F0C92F325EF9F15AD53847370B3927AA514843C08289E1ACDA006EC030D889FBE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267237, "uuid": "a4ac1bf1-f397-4e78-a243-0bacd48ba948", "value": "24:3+Ydb5jl8AmslI3t8AmypR/z2HdllPGUqtWB4u37I8paXDdz3N9l5zBkEp7iBAGl:OG5E4GYg2H7h1EXD/9LuEpgn3f3UmBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626267237, "uuid": "32114f51-b9df-4a9e-9fff-2d077278b497", "value": 2000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626267237, "uuid": "2cf4b9c2-61f1-4d25-b870-6fdf1f0ed7c8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267237, "uuid": "4fea3950-64a7-42ed-9478-68aca0ff6999", "value": "853c1c6bbf85dfaecfd5d96a1073ee11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc21e268-e4a1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626266939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266939, "uuid": "0d75d2b3-13ef-4baa-9f9d-fca10dcdf50b", "comment": "Malware payload", "value": "25de13d9891f5c6a7ad8cd27dcd94f1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266939, "uuid": "b98f2f25-6594-48c7-af21-4b2de207d25e", "comment": "Malware payload", "value": "79b30159c6eaabe98bef0992b5c26e83249ed532c47da8ff24d3688eda8e8f79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266939, "uuid": "756a7ef6-5bfc-484c-bf39-40683c51e2c6", "comment": "Malware payload", "value": "8f77981394b79ed398e71daecdea9df877a4fea8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266939, "uuid": "d392f5cb-b589-47f3-8084-f6c9ef9f9442", "comment": "Malware payload", "value": "34c9b4a70fbd9ab5edf594115622fb21f4a9a07705ea910f9229b610c31e7dbc4484c0bb10c57a832afe6943ac628793", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266939, "uuid": "c398110d-5575-48b4-9ddb-3fe699b82373", "value": "T109851241F8E38976E1A7F276702CE1945925FC6F17248AC77784FF0A95E1A802E38673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266939, "uuid": "82977b2b-1903-43b7-95f7-6ae9186395e9", "value": "e04eb610508ddb951732064297e50b65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266939, "uuid": "8a4c31c0-8d59-48e7-927d-2460cbda09d5", "value": "49152:l1GBif9TlYPt0ksUv43BWzR7uj0nOSkcQWkDKhlVvEemAo9:l1xf9GOEvn1knWkDl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626266939, "uuid": "0959863c-2d52-4833-ad1a-7e24e5f90a64", "value": 1751793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626266939, "uuid": "d40f8df5-cc73-4299-8d4c-9e614573606d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266939, "uuid": "3a78c47a-d329-4a9b-b6af-bdf2537d1ae6", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf705533-e475-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626247993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247993, "uuid": "71d5be4e-5cd5-4a37-8d49-205995dd3bc8", "comment": "Malware payload", "value": "8182470cc248e5efc88b4fda27b28a89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247993, "uuid": "ac3df069-5a58-4c58-81d9-326041abddd8", "comment": "Malware payload", "value": "7b5338764cf98206793e0a435e3f46a344d3ff674e1efee0e61d70ead0c3f246", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247993, "uuid": "519f9bdf-5154-462f-814d-b69a7b493330", "comment": "Malware payload", "value": "771bcb14ccc53a29a75904aba4913b8ca8300160", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247993, "uuid": "75a4fa74-f17e-4fee-9d58-2a36b6116744", "comment": "Malware payload", "value": "c19fec6b9339401c856501d7965dea0ffddb2515de9097149cd6072574561147a46b87abdab90cdcc6aafd3b1706fc0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247993, "uuid": "f17066da-aafb-47b8-b956-18f56fd5d05b", "value": "T161F2F119D65EDCA5FF70AAF084BB2AF07FF14B4E6150C9700341BF01154262B63669BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247993, "uuid": "f18439af-18df-4776-8fab-23d28af34a31", "value": "768:Pb+S3FhHkQ1+7ZQuTrGTVKQypgbvPBdoCAxfuAXG4uVcqgw02NWXk:Pb+UF17+quGxFyp+vPB0xG34u+qgw06z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626247993, "uuid": "3ab99cfe-afe0-4ea2-8497-d4ca1255df49", "value": 36052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626247993, "uuid": "8a279a5b-4858-4330-aece-545b23838d9b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247993, "uuid": "a84c777d-02d3-4174-89e7-bc3a6e22d717", "value": "8182470cc248e5efc88b4fda27b28a89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699a8bb1-e4cc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626285216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626285216, "uuid": "7f46ceb0-3e7d-4574-9062-0c166c74cccd", "comment": "Malware payload", "value": "a2657b9fec67bd20e27de8932a975278", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626285216, "uuid": "9069719d-fbf7-4dad-93e3-68463731d709", "comment": "Malware payload", "value": "7bc8e2b75d876bfbd12297c6eb01d2a09f0694242ad22559e1be6736dc237a37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626285216, "uuid": "3e093ca9-743b-4b3a-8d4b-4b30d5be6f14", "comment": "Malware payload", "value": "e8029e31debb6ef813fe68b76a3c817d6b332e9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626285216, "uuid": "a5d6a247-5669-411d-984a-01a20323bf29", "comment": "Malware payload", "value": "96fc1a2ade40c91bc287bfa44ea908a190ca7defcf5096cacbc389a39d80e9043476d379390da0075935e40b318fa65f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626285216, "uuid": "898646f8-e4dd-4372-94ef-820099baee3d", "value": "T16DF302D1B39A11FEFD5DA070960BA9A612A70C29C37CCAF7E110DC917DE48FB243512A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626285216, "uuid": "9084c980-5b09-4f66-a321-5ac7bc29a109", "value": "e92132005097daafddd51d9c4d138d88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626285216, "uuid": "54c87ffb-8ae7-4b49-aabf-b809e623ad3f", "value": "3072:p7p3dQo86PI7e2seizPWM6Ox1uTQjY48+STfLbh9w47sIs:D3dyj7Nse2eOx1KQU5TTbbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626285216, "uuid": "e25c4285-d774-4d69-b3e8-5fb15dfb627e", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626285216, "uuid": "acfe7cda-f801-448a-89fa-d543589e331b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626285216, "uuid": "a035f158-f761-47c7-8386-8f5ed76dc52d", "value": "a2657b9fec67bd20e27de8932a975278", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa7d140-e4fa-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626305001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626305001, "uuid": "4367cb22-7f19-466f-a05e-5d5bb23ead9d", "comment": "Malware payload", "value": "c0b7a662bf0e050847c3174552688465", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626305001, "uuid": "d3cf87a3-cb8a-4f02-8d22-5899c22ea0e8", "comment": "Malware payload", "value": "7c2d1f9406d194c8cd18df13efa8ee1385d6531b55b66a989e5b57d4e34149bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626305001, "uuid": "957829c3-db2f-4abb-a1c4-166772b8402e", "comment": "Malware payload", "value": "5ebfcc2c6083dd6daf1f7a4ef9907c2515e94af4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626305001, "uuid": "2b75af73-13df-4583-ae45-02b9a37df3ba", "comment": "Malware payload", "value": "c610c405a5123eb6bb014e04d8e2bf6cf0a8c52ab62e44180706dcd33eaf83e87e9475525eccba18a87d8243cc7c2b8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626305001, "uuid": "a2c8e5d8-289b-460a-95a1-c54a7f924dc2", "value": "T158D3681869BFD069D0E3EAB22EDC94BAC99A65D3540D743710B0733B8B62B80DE4F475", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626305001, "uuid": "314925cd-2567-415e-ac91-ea06b7662212", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626305001, "uuid": "b8cd2be9-2223-4231-8dd8-38d7df143ef8", "value": "3072:XpQtjfGCm8uGuQZ8LvSjjPGm/DKlIKHDsNHcjpOkidwUiFvyMVq:n8uGuQZgvSjjPGm/DKCKHDsNHcjpOki8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626305001, "uuid": "2bf3fbd5-6d5e-4288-8601-412b3a038694", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626305001, "uuid": "b2845b98-4a71-4f73-b1ae-cebec4c2668c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626305001, "uuid": "ca2a667c-d3fb-46ee-94b6-4d778f5b29bc", "value": "c0b7a662bf0e050847c3174552688465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab71243e-e4b4-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626275018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275018, "uuid": "8c695580-a618-400b-b116-b54944778f4f", "comment": "Malware payload (SnakeKeylogger)", "value": "0fe4cc9ca6b457b773968d38a82700c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275018, "uuid": "c534275e-5b60-4d90-807b-07c86c2eb8bf", "comment": "Malware payload (SnakeKeylogger)", "value": "7c49760250c09582059e8ea412b9956c7696e4f5a48984c96f75347e58241060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275018, "uuid": "6f0bce93-c005-4939-9637-6a200b85cca4", "comment": "Malware payload (SnakeKeylogger)", "value": "8cc7ed9c5dbf85081fa873db254db9a03ef497ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275018, "uuid": "cb98dd00-826b-4d4c-bc3f-0663e42adf3a", "comment": "Malware payload (SnakeKeylogger)", "value": "cbfd5f9d0cda4f97dc03917fbfe5f0ad9e261ff5ab33566f6aead5363cb012a433b370199fd9f975346529e08c0a334d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275018, "uuid": "7d009289-0b11-4f96-8944-0175d21f8da0", "value": "T155F4F1363B80FB0FC13E8D3948A55C00A7D0E673470BE78B6CE326DE558D6A58E625D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275018, "uuid": "862e65ba-9041-424e-9de5-d39ab8fe19da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275018, "uuid": "158e17bf-7223-4614-9d85-05ab7093c01a", "value": "12288:r5g7bMkqPkihQd0RH4IT283EHq46XzlzzhOQUqiiWIsjTPm/u6f1X8RXfE:27bMkAkihA0J4x83GAz1zZUqiiWdPop2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275018, "uuid": "66a9355d-dbcc-4fe7-83c1-8a6c55ae28bd", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275018, "uuid": "583b0bd4-fe5f-42db-9083-3b7a83446793", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275018, "uuid": "bb3af164-fd7c-4455-b4aa-429b056e3683", "value": "img_receipt1407.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6475b871-e4cc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626285207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626285207, "uuid": "98e4e6cc-2e1c-4a9c-a326-e25609c78554", "comment": "Malware payload", "value": "363431c16f8b0a0196b67b11adf75ebd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626285207, "uuid": "177cf924-dac3-4cf0-8849-38377d436820", "comment": "Malware payload", "value": "7c4ec96ba82e79cb37c6829a595dc09b76568a5dadd82c743c3f9a69c985ad83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626285207, "uuid": "a55f3d58-c024-4fcf-8aa5-e14bd6d1133a", "comment": "Malware payload", "value": "381994e2140ce8d255952d13f05d8d79da1e1c74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626285207, "uuid": "6c208d9e-e4f8-4509-b155-1996fcdbcf9a", "comment": "Malware payload", "value": "83f3277b550f8c74bffb58561e20dc8b76cd679afb2e0d8b63b700d19d70763d6d2f70098719b503db7e852065ab3fbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626285207, "uuid": "b36a0e5d-af68-4c19-b980-4b29d56841ac", "value": "T131741237D23060D6C05A00F55A0DE7BF99181D2076E2AC3E55D287EA8936EF76873B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626285207, "uuid": "134139b8-9e86-4a9a-92c2-3b4c1c891d16", "value": "c3803752167a683f3dbd2e2ab3d19b6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626285207, "uuid": "3e675716-c9b6-4b8f-a716-83adeb64b1cf", "value": "6144:IpWMSmgY0IyFpXjsCEqhp3xuo8Pr7Jjc7wPxfC:lHP7LFVst+0oA71+AC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626285207, "uuid": "e61340fa-d79c-4efe-a316-6086ba1d8e5e", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626285207, "uuid": "ed938a0c-be26-44ed-9c29-2419b7f201cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626285207, "uuid": "c710e0a9-f5e7-4f80-893b-bd1ed851f174", "value": "363431c16f8b0a0196b67b11adf75ebd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd7a923-e4b5-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626275509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275509, "uuid": "32efe9a0-67db-45b5-aa67-fadbefc96635", "comment": "Malware payload (TrickBot)", "value": "a4358233b2581e5d405fb75eacc67c82", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275509, "uuid": "51d788fe-caba-4ab7-93e5-1eb4d765658b", "comment": "Malware payload (TrickBot)", "value": "7d6688ec15f6fec19a2cc6743f3fe50f5dcf79d14f122f3ebdf844464c45abec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275509, "uuid": "8bf71467-e96a-4257-9065-83d2c17318bc", "comment": "Malware payload (TrickBot)", "value": "798c33b84f1350a2ec420547e635605a6480d950", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275509, "uuid": "8aea6a43-6ce7-4c9d-aacf-19a67b560ea3", "comment": "Malware payload (TrickBot)", "value": "200c6131ca5d19f97457163b3bd55a2e73b259307c4ee9afbb7f2f440468aa8c36db99193353929de595193eee23a70e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275509, "uuid": "71e0b839-c1a1-46c3-9c51-1e550fa3b377", "value": "T129A4CF1033C0C036E6BB037A495BDB5962A5BC608BF5C28B7F947E9D9E312868E35752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275509, "uuid": "3eacd730-54fd-4689-ba20-b53923904ca2", "value": "285edb96a4eb2f97aa48802e35f98fc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275509, "uuid": "33772f03-d308-4d16-844e-1eae660e4da0", "value": "6144:cIzlI2lTAbw3TTIaThNALS0znO1hTF8PW8yLvBYQ8YiXCn6muSL7Cw5O547fEACA:vT8wIaThNv8nO3LvBYtYuuX/Ci78hH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275509, "uuid": "8a1a7034-d4fb-496b-ad39-e589f401cfcb", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275509, "uuid": "0e071d56-12da-4663-bb4b-6c6c383f1004", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275509, "uuid": "7443cebd-bc4d-40de-b876-c7a3a365b3e7", "value": "a4358233b2581e5d405fb75eacc67c82.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4bd75d8-e4b5-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1626275544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275544, "uuid": "e6a5b37f-8088-471b-8c1c-75ce390b7ca1", "comment": "Malware payload (TeamBot)", "value": "4a8ddc56ef32a98533d92a5d94de0234", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275544, "uuid": "36cbe73c-2ca8-4b8c-add8-c04504abc97c", "comment": "Malware payload (TeamBot)", "value": "805f7cba545ef7535c7368a49a96326bec119c84c76e22531c0fb5da5437e8fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275544, "uuid": "e22bf14e-0562-4c79-ac22-9928ca69bd1e", "comment": "Malware payload (TeamBot)", "value": "9e84f7f37d81363982126bd4fff574b1f5870808", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275544, "uuid": "2111468c-b268-4e52-9102-e3b6db5830ee", "comment": "Malware payload (TeamBot)", "value": "a25984775ad1c0d4f835749e8c2ed4d42b243cd145db13676da72e479d95a3c5fff197b20c817078868dbe0df748dabe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275544, "uuid": "325c300c-240f-430e-b4ba-af23174dd9a7", "value": "T1DFE4123076A0D131E2F745717D3892B15D7BB833AA38C54F7A5913AA6E323C26A92707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275544, "uuid": "b85a2a61-0c99-46fb-9ab7-bb80171e1f7f", "value": "6cdeffdda184948255f2b4720bcebeba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275544, "uuid": "ac2ba095-42ca-42ef-90fd-bb0f28fbe7f4", "value": "12288:/4lzTr7d085VFOAfGCu34QFx2Y7tE8fsvGml/xIz3uppH:wlXr7alAOC/cIPl/xAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275544, "uuid": "60d32af1-4ebf-4493-81cb-c7daae4622ef", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275544, "uuid": "143a41ad-5478-43a2-a332-d125c9ae7ff5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275544, "uuid": "3dfcefe2-4754-4db5-b4aa-5c794a9d5e93", "value": "4a8ddc56ef32a98533d92a5d94de0234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b126550-e49b-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1626264012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264012, "uuid": "b928c319-44c3-4cff-bdbc-097a39420706", "comment": "Malware payload (Gozi)", "value": "31ed7b3f7d7173afe801858e30c0fb62", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264012, "uuid": "580cb7e2-44d6-46d7-9f63-28b7e89b9c93", "comment": "Malware payload (Gozi)", "value": "8081a3a7be80c197b850d2c1e3cac75944d3fb55fda2b312815f565616366843", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264012, "uuid": "2e525e78-41fb-4f9c-b57b-a10cd237a34e", "comment": "Malware payload (Gozi)", "value": "40376b923682dc858806071f97cb64f781142dbb", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264012, "uuid": "ad2143e4-0a68-4aa0-806e-7c761e4459ba", "comment": "Malware payload (Gozi)", "value": "cfe615bf0361644ba5540f8c9002a73b391bdfefd330d7568a5877904669422f97eb772a36d1531c1e88bcf1ab3da29a", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626264012, "uuid": "c7dff9cf-8f28-4cf4-81b1-c8c07cbdcb42", "value": "T1C224E1F781369864F9E8E9F0E61CD8B3990EBD5704D8D0C962EC573C6EE82B28352715", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626264012, "uuid": "91399f16-9524-4d72-8b21-1baeafce4766", "value": "3072:GPLcNfKSwCj4DzTB4uN5+8eV6hwIVFvnQCa5wrNvNppmWDzVXImozZHMXe+8ftJ8:dd73uNs7DIrPZPNflV+sOdftJ6Twg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626264012, "uuid": "0d9a5304-b3c3-4823-b3b2-2cbc4c93448d", "value": 213949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626264012, "uuid": "21fed121-bb68-4fc7-b6ff-dcc2e74872b5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626264012, "uuid": "04c37169-b24f-47b8-bd8b-ad48f945bbc8", "value": "virus3.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0521bf-e4ad-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626272013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272013, "uuid": "9b235bbc-dbee-4b55-8990-3c0a2d1e83b6", "comment": "Malware payload (RedLineStealer)", "value": "08e6ea0e270732e402a66e8b54eacfc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272013, "uuid": "aadef685-eb8e-4f49-9876-796ac7156742", "comment": "Malware payload (RedLineStealer)", "value": "808791e690e48577e7f43b9aa055fa0efb928ef626b48f48e95d6d73c5f06f65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272013, "uuid": "d15328ca-a13e-4dfb-b59e-843177422ad4", "comment": "Malware payload (RedLineStealer)", "value": "2d64b8331e641ca0ce3bde443860ca501b425614", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272013, "uuid": "fea00336-0bc1-4eb3-a0ba-4b7c3d730d88", "comment": "Malware payload (RedLineStealer)", "value": "1ff10ae792dbcf0d9e1d22a9c72b778c13644704c54b75b58b5ef6f9c1acad6a1af86399e61886e9ad1afa8f7b9327be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272013, "uuid": "1383ba3c-8426-4b68-94ca-ad9c8700898f", "value": "T104F3C12633A7D435C1C82230E461CB3B2668DD2717B47796B0C5BE97BE6B24D49BC2E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272013, "uuid": "e77cfebc-919d-4422-8647-2136cadcc086", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272013, "uuid": "67600e36-f202-479d-bca5-fa7774a77ba8", "value": "3072:0F8DeftClWsgBZf98dmu5tcyNH+gL/GxS:E8QCQsIf9Y5SSnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626272013, "uuid": "4bc771b7-2b9a-488e-a0ba-0b0d07f15c98", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626272013, "uuid": "e68d840d-9de7-48fb-b121-1cf8d90aa50c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272013, "uuid": "df00eb77-4ce7-4129-8fd3-e257715cf43c", "value": "sahiba_5.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034737f5-e4a4-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626267864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267864, "uuid": "17db5331-5053-4dc4-b5cb-a03a854532b8", "comment": "Malware payload (NanoCore)", "value": "413f1d798e49cd466b7284a74feec09a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267864, "uuid": "3101cb52-40f8-41fa-b7fa-97ea9e92c173", "comment": "Malware payload (NanoCore)", "value": "80d596a7fa52a5d9b41243e03a88ba0ca560cc95219a38d764947a75f568bea1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267864, "uuid": "37eddd4e-e7ca-4fba-945e-97ff08d8c9ca", "comment": "Malware payload (NanoCore)", "value": "2cd24d3c522417446422b759724dc3fb1d5effae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267864, "uuid": "35ebde6c-5f72-4fb0-9a59-76a4d66794fe", "comment": "Malware payload (NanoCore)", "value": "b3f9f80122343c9e51ef13006206ffdf8f36ef15d7025970e9209d46da8d197be9058dcbf809a2cc737d553674122798", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267864, "uuid": "00de653e-fa8e-4dc8-932b-25da4b733694", "value": "T1EF45120277C188B2D4731A325E39AB24AE7D79305F359E2FB3D069ACDE3158066357A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267864, "uuid": "658482ef-b5c1-4946-a200-bf8ea16db148", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267864, "uuid": "dd5ce961-c1da-4ef6-8ed5-a9fc9ad513e2", "value": "24576:BAOcZpJSblkEu6TiE89VUtLu9AUk7tTlLkqtTtSO:bMUTiEWKY65ttbPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626267864, "uuid": "62732f28-73c8-45c5-8d93-ec8d58d5a03e", "value": 1165771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626267864, "uuid": "4267581a-8a9c-466d-82d3-ce6f27c8de64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267864, "uuid": "b9abc0c4-40cc-40d4-86bf-fb789781e22a", "value": "DOEN100000597.PNG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6b6f7d-e4b5-11eb-875b-42010a9c0053", "comment": "Malware payload (StormKitty)", "timestamp": 1626275478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275478, "uuid": "b589f91d-2f50-4430-8c0d-4538f31a0fdf", "comment": "Malware payload (StormKitty)", "value": "a1b3cb748176d91f760264b5349292eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275478, "uuid": "94eddb1f-0420-4f63-8247-880d483bcb9e", "comment": "Malware payload (StormKitty)", "value": "8130e7cb38e727c9f90c9ec404685cffdff6c731d780ba7220af582cadadb30b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275478, "uuid": "24c928d8-8e11-486d-8f4a-464c5f39ecf6", "comment": "Malware payload (StormKitty)", "value": "0629209324566660c0bf6151b4a9a894cde4086e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275478, "uuid": "84dfb383-1145-42a5-a4f6-5ebcc993f498", "comment": "Malware payload (StormKitty)", "value": "378dbd1f97726748a0179e6bf5c4fc7befd5eb9b99291a7b2f4d67b5984b2b2ba2dc6c139d8981efecdaefac9ce2144a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275478, "uuid": "a1f16280-4d83-4f6e-9947-57a5b00aba66", "value": "T1D0259E2C23BEA609F637FF316FA5E6449FE266A59215DD0D2DC4024B4821C81FEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275478, "uuid": "8121f29e-319e-4351-b313-ae884826a74e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275478, "uuid": "4571df4b-8164-4826-a1d0-93b7d6ddb142", "value": "24576:YBdiSs3a279xxcDOY6mcf0gV3xt/NqCr:as3a27XxcDOYBSh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275478, "uuid": "68b95941-0dc1-45d3-a571-d9317983d972", "value": 981504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275478, "uuid": "bf076424-d590-4168-b39c-ebf6187fc714", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275478, "uuid": "5130b39a-c673-4444-b233-2045f658a59b", "value": "a1b3cb748176d91f760264b5349292eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299a16b3-e4d9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626290692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626290692, "uuid": "06f737fa-2fc0-412f-842a-3c47e9297f38", "comment": "Malware payload", "value": "65fa55d2469c14ac829514bb5919a88c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626290692, "uuid": "5099f6c2-8fad-4733-bb53-11e1a79f87cf", "comment": "Malware payload", "value": "813643e0360e8502bbb023e01048d91c300fa8fdae2b5c3023d56fd3c4eaf409", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626290692, "uuid": "52f97abf-ad22-40f2-9d38-67907b7acc69", "comment": "Malware payload", "value": "b711e211de5c6707228b484261673a742d212f20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626290692, "uuid": "b1b5aa23-361b-4480-908b-15457ae7a712", "comment": "Malware payload", "value": "88b264e6de0dbeeca5b03e4dca1f567dc1b9d20cf7c982d3de839dce3b62df250351909b59cbc6a7801d34e58e51cd7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626290692, "uuid": "75ec8d95-87ac-4b72-afdf-93100ed1269e", "value": "T1A977123B494CEFD3D56C52B96C52AD452EF05316A143F2FB9E820DC73BD97A00E160AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626290692, "uuid": "95dc7d3e-54df-4585-85aa-73e9759c16f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626290692, "uuid": "e08578e8-7564-4a51-87bd-482280f72ad6", "value": "24576:E67GRxirr/iCrLliTOTfye9Cb3teYzc263AsXs/02z+:zsxirrYOTfrceYY263AsXs/02z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626290692, "uuid": "98590d1b-4fbb-4533-9105-43b848ff13d9", "value": 35651584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626290692, "uuid": "73885f55-9047-428f-80dd-4edd692929a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626290692, "uuid": "fedaeb2f-1fad-428a-b026-32bd87608358", "value": "transferencia.PDF____________________________.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501d6e6d-e4ab-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626270999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270999, "uuid": "523debb3-d81f-452f-9367-6e2633a38e00", "comment": "Malware payload (Formbook)", "value": "f736c6081eb850e32c805fab74bbf941", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270999, "uuid": "8f126535-f33f-476e-99f4-8c1d0bf92278", "comment": "Malware payload (Formbook)", "value": "829b0cf5a06a20d2a4ff31190f56d23ddc994ff8807bd12feebecc255afb0160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270999, "uuid": "cf1e05a7-7a6d-4ac7-aa60-e07f9e3c82e6", "comment": "Malware payload (Formbook)", "value": "7b029b00e3467c72718b31af20f610e42fc19140", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270999, "uuid": "9a07a54a-c68c-4877-8720-0de09a5b35a1", "comment": "Malware payload (Formbook)", "value": "a3f5033a1807e0f35bb32a43a7e9c4409a47ed35efb9608135b4de232a38c6ce3d843205d7bd6b50bc386cffa0ee02af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270999, "uuid": "ff9f0b86-d868-404f-8163-661ce774650b", "value": "T1DD15E1A26241D64DDD69CF3C44616D006BB1BEF3523EE24F6CE238DA397B24B49F1582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270999, "uuid": "1057c057-7896-44cd-b999-82217920aba5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270999, "uuid": "0f3b61df-e0e4-43c7-aae5-6935c9eeed20", "value": "12288:VDz8+G937BossfnOgeBIcfuqtxfpw39gUX6jGSRLeTtOzlIBvb3n0UEeCss46FZE:VDz8/abJeBuqP26GTtOzGvj0PVg6DIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626270999, "uuid": "ff4301fc-dc54-436e-b31e-e8ce8c8a9d7b", "value": 927744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626270999, "uuid": "cb9a724d-6474-4dd3-a1d5-10bde0adc198", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270999, "uuid": "579b9b5a-9fa1-4a1e-a38a-19ff67e93b61", "value": "MUEbcaypuo2eAhL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49cf05fe-e483-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626253809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253809, "uuid": "cd9f82ba-a529-4830-b8f5-14297653f121", "comment": "Malware payload (Mirai)", "value": "55db4ea87b3ad46bbe04e885528805a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253809, "uuid": "b5d18be6-0159-4a8e-be89-ee7e5bde4fbc", "comment": "Malware payload (Mirai)", "value": "82e5c2b11c66d7ff50afd0a150a44b39a805fda776b1e122ab0a53f324cf57a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253809, "uuid": "0c6c1ff7-8735-469a-a817-f6f2d61b802b", "comment": "Malware payload (Mirai)", "value": "6f5d19c3b8f6fcaa3d25d4f62fbb63723a7da6af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253809, "uuid": "ce0ead62-0c78-4db2-a369-561ef1fc2d5f", "comment": "Malware payload (Mirai)", "value": "c14f80df6a916f16461da60cede79d885bca20fb50effc7227d3f57f9e83861a9bff80d2c72ee2d0a299cc811911849f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253809, "uuid": "eacf21d0-c912-4ea3-89a9-4824437c3f15", "value": "T11BB2D160B075BC25C7348135F7E6D94A165B17DDA9C63A573A06C5783EC284713FA383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253809, "uuid": "b6a628b8-1a1b-442f-91c9-e849145d61ce", "value": "384:hRPVaoY1Zn5SQCVlNm94qHKJnsL9Dw0wIDtjB1BAYJr2NBxmFlfUAJ+RZeQztIhb:vQpmm4Min+98arswr2NzmFC4oIQztIs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626253809, "uuid": "00ab92d6-496f-4457-9e4d-331ebe2465dc", "value": 23776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626253809, "uuid": "3e88ce31-0db3-4367-8f6e-8bd3409d467e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253809, "uuid": "8bcf995d-42d4-4da5-9209-cdd44b9530a3", "value": "55db4ea87b3ad46bbe04e885528805a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75335a20-e4aa-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1626270632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270632, "uuid": "e2140d09-87a7-4a14-ad56-f08c6b0befb6", "comment": "Malware payload (DCRat)", "value": "a63b54e6077c5d034c060adc869e8c3c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270632, "uuid": "8114f314-f4d6-49c5-aeac-f30e2fab3f7f", "comment": "Malware payload (DCRat)", "value": "83923b2bb65492892ef63d18dff00654431b27cd409d8fd67d4ba0eadc052c6a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270632, "uuid": "a1849851-1481-4c5e-9fde-7cc68ffede70", "comment": "Malware payload (DCRat)", "value": "fc59c4232058744b1495b3d546a5d4cba11d79f7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270632, "uuid": "ddf64419-7d8f-483c-b54f-674091833723", "comment": "Malware payload (DCRat)", "value": "0838d0247fd4cab1bb480f447c2b9155033a20ccbadda941e9ef05cbb34428d1cae2364d8bb9fbef45a7cab58b603ae9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270632, "uuid": "c230b785-2ccd-4676-b7ee-777a8123dee8", "value": "T157F36C422381CB69D16FD3F1B592C1864533ABD6D613B20FB286AE6109E93D4D5C3ECB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270632, "uuid": "6b257ad7-9014-48e4-8344-bca071de8dfb", "value": "b9778d941dd7a5b9a7e6b833506dbeae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270632, "uuid": "f980cd0c-0566-43a1-b432-4a16cc61a2ac", "value": "3072:afwr84wFujfH3mHrFLWYPNWJyWMQs6N0YjOpmlP2MZ:Z+0fcRzdmjOpSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626270632, "uuid": "68b99abb-c81d-4e3f-bc5c-723d84ee4a0f", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626270632, "uuid": "d9e8300c-b29b-4c4d-a2e2-71857e13d280", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270632, "uuid": "ce36ab1a-9a99-4318-954d-8fa445526582", "value": "a63b54e6077c5d034c060adc869e8c3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e0e4a1-e470-11eb-875b-42010a9c0053", "comment": "Malware payload (RevCodeRAT)", "timestamp": 1626245890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245890, "uuid": "864e64d2-8cb1-4298-9e5c-37e816e2c2c6", "comment": "Malware payload (RevCodeRAT)", "value": "2d29230b77724882289e74bb9e69b95d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245890, "uuid": "0200b5a5-af09-4eae-843f-750c89cb20cb", "comment": "Malware payload (RevCodeRAT)", "value": "84d9088f856e12f998ce324510f185b9e6939c8d1cb2cdb46eb9b38baf879619", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245890, "uuid": "d48daee4-9cb3-4071-b9af-94432d1836c6", "comment": "Malware payload (RevCodeRAT)", "value": "4be47bbd5110c38b3312ab232570051f6335b65b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245890, "uuid": "b9ee319f-3bcc-4c6c-ad96-e6eb137954de", "comment": "Malware payload (RevCodeRAT)", "value": "b68ee652b0a487530ba060651ff7d38dda824e87ae655b755d4422f6be2679c362450d464960ef399a7d1a60bb888ce9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245890, "uuid": "26be19b9-3523-4324-98c9-19fd4fb80597", "value": "T1E675E02D23FEA718F233FF319FA4A6489FA676759229DD0D19C4024B4421C85EEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245890, "uuid": "c3d6b427-9147-487b-a949-566106157c19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245890, "uuid": "c7a0d219-c19f-4045-a6d1-507b96767389", "value": "24576:iFjKF+JFzjUw4wuWN36I6IcDKSEtS8j3D4AmN0kUqmJlEUgAWtndDuW:kFzkwBwWS8fmN0kUqmJlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626245890, "uuid": "77e8f5f8-a98e-4c63-8768-1d4f6cbb9b71", "value": 1627648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626245890, "uuid": "4081bc0e-e756-4823-9184-9999628a8cbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245890, "uuid": "a380248f-24ba-4a4c-b828-3c48ca564b4e", "value": "BANKING_DETAILS..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270551b9-e48a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626256757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256757, "uuid": "31ec4412-c12a-4e3c-ab64-b2c8e363af7b", "comment": "Malware payload (AgentTesla)", "value": "06d5eaf28dbe97b59e104b0369a822df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256757, "uuid": "a811640a-594e-44de-84b7-e8e407fa4ef4", "comment": "Malware payload (AgentTesla)", "value": "88078fd25e03336ffce943a71bcb5b4bd9b4f754793c9a3b1b0f2de2c223b29c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256757, "uuid": "d2136e70-81c1-439b-a7b9-5d050af14c07", "comment": "Malware payload (AgentTesla)", "value": "36ad0fba224bfc17a75a413ea66114f59c51d13c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256757, "uuid": "f87cbb2f-9dd5-4b87-b409-f0ebd5df49a9", "comment": "Malware payload (AgentTesla)", "value": "37e6e726ff83917a53d982ca7cd9403bb383762dde0bb36b10c5bc413b97901f9b2a18dabb97bfbff835d6a8eeb716ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626256757, "uuid": "33ca34ff-522c-4a85-991a-4a78c3579037", "value": "T16EC4235221AB4BD8ACEDF1E9CAE901F5084EFB5D18C716E672C81C46D1A1053AFCAD7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626256757, "uuid": "68e21048-a7ce-485c-86af-baf1fc36c206", "value": "12288:s0tAGCPENxxEVh4SLPbHvmbkmdeQzzTdBzQLzlNAq8evfcOVCvdej:s9vYxxEV9LTPmgunzT3+zAfevfrVUdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626256757, "uuid": "504be6cf-33fb-41d2-b8c8-6d521044a81e", "value": 576574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626256757, "uuid": "54cca3f0-fb48-44ff-9860-0503dafe3bf9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626256757, "uuid": "b7e7dfdc-a45e-43cb-8e5a-18529cc1c022", "value": "VSL\ufffdS CONTACT DETAILS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd1860e-e4d3-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626288335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626288335, "uuid": "cfcf02ef-36c2-44cf-b11b-3af747aa71e0", "comment": "Malware payload (Smoke Loader)", "value": "a3a5fe1fecb040f32413e8c507008126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626288335, "uuid": "a918f94d-40b3-4d78-9bd3-5c38669f3a28", "comment": "Malware payload (Smoke Loader)", "value": "8876443ca226bd35c82f3e50163007b03b39f61efdb751568f2cef7d71a7b954", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626288335, "uuid": "6af85b64-1bd7-423c-aaec-e8ad28edbfa6", "comment": "Malware payload (Smoke Loader)", "value": "aa6395c36c142976d93ab5a76535a139ff46fe15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626288335, "uuid": "775d3454-6d03-4fa9-9934-6e86a1e600c3", "comment": "Malware payload (Smoke Loader)", "value": "afe498be6edb49ab07c40e9ffb2af640cd842bd20adc8baae219044ea7f28ba6bf3ed26ccd0dd430a73bfb716006d083", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626288335, "uuid": "211624fd-fe12-49ca-80ef-41c040483e59", "value": "T18814AE2132E09432D9E716306470D3AD6A7BBD326B7C858F3B55276E1E332D1AA76307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626288335, "uuid": "31d178b4-e4f9-4642-91b9-aa21736691ac", "value": "f9c1cf1b2cfb3ee96a94f56e9a89c09a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626288335, "uuid": "a30fe716-9fde-45c8-afe8-672ce56ac1f6", "value": "3072:LBNmhufQiKmEMs+OHCT8lZuCVwcm5IzHSH:1VYiKmEMs+YC4Xuyw0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626288335, "uuid": "bb7fd213-eddc-4eab-b783-5bfe13e0b7f2", "value": 194560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626288335, "uuid": "4ef64bc3-33d0-4e2f-8781-8e0b924f8575", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626288335, "uuid": "e9674eba-29b0-4590-a0a2-3243d653e23c", "value": "SecuriteInfo.com.W32.AIDetect.malware2.30233.27096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878b5237-e4b8-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626276676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276676, "uuid": "07eb1258-cd43-4d37-9b9e-1e7cafcc194d", "comment": "Malware payload (Loki)", "value": "43b5591895c9e5c69e6cd3ba7030d394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276676, "uuid": "1c0aa096-a173-4dde-b2c2-2058b1a93d69", "comment": "Malware payload (Loki)", "value": "8877f683807ceac1fda7de3574834053659e0976300c84dcc2b819d4108fa5a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276676, "uuid": "c23dc262-81e7-4a33-b66a-807d1313066e", "comment": "Malware payload (Loki)", "value": "4faa8ade23a1133b56c44c8fb4894d049d0c6eca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276676, "uuid": "ea14d647-3dc7-4494-a48a-6b7e19e0ea77", "comment": "Malware payload (Loki)", "value": "4e9c6f5351f3b125c2feede2b066debf51023738faaa93728a48016cff50f9aefd427288f840910fec097196baeadf35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276676, "uuid": "eb830d02-8051-428d-bb67-765f260af6c8", "value": "T100E4F1753B80FB4FC16E8D3885925C0077E0E6775317E387ADE325ED098D7AACA22192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276676, "uuid": "38c4d3d0-a91c-4f1f-b15f-159f63fc95bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276676, "uuid": "ddf3b25b-d0c6-420f-b598-5c71c1c46d75", "value": "12288:aqBeJLzt9ExeKHBVeCEBBWmboOfSKQEcZUjHRNeT+m/ZeMYW:aqBI95kg6a/OUjHRfzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276676, "uuid": "9a2fad67-91a9-442e-b051-2cd782491c8c", "value": 720384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276676, "uuid": "de453fee-d524-411e-8d62-b2e19d5fee5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276676, "uuid": "723a799a-cf9f-4bf4-a306-836315d468e7", "value": "43b5591895c9e5c69e6cd3ba7030d394.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d988056-e452-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626232743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626232743, "uuid": "06f4d638-c62e-4396-acf1-6a60b2fdb98c", "comment": "Malware payload (AgentTesla)", "value": "3a892e0b78c91c1ce8d6c161966363d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626232743, "uuid": "90d39dc0-e202-48f1-b42c-dfe5a929c8d8", "comment": "Malware payload (AgentTesla)", "value": "88bc574301d48727f2b68ce288db5158933800e895b16c1f1afd2d33c80b7077", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626232743, "uuid": "0f52ac9e-7658-49f2-9c8d-4d87dbd6c449", "comment": "Malware payload (AgentTesla)", "value": "bed80701b2c5e2c1dd52b64f9251447cf12aa6fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626232743, "uuid": "f40c4bf6-98ce-423c-82b4-7177ba88bce4", "comment": "Malware payload (AgentTesla)", "value": "f90b1c989714b0a6ead617d4ae74ea1f3d100965412bcb4bf703c6a2c8109205324f208ca725119a33f5e279a3c1b44e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626232743, "uuid": "2bf8f938-30c2-4844-86e7-aeefb6689987", "value": "T1C88401673249AA3BCA3E29F85043194487F460792886F3E84CD979FD48D4FC98752BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626232743, "uuid": "a31b5fb3-5fb5-42d9-83a4-7f543c454f29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626232743, "uuid": "284c9b88-c65c-4ca1-b635-3aa334538177", "value": "12288:N24Lfpi60+Zm+sm//3GGcrgjuz0461IKSeu:9k60+Q/m//a/0R1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626232743, "uuid": "cd67938a-468b-466e-b9e5-73d707d4607a", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626232743, "uuid": "d702cdab-f67a-4e4c-a83c-7627d7c120ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626232743, "uuid": "b293e5b3-d221-4a46-8f2a-f7b1d3827762", "value": "AL Naser General Services.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8d4425-e494-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626261066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626261066, "uuid": "847cc3a6-2792-4823-a672-a95171bc706b", "comment": "Malware payload (RedLineStealer)", "value": "91b80d727ddd4512e60ca369a4cc6034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626261066, "uuid": "a8111bf1-bfaa-4a72-b6cb-aa446c1fd921", "comment": "Malware payload (RedLineStealer)", "value": "89064913fd45e3e669524d0f0ec65d83e2f238f25d942ba7491dda853b279826", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626261066, "uuid": "65ea6d79-e507-439f-bc84-fd6453cda08b", "comment": "Malware payload (RedLineStealer)", "value": "039aa9303320ecbb671ebed96c40200705228ee2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626261066, "uuid": "56411859-e52f-41e7-820d-3de7ed0f11b3", "comment": "Malware payload (RedLineStealer)", "value": "24cc8fb6ef99d2bb4db55a5f9427b78bc30a5fd380f0fb75d9c00f2f181ee068357402abe6f4000d93924f6f04195176", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626261066, "uuid": "480d310a-fd00-48d4-8a0d-39be9b713096", "value": "T189448D98B7564509C6388531E0E3026807F3DECA72A2DF067AC639D50F733ED5E56E8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626261066, "uuid": "168b1e42-326d-484a-8800-e57fbd7804d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626261066, "uuid": "8d1dd8ac-616e-4d25-9720-1da8a8d41f63", "value": "6144:4qsF/tWNfLzIP0IR81hS+LfAsxMpHU4XcXW+:4H/8NfLzIP0u8bSgpxMpzqW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626261066, "uuid": "7c32cd8f-dba7-4d7d-8cd6-21d033f2ba44", "value": 260752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626261066, "uuid": "2081f1ea-c61f-46c7-a5f4-6b067043af80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626261066, "uuid": "549b403b-7d94-4fbe-b969-14983ecae6ee", "value": "89064913fd45e3e669524d0f0ec65d83e2f238f25d942.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf5abc7-e44c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626230244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626230244, "uuid": "6586fbd7-232a-42c6-81dc-ba6a4746c6d3", "comment": "Malware payload (Mirai)", "value": "b603408521f2027e916a5d0e3f472fd3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626230244, "uuid": "10861031-ee5a-444e-bc04-40ecd581b8e2", "comment": "Malware payload (Mirai)", "value": "89da1c78997692003488b8aafc7d194629cab011a7c8a03da2ab459d5909014e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626230244, "uuid": "5432c702-8fe1-4892-b073-4ecea17c2c05", "comment": "Malware payload (Mirai)", "value": "585a4ff081f9f5df731e4a821472cad6542ac5b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626230244, "uuid": "2e02dfe2-447a-488d-91df-90a84c0875d7", "comment": "Malware payload (Mirai)", "value": "ccb74fcfe18f55174667f85d26ee185493a4cc2b444dbb53deccc334e4e69564f2e6ec3fa354dab7e5c7dbc95e6b4b07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626230244, "uuid": "2a2e79a1-c22d-4242-8248-f0f68ac6b5f9", "value": "T10E234BDAB801AD7CF94FEBBE80164A0AB62133505193072767B7FCD36C321A49E66D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626230244, "uuid": "826d9e1b-5ca9-4662-af38-47acf09eaafd", "value": "768:Cbez1MYbJspJqE+Ink8yENhGEOCrydbujWen3poWRJT5o02bc8JU:GQaYOpJOVXENhGcWdCjpZoWRJVo02A8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626230244, "uuid": "71f92436-e456-4057-b186-2ec5a3af1f3c", "value": 49788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626230244, "uuid": "3f25b791-278a-4462-9f0d-ede4a06a0312", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626230244, "uuid": "63749b4f-006d-444a-9faf-25fe718b2536", "value": "b603408521f2027e916a5d0e3f472fd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d9ea30-e44e-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626231220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626231220, "uuid": "bd18dab3-98e2-4366-b04d-d684924a72a0", "comment": "Malware payload (Mirai)", "value": "3787adff32476900a112e17516c6c900", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626231220, "uuid": "c7653337-ab20-4d6f-9909-a6b45d61ca78", "comment": "Malware payload (Mirai)", "value": "89e0e8f8d2557e36978fb6f55ba6a096d181944d764f996a2a875f024148d224", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626231220, "uuid": "8c3e24d8-cf91-4fe1-b535-3c116816e221", "comment": "Malware payload (Mirai)", "value": "bee0403d980ed3b43561fa8c048c0c08eb2ff505", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626231220, "uuid": "55d84a9a-0f2c-4a1b-8341-82c9b80efe9c", "comment": "Malware payload (Mirai)", "value": "e4e44a315263514b279f808403f6787542f4ed4072147a8c9c7bd4915a607d8522b8cfdb8130cbb1866cc861fe40dd1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626231220, "uuid": "a56241ec-97ef-412e-9e93-3e119deb9a37", "value": "T19513F892BC829B66C5E0637AFA5F418D3321A3E8D1DF3257CD152B017AC591F0D6BB41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626231220, "uuid": "115eaedb-c265-4f7d-8581-87fbffeafc96", "value": "768:3/IAjD28m0Gjp7DLVqFdZuRfHno1WC8saYDoCerCosG1ncvYPDX/hex3OgWytLPk:3QADmZpD5k/8sEsGxcIDX57/y2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626231220, "uuid": "28926c13-a187-43c3-a638-f73f27682cc1", "value": 42864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626231220, "uuid": "756dc5b0-3d54-42f3-b6a0-12497a92b7c0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626231220, "uuid": "8cf9115b-725d-4ca5-9050-61affbb0674c", "value": "3787adff32476900a112e17516c6c900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee7402c-e4a0-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626266568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266568, "uuid": "d0d63a52-e4a7-4814-be4c-278ec6650137", "comment": "Malware payload (Loki)", "value": "8ffdf1b064ccd16a180670c12854e5ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266568, "uuid": "02d92308-cb8e-459e-b0e9-1642b5ea178f", "comment": "Malware payload (Loki)", "value": "89f35e6df8747241c1c7afa4f66b071c795b89d86225e201261f385f880f7599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266568, "uuid": "f8d7190d-d082-4f77-bd8f-0c6ccecca0f4", "comment": "Malware payload (Loki)", "value": "225f4dcaeed9e37174e2724cb9ec459b1f3d03d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266568, "uuid": "bc519b0d-4153-4817-8fdc-0e5e65bdb608", "comment": "Malware payload (Loki)", "value": "7924a5b00f856e97396c522c47e2d4ae9b7e6f7fe0a8ef24ba4fb1255692574bda94c3838f37c148231d3fb0dbfd29a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266568, "uuid": "d81038df-2781-4c48-9d74-72f116cdf2fb", "value": "T117F45A6C23FDA689F233FF346F91B6449FA666B99215CD0D2DC4024B4821C41AEB7D39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266568, "uuid": "cb702025-2c1d-467a-bf9a-7c797b8dbe24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266568, "uuid": "c68ca140-2a6a-404e-9f4e-ab32378c7c5b", "value": "12288:IRq9rV6rNls9XOd4+QCJiWYKE9u72574N3Eni3eSIEHJ4ittQiW0Xss4mwilqQHk:IRq0iWFmx574dFGEpXt/W0Xsvmb2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626266568, "uuid": "102d5380-87dd-4b63-b39e-aed6a9968a44", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626266568, "uuid": "5c6bc3db-9700-4ec9-ad56-9bada11b15ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266568, "uuid": "355fc350-f6da-470b-9897-750452972835", "value": "INTEGRA 141398.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957dc0fa-e4c6-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626282712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282712, "uuid": "5c02e253-07da-494a-9abb-e96421ae02e1", "comment": "Malware payload (RedLineStealer)", "value": "0422956b6bbb8a31c67d3852ba47fd2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282712, "uuid": "afb0ac56-641e-48e6-9d73-a0adf04e0d8f", "comment": "Malware payload (RedLineStealer)", "value": "8c373ab975303f6d0167e981cd158c17e9faf03fc6cf52eb7de2f7bfe18a2d27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282712, "uuid": "122faf81-91e5-4034-bdad-27a6b3ab2236", "comment": "Malware payload (RedLineStealer)", "value": "d4c133016c153483b88d4c6bdd04dd842305a032", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282712, "uuid": "ebc197c1-045e-4167-bbcf-f7ed22eb2a2d", "comment": "Malware payload (RedLineStealer)", "value": "caca67b8396a304139d8fc2dce1aaa11e5f307426d3b46e9e233f34ca570e8c2210a21198936b68994be9fafa6720dd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282712, "uuid": "45189461-b545-4ba3-b994-693f4e9ca715", "value": "T1CE54DF1035B1C833D1A74574507983B0693FB9B76B30A44AB6533F9F9EB22C1B66A3C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282712, "uuid": "0fc67d99-1e2b-430d-a953-889b863b5e59", "value": "17171168c445a60dba0c467d92521f23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282712, "uuid": "96499663-59d0-49ef-af5e-fb6b1298dfc2", "value": "6144:Rsi2jjZiLRf3OTu4CDOHJzzL5ILmD5X2oIgXl:R52jj4ZON4Ow6lX9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626282712, "uuid": "c6142058-9ad0-4b6e-a6ee-b338c50acf8d", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626282712, "uuid": "aeb4d8c5-193c-4033-ba66-eeb87418d671", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282712, "uuid": "6746d795-1aaa-436e-9e7b-cb2be1c3e47b", "value": "8c373ab975303f6d0167e981cd158c17e9faf03fc6cf5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a254be-e4c4-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626282010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282010, "uuid": "3c6a48da-5a43-4144-8860-ce3b143ff359", "comment": "Malware payload (NanoCore)", "value": "cee9b43e921b27a6be23ee4616aebae4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282010, "uuid": "5d603f3e-70e9-408f-9759-1e44a53f8443", "comment": "Malware payload (NanoCore)", "value": "8c651ea8989785221ea7a3463dceb018aa0181b97ca479eaa7972cbe9e80fdfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282010, "uuid": "39b9e9b1-4337-4227-b449-e7472e8b5317", "comment": "Malware payload (NanoCore)", "value": "99c4cb613a08b079ea2fc21af048b0be6d3e2417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282010, "uuid": "3206b384-a6cf-4469-bd0d-fc0e1b3ccbeb", "comment": "Malware payload (NanoCore)", "value": "5520801155527419181439ffb13c951e1a3e0b7fcf48632bf80dadedd597456296fc0daab75554787743b62354405dc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282010, "uuid": "b6020b69-1b28-4587-8f85-f2a25db48133", "value": "T195D2C70A3490B415D3A74A750CA7ED6427F493328861D24ED8E2638CDF436FA6DDCEDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282010, "uuid": "1e30c425-1d54-4c70-8a3b-190d6df6909c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282010, "uuid": "4a1a61bb-db51-4cfe-b94b-8b2ae7a3825f", "value": "384:DkdokoTCaP+mYGDatbk2mJIuCm9oNXsdeuhC7VTJQFSH/9Lkk3a3N6Pex2NLaL6z:Iddom/6KzSVhC7VTuSfxXKDfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626282010, "uuid": "bcfd805b-731a-4f49-acf3-b3e14499d602", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626282010, "uuid": "cf47cd69-8ff0-4604-bf8f-96bb2c1c618b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282010, "uuid": "ab6d0516-ab31-4a0e-b29d-4fcca7353cf5", "value": "Victoria-Invoice-62541323.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d89cb8-e4b8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626276480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276480, "uuid": "9665ee25-7f4d-46c8-a736-9f1ebb776154", "comment": "Malware payload", "value": "51976a0ff5e02c1f5966369a4c6005d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276480, "uuid": "a9a19a57-1d64-4e27-968c-b5d67186814e", "comment": "Malware payload", "value": "8ce827f772c34140506efa890a651c450d7cacff7f0f4f07250cb824f49af292", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276480, "uuid": "6aba59dc-4f2a-4da2-a2a8-a9aaa26561c0", "comment": "Malware payload", "value": "1692e557257e6c626cad3b03b356e2991aeb2bc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276480, "uuid": "d5c0b777-895c-4c8e-9740-95e73dabba1f", "comment": "Malware payload", "value": "89adacdeb88cd2082c91af7a1d47e57ac13fcb0b74d4c44212000c66a4340f4d5904bfe02ac63616f6eadc4ea418a03a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276480, "uuid": "055e9dcd-940c-49ec-a697-9122c0cf40d2", "value": "T1BD45AF22E292CC37C13326399E1B97645E3ABE50393869463FE42E4C5F396C53F25297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276480, "uuid": "34a8b2dd-91d1-4319-b558-79f8b9ab36a7", "value": "fcb44a1a3fc4e1e98c43d377bd1fddff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276480, "uuid": "60d87e6f-7809-41ab-b07e-d25a78537146", "value": "24576:XBoara9t7QhFjBRfUYUgaOr8m3zFlpoe11f85mEHl4EDtCo:XbetY1RfUYqwoa8rCE5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276480, "uuid": "7f5a053e-ec70-46d9-9c09-10e5db026d87", "value": 1274880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276480, "uuid": "f5d7b786-67af-48be-99b8-f4f833ec1164", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276480, "uuid": "687b7fe3-55a4-4207-b9fe-65065a343a60", "value": "51976a0ff5e02c1f5966369a4c6005d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3230d685-e468-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626242173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242173, "uuid": "0670d656-6b5a-43e7-a5d8-6adfb2e6ddc2", "comment": "Malware payload (NanoCore)", "value": "719584fcfee7ac5186d733730a250c88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242173, "uuid": "8df8f978-6e0f-4eaf-a494-5d2421059417", "comment": "Malware payload (NanoCore)", "value": "8d1d56d87c6bc5b59d02b1b0e2b210b4f919a4df439209c29a8d90e407cd58ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242173, "uuid": "3027478f-c2f3-4c43-b7a0-844adaa801d1", "comment": "Malware payload (NanoCore)", "value": "cb5afebdf8ba068676fb0a556b3484e26336d018", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242173, "uuid": "82d4af1a-0e1a-45d5-a516-b23ad0618e7a", "comment": "Malware payload (NanoCore)", "value": "1d37425ca9e95bf86e33c5c0bfd915a3f9ee43406093634d1f8b2a4c181ce02fca3a3053f76a503f372f91394d9a4bcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242173, "uuid": "cf76060c-676b-4de7-b748-d25c1f814c80", "value": "T194159E6C23FEA219F637FF31AF94E3449FA666BA52199C0E19C402075461C81FEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242173, "uuid": "33cdac80-53f5-40e4-babf-489f29f5c4d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242173, "uuid": "48238f76-d9ab-441a-bfcf-f0758c731a69", "value": "24576:4h0tS1R+PSXB7ZdJKYmQa6fKtNOxUkQl:4hYSSEBNdJ/mteKtG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626242173, "uuid": "1b682726-8cda-49c6-86c5-b475613a3821", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626242173, "uuid": "2a5d0489-658d-4aa6-89c7-2d3bb13ffaf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242173, "uuid": "16688c0c-852d-4170-b690-dc27ee6ab435", "value": "CV^RESUME 67516151.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b58af21-e479-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626249624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626249624, "uuid": "6ed2196a-e012-422b-a8b7-5448bd8645e0", "comment": "Malware payload (Formbook)", "value": "46693b74a1dfe3460d3802827398d235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626249624, "uuid": "84e81662-26ac-49fb-b7d7-61843acef96f", "comment": "Malware payload (Formbook)", "value": "8da1dda33b97c3738bdafe9dfc6543827bb18c2e20a7cf6af60fc6a919e59ef0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626249624, "uuid": "72e2a831-dfa0-4f72-8d47-f2d8c79449dd", "comment": "Malware payload (Formbook)", "value": "9db47616223676bd79bf6a2ace0aa08d6861a9e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626249624, "uuid": "729d4295-bd12-4563-8424-3a6623e9dd78", "comment": "Malware payload (Formbook)", "value": "8f54051e601cdb8f6d210a705c0eb40cf1563d7ea07a4ec096748a73a7e8918d4514a01099dd6e03adcb4e98c0709c07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626249624, "uuid": "5a0fb012-faec-4fcc-8301-6988883ab643", "value": "T110159C2C23FEA109F237FF759F94F3859F66667A9229914E1DC4020A5821D80FE77932", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626249624, "uuid": "50259995-1aec-4c5c-930f-630154d0559e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626249624, "uuid": "143259c4-9c75-44fc-b9fd-fdef936bca98", "value": "12288:PsprTZ1OsQip0DBJoyKCmZzjJzhkIykA5CB7ph4lxjgbQew4M7ZxW5d5H46Vbit8:POb9xeDB+9Fzcdem/WN0+k6xI0DX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626249624, "uuid": "e1b10eb2-3f1e-4d76-9349-eeb12f0c4efc", "value": 930304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626249624, "uuid": "01233f85-60cb-4365-ba9f-d760174ef587", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626249624, "uuid": "42b0c291-3666-499f-9e5b-350eb023fac0", "value": "New order.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4d09f5-e482-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626253273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253273, "uuid": "58f4e25e-8952-467b-9f68-7e036c01500a", "comment": "Malware payload (Mirai)", "value": "5532fc47090e642acc3d95f3ed4c4fae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253273, "uuid": "17dad184-0c01-4af4-bab4-3881de78942d", "comment": "Malware payload (Mirai)", "value": "8dbd2ded8153f8f11a6a77928cf96cac14fcd0d2696eed964178d474f6cc4dc0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253273, "uuid": "bc663df3-917b-4494-82f4-f67edd6158a5", "comment": "Malware payload (Mirai)", "value": "1dfde8da744da453f897975dab0ceddd3f8885a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253273, "uuid": "68526622-da3b-4f47-a1e2-b99c318bed38", "comment": "Malware payload (Mirai)", "value": "a4bb9e16171a16fc968890835a81046f7158a6089297a63d19c56cf066714cd79c6cf544aa1ad9899f09fc0b5a4c5143", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253273, "uuid": "ca6a1bd9-f915-43a9-b286-60bd9eaddb63", "value": "T1CF6402D7EB10BCBAF4928170B57B075CB370C6C9C287E280B358D5693C6D38657AA2D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253273, "uuid": "696fdad8-5d09-4985-88b1-a675268bb827", "value": "3072:2glZ3FtCKXhkmHtZ9TEKzjfj/WMngyIfsJ0F7xPtoga5POdOQ33Q:2IIKXhZtL7jOTyIG87XsPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626253273, "uuid": "8ba23286-fe1d-423d-8876-a0f637541ab3", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626253273, "uuid": "a4d3e9e9-57e6-4c45-b511-dda47643b683", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253273, "uuid": "7a948298-ed2d-4dfa-b819-a5574aa6c71a", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388b4821-e4aa-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626270530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270530, "uuid": "59b0edf2-7aeb-402f-b4e0-70bec6edfc89", "comment": "Malware payload (SnakeKeylogger)", "value": "edf915265c87cc2fccb85c9152b25538", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270530, "uuid": "d1c8b610-f3e3-478e-a9f7-3e260d306c83", "comment": "Malware payload (SnakeKeylogger)", "value": "8dfd6c0deb2f1331f4619a996e12d90a0475e222d1359b8e8a67267222085e51", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270530, "uuid": "4370fef7-9b1d-4f0c-a163-35ca436464bf", "comment": "Malware payload (SnakeKeylogger)", "value": "b7ef7114359b56564026bcbd4d5c996b2ce80bc1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270530, "uuid": "558ddde1-0ac5-4dec-83ec-fe7740079f45", "comment": "Malware payload (SnakeKeylogger)", "value": "747c1f59d2c3c994705f465b4c835b415cc08fe07a66b936c27fe3c2ba249ff02ea6ca0cdcd03d707641b4679aee64b6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270530, "uuid": "cb69fb24-9b88-4c45-ac95-75957ad843b6", "value": "T1B41393ADE55741948F86A7B8AB2BAF48058D765DF785D532323CA33563C2D7B402383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270530, "uuid": "45717b84-0e55-4d09-9d87-1ad0110d5d92", "value": "384:Gz/dQryN3nqce/zmShgoqj54vL0Jd+A1fhVahk0YJgQlzjJDLQjuRwx:GTSuV8/zlRScmfwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626270530, "uuid": "aa5866c5-013c-409a-b600-0fff5829ce71", "value": 44085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626270530, "uuid": "5beef476-93bd-4af8-8bf5-ca8592f22a66", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270530, "uuid": "301b0699-fffc-4f67-b5ea-beecec6ed124", "value": "product list.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ea0114-e4d5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626289124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289124, "uuid": "3231ac0e-a8d3-470c-ab27-4e338edb71e3", "comment": "Malware payload (Dridex)", "value": "ea09239b2e17576e1907df8e7f4ef6a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289124, "uuid": "a70569d5-2faa-4601-af1c-7b0af9ed984b", "comment": "Malware payload (Dridex)", "value": "8e2d3f6bc5f7b639638d2f5ec751bc2985f1636005131623c5d2c448885c5d89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289124, "uuid": "c4cf9ef0-9554-4170-a60f-3c68ab523ac6", "comment": "Malware payload (Dridex)", "value": "931bfe2fa810a16caf53035f351f08464f3947a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289124, "uuid": "5fb28d44-0f2e-410a-a0ed-628e3b9ebe21", "comment": "Malware payload (Dridex)", "value": "969ebd88b044192c8fc3ed0558cc7823388c2c251cfbf2b4130004f5d3046db5ed72c39ae29dc4806835d1fb53c4c387", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289124, "uuid": "8a16120f-dce6-4133-b810-793cfd3c4f1f", "value": "T1B1F3023272AB6AFAE276FD72055F9931273160480318DA6FB7019F86D95E0A34C6FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289124, "uuid": "c4f5467f-addc-4730-b6b4-f07f7739c715", "value": "e9cbee8358b331a128409a4d26e3e347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289124, "uuid": "2ca3d287-705f-4bf9-80aa-86e2fd87b938", "value": "3072:HWiJzQu5JD9ko9WY1wzxWrPAmNa7L5cWlvsRwmhnxONgkM:HLquAkPAmYX5WncNgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626289124, "uuid": "4ed668ed-8b6c-4f1b-9ddf-9f2f0f10a0ea", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626289124, "uuid": "c503a20d-527f-40e3-aa12-cc3d71a1fcbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289124, "uuid": "b9db9681-8b22-4d42-81fc-d8abf25a9de9", "value": "ea09239b2e17576e1907df8e7f4ef6a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc014060-e4b0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626273382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626273382, "uuid": "54ca3488-983d-4dc7-9b4c-05b866a68ae9", "comment": "Malware payload (RedLineStealer)", "value": "8588d95ba7b07ab2e5ca59cb2d471c35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626273382, "uuid": "83431024-7fd9-4588-b6c3-dc7a4f22777b", "comment": "Malware payload (RedLineStealer)", "value": "8e3b78de49837ac2a4ec7a0737f08389e66bc4c03a4abd314a8787d569a581dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626273382, "uuid": "9e0d30e3-4929-41a8-bbe1-83dd934ce63f", "comment": "Malware payload (RedLineStealer)", "value": "da36f7e2f3f09e6bdbd41899d6550c171b9bab97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626273382, "uuid": "4bc6746c-b07f-4823-8c55-c34b1432a6fb", "comment": "Malware payload (RedLineStealer)", "value": "8b696bf77417ae9fd5cca82bad5e4f3d382e4b80ed4f229633d3bd7427a122a03058254b8b085d7ff8f7ba7dbdfbd73d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626273382, "uuid": "2907737c-2b4b-4fdc-99d0-c74ea4b001f2", "value": "T19284342864BFC01984E3EEA12DDCA8FBD99A95E3640D743701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626273382, "uuid": "bbdc35d3-2dfd-486f-bd61-c4bd5d78fa67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626273382, "uuid": "adff38f5-7fa8-4e6b-b725-0029fa899e88", "value": "6144:0wwKqovblIm78ecX2oUwezyRnpOLTzVRJ:0wwK3vblIm78ecX2oUwezyRnpOLTzV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626273382, "uuid": "80650557-ca87-4804-b3b2-7c4789a6201a", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626273382, "uuid": "08f9c214-0213-4625-9cb1-5b240d46cfe9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626273382, "uuid": "ccc0e3e8-3f40-4a18-ad3f-1369a3890043", "value": "8588d95ba7b07ab2e5ca59cb2d471c35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c585607-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626246109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246109, "uuid": "81e3ccbd-1066-491f-9fd4-704eeb009882", "comment": "Malware payload (Formbook)", "value": "3833c84c345d167c26b9dd5ce004f2d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246109, "uuid": "f805da97-2f60-4b3e-a4eb-2e3212dbf6f2", "comment": "Malware payload (Formbook)", "value": "8e6a33ff57482763cdd7fceee4f95ab8015a5fa346e3f6948f9783ce14d1d0fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246109, "uuid": "dfd92b6d-a434-42ca-b315-34e4196c1b16", "comment": "Malware payload (Formbook)", "value": "02e7946519bdd920a3ef11600e8c68f32f827d01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246109, "uuid": "33f4ecee-559f-4f27-86b1-08a1766e904b", "comment": "Malware payload (Formbook)", "value": "93344b610453289f7e1a68730701adfb720e256897fff7b47c3dd73602fcc86a7fd4d31d700098d5e0fe0ccba0ae7ed6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246109, "uuid": "4c79816c-2bbe-4a80-a2d2-33d1cca1871d", "value": "T12A255C9813BC66D9E137FF305F65EA540EAA7EF912248D0C2D8632174832D42BE67C36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246109, "uuid": "6f3b7b53-2710-4919-ba2b-8b13f4e6124f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246109, "uuid": "f2f76924-bac3-4a67-b4c3-1e64599b3d6b", "value": "12288:3fdGyFrNls9XOd4+QCkISTdwRjQDYrBbd62LMNbgmpkDh/xiOCCAqvAnCi0v6Foz:3fmISeNQDYqyMVgokYqIn70SF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246109, "uuid": "d28ec200-0456-4d9d-bdce-7e7bcf8cbd10", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246109, "uuid": "1bc30f3f-b7a8-4d6c-9a15-9529f62bc3e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246109, "uuid": "fcbc8409-7f4f-4bf4-99ab-49c255c42485", "value": "New_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d125c3df-e4e3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626295268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295268, "uuid": "b2745bde-b611-4fdd-a391-50205ab6aedf", "comment": "Malware payload", "value": "929d5b7d7b5d40d044661332d448c99e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295268, "uuid": "8bf9dc3d-a8a5-48ff-9e8d-2efb1dda3e88", "comment": "Malware payload", "value": "8f133390f840c2910680bbb02149ed3512d8ec1c6c14f957ad7bb5dbc75497eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295268, "uuid": "62762edc-1f8c-40f8-b6fc-e30d1d8e31e0", "comment": "Malware payload", "value": "728cefb335a691541c2c63f00049446cf2d0109d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295268, "uuid": "e76cee84-0e52-429a-afa0-7f8d1bc4b27f", "comment": "Malware payload", "value": "b915a0fcee5cc62bf8ca47a3b871dd7643baf1625af819756df4d0aa12cb7ccbc3f019d9b4e383f069997a69bafdaa76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295268, "uuid": "5047be13-2276-4fd0-abb5-f053a9b97b93", "value": "T1E8E49C7793880957CB7D93B53672E846F6A2ACA63B70DD0F468BB1E117732422486C1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295268, "uuid": "5b989f56-23d6-48e6-be6f-86b9850b8d9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295268, "uuid": "c2d6223c-ad22-4545-ab85-a5e227c88abe", "value": "12288:VY+T9415Yq10kCFxEP0wrzcZVwhkd/AUa1+YE:VYi941iqCLFxEcwvawhPtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626295268, "uuid": "33b7ea9d-9f4b-4486-8ff3-5a1f031848b0", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626295268, "uuid": "ef2f360e-f74c-4a85-a1a7-f8ad3a37891b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295268, "uuid": "a8bc0b6d-3dbd-4cbf-b4d6-edf406dc53b1", "value": "TT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb27804-e4b5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626275450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275450, "uuid": "b2db01db-4ed7-4dda-90a5-9df5a773c502", "comment": "Malware payload", "value": "7738da61d18f7da5326367f973671679", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275450, "uuid": "993513c2-b8bd-4004-9955-2211b622db2d", "comment": "Malware payload", "value": "8f15d3117f5187860694e0af3fab3f6cf30e522c273ac6209ba76ef0ff57a7b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275450, "uuid": "add896d5-d160-4c29-a74e-bd4c052c4b45", "comment": "Malware payload", "value": "245f1916634daa96ef7432c62dae291ac4002a86", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275450, "uuid": "329421da-edcd-4a14-aa13-e50ae3aab251", "comment": "Malware payload", "value": "115081564153639e82797b3aa1e8b4ec03212599ae2d0dcfed03f6f4d1786b7c6ca1112e47265321d815a5b77d9c3f43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275450, "uuid": "3e55fc16-d484-49bf-9398-238cbf39f706", "value": "T1AC55234227B99837E41216357B768A9B87B3AC154828EF7FD205BE9CB533140C3647AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275450, "uuid": "dd39433a-3ce2-4fa2-b928-1e4f8414e3aa", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275450, "uuid": "ae66ce64-d3f6-4dd8-bf81-35aab6fac6db", "value": "24576:YklijGktQy/1Z/rZfk+9iS3A/QjqOFOwbAOfC4WT4ODhgi8mcLqvJzbo:dltsh/1Z/rFHO/OFOrOfFzO/IMhbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275450, "uuid": "142b9861-e91b-4ca2-b949-e44b8857db35", "value": 1390642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275450, "uuid": "c91be0fe-0c28-44d7-a1f3-cf57e90d5e16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275450, "uuid": "c1873820-f452-415e-b983-3fd2007c1bdd", "value": "7738da61d18f7da5326367f973671679", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9c517e-e4e4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626295715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295715, "uuid": "3d6f4365-790f-4818-99dd-215f73365603", "comment": "Malware payload", "value": "27c11987229b333d298807ee040f4241", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295715, "uuid": "3805c54e-a13b-444b-9548-03dddfa6bf6c", "comment": "Malware payload", "value": "8fcc463a6e296541816cc3677b33bfed1ab3eb4507e4aec7e33a3c024aecf9d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295715, "uuid": "2b584037-82f8-43c7-bec8-2bea2eb3877a", "comment": "Malware payload", "value": "d3407609cf600b72d0e8d859f266ece922f1fe79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295715, "uuid": "d5f65efc-2855-4780-beed-820b197c271c", "comment": "Malware payload", "value": "c7426fda5c8b93ec491bd9a4e23b696e7d26d1c25ab14dac7f65b43a14058bc35799a4c17dd449f6c4f0a0b81ec570a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295715, "uuid": "7a393ef6-e57a-427f-8d38-9a4978e24787", "value": "T188B2F69979D6CA06C9C15177FB0F829A3F255398F1EF33036F122F21668796A0F66114", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295715, "uuid": "49e778b0-ea68-42a6-8299-e57ce1ea82a5", "value": "384:m/BsO0RR3cpd2/PTpfAkL5w9x+B5Xhml9AhFx4eNw7Vs6ZSE:mplYcpk/PGKGwnmliSWw7nSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626295715, "uuid": "f0af9d42-b76a-4226-9814-951c2b89886c", "value": 25576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626295715, "uuid": "5e8b933d-b7c3-46dd-b603-96767582dda1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295715, "uuid": "9574a7c8-f710-47aa-a81f-4582b762920e", "value": "27c11987229b333d298807ee040f4241", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48402e44-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626246075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246075, "uuid": "8d15b8b1-fc0a-46c0-92d8-db348383d70f", "comment": "Malware payload (AgentTesla)", "value": "340b6f638f49624fc9e05762bbc88720", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246075, "uuid": "7c547320-75de-4a97-9e56-f030d8e55275", "comment": "Malware payload (AgentTesla)", "value": "8ff56a14889028af73b94e9ae9dbf0d26b26390172d22ded0d6aab9e832ac628", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246075, "uuid": "05f4118a-1d30-450e-9e90-471a8bf5465c", "comment": "Malware payload (AgentTesla)", "value": "c3174420764eee953cce0c7091a53a84bb90abd7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246075, "uuid": "b31b0e76-7a74-4ff8-8408-f30778ef5d66", "comment": "Malware payload (AgentTesla)", "value": "6fa3e36881ca9e557520d448c6bf9fde0b1e411cc666d17c8d3abfd3b67e5a1547decfe81ca2f77fbf851cc28d566b61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246075, "uuid": "6a4bbed2-9187-4a7f-88c1-2ce71de426ac", "value": "T18905CF2723844B2BCBBE45B9B650E490F761ACABB701DE0F66C372D2596B70051D6C2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246075, "uuid": "fe9df9b1-4a87-40fe-89a0-59eb0e962f38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246075, "uuid": "f111a4cb-6bf0-41b8-ac2e-5cab04c8ab5c", "value": "12288:0dQUCG7cptxwhW6yHgI5rWyz0CRNwC/SIv4Ge+Ou9DDN0M0WaL46TFD6o:0dQUlcp/364n5fz0yNwtIwZG9DDN3lK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246075, "uuid": "d316d1ba-a75a-41f4-88cc-22c3bcd9b3e9", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246075, "uuid": "a967c775-9d28-45f2-bcac-fb03dbcdd056", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246075, "uuid": "ce96ba4d-0676-45d2-8e46-4ba21862f4c4", "value": "payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1394c342-e4b5-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626275193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275193, "uuid": "df84077d-6ee0-4593-a2ee-402bc1baa36f", "comment": "Malware payload (Loki)", "value": "e2ff5a2d8427e0c6132177f27052bbdb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275193, "uuid": "d0986e34-dc51-4610-adf1-a4e25e40f779", "comment": "Malware payload (Loki)", "value": "9078e729496a2a7b25e83d386d6ac997e128d25fad90b22864e121aa6419980b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275193, "uuid": "2fb8c304-b290-4bb2-930a-c3b7d016fe45", "comment": "Malware payload (Loki)", "value": "7784c79f97ba604b65a42f9b3d758628ea154dfe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275193, "uuid": "461bb4ed-ddc1-4925-b8a0-2e63ba908a6e", "comment": "Malware payload (Loki)", "value": "5b8942b0bcdbc18525c58c7b5230ceaba69de235e65787e3433fb646a835ffc81d56c982e7c4b023ea7c042eb9c68f84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275193, "uuid": "fdf47109-a757-4fc1-9050-b4d2fd1359f5", "value": "T188F46B2C23FEA709F237FF309F95A6449FA676A59215DD0D2DC4024B4821D42EEA7D32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275193, "uuid": "c240239a-3bbe-48f6-be38-2eafa86c65d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275193, "uuid": "d7212c89-3c54-429c-af89-1f0166358aa4", "value": "12288:tXXqW2HrNls9XOd4+QCOgmhdvUkFnG78fKi37bbMqUyF4R1CVARxAup:tXi4gwdtG78T3v+y8yPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275193, "uuid": "f24af46c-a696-4af2-9cc5-f50be69f621f", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275193, "uuid": "361c6837-49ed-4810-9c68-8503017d5ddb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275193, "uuid": "6edb9ea9-23b9-4686-8c52-b6b1d8bde9ce", "value": "e2ff5a2d8427e0c6132177f27052bbdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31cfb635-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1626246038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246038, "uuid": "675e4592-ff3f-4c62-aea7-44c25eaa7c4c", "comment": "Malware payload (AsyncRAT)", "value": "335374ebac07330d1a685238938b474f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246038, "uuid": "082864b8-ccf5-4714-8752-e8da119d9e28", "comment": "Malware payload (AsyncRAT)", "value": "90b7c5df65826a43d51d12ceb3b98d925c08d0c8211419f3052db6af57f3d517", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246038, "uuid": "80ca36fe-a77e-4e77-9999-1a2e4edd7232", "comment": "Malware payload (AsyncRAT)", "value": "d4478834f172f351f5f9805ba098dc4b5d0dfc1c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246038, "uuid": "e749f766-32ea-4e87-a8f7-63dc43d91827", "comment": "Malware payload (AsyncRAT)", "value": "f54c0bf29a5baf41bea030f7aa12531ea9be6fe203043c0512a91b1b2bc55c0c6b57887f490e7096704ff2d806d7ba58", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246038, "uuid": "8388fea2-95cb-4d40-982e-209292a3c348", "value": "T1D9E46C2C23FEA709F233FF35AFA4A6449FA666B95215DD0D2DC4024B4421D81EEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246038, "uuid": "b68c7c7d-0384-4385-ace5-ead9ee36ef3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246038, "uuid": "3271874c-2a21-4d9e-9d21-3fad86e6f956", "value": "12288:pwgPR4rNls9XOd4+QCITT9jCnrhUuGkIRt7rV8lmNrjB9nTlGOoylxrOiKSEhEuI:pw2TT9jeVlGTjKUf7bKSEhuRo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246038, "uuid": "33a5969b-78c0-4dd8-8fd5-30a3cad4a007", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246038, "uuid": "ecd516fc-43b2-47b8-b20d-90ba00b5e0bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246038, "uuid": "052a0d75-c1d8-430d-b1d3-cc6c073bed53", "value": "PO???0sEhMVX8agYEoeZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bad8bdc-e4c5-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626282266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282266, "uuid": "bbadd4b2-1e59-44a0-9739-8823c183792c", "comment": "Malware payload (RaccoonStealer)", "value": "9a122ed5dd32c372318c47d47f9e605b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282266, "uuid": "d448196f-8182-40cb-b30d-261ddad19e12", "comment": "Malware payload (RaccoonStealer)", "value": "9169cc1093e14262e9d08db10152ee815f88ed87d12bc7b934c3645d23f347ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282266, "uuid": "5aea54c6-9d1a-4171-b170-0ef464a7512a", "comment": "Malware payload (RaccoonStealer)", "value": "19bdab5071f253aacc406ddd8b09642dd69c7e7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282266, "uuid": "a3771ce5-5385-41c7-b754-681b5ae99ac2", "comment": "Malware payload (RaccoonStealer)", "value": "e83c2f81ee95436f21035761e305a81712a351045649bbcc0eb06120f3792733cff67f371fe129a0e249115cabba642d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282266, "uuid": "4960003c-a3e6-441d-be09-48977e4de498", "value": "T1BFA4BE9D761072DFD85BC8768E695C78EA11247B8B1F8203A01B15EEAE4E897CF051F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282266, "uuid": "37da4160-bb5d-4c01-bf46-149a382c22b7", "value": "12288:hS6slG7Z3MkVOj2+sS7Wv390urpfG15pIsU:M6XV8kVU2+sS7S9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626282266, "uuid": "a533a53c-ea65-4d66-89e7-5222f79d4415", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626282266, "uuid": "844c3562-5c63-4c1c-a1ef-dd561e4b243c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282266, "uuid": "79873cd4-9ecf-4aae-b713-ff7fd68d6794", "value": "9a122ed5dd32c372318c47d47f9e605b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56179025-e45b-11eb-875b-42010a9c0053", "comment": "Malware payload (Kutaki)", "timestamp": 1626236650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626236650, "uuid": "2fd93586-1e7b-4b44-b3c6-de2fb1c45089", "comment": "Malware payload (Kutaki)", "value": "2cacb86c012f9210617b71fd4497cdc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626236650, "uuid": "10ca9011-e42b-40b2-84bc-4169e4f90cab", "comment": "Malware payload (Kutaki)", "value": "920ffd770f11e6114c2f664391891d850906d71010618eba1577f247c5247d64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626236650, "uuid": "3fcf24ed-534b-4f21-904d-e7e12ab98136", "comment": "Malware payload (Kutaki)", "value": "845264902c3666d4ac8611355911ee8791dfdbd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626236650, "uuid": "d456dfb0-ac01-4738-b163-52aaf752563d", "comment": "Malware payload (Kutaki)", "value": "d3055a5790092411d9d7ca2acd71b7b3423824bd9a8031c9b5143490eeeffd0171a60c0aeeccf3bff64bb629d3174feb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626236650, "uuid": "3316ec0c-b52d-4c44-8467-911573d6bb49", "value": "T1EF350722F590A48DD9D64C70DEB1BA7A2C3D6C7614409A07B3D06E8835B26C3ADB5F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626236650, "uuid": "5dcee505-3ef4-41d1-828c-dc4abf31af8c", "value": "016ce302551cf81e7ac61a874e49da7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626236650, "uuid": "36a6bcaf-b53b-47e9-b88c-676cabfd098f", "value": "12288:XovTacfXmrXm+NPsejgmFQ84yh46A9jmP/uhu/yMS08CkntxYRC:YvTJM2+NPsezFQDfmP/UDMS08Ckn3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626236650, "uuid": "fcd20c2b-a83d-4cf8-b36f-4507885a644f", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626236650, "uuid": "c11df4c6-4489-4d84-8bca-5da4d36e5d96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626236650, "uuid": "d1373f99-106b-4d7c-8c72-16b4183a2144", "value": "RTGS Payment Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723d1686-e4e5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626295968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295968, "uuid": "aba3ef2a-476c-4373-8d84-e8128f896cea", "comment": "Malware payload", "value": "10d97303ac2177c3cd4e54c9e57a4c53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295968, "uuid": "2c171be2-dda6-44eb-a48a-cdcc324e8c39", "comment": "Malware payload", "value": "923de5fc24a860522375e93ea09e4298e5a1dfaa6a17c61754162aa3d4339bce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295968, "uuid": "a070889a-87cb-4a35-8823-f5cefc14d28e", "comment": "Malware payload", "value": "2f4fd1121786170c10e07fdab5a15aa4f8dddb00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295968, "uuid": "6a46ef06-df90-4f1f-bded-4ca0cd07e2bf", "comment": "Malware payload", "value": "f3e52c181b18fd4a1b9d99bd04c27a689fac0146c636f2e7a7010237f231c7b336873374da7bceff6a48a4b34f5492bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295968, "uuid": "82a24f23-0b9f-4e9b-8bbd-f6efffd02b27", "value": "T155741237D23060D6C05A00F55A0DE7BF99181D2076E2AC3E55D287EA8936EF76873B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295968, "uuid": "b199c0f3-e9d2-42cf-8715-ec2e60968478", "value": "c3803752167a683f3dbd2e2ab3d19b6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295968, "uuid": "698f53a9-c2bc-4bd6-b764-bcaa33ec2868", "value": "6144:IpWMSmgY0IyFpXjsCEqhp3xuo8Pr7Jjc7wPxrC:lHP7LFVst+0oA71+cC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626295968, "uuid": "c9911e47-a56d-4126-acd2-8a8d899f3e1d", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626295968, "uuid": "b73f2b70-d386-49e1-88a0-98fc18435261", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295968, "uuid": "925fc5f7-2e57-4666-bc4b-a08db8532d21", "value": "10d97303ac2177c3cd4e54c9e57a4c53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4019b3a-e4ca-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626284481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626284481, "uuid": "44c0e539-c0e0-41c6-9eff-14c18b488edd", "comment": "Malware payload", "value": "1c54dba00a0049d433c29f7eabf1b486", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626284481, "uuid": "fee1f31d-e66c-472e-bde3-689376341d5c", "comment": "Malware payload", "value": "925dbf95054df732ae3e22d9549cc9b8f9eee2fd0d05f9cc59091c197b6be637", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626284481, "uuid": "b3ad2dd6-34b0-467d-8200-804dd06a7284", "comment": "Malware payload", "value": "4b2ff00809d321e3cc3cd647c1a26b5556c5fba8", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626284481, "uuid": "7e8f30d3-8af3-461f-a170-869181e40956", "comment": "Malware payload", "value": "41e852c3eecec88f02accaa7bff3ac72f86b2429a402342da93280d74f2ad78e64d0c57fce65e6289644bf0c9f92aecd", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626284481, "uuid": "08f105e2-b251-442d-803a-49ddba04883c", "value": "T184F459E5ABA4CDB5EB01C1718C9D1A586374CC118A49AFC77255B038FF3BB798E881C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626284481, "uuid": "881b633b-cfcd-4edb-b3ee-ae9e3cfb8dcc", "value": "12288:bRYbXrlUc6XS/CwRl+4MW1H5onZHBDznxcp/c0UGtkbByxlFYd2DrpbA:UUc6EjDMW1UrDjxcNcfgZI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626284481, "uuid": "ebbb9cb6-d622-4998-871f-7e30721ab4be", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626284481, "uuid": "8198c726-0712-4444-946e-7c4efafae016", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626284481, "uuid": "3e8b44f8-de1d-4249-922e-f151e383f315", "value": "1c54dba00a0049d433c29f7eabf1b486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ab734a-e4b7-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1626276319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276319, "uuid": "b1028229-0095-4acf-8140-a36d06273a48", "comment": "Malware payload (ArkeiStealer)", "value": "047166d4c80ac20a450319ad026f691c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276319, "uuid": "28b21cc6-2269-4b85-aa9f-58b1ff1495a1", "comment": "Malware payload (ArkeiStealer)", "value": "926d7ec0b89588104045819ed00a8a950999d3b981c2260c69577b4877bb2594", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276319, "uuid": "b6737f72-a044-4f05-84e5-3b9a6aa70cfe", "comment": "Malware payload (ArkeiStealer)", "value": "d56b764edd07a4d735fa8bc263dd5a634f199c1a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276319, "uuid": "818c8e17-45fa-42dc-902d-96ea47e94f92", "comment": "Malware payload (ArkeiStealer)", "value": "a8f46beb2b427bc1bab8ac5d3d2b88c4d01249e478ddedcf0c4a5a1e0636137fc188a30bab890e93638ff8a143582d2c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276319, "uuid": "2459ff94-3014-4a3a-b030-cd58ec81c961", "value": "T1B3C402513563D636E592C5305534C7302A7BB8323AB4C98E37A427AE4E713E3D6BA31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276319, "uuid": "fc2d1582-fac3-4ee3-82ad-85f18f304698", "value": "cf8113cdf9d71dde8baf28192dd4ab3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276319, "uuid": "6a1aace3-ea3a-46f7-b5c7-4b7914c59bed", "value": "12288:8nrUXAKAjoMLsGWsFXyi8AOytXGGUNefjnHw5iWaLGOURK:ayAKAjoMLnXtykCefjHgnajuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276319, "uuid": "f344a2cc-e23f-4322-8af7-c2c5185dd52a", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276319, "uuid": "aa180712-d86c-4912-8204-71b7e22d4e51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276319, "uuid": "7bd34287-d517-4fdb-ab9f-063df688620a", "value": "047166d4c80ac20a450319ad026f691c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab110e26-e4b8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626276736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276736, "uuid": "b3839088-d684-41a2-a46a-358741232d5b", "comment": "Malware payload (Dridex)", "value": "3709783d395d27a3fc51ae2812ce98b0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276736, "uuid": "0683dfab-2b6f-4741-bb94-390edb702f09", "comment": "Malware payload (Dridex)", "value": "92bab194eb8d9e8189b184caef04bfc4e8b375ec095cd027d94a5fec73747e53", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276736, "uuid": "ca7194d1-0274-4e41-9250-b3aa773b52fe", "comment": "Malware payload (Dridex)", "value": "f5c2a4ba75990fc5e4d9b3bce249471f3e2f1c70", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276736, "uuid": "e74ae3b8-1500-4d53-b05f-438a148916c9", "comment": "Malware payload (Dridex)", "value": "271c7bd8653799f1f83da78d04e4d47edd832798443a559190b0db44a25a0f285f6a4c550a7fc7cc6caaabb3cfb63e71", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276736, "uuid": "1f733689-ab10-44fb-ad13-ab7da88b5ff6", "value": "T167F459E1ABA4CDB5EB41C1718C9D1A586374CC518A09AFC77255B038FF3BB798E881C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276736, "uuid": "4aec54ed-d10b-4f50-96a4-88ff138225ba", "value": "12288:gRYbXrlUc6XS/CwRl+4MW1H5onZHBDznxcp/c0UGtkbByxlFYd2DrpqBTq:zUc6EjDMW1UrDjxcNcfgZI2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276736, "uuid": "894a2b10-ae67-4aa4-9029-1d5247239b69", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276736, "uuid": "0d543ad4-7e24-4974-b0ab-7c5c4eff4366", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276736, "uuid": "f714f079-90a6-4169-8d92-3e2530de25e1", "value": "3709783d395d27a3fc51ae2812ce98b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc529ec-e459-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626235914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626235914, "uuid": "fc988c3b-7577-497d-8feb-ca656f1d81fa", "comment": "Malware payload (Loki)", "value": "ee7a369229dd4f5fb159c6d3c01f9106", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626235914, "uuid": "f8561218-9b13-41e8-96eb-ed3d6f6963ed", "comment": "Malware payload (Loki)", "value": "930a0bcb30b0ff7a6d150035840d6aee497044576bbd985b3437b65ea181ebd4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626235914, "uuid": "c1727491-005c-4d68-a0d1-7fbc954e112a", "comment": "Malware payload (Loki)", "value": "2801e3eed74d5b1c99071ef43ef428d79e61655e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626235914, "uuid": "1d964017-7f52-4856-8d3a-f426d50ff7b6", "comment": "Malware payload (Loki)", "value": "01352fdb715a34ab11ee808299e7f247e90aa0ed69ef66cb64f47b08a5f0957dd7ce04aeee4b94a1463c8cf8f35d40c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626235914, "uuid": "b459db7f-651a-48ea-8d3a-d16ce05a1ac4", "value": "T163C3011B32D0E4F7CBA21BB04E7E2606EBE9C10550D5578367248F8DF962E91A62F463", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626235914, "uuid": "4c2f4c03-ae93-4e12-b799-adda49682dfc", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626235914, "uuid": "2d664a96-21c6-466e-b85d-78efd5130cf8", "value": "3072:iBkfJpRXATwMdFCcGbzRPRFbdcoAgQagrV50xRdXjbHm:iqjIK1TaYpgrVudXXHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626235914, "uuid": "85c3c2c0-1aaf-4af7-91a6-47ec69e30026", "value": 127183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626235914, "uuid": "910ddc9b-124c-4862-850d-d1917bac746a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626235914, "uuid": "0246f534-10fa-4a62-b012-199d0b1311c6", "value": "ee7a369229dd4f5fb159c6d3c01f9106", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28b887d-e4a3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626267836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267836, "uuid": "71a970ef-1eef-4af1-a8f0-ee6ff93305c0", "comment": "Malware payload", "value": "01f601da6304451e0bc17cf004c97c43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267836, "uuid": "2cdc7029-557a-406c-8e61-2e065bb937f0", "comment": "Malware payload", "value": "945adada6cf6698b949359d9b395a5f905989d0d1eb84f537de492ecc1263148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267836, "uuid": "2df3af4c-447a-4873-8d80-6603b3069b8d", "comment": "Malware payload", "value": "1aa363861d1cfc45056068de0710289ebbfcb886", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267836, "uuid": "5324030e-58fb-45c2-a5cd-34a2795a1de0", "comment": "Malware payload", "value": "65cbbcf51a92d22601c62973274cf7a96ab46d92c27a61d3e36733d48b0b6437b414b00b49572417f55a5955c34be514", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267836, "uuid": "2cb70382-52b8-48bc-9073-70cac661f5ee", "value": "T1AB157B42B3D6C0B2EFA119F2C57997362939BC35533888CB73D4382DD9B06C16A7536A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267836, "uuid": "e7d16551-c626-4cca-9581-e4909f753ee6", "value": "6c272312b690db5e72b315f1bb1db5b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267836, "uuid": "b436bd83-dd8c-4d79-980d-f493fdc0b1ae", "value": "24576:Do59ch+IzJ5XcLfeaFhwG9L53KmZ0s09:D0m+2JA5amZN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626267836, "uuid": "dc0c20ce-40ac-4a85-a036-dcf1643fe79f", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626267836, "uuid": "78cf0bb8-a112-4553-a104-0558ba8dfd84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267836, "uuid": "569ffd19-c4fc-413f-9f43-2a72412b4c68", "value": "xpKkU5EF92SwjkPV", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf159d6e-e4b5-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1626275481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275481, "uuid": "4f662217-90f6-44f8-b57c-8b9324915cf5", "comment": "Malware payload (CryptBot)", "value": "856bf12bf3ecb5b5a388a0a58f99be9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275481, "uuid": "2ae09915-65c6-4353-af2b-622198ff84bc", "comment": "Malware payload (CryptBot)", "value": "949b755ce7ba4afeffe8c261141b77bca5f443761aa062936141ed94b737e848", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275481, "uuid": "467f6c25-d366-4e44-a53a-5adf0fb0d4a3", "comment": "Malware payload (CryptBot)", "value": "6b632e17a4ab106806d378f598f0904906eec1e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275481, "uuid": "3b972e72-5094-4cb9-b867-e9b866655757", "comment": "Malware payload (CryptBot)", "value": "2fad52c287d3e19e16c65e14bad763363e26bfd0f2fa4ed6d7c0bec8070eaab8b6ee0d56f8f88ffd32bb452dec726b1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275481, "uuid": "91a078b7-cf38-49c3-a133-43f9b0cd703b", "value": "T16DE412223262C173D5FB19315832FB741EBB79322634858F272CE79E5E312D21AA574B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275481, "uuid": "8c0d52cc-5d39-46b5-b972-3be5386e02ad", "value": "cf8113cdf9d71dde8baf28192dd4ab3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275481, "uuid": "e8c419ea-702c-4c65-a49e-740106e402be", "value": "12288:KGvf6wE9pHG+IN+2Rx/IngmQK+GKFGXgE1ekGpFm9:PfhEjGNX3/a3B2SgESM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275481, "uuid": "12137da8-f015-4450-b210-a8f28ff833a9", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275481, "uuid": "ea1349c3-b7fd-40d6-89ec-35a74c7260d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275481, "uuid": "683a996f-635d-4128-a13c-9bca11fdd78f", "value": "856bf12bf3ecb5b5a388a0a58f99be9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2d6356-e497-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626262514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262514, "uuid": "ec4ad1ba-5d6e-4596-83f8-31bc46de8974", "comment": "Malware payload (Loki)", "value": "41496ecf0772fb06472b37b7be9a7ec9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262514, "uuid": "b7ddb6bd-34f5-48f6-81fc-d10db9d85406", "comment": "Malware payload (Loki)", "value": "94a1e919eb41d87d67dc8de0be85ac9fe1d2cdd47aa388d1da14c98134669e4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262514, "uuid": "997e861c-3218-4f37-904e-00b41bd78ff0", "comment": "Malware payload (Loki)", "value": "841801401183a09a3ff32b474aa30b1e91d5fc22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262514, "uuid": "33eb8770-d595-44c5-acab-63bdaae3191b", "comment": "Malware payload (Loki)", "value": "d64b2a71bad49b77e470adb1331aeba0b5e86a97320610b1b2618df97072ffb62790cb131184309d1ca67bc28f8b29ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626262514, "uuid": "916822ac-8e8f-48a6-a4bc-19c3708ba3e5", "value": "T126349D2136B0D833E1E705305474C7B42A7BB8626630B58F775B2F6E6E312C1B5B6B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626262514, "uuid": "442ee7bd-d0da-40db-9123-d99ad223d3dd", "value": "86999106a45c5cfd18d93deee15bee55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626262514, "uuid": "f79798eb-865b-49ce-81be-a1774ea4e755", "value": "3072:l9AErcV6xLOtRqeGg4eA6urbToLiPRF3DP5/JpNNSV7yirI:MdV6dkHGgTAZrHoLuF3tJgJy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626262514, "uuid": "5cbf125c-2cce-4095-a93b-726b7088461a", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626262514, "uuid": "0c032e4f-9ec0-48d8-9080-0afd7084ec8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626262514, "uuid": "d3b44a5c-8be6-460e-817d-e92354cd3f75", "value": "41496ecf0772fb06472b37b7be9a7ec9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec4d00f-e46d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626244556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244556, "uuid": "88815d94-ef5f-4a8a-948a-b04ee7554d38", "comment": "Malware payload", "value": "410f43574e0f0e05d2d59f42b8a3d87a", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244556, "uuid": "d8180d53-ee0e-4f1f-b92a-bff0f8c22e86", "comment": "Malware payload", "value": "9508d3c18d753430376df4c464c4bb82991d9fc4556b3dee0a5ff77794ca9f2b", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244556, "uuid": "85920998-9925-47f7-977a-52311938f62d", "comment": "Malware payload", "value": "066f5e64acd3fe8f7395ee38563bbfa04844ea62", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626244556, "uuid": "6348c101-68fc-49e0-8be5-52ae4d0e33ef", "comment": "Malware payload", "value": "b0a41f507aea7c41e260dd6bf913792a848fb4b286f53fc196dba01f3e77cd13dca2b1f98b21a638dd4e03e975a01ddf", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244556, "uuid": "b296fb65-dd8b-4ca9-9c5a-fca132fcc968", "value": "T19945129AD9511711F7818FF82BAD6E097C180E0253542AAF351C3BBB62333FDA26341B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244556, "uuid": "3420af08-4545-4d42-972c-e8ca454a6971", "value": "24576:U4NTy52UZ57k+poTGWjxUZsrUhZTFhcjp7s4UQFJkhMK:U41NUgq2GhhTFhcJs4UGkhMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626244556, "uuid": "38b403ab-39fc-43a8-a3d0-21491190a6cc", "value": 1190712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626244556, "uuid": "6e71c04b-8271-4374-84e1-18ddc157f6b8", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626244556, "uuid": "a734aa62-c075-45de-8f79-e69c5b06c527", "value": "Quotation 2000051165 .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbc3649-e4e5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626295957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295957, "uuid": "5df7cc6c-649a-46e9-9273-4738ef8eff20", "comment": "Malware payload", "value": "7d018423023461e09eb3b64b961092dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295957, "uuid": "7e37eef1-1a4d-422c-9866-bef7b802fa76", "comment": "Malware payload", "value": "956e66f820c127b655c4e59af455c4cc827d43b111f4cf260b6da1d30ac443b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295957, "uuid": "5c0786f2-7e8f-4a17-904e-359c82009da8", "comment": "Malware payload", "value": "73173c8c64e63ad659dc174bd4c06de5ec041179", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295957, "uuid": "8b529fba-006d-4f75-89c2-6bddffdf4697", "comment": "Malware payload", "value": "c197c35b3ff355963dbcd0f5b983e679409d748b4251bf551cd92568c5344c076fddd7a3b4f2c14ebb03175021eba74a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295957, "uuid": "be39dcae-59cb-4b2a-bc94-5be8e77db9b9", "value": "T16A741237D23060D6C05A00F55A0DE7BF9A181D2076E2AC3E55D287EA8936EF76873727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295957, "uuid": "c700ca30-d5b5-4c82-a8b8-5b69ac8f1938", "value": "c3803752167a683f3dbd2e2ab3d19b6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295957, "uuid": "65658904-62ac-4e87-bbb7-0ff4643ef49b", "value": "6144:vpWMSmgY0IyFpXjsCEqhp3xuo8Pr7Jjc7wPx5C:kHP7LFVst+0oA71+KC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626295957, "uuid": "62655cfc-1994-4d7a-866f-00868b5fa78d", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626295957, "uuid": "1f1516d4-7acf-497f-93bf-17b2020d815a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295957, "uuid": "fe16c950-6dd4-4faa-87d5-426c183bcde4", "value": "7d018423023461e09eb3b64b961092dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17afe37-e475-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626248024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248024, "uuid": "f269cc25-d130-4998-9456-a9d8792e8a71", "comment": "Malware payload", "value": "febf3dcb2f56cee778a4af805d56b609", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248024, "uuid": "872ff37b-22e8-4743-a67a-9346fc818097", "comment": "Malware payload", "value": "957b5c4b6e7f052c6f07e1235760237c42ddddcfb1672cfdeba66aedde97f215", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248024, "uuid": "56edc53e-3a08-436c-a03f-0b5c27488a5c", "comment": "Malware payload", "value": "c24f54a3dda7e6f0a7a05a164625b2ee0d42c8b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248024, "uuid": "0278da77-8e1a-4085-ab52-fca79857ee1b", "comment": "Malware payload", "value": "46bd3e82fb64abbb198f095ab005c88bfb68908f327356ba56c0bb6db8caed718f7eaec5706500fc374218df51e10578", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248024, "uuid": "6871c66f-ef6c-4cc8-8f9c-57347891a7dd", "value": "T194D2E1A3A15E46E8C52BB2F71AFF7A6E1C21600D5124E995EFCC127A4803F657E19313", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248024, "uuid": "e21e6dd8-d308-49b1-8527-4ef2fbcfa493", "value": "768:D83mwMT2YcfsARHP1dIEPAkXnbcuyD7UryqG:g3mw3fsARHtmEokXnouy8mqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626248024, "uuid": "ef160634-8849-4929-ac92-dfe96b9402f8", "value": 29068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626248024, "uuid": "5d23e8ad-96a6-4e32-bdca-637d8c1d2669", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248024, "uuid": "9af63ced-10e8-4241-8611-84c3018bbde4", "value": "febf3dcb2f56cee778a4af805d56b609", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f76aa3-e4b6-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626275977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275977, "uuid": "f5843c50-7175-447b-be6a-5cae72a019d1", "comment": "Malware payload (TrickBot)", "value": "790eef2cd2b527c7350aa2f6800de31c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275977, "uuid": "c6484571-03d0-41c6-8e9f-aa35a536c262", "comment": "Malware payload (TrickBot)", "value": "970fe530e3eaa88b4ae4e9cfff4d911874ab45c7e8026522d89a8f97632a5726", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275977, "uuid": "8584948e-a52e-4728-9d27-5a7a11d3815e", "comment": "Malware payload (TrickBot)", "value": "87b15ed63220b199b72737eaf1d744300aefa34d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275977, "uuid": "dae1574d-752c-44c3-b305-f66d93106265", "comment": "Malware payload (TrickBot)", "value": "ed9684bafaf225b257ed1157da8c0373fc0ec2eed3cc73faae00051253b20e9356511ad5d3250684f88858c87ebd4757", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275977, "uuid": "3e2ac4fa-56e2-4ea0-8840-569209c4d964", "value": "T14805BF12FEC19835E1AA1175CD36CFEC12A87E70FEE0862B6B847F5E6E32041B934655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275977, "uuid": "d42e6df5-4bcd-432d-afb9-7d6a73bf60ab", "value": "a9b6c26936cbed29ffdd5c3c54f9fb9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275977, "uuid": "def28d36-5279-4ca8-803e-31d0fd922e8a", "value": "12288:Uq01h69yRiu1fctxoF+/o8qZPUvuTh2rS/IIsrb+msgaa+Wnw:Uq0syMu1CxoEo8nuSRbfsgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275977, "uuid": "f5e3bf32-15ed-4347-9a45-d7653396b1fd", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275977, "uuid": "e9b7f9f8-43c4-4e2c-bb33-4f278a123bd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275977, "uuid": "ea64d054-9608-46f7-82e0-d193f2b2e6bf", "value": "790eef2cd2b527c7350aa2f6800de31c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecd2052-e472-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626246650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246650, "uuid": "1687984f-9b60-4f63-a4fc-2abe82982196", "comment": "Malware payload (SnakeKeylogger)", "value": "7b64447413e8a310f3f1c3a59906037f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246650, "uuid": "18aba2b0-fe5d-49b5-b827-ccb0d7e502d7", "comment": "Malware payload (SnakeKeylogger)", "value": "97c3aa0cc8d19f8b56a41a00ca49375deb5172bded57237614ddd50a15341537", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246650, "uuid": "b6c63773-6bbb-4969-8554-7ef16205b284", "comment": "Malware payload (SnakeKeylogger)", "value": "925be841d0a92d1dbd309547de3f99c0a3345867", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246650, "uuid": "33bbdd9a-cb99-450f-995b-8c19262742a3", "comment": "Malware payload (SnakeKeylogger)", "value": "2efa1087e9272e81f2c7607f389a2bd7a96428de26a419ec54292674292e72015132ce8c5aefa3a7c0a9c18d62cd128b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246650, "uuid": "08ef1c91-0285-4236-bede-8898b2ad67e4", "value": "T10BE4CF273388472BCB7E42B9B650E481F761ACAB7701EE0F5AC361D6557B30094DAD2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246650, "uuid": "321a6deb-3709-431c-833e-c591137a76f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246650, "uuid": "8d8dc47d-19a2-4cf1-9870-4a6c24a98ef5", "value": "12288:NpQUCQ83Te3kRyr0og6y5k/xz/dHpIKlilWZ3eUgD:NpQUnvIoD/1dHphiK3SD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246650, "uuid": "b6e919bb-fd21-4565-9ddc-6b623cfd2977", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246650, "uuid": "f570ebb4-2e7d-4214-bee7-0d4611c51660", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246650, "uuid": "75846f48-620a-4b1b-8685-97e7208b8002", "value": "7b64447413e8a310f3f1c3a59906037f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91f3b74-e4c8-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626283738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626283738, "uuid": "805592ec-c613-4db3-986d-d99cdbc5b493", "comment": "Malware payload (RaccoonStealer)", "value": "a0dc5d0a89b720a4336892ca394a77fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626283738, "uuid": "5ce2251c-0d4e-4f8d-b16c-38bcb222ffc4", "comment": "Malware payload (RaccoonStealer)", "value": "97c558bcbdaf21258e91098900d19e1ba944379a779a6a7c57aec46ea3de5438", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626283738, "uuid": "d10b5838-2e64-4df8-96e2-4ae68c6b002e", "comment": "Malware payload (RaccoonStealer)", "value": "91c090fa542a3a67f1031d1ed60fa21f1df1d009", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626283738, "uuid": "1fc2ddf0-1dea-432a-b5d7-5f52a0f13f87", "comment": "Malware payload (RaccoonStealer)", "value": "6423d97a4ca27c5d3b5f35b1b5fb654f53e9f500e111102f5ab6084a460c5944168413ac77f325f27281681d0b068abb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626283738, "uuid": "46ede4a2-788e-499d-b98c-51838ab000fc", "value": "T1CAA4AE9D762072DFC96BC8769EA96C64EB51247B531F9203A01325EEAE0D897CF140F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626283738, "uuid": "6f78a9da-6ade-4b07-82e9-2b29f7d84bbf", "value": "12288:KS6slG7Z3MkVOj2+sS7Wv390urpfG15pIs:F6XV8kVU2+sS7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626283738, "uuid": "5077e17f-004d-48b6-adef-a5726df5b0c9", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626283738, "uuid": "ae041ec2-a676-475b-811b-a39927c602db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626283738, "uuid": "9bb80cdf-7e3c-4db8-9c9c-426eaf58dfbf", "value": "a0dc5d0a89b720a4336892ca394a77fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3f9136-e44a-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626229468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626229468, "uuid": "aee7a2bf-0d5e-4637-97b6-bf0a27041952", "comment": "Malware payload (Mirai)", "value": "1f0c51938b59b9da5cf9eff12c725f77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626229468, "uuid": "93cb600b-bde0-474b-993c-169fca4a4ff7", "comment": "Malware payload (Mirai)", "value": "9809fd904e5fe3c46f99400cc283f886c6a3ba2f69e888fb36138817175cb9bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626229468, "uuid": "36fa916d-1df0-4e03-a89b-88639ed4335b", "comment": "Malware payload (Mirai)", "value": "80dcf008515e7fdb3d1d95b26fa633fd506a6551", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626229468, "uuid": "465a841c-a04f-4f75-bca5-7a2fb62365c3", "comment": "Malware payload (Mirai)", "value": "c4ae31ea88bec4f00eefbf10535c8af44ec3dc5da97042f0134823141623722ea13833d6392e562cb952ba43d0f92785", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626229468, "uuid": "bc8eb2ab-5a72-4572-a071-61057406ba80", "value": "T135233B42722C0A47D5A25EB0393F0BE093FFE99020F4B5886A5F9B468635F775186F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626229468, "uuid": "8d7b4cc9-b5bf-4931-ac15-95f966460987", "value": "768:46DWbJ8V0Wc1qbkC+yuvRsGQBCnfw0X5zF7UXKARVdUPvEXIZSG:jDNiWc1qbkAgbru5sMXEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626229468, "uuid": "37e2f399-6ea1-48fc-b9d5-aa4ddc4905af", "value": 47124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626229468, "uuid": "a3b2ffbf-72cb-45a5-8156-fe14b3019a98", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626229468, "uuid": "71f603cc-72a7-4dc0-b760-aeab9713fbfd", "value": "1f0c51938b59b9da5cf9eff12c725f77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296e5849-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626246024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246024, "uuid": "c4c4c33d-c6ce-4b5d-87a8-8caf4cb8960b", "comment": "Malware payload (AgentTesla)", "value": "00f6bd1bfebe19501ee0fd4e5ab1d076", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246024, "uuid": "bfc161c6-1f07-4efb-a4ef-17ecd72bfaa4", "comment": "Malware payload (AgentTesla)", "value": "990808bb3d292b3d571aca85e77a275e8411c4fea252a1af7bf67ea760958a6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246024, "uuid": "598eb150-c160-482c-9f9f-f23aec5d4ae1", "comment": "Malware payload (AgentTesla)", "value": "48031ad16e5778e640d7f3dfc6fde563510e8fb2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246024, "uuid": "91526316-2df9-4f3b-8e47-cf079ac4fef7", "comment": "Malware payload (AgentTesla)", "value": "44f3c89daf0689b54b5d832a6e1e1c8064bb95f88403dc8cf71411cb311c58b0fd363e030277f044d4e17989debf1db1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246024, "uuid": "5ec286b6-875d-4f17-a336-60d6996febdb", "value": "T165159D6C23FDA649F633FF31AFA4E7449FA66AB952159C0D19C4020B5831C81BEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246024, "uuid": "78f59564-c5b8-4bd0-9bdb-ecf0ab353b05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246024, "uuid": "c3766e82-d967-4278-8784-6947bc86595a", "value": "24576:VhEtS1aLRalQ/K78fpKfcrbJR/bs+HSh9:VhIScLRC7igfs/I+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246024, "uuid": "671a6dd9-3eb5-49c2-99cb-8e18f7e35870", "value": 879616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246024, "uuid": "99ae26eb-5db1-424e-8832-6eecb8e28d86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246024, "uuid": "27d02469-907d-4222-9409-845efa97476b", "value": "REMITTANCE COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a626db24-e49e-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626265560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626265560, "uuid": "17b28108-6c46-46a4-b780-2263b70dd4e7", "comment": "Malware payload (SnakeKeylogger)", "value": "1b5a3c776365ee36631a3a4360f6c449", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626265560, "uuid": "e01a8a52-a769-4df7-a66a-dc49e5bd060d", "comment": "Malware payload (SnakeKeylogger)", "value": "9951d9f054be7e8c7b662ce9c2fc30b5aaf61bdc8482d7fd6e4464e4923540af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626265560, "uuid": "7be54e37-40c8-44a4-b59d-5107e3c2ac5f", "comment": "Malware payload (SnakeKeylogger)", "value": "017ea4869dca50a8b4a86f5bed9868608c189e25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626265560, "uuid": "ab9a9b71-2da5-4ec7-b084-d062170ccdf3", "comment": "Malware payload (SnakeKeylogger)", "value": "162276bccd7778d51e286a49a9e6bab22b8b1aaaa8d7de92cab0bb195ea3f62c0d6c6c0386cfc9ed14ce0261f767667b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626265560, "uuid": "cc57f1cb-a1aa-4964-b2e8-41e64e72e6dc", "value": "T1E9F402663785BB4EC5BECD7984521C10A7E0E7739303E3836CE326ED56CD6A58E222D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626265560, "uuid": "d17c80e4-9aaa-423b-a6aa-23d15097281d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626265560, "uuid": "e90d9223-2f75-46bd-ab81-c57439ed16c6", "value": "12288:7b8/LggF/ChSgxpPkHMkHmM4T3OkFGbsQUx+C/CpxHrya6adtFFlv7:76ggFChSgrkHMkHD4zOkIbAgryCtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626265560, "uuid": "31b93b70-628a-482c-9a9f-2c93f256a4ee", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626265560, "uuid": "069d4b59-a062-4240-a557-1d5f2024f787", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626265560, "uuid": "fa56c633-1742-4c78-9712-9d58685bf161", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0add74ac-e477-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626248549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248549, "uuid": "e9c23448-4a4a-4636-996d-a97bf8533301", "comment": "Malware payload (Formbook)", "value": "3732463cdb2a4f37302ef8a871ab385a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248549, "uuid": "ab5bbf73-ddba-4564-8a5f-a8305b357b57", "comment": "Malware payload (Formbook)", "value": "99e69a8f20885bef44503976b29f58ae65f5737bf2948da5d04fd873c70634a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248549, "uuid": "af50505b-6efb-43ae-b6c6-5c9afa82f387", "comment": "Malware payload (Formbook)", "value": "9ea95edde42ac75ccc174fbb99912ce252991d79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248549, "uuid": "3920fee7-482c-4786-970a-9c12ab97fee9", "comment": "Malware payload (Formbook)", "value": "c2b9bd84ad420528093bd4d8850a5fe1febb88d660238a8a3d92fda126bd2c9e35b28339da70865c0685a635db5f25e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248549, "uuid": "6df707c3-ead1-4972-85d2-72f4233905f8", "value": "T1E8057D72A363C83ADCB216788D0BB2519834EB10152C98CF6AD5EDBCEF752F17625352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248549, "uuid": "9108d41c-7204-4eb4-ad13-243aeaffbfad", "value": "81b44cc9bb38ca599d2bb46a023cd8f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248549, "uuid": "e34df91c-fab2-4ae7-a437-9cf0537869b9", "value": "12288:PXjVVvgR6lgIdw67J0/BVEULCi/FKGI9isgfDeuUtttttttttttttttttttttttX:PXjfrR+6dwJLxsr9isgfKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626248549, "uuid": "edb0d9e1-43c0-4f49-8262-3468d4d9ad28", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626248549, "uuid": "2d594616-6316-43f7-9139-fa6b54afe1b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248549, "uuid": "9cffbd20-2e62-4e13-b409-bf2cff2a14d1", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a38887-e4e8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626297232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626297232, "uuid": "278bc702-dce9-4ee2-9749-ab267c45a30e", "comment": "Malware payload", "value": "69a5989be7d6620acef59ec0de98ad33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626297232, "uuid": "93baf151-1384-4973-9627-f5cf4f2f2a84", "comment": "Malware payload", "value": "9a6416a860176c5f6c05c0db553b68c123d59cb7cb6882295d03a7d0e9e3d340", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626297232, "uuid": "d40f2a97-404b-41af-b950-0c0a5088e65f", "comment": "Malware payload", "value": "a2c34d1ce423bb0f48af9cdfeec530ffcddc77c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626297232, "uuid": "e22bae43-ebf6-49f9-b08a-4556e770cd6b", "comment": "Malware payload", "value": "f84174dbf7e79772ff35e0af60316ffae8e31f1bab713a82dd0683f1f604cf74fc8d3c12175064367ec8920e173a03ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626297232, "uuid": "5aff6f92-befd-422a-976e-3f87c41c14e9", "value": "T147E24B35BE62186FC4C85E7A55E74725B6F6434F38F88A3B3C220E9CBF04A447253669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626297232, "uuid": "b267cbef-b19a-49a9-977c-a261bcb51042", "value": "384:OGHQmVI7tBJ3aXoOCZM4P8IFU+pMqdY9HlMaGACqqzjDw:OwQmVI7l33FNO+uKaGACqqzjDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626297232, "uuid": "dac5001f-32e0-40af-8857-5ebf367205eb", "value": 32920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626297232, "uuid": "3c61e632-bc0f-4d6d-bcf6-07806568c090", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626297232, "uuid": "06009795-5c30-4167-99ee-abbd7262f746", "value": "69a5989be7d6620acef59ec0de98ad33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59af1d61-e4bd-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626278746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278746, "uuid": "31bfc623-0af3-402b-b14c-d3b212cda2f9", "comment": "Malware payload (Loki)", "value": "969dc0e8ad27cea25942f67697e5928a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278746, "uuid": "d7585185-0f30-4625-a2d4-314134e82a86", "comment": "Malware payload (Loki)", "value": "9acaa69ad3457d20b0cccc0bf6c8d6fd144d4299b620353321e6d5ed9271d1c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278746, "uuid": "bc8c961a-75da-486b-93b2-7c833fc81d71", "comment": "Malware payload (Loki)", "value": "a07141686b1ec119ad5df88630a7e1838aae5656", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278746, "uuid": "c1288638-2ae2-4fc8-b432-9595a8d39ea4", "comment": "Malware payload (Loki)", "value": "049da20debe9028d92cc9bad90bfc976ea93cf9c23b119194709ff526133906b927af069bff82b6a17cc60665b205654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278746, "uuid": "7078e125-13be-45ad-8bb8-4f75c1a25650", "value": "T19DF4F1223785FB4EC53A8D7640A16C1063E0EFB68307E787ACE335E965EE7954B31582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278746, "uuid": "ae734412-3133-42e7-a4ed-451a7f2f3077", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278746, "uuid": "b1cca17f-d3aa-4e41-8f99-500e7f1f5b41", "value": "12288:IJuk1sxw06MJHzrSbwmBkLFtEBW/cuZC4LThlQHwBjQqCNH:uFmwhMZ3WwmBskBocuZjlQQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626278746, "uuid": "186f01a5-d091-48a5-92b1-ebae9a67526b", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626278746, "uuid": "c299696a-6dff-4b36-a4a1-21c6e35fb361", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278746, "uuid": "f3a326f7-e0a0-4205-a313-98aa172db7a4", "value": "Order request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fc64b0-e4bf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626279785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279785, "uuid": "a724d218-cca9-42e1-b452-36ab4bc061dd", "comment": "Malware payload", "value": "3c21cccff5c8aabf1977f2dbdaeaafe7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279785, "uuid": "f431000b-90d3-4c71-9432-a88964d261af", "comment": "Malware payload", "value": "9af4b3b8c67d21fef69dee132cb686d1cb9e34e2d5e807b05c2a92e48f08dd39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279785, "uuid": "eaa12ae8-2239-4219-8f48-0e33ff05d25a", "comment": "Malware payload", "value": "88ae2ed9e9ceeba5cf578c994e1b2493bfddd112", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279785, "uuid": "e7a0a013-fe71-4bfe-994f-649b29877b43", "comment": "Malware payload", "value": "f1389f906a3f9f9418b5d53089297f2101124413136552939de91d5bc60553cbcd33e243ee9e62702054faca186b3ff4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279785, "uuid": "1ea57433-db88-411c-84fe-dd0c33355805", "value": "T12B741237D23060D6C05A00F55A0DE7BF9A181D2076E2AC3E55D287EA8936EF76873727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279785, "uuid": "0fc840ed-bda1-48fd-9d5d-a4ba716b8ee2", "value": "c3803752167a683f3dbd2e2ab3d19b6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279785, "uuid": "a89fb0e7-fefe-49fb-98f0-f41554c43be7", "value": "6144:OpWMSmgY0IyFpXjsCEqhp3xuo8Pr7Jjc7wPxyC:/HP7LFVst+0oA71+FC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626279785, "uuid": "032a066b-09de-49e1-acb5-adeef96d84ac", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626279785, "uuid": "6b6352d4-2b32-4b05-bec0-db6cc64bc971", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279785, "uuid": "1efd4b3f-4d91-480d-b7e5-1f688c29e0e5", "value": "3c21cccff5c8aabf1977f2dbdaeaafe7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9bcac3-e436-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626220962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626220962, "uuid": "7f91285c-ad9c-4bdc-b748-81c376dcb793", "comment": "Malware payload (Mirai)", "value": "64ef27722e4b503801514dd97c077576", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626220962, "uuid": "b509bae5-d2bc-4c97-88e4-60ed66a8652a", "comment": "Malware payload (Mirai)", "value": "9b11a98aa8510e54bdb58c608e3719c39d9bc0c3359a231300d7cf0774ca5be6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626220962, "uuid": "211713cb-2d5d-4ae9-8962-e0bd8edff2d6", "comment": "Malware payload (Mirai)", "value": "3ffc1ee6594f37b79e482e14210f7d4789de4242", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626220962, "uuid": "ac265f14-0048-4868-a277-6d7a158a33c2", "comment": "Malware payload (Mirai)", "value": "73c2da4f32dad7d3ccf62f4af22c3ca58dc76ed8747bfd587556035f354cece19e7076cdce5d6bbc3ded97da77268974", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626220962, "uuid": "94710ed7-8690-4dd9-bbc8-02d541682256", "value": "T188832881BC40A626C7C1177BFE5F018E331657D8E2EA33079C295F607ACB95B0D67A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626220962, "uuid": "3f565bf8-43ce-42fd-8442-4d9c4113149d", "value": "1536:Zj+gO8c+C02qGK0Ok2xAsjBNFqleSeZ0++KiqQRKAwHq7vtI:Zjzbc+ue5NUlpwhiqJJyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626220962, "uuid": "fba70479-b57a-4735-8cbf-ef59163e3d8f", "value": 87352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626220962, "uuid": "d7897f5e-1609-42bf-a3c0-fa9b532d79f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626220962, "uuid": "b3e7d5de-ed2a-4c2e-a690-4b40c54ffa7e", "value": "64ef27722e4b503801514dd97c077576", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4890fe4c-e4bd-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626278718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278718, "uuid": "9658f536-7a11-46c4-a0c7-732fbf1c42dc", "comment": "Malware payload (SnakeKeylogger)", "value": "1fc683f57c93b41775d87eb8bc9560b2", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tbz", "colour": "#802FEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278718, "uuid": "33192d54-0cfc-46a4-b453-e9191bfdb4a9", "comment": "Malware payload (SnakeKeylogger)", "value": "9b5cc2d63a8ca39fa9acc9808a71b380baf4f316baea714619870b9244c480df", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tbz", "colour": "#802FEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278718, "uuid": "c17d668c-8b8c-429b-805f-d577dea64808", "comment": "Malware payload (SnakeKeylogger)", "value": "0df6181c8b45a6fd5397a4fdd4a435d66e80c218", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tbz", "colour": "#802FEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626278718, "uuid": "b66038ee-022f-4c1b-b824-d8769d0d7da3", "comment": "Malware payload (SnakeKeylogger)", "value": "fbfdb40d0ff8d013f4a0610c76e4b1bba5097310a2d2a708716849899dc3f8af535b511f097d6b3ca6de336972c5e68d", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tbz", "colour": "#802FEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278718, "uuid": "fa580db5-0a69-4121-b301-066ffd92a48b", "value": "T146A423A3D448DF6EC434793A6CBF6E61E0273235173EC6B65D252600BDA5736B8F0161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278718, "uuid": "130c0d6a-dc93-468d-8395-9b88eba16904", "value": "12288:+iF8WK2AQ+JpY+S6QCvVKL8beQWshaZCpyFvWCWsM6oLB:+imJW+S6QSbGsECpiWsM9LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626278718, "uuid": "aa8f4e3f-3360-4b54-943a-cebcd5fc1aa4", "value": 473708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626278718, "uuid": "31b2398e-a857-46c6-96cb-3ca85c73967f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626278718, "uuid": "10657488-f3c2-4576-80be-dcef8c23736f", "value": "New Order Requests 15162006-RFQ.tbz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742d38bf-e477-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626248726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248726, "uuid": "58796808-876d-4ee0-a9e6-554f4cbc8649", "comment": "Malware payload (AgentTesla)", "value": "b438134488cf9604481ada4b971e8f09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248726, "uuid": "2e180ff6-3724-45da-be42-6313d6f5de10", "comment": "Malware payload (AgentTesla)", "value": "9b66d2992c738c868070ed76ed68fa0aaf5c7fe6c2848408939f7face641f35a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248726, "uuid": "7884acde-1650-4ce8-ad84-59e6f54321fb", "comment": "Malware payload (AgentTesla)", "value": "dc5e0a70a90ea94c5a907887402213622038ae56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248726, "uuid": "ae1f10ee-7b84-4749-91a2-83359c6baec7", "comment": "Malware payload (AgentTesla)", "value": "df2b6e2df222f3107742863293844778632d4eaad529a0b516cfb16984f9fec1cb8ac6722df8dd6c38e7fad1446d85aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248726, "uuid": "978a1882-eb2d-40dd-bfd4-da982f2d5a1f", "value": "T17E158D2C23FEA109F237FF749FA0F3859F66667A9229914E1DC4420B5861C81FE76931", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248726, "uuid": "79d504c0-6d0f-4a23-9a6a-e7203f68f0c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248726, "uuid": "93f0b5ca-ae9b-4740-9705-82793556c0ba", "value": "12288:yaEmH4Hey5wrVFknQ2g9+8jhJjLeiGeA2dNYv5o4Q69vzs/0DZleS49RhwXN5Gnc:yxxHfwRWQV88jDjLevCdw5rQk7h1Q9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626248726, "uuid": "5cfe2e38-5938-467e-8f71-97f9c015d33c", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626248726, "uuid": "cb68ffc5-ff93-4099-93e2-2e8d9c23c1cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248726, "uuid": "03a3a64d-8aac-468f-94ba-18f1ba451399", "value": "MBK - SO# 0231860.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1019790-e4a3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626267753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267753, "uuid": "390f1fb5-a771-4739-b1e8-11c2a933d260", "comment": "Malware payload (Mirai)", "value": "6fcfa2492ac431e7bc6d41b5bc613c0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267753, "uuid": "7aa805be-892a-433d-aba0-35cf6e105859", "comment": "Malware payload (Mirai)", "value": "9b74dff20bfa0a7fc3e6a57bcaa279327dbc5078bfa93fffa55cd2ec5e522945", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267753, "uuid": "3247cfba-0106-460c-b29a-aa81813107ff", "comment": "Malware payload (Mirai)", "value": "fc8158d7e5a7cffb4b2c799992c3abe26cfa344e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267753, "uuid": "fc433c2a-7658-471c-95f5-3b7668e53bdf", "comment": "Malware payload (Mirai)", "value": "3299a95e56c9c92610f60cba336beb40675587f4923f2d80cfa12d5b8482514e13b0444004d27f266b9a165ef8126a72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267753, "uuid": "6edced2a-9480-4b9b-8b83-4c1788f906c3", "value": "T16263A506BF214FF7DCAFDD3749A91B05258C640B21A97B397E34D828F64A24F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267753, "uuid": "cc35c7dc-7f16-4efb-ada8-a1cc460ce21a", "value": "768:QxNCJ0EYlDYhHnrwqsFDwLX3U6ngBhN6PNUpGXS5SyeweVKe0n3oNWpkmPqXitMF:QxNCJBYlZFwwjhwPTXSNxIKzn6CpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626267753, "uuid": "9b3944db-0fac-4f69-8368-2275bd2fb843", "value": 71528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626267753, "uuid": "9869162b-d9d1-43bf-ac47-4b88168ce0d9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267753, "uuid": "cb26ec1a-0bb6-44b9-b063-96c9cff4492b", "value": "6fcfa2492ac431e7bc6d41b5bc613c0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5527d3-e496-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626262217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262217, "uuid": "cf969ff1-20b5-41ef-83f2-668aa86214b9", "comment": "Malware payload (AgentTesla)", "value": "aac7c97fb12a8fbf245d90b74ae2801e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262217, "uuid": "d05da185-bd71-4def-b149-4b1605e06bcc", "comment": "Malware payload (AgentTesla)", "value": "9b99e2125412baa8aaf718d761f20fad628d2b19a60bc456c0a19d84d913f656", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262217, "uuid": "47ae6dc8-ad24-4b72-8c9c-490fda872eba", "comment": "Malware payload (AgentTesla)", "value": "254c76721f3d312310a7e85d8622c0fa5a24b120", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626262217, "uuid": "52ed1a47-b2fa-4331-af05-55a9094cbc5d", "comment": "Malware payload (AgentTesla)", "value": "addcfa594445d01489cc942d9b7892667feb5a23fed869e87bc65def2a985eca5dff47c42599b989f5a2a15f40890a92", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626262217, "uuid": "34d2946f-c0ed-4991-a054-55f7273079ed", "value": "T152F46A3966552A27E737D2B84A514044F2BD9CDB3631EDD74AC3358A313FA022ED632E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626262217, "uuid": "f4971680-b04b-40af-9422-cd24a9f1610d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626262217, "uuid": "1aa44025-7ce9-403e-be8f-369da1d22fac", "value": "12288:hmh8EKlXgFxY3wBeTW60p0qZv708J1vbUbvR9xn1kkUVdK/U3ooHiMJ:hmpzZD4vzx1kRduJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626262217, "uuid": "96dd356e-9749-42c9-a19b-264731c4b7d2", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626262217, "uuid": "2c767c35-d1fe-45d5-b610-d7db54ef88ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626262217, "uuid": "78db2c64-6eb1-49a1-9b3a-2d2417d51e2f", "value": "UAE banks and Turkey banks..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a81927-e473-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626246964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246964, "uuid": "a0f20593-4832-4dcb-a40e-31dea76792f5", "comment": "Malware payload (NanoCore)", "value": "edc8596873b2e1481a6135e7b1238c3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246964, "uuid": "a6baf773-9dc3-461d-a81e-7792582d444a", "comment": "Malware payload (NanoCore)", "value": "9be859e3cabd6c8e0772cec1b89f95269649a0939cc44358939ab2a669bcef11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246964, "uuid": "e525a729-26af-444c-a610-c904b573f6c9", "comment": "Malware payload (NanoCore)", "value": "0dff44ab06051f4034afdfd92fff94a6baef154b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246964, "uuid": "2cee2da2-6925-4980-b929-7c7adc7d5e7a", "comment": "Malware payload (NanoCore)", "value": "a08875e488f86aef51530c49f90eb37a8d60cf967d2330f802783c0fcc1b9aa26e716f02293f46437290e4f78db14278", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246964, "uuid": "ba4f00f9-bf28-4c0e-aa48-7e3542f4de3c", "value": "T173F4DF9C365076DFC81BC9768A942C24AA20BC7B570BD243A45336ACAE4DAD7CF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246964, "uuid": "25e70afd-2a82-4140-8998-23c08c00e6cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246964, "uuid": "b0763311-071b-44f0-a641-31707638620f", "value": "12288:PLgs+xmxXgnqa2n9idFR1/LtYHSZtvjdMVG3VwTGMExPtAxnBYjztbCCP6lnMJWU:DgeLDoPRPiMljCsVwiXPtAxB0Zr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246964, "uuid": "35e0e44c-442e-49f0-b421-0b002802fa89", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246964, "uuid": "0931e57e-ad1e-4e9f-918e-ea7363f131ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246964, "uuid": "4ba14a9d-7359-4539-930a-7f903588c388", "value": "PO- SOHME202162312.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f742a60-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626246007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246007, "uuid": "863b498d-c014-4d7a-82cd-6cc6dcdaaef5", "comment": "Malware payload (AgentTesla)", "value": "17322f8b77dda95932f0309419252e57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246007, "uuid": "93a7730d-89db-4ca1-a754-77065fdbfcdc", "comment": "Malware payload (AgentTesla)", "value": "9c9a46794e95fd68fca94f44894192571216f1fceabc5f1a6a33ea4ccddcef59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246007, "uuid": "daaeb16f-47ed-4ba6-8986-441872a42c93", "comment": "Malware payload (AgentTesla)", "value": "0d61a1f2d9ff76478ba6293a69f2c1a4213cfa22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246007, "uuid": "fa958b92-3b75-4c0c-ba7f-5a6ca18d1b39", "comment": "Malware payload (AgentTesla)", "value": "8dccdefd547b2eb9e1aac53e6db90559b28e72acdd5700cecec9e3ff7432b8aa89ba8e8eb7ed86becb2978d13d9b8a72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246007, "uuid": "ff5ae24f-f183-4fac-94bc-b3f55f657576", "value": "T1F8156C22E3C046DBCB7D02F97DB0B288FA585C7A66109D8B3FD23185657B62114BED1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246007, "uuid": "83ebfc09-7cfc-4dd5-9238-99b4d38e96b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246007, "uuid": "1e014e01-2ad2-4b16-badf-0232a2923f20", "value": "12288:QXQUCG/6MY4WekfQKlRzcz4kqW/RPEr3mlgRrD1Ko8qh:QXQUZS34GkqAEr3qgRrI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246007, "uuid": "c0bda402-3428-4c82-8f54-f619882d96d1", "value": 927744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246007, "uuid": "a84476c3-252e-41be-91d7-2a15587f447a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246007, "uuid": "a7e6d5fb-288c-43a1-aa82-2ae037bf2829", "value": "VsC4Ouvd2LIF66W.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f3e50e-e4e1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626294142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294142, "uuid": "959ac0bc-b840-4935-986b-486a21839086", "comment": "Malware payload", "value": "d33bd917d5420e16157fa94bad66eed7", "object_relation": "md5", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294142, "uuid": "7a861e14-dc3f-4070-b105-1e3fa9da84b2", "comment": "Malware payload", "value": "9d941be63812c1b2be63a0bd33a8d8a84842ff19220f626039f783c2ef2e747e", "object_relation": "sha256", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294142, "uuid": "74b48d3d-4e3f-4776-8066-144e0e9222c6", "comment": "Malware payload", "value": "13eec3f0cf1ce7f61c09f12143b0e235712447a5", "object_relation": "sha1", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294142, "uuid": "24280727-b4c9-4f1d-8897-95fccda71212", "comment": "Malware payload", "value": "79436bbf3696258f814aa45b49a2dcbb4f32000d461d343d396603f478fe54bf9649b71856fa1e3af758a9d09d2d912f", "object_relation": "sha3-384", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626294142, "uuid": "d72f52d9-7caf-4aaa-9552-365f0fda8bcd", "value": "T1D0F4DFA19EFBA2DDF1F3523A8879087E7512BA675C2C1544EBF105C14FEE1129FA6320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626294142, "uuid": "f5ffcf9e-2a2a-4e34-b48a-9e45de865c30", "value": "d65b30dd8c9856808552250c7cfb0efa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626294142, "uuid": "9c298d24-e2ca-4dae-b193-76f92c4a98ca", "value": "12288:oXBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJ:iB/Qn0rbD8UZUDtgIiemI51Mwtewkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626294142, "uuid": "d1945843-a62e-468d-bc6d-20d57d9e7440", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626294142, "uuid": "02a169b6-8fc3-457a-a55b-f6273d444cd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626294142, "uuid": "6457a74e-1e7c-4257-939c-79dda0527752", "value": "OLEACC.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21d925a-e49a-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626263862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626263862, "uuid": "c6ac4e67-a85b-49ab-b75a-6696b143d189", "comment": "Malware payload (Mirai)", "value": "4d1b9e4a3fc17d6ccfab84b3149a62f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626263862, "uuid": "68b53860-9f78-4f88-afc7-3000109095e1", "comment": "Malware payload (Mirai)", "value": "9deb51651bc7c64cecf93593b14a6405ff5b0239f3e0ebbdb36b7682c1a48a6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626263862, "uuid": "7870cb1a-aa61-45dc-8afb-a6c355d022b5", "comment": "Malware payload (Mirai)", "value": "dd9e2071c095106092ecf301d0e20c4df7f2fd28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626263862, "uuid": "b4bd0820-ba9b-472e-b752-beab40fb345f", "comment": "Malware payload (Mirai)", "value": "f3d80ade787c1e067e1efb8aa015980b0b0e78aad7570aa8158254f328a13247025fc9f81419568631ffbbfd5cb29294", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626263862, "uuid": "62d672af-0536-4808-beff-91877ce86711", "value": "T13AD2F1BE270304BAE92BC07D2D522B501D312E9BB817EDA69519C2FDC9630D95843EE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626263862, "uuid": "e0997328-b017-4302-99be-f7b06edf0eb4", "value": "768:71hwakqz7JJfp8cn5QSytK9DE0ldqnLJgGlzDpbuR1J9:71zd7J5pf51MK9XqnBVJuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626263862, "uuid": "4be7847b-ba76-42c2-bb1f-4e777aea293d", "value": 29008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626263862, "uuid": "ca609aad-5ef6-4a30-b025-6dc16d702dd9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626263862, "uuid": "955cfbc6-9537-432b-a566-718a643216ae", "value": "SecuriteInfo.com.Linux.Mirai.3982.15996.26800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a096d562-e493-11eb-875b-42010a9c0053", "comment": "Malware payload (FluBot)", "timestamp": 1626260827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626260827, "uuid": "68f6cdde-df7c-4b7e-88d9-7539978c6e82", "comment": "Malware payload (FluBot)", "value": "6410a472bd0c90fa069bfacf10cdc840", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626260827, "uuid": "7efbb6f0-d236-480c-89d3-1c5e7b2ceab8", "comment": "Malware payload (FluBot)", "value": "9f41dff89cd49eadea3d1e3b98b58402b9cda6b54eebc62a371568b5a607d849", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626260827, "uuid": "dbedb350-8be0-40b1-87e4-c364d5339cb7", "comment": "Malware payload (FluBot)", "value": "1a822e7e3f915353b723009c47b981048c847210", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626260827, "uuid": "fb49675b-b06a-42bf-8735-20800bdaf239", "comment": "Malware payload (FluBot)", "value": "5f7bbd0f897d6720ff2864acb8477b3382cda12a87fddcacf38cde619145346dd35f7db94c4bb75109b34654b4c6cf06", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626260827, "uuid": "18c9f8b2-e8ff-4ab7-8bff-2910b8e09a42", "value": "T1A9E52295FF9EE417C00BD8398164D5879848844C8B48FB5BAA3E939C0AF6D44A743EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626260827, "uuid": "42c11c86-b5aa-41dd-a59a-b72ba9d09d10", "value": "49152:LL/veGrKNkHSvYAgYY9cKQHPfZc7DI1SSNwXQ89O4kgzfimGR0IVw36vY5:LLbKqyvYAtqLCHZcnX9XNKgzqmHIA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626260827, "uuid": "42b04fc4-0535-4b55-9ec1-1648cde22793", "value": 3154878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626260827, "uuid": "88a6771f-4857-4ec6-85e5-c3bb6a6692dd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626260827, "uuid": "9750bb9c-d8ad-4540-b50e-78cf4a61b842", "value": "9f41dff89cd49eadea3d1e3b98b58402b9cda6b54eebc62a371568b5a607d849.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797524dd-e4b7-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626276223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276223, "uuid": "a11e8023-02a3-4bf9-abeb-b5f4663cc1ea", "comment": "Malware payload (Smoke Loader)", "value": "a4161a7e4be5c841d10cf69cb0fb15a1", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276223, "uuid": "ef147d92-0a1e-4a9d-aed8-8934dee0e3f4", "comment": "Malware payload (Smoke Loader)", "value": "9f42f0539f682f13af0c8da768e854d2bd2d547047caf431b7e5136f6955f81d", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276223, "uuid": "4a0cebe3-63f6-4e46-bcca-59071568178d", "comment": "Malware payload (Smoke Loader)", "value": "9557c3c06c44ca1a5583ac531c8b36882b922c29", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276223, "uuid": "191c2125-2f0a-42c9-81e6-0b7a356ea5cc", "comment": "Malware payload (Smoke Loader)", "value": "df3cfbb95742432c1481fb495ace1d19392850ad0e25bd7582d733ec1044f910d10cc271fa6e27206c1a1a00d57956c5", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276223, "uuid": "3ab10540-7af2-4c27-898f-68371080354e", "value": "T19C149D2132E8D432D6E70630187496A02B3BF9F3E6BD854F3B54176E5F312D19AA634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276223, "uuid": "3a7d3abb-f3e7-4f33-aff9-1e912a11fe51", "value": "cf8113cdf9d71dde8baf28192dd4ab3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276223, "uuid": "1f2f2e35-64d6-4ae9-b60c-a4265e3cc888", "value": "3072:TBNmGGhUsvJYXq+AuTWPAZvDS0m5opRPgikHB+I:dLLsfNuC4ZbSkpRPCAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276223, "uuid": "b3d64dd8-7d0c-4b5c-89c0-c9d9c1c008f8", "value": 194560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276223, "uuid": "ec3c6e96-5ed9-4c25-b7df-49c128010c1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276223, "uuid": "6acf85dc-e388-49b9-82aa-d112f4cf7be1", "value": "a4161a7e4be5c841d10cf69cb0fb15a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2a5a73-e4b8-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626276764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276764, "uuid": "c3e988c8-8082-4fde-838c-bdc14b3873c2", "comment": "Malware payload (RedLineStealer)", "value": "bb2515ad581954d501a1692e5bce1499", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276764, "uuid": "339f6913-2c60-42bc-8801-cdc27bbb0bac", "comment": "Malware payload (RedLineStealer)", "value": "9fe9b2f35c467177077ddb809213375fb68a0e0136b1752c75457f33b30ecb96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276764, "uuid": "584f0342-bcc1-40f3-a4ae-cee6dcbf8e64", "comment": "Malware payload (RedLineStealer)", "value": "26e31968f7b3ffdb0adc8aeb1f35bc0cb45514be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276764, "uuid": "5835e6b2-f3b1-4d82-8852-cf3c5258af14", "comment": "Malware payload (RedLineStealer)", "value": "64e299c1b3616703eb1bedc772a5db584d276c05ca824bc16eac3941d60692ac88a938681645ae5fa618d4a4e4747f72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276764, "uuid": "0cd6fe84-707e-425d-90f7-1465edfbb1ce", "value": "T137F3B02633A7C472C1C42230E461CB3B2364CD1707B5B247B5CAAEA7BD6B64D59BC6E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276764, "uuid": "8007d458-006a-47bf-8681-67c89cc79bde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276764, "uuid": "dd08d8b1-91a6-44c3-86d4-22c5cd3edb7b", "value": "3072:OwKLFuleMBloAFc+D2gbk+jBg/FIhTdi43u:OwK5uljBlVcC2YVm/Fci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276764, "uuid": "959dd773-15e9-4131-bdb1-e54f7b0a48e1", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276764, "uuid": "3e4095df-6448-4a31-b3b8-de71de5be3f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276764, "uuid": "d8c56b62-cbc2-4828-ae41-1a09bd763632", "value": "bb2515ad581954d501a1692e5bce1499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1546172b-e4be-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626279061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279061, "uuid": "46c637ba-accd-4377-bbe0-6ada2f62bf08", "comment": "Malware payload (Dridex)", "value": "ea91555829c1dfdfd47709496461c5d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279061, "uuid": "9d0aae00-b9c3-45b6-bfcd-473bf9e5a2a1", "comment": "Malware payload (Dridex)", "value": "9ffe349bfcaac3ceffbbb5accf85814b0e08d204a02b63a9df9681235a464ecc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279061, "uuid": "6ef9ab22-bcbe-41ad-8f8d-bf2e147afcf4", "comment": "Malware payload (Dridex)", "value": "801a1c4ab318d6e7168208315991e68cf9991a09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279061, "uuid": "1c0fdf0d-f4e7-425a-a2f1-5938583a280b", "comment": "Malware payload (Dridex)", "value": "1b1c83b4f7ea2bfe7f33c6bb66c53d9df43b18564a94a12a96f2b2099f0832ac54065539f60c54fc2ddcb334b531b16f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279061, "uuid": "caec2db0-1d05-4506-9bb4-88c2db298a43", "value": "T15DF3023272AB6AFAE276FD72065F9931273160480308DA6F77119F86D95E0A34C6FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279061, "uuid": "a37c6075-2189-46e9-9442-f09219b666ed", "value": "e9cbee8358b331a128409a4d26e3e347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279061, "uuid": "b9688edc-7535-4fcc-9cf1-2f6f5fc5d268", "value": "3072:hWiJzQu5JD9ko9WY1wzxWrPAEN87L5cWlvsRwmhnxONgkf:hLquAkPAE+X5WncNgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626279061, "uuid": "571971f1-4309-459e-8646-49ae7d99ff66", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626279061, "uuid": "6a0c0829-fd50-410b-93a5-161866a90729", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279061, "uuid": "b081e6fb-504b-4865-9b61-02bb320457a6", "value": "ea91555829c1dfdfd47709496461c5d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0a02be-e44e-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626231236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626231236, "uuid": "5f9de956-39e4-4a10-b3b8-55a9a0b4762d", "comment": "Malware payload (Mirai)", "value": "1099542d17cc6d6f9ffc856e5d74b4fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626231236, "uuid": "79c3e248-f954-43ae-b65c-0ef5c7091f5b", "comment": "Malware payload (Mirai)", "value": "a0204776b1fc72d9b5e1fc91671340eadf6078b1ba9b18dda68d12eb2b8852a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626231236, "uuid": "90314119-1038-4088-9f05-bb1ac5c34697", "comment": "Malware payload (Mirai)", "value": "6173ce074e37948e8814a301f009237643a3705d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626231236, "uuid": "b47f9452-f8d8-4769-9fe2-ade365e933b9", "comment": "Malware payload (Mirai)", "value": "5faea069e760c480503e1aad4be3adfab196e2201bd44df09cb379eb43f407df9683c770e9f902c78b84837705657566", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626231236, "uuid": "a1affcf0-9595-4d0a-a7db-0692aa587a3a", "value": "T1A0430952BC818A05C5D412BAFE2E11CE33176768E2DF72139D106F247BCA92F0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626231236, "uuid": "94dbe753-8065-4cbf-a09a-21d82a25ec7c", "value": "1536:ZVn8PuSSfuHJEbia9VMGArKGR4x7ZL1Ixi+5QgKW1:KkfsmiGVMj3RL5QgKW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626231236, "uuid": "29b3cf0a-eede-4095-be09-1fc543a0efd7", "value": 59664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626231236, "uuid": "7c20aa21-32eb-4ec2-98db-ea6ac25c0cdd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626231236, "uuid": "8158edb7-6699-4325-9e81-42d175b03e02", "value": "1099542d17cc6d6f9ffc856e5d74b4fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d058183-e479-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626249412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626249412, "uuid": "55cdf111-3c12-428c-b43e-fb3c14c86bd3", "comment": "Malware payload (AgentTesla)", "value": "dfbea52971dd914dbb99ebc555ca1185", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626249412, "uuid": "35430e3c-fe06-480e-aea8-39fc17afcf50", "comment": "Malware payload (AgentTesla)", "value": "a13aa55c0d5b2430e323779a04803693508cc6a5b028b4a1a79ece20d2a2e618", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626249412, "uuid": "bcde7b82-7017-4090-af51-ee4fae0d13a6", "comment": "Malware payload (AgentTesla)", "value": "fd342303681c9c0587a660d27e804d3f5e517d17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626249412, "uuid": "a3d29fe6-5780-44ad-8f40-6c0640c1b040", "comment": "Malware payload (AgentTesla)", "value": "7e06cc7852bbc578475bbe20efdcb18f6434e6b62e5f05ae0aa777fbf9ac6e72eeab38fa0b8c56891c20fcd597de66a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626249412, "uuid": "e46217e9-5705-4341-9f04-219ad067b18e", "value": "T163257B8936306C9EC91288359D649C30F721EC63178796E370973DBBB9FD6869E043B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626249412, "uuid": "65d865ff-c123-41fd-a53b-03195f8b033a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626249412, "uuid": "b9bc0526-d84c-4de8-a977-def6a707aa84", "value": "12288:t89g4ACq8zeCcIKUCQLvM0O/UK5ZHXX01ghkA5yEgm7xTjvvAmkE41bgAlRjIppV:t89BagXI0LvM0OW1fA5ymV3vXw0Al/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626249412, "uuid": "a2843396-4345-44a7-ab7a-f8f15383ce2f", "value": 972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626249412, "uuid": "92eaecc9-84e6-417b-8ad7-6b25258aafab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626249412, "uuid": "327544a4-5ebd-472b-a36b-b4e76e6094d2", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6383504f-e4ab-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626271032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271032, "uuid": "fe510162-47fe-4ff8-bc7d-4706b70a9690", "comment": "Malware payload", "value": "3b5b0ea521c586b6790cb8d922166dd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271032, "uuid": "17be7872-7cee-44d7-9668-946cf4cc739d", "comment": "Malware payload", "value": "a239ac87d4d44907d0006e5d401fac3512d89a5210b448e800e02ba8e777b2d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271032, "uuid": "023ce933-57c0-4b65-b597-8100e3859b08", "comment": "Malware payload", "value": "c13d6c98f9141dea886588315fc4f67147f99951", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271032, "uuid": "ee32e416-de4d-4078-8054-a295ceac6dfa", "comment": "Malware payload", "value": "1cb74bcd7ce7b6c64af231a2494efa0d87bd01b0174132f69c39f72caef067ec2e64c4acfe8ba56dabed7c59a580b8a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271032, "uuid": "32db9448-cf2b-4afa-b8ce-25a5cfb77a8f", "value": "T11BA4BD7B47DC0A27C7BE92B5BAA0F406FB9088933B10DE0F47C761C5556BA0225C6D6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271032, "uuid": "95089476-e717-452d-b6d5-daa378e0cfa1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271032, "uuid": "048be5e1-16dd-4e3e-8016-f8b229c3192d", "value": "6144:E7WIzCysrlxy2yzfwEaLKiy3rV4xpHm8aNcU4YkBoy2IxeRSZ9Uy+0AixF:E7WQClBK7ky3r0ZmHN8YI0Ix3UmAi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626271032, "uuid": "41a7143e-121a-4114-8da8-9730bbcfe6fd", "value": 456192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626271032, "uuid": "1df0bf0d-78ee-478b-824c-a0d8bfbb2ec2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271032, "uuid": "a7721774-d36f-44f8-be2b-7f0df439b11e", "value": "3EA9kMBedh511d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fbbb34e-e469-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626242786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242786, "uuid": "e5d4f761-4c09-40ac-b43e-55346455444f", "comment": "Malware payload (Loki)", "value": "d7c9f4fb14fb9617855dcc7aa08a028b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242786, "uuid": "4ddbf79a-1a6f-4afd-8a55-31e7770f2756", "comment": "Malware payload (Loki)", "value": "a391385c673fd95c6f8d770f49aace5fa6e8512eb35c5178c504b5d51cc3864f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242786, "uuid": "5e2172b2-1470-46ae-9256-5ab311d00482", "comment": "Malware payload (Loki)", "value": "ebc8255d3e714ac9b7f8d5a986a851950bb41753", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242786, "uuid": "20902d24-9dc6-4e6f-8f73-a94bcabb684a", "comment": "Malware payload (Loki)", "value": "47951ca4183f7b37d3e6382e036c3a3fc9a05a263d3f4ac4def8e62356dec85f5be8e4789e552e240c9828f7d615f48d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242786, "uuid": "404a7269-f415-41e1-a269-74204fe9ed62", "value": "T19A35F12129E5A415F3B6AF754EE0B6A99A7F7F732F02C40E2891328E5733B41CC5153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242786, "uuid": "6900bd50-4050-497e-9c4a-978f3186976d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242786, "uuid": "252bbf5d-9217-4992-b4bd-be21625f5b7a", "value": "24576:VobAaMd3/EebAaMd3fPKamna6mSA4bHcdmg8YvLew:uAaMV/E2AaMVfmnnmSDemgbvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626242786, "uuid": "7ab1754f-379d-43de-a9bf-9933bdc51574", "value": 1133056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626242786, "uuid": "312e8bb3-0c49-42cb-9ec1-967c095facf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242786, "uuid": "99eca7f1-638c-41f6-beac-07994bf1e815", "value": "datos bancarios y factura.pdf_______________________________________________.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c06aa7b-e477-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626248793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248793, "uuid": "7d9b10b5-8661-4130-bc0d-37b98175d5ad", "comment": "Malware payload (Mirai)", "value": "5fcd40166a3b6b9af6228b5aebc4e0e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248793, "uuid": "c0376065-394c-4f15-b8af-0f8db8c4e5df", "comment": "Malware payload (Mirai)", "value": "a4fff72ea3ce0ea017515286bacd496c36f5ed916e276a0becb7d517437ed493", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248793, "uuid": "f278228e-315e-4cf3-bd23-8f0079dcfc59", "comment": "Malware payload (Mirai)", "value": "50ace7d8340ba5d9f24c0022c68c9671373dc26d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248793, "uuid": "8d46476d-ba08-4beb-b19f-3cd954fc248b", "comment": "Malware payload (Mirai)", "value": "c49c34890ebb62430c467422eba362bd2633f1e86c3b2b01d613771fa36813e147a384a7d6554d3d8a49bf50fb825d3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248793, "uuid": "74fb6fb3-69c8-4a59-8e04-d276a7f6b275", "value": "T1FDB2D0727425F8B2C7A200B79DE9DB83BB801EF8D0E873291469099DA6D5C42AAF1547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248793, "uuid": "1b50858b-28bb-4793-b053-526a7e19560e", "value": "384:tZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3p7hymdGUop5hV:QX9nxn8o9wnBoWzEQf2EjKb3p7s3Uozf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626248793, "uuid": "1113dd78-1151-4c89-bd4d-7d37c42ab7d0", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626248793, "uuid": "a05cf6c9-91c9-470c-ab9c-3d1cfc2ca6be", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248793, "uuid": "ce825ff1-8dc1-412d-9613-677661680bcd", "value": "5fcd40166a3b6b9af6228b5aebc4e0e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9233887d-e4ad-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626271969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271969, "uuid": "94e12b09-2882-4b97-9822-c7209edc5830", "comment": "Malware payload", "value": "6e43430011784cff369ea5a5ae4b000f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271969, "uuid": "43acdf9f-41fd-49b2-9112-6347af274338", "comment": "Malware payload", "value": "a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271969, "uuid": "e30b9bd5-7be3-4ba3-ae21-9f1ddf90c0a1", "comment": "Malware payload", "value": "5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626271969, "uuid": "09725b61-63eb-4a0c-b60f-637b1253bda6", "comment": "Malware payload", "value": "b6e366cd49990fe695135c40f560ab9a7b1165ad979c67fbcc887bc741c11179d6da2226ef98041d8c4220f8244ad3a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271969, "uuid": "69abe719-1530-43cf-86e1-ab8b5b1d99f3", "value": "T151F41200B5E1C062E9AF5E3015B4DA963F3D3A554FF08D5B2B646A6A1C713D0AF3CE29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271969, "uuid": "a35dac2e-8859-4146-b59e-11e089c6167e", "value": "385b4c734448931d8105f2b8af2a40a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271969, "uuid": "9209928a-d395-4cb9-b2e4-373ea6b2e0bc", "value": "12288:CcXe9SLN+NH0khUZY+vcvw15G8QYewwB9gL1xB3iJZcaFh:CcO2Q2ZYuIoel9gLHB3yZcaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626271969, "uuid": "cfd7b3d5-47ca-4ae0-8267-5fd8c14df367", "value": 729724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626271969, "uuid": "0b3e3981-b20b-474d-afaf-24639807aabf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626271969, "uuid": "540b2ecc-9247-480e-9f88-b38fee507b61", "value": "sahiba_1.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a9d93a-e494-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626261179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626261179, "uuid": "5e3ec4b7-43fe-41fb-9310-7ad9f8d6feae", "comment": "Malware payload", "value": "06728e03a423984c9e43a21ad6d47101", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626261179, "uuid": "80ee6513-d992-4be2-8b12-f731c8796b2e", "comment": "Malware payload", "value": "a5b4e38ce934a7b8f7611f07a535658c4c297038517eff51ad3cdb81ed0d8be4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626261179, "uuid": "c9ac7ffc-cbeb-450f-a9cf-0f3ecdbf1676", "comment": "Malware payload", "value": "222fcc5b88f5cd559c6637512b7c2f0a01a4c979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626261179, "uuid": "75223b94-aaf3-402c-8c02-87c6d6b8f013", "comment": "Malware payload", "value": "454b007f179c4ab8260a286195f49c5148210e48a07c019858d8b535c62d50de3cf6d9373f0c2720b55e56100668bae8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626261179, "uuid": "0be7668d-8239-42c2-a943-eeb552e1abae", "value": "T1D3F501B75228024DD0E5DCBA4B37BEE132F5072F9E827D745AAE7CC168520E4B217D92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626261179, "uuid": "fa31ad94-6a28-45dc-a85f-068e204ca536", "value": "390a9025379785411b4d78282e53583b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626261179, "uuid": "8477476f-7730-4856-ae2a-d6f621e33ad9", "value": "49152:3F/Jnhv6rVMBWRapUzxRqrhiZLtKdcsxUL7nUufPRHN7rsVfvA:3FJI5MBVez/qrhiZLuCL7nUeZBrsRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626261179, "uuid": "00276077-05d4-4966-a005-17f53cefe6f3", "value": 3593216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626261179, "uuid": "808e6ab9-7e83-4266-8531-6c4129e66474", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626261179, "uuid": "52df9611-ac3f-4088-a340-7764f060729f", "value": "browershelper.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470a6223-e468-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626242208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242208, "uuid": "d56d7ea4-6b47-4e7b-b6a0-a3cc2a260aa3", "comment": "Malware payload (Formbook)", "value": "9e2f228029738210cb89504393113f02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242208, "uuid": "aa4b8b86-1b6b-4dd7-8686-ab28c62ebbf3", "comment": "Malware payload (Formbook)", "value": "a62281360a594e22783fb5dfc0e34645726b22df9ae0939b56a5b41e51289f97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242208, "uuid": "33421437-67e9-4867-b5cc-d477817abb67", "comment": "Malware payload (Formbook)", "value": "47b2dcfae34251772a5dbde9e381cceaf80063e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242208, "uuid": "e9b81b44-c860-4fdc-be4a-eacf5984d79f", "comment": "Malware payload (Formbook)", "value": "d8d694b4e831b8efdf0bcfb9a8537be001c4a24bad550b215138abffc3d6c4b3613f61a03dcb3d023c5b234fd0bb06cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242208, "uuid": "41abd16c-daeb-4858-a261-d57b950704ca", "value": "T115057C6823FE6709F637FF316FA0A6445FA67AB95225DC0D2CC4124B4832D81ADA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242208, "uuid": "3f4333ff-e667-46dc-b122-ccba372b87b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242208, "uuid": "1abbd8bb-da57-467c-a49b-136d8b2e54e9", "value": "12288:tl55FbrNls9XOd4+QCd88G16O8c0Tz0vXrmUJSVxgbZvU6cYRUjRRFnfiwxJ9Q1E:tlhzKg2XKxgbZIYRqRFnXxJ9Q1QM4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626242208, "uuid": "575542d1-85fb-4572-b56e-8294dd68220a", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626242208, "uuid": "672d110e-82c8-49fb-ba44-1e48b692c496", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242208, "uuid": "86ba264c-867e-4b67-9718-e7cad8d1f094", "value": "ULnsMhkLMmFISmk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dcd2346-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626245977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245977, "uuid": "51a1b003-f52d-4e1a-b312-3b471c9bc882", "comment": "Malware payload (AgentTesla)", "value": "47f2cddfe733e354a66d614a2801722f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245977, "uuid": "4b96f178-b9f2-449a-9f02-4e96461f2807", "comment": "Malware payload (AgentTesla)", "value": "a86ceafd644403dcfb2bc1ac61e70f465afb1df22685f5139a8f1eeeb0c8640b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245977, "uuid": "2f8950cc-c5c7-406e-a8ca-7ff19cacf089", "comment": "Malware payload (AgentTesla)", "value": "a55f9b4757cc737d4cb66ee30577c2ecf520d250", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245977, "uuid": "b65d3e5f-2164-43f7-a1f3-d6c19e67447b", "comment": "Malware payload (AgentTesla)", "value": "d37f5ba240a312eda3a71368bc263f1facc6904e97b3c9b31c5026861d6e51dc88c223188e6a1f85f5b0a5a6700504c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245977, "uuid": "f69dd99c-a12f-4476-ab33-12e07c87e2c1", "value": "T1A4F4CF3723884B27CBBE41BAB651E491F761ACABB701DE0F5AC372D2452B70150D6D2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245977, "uuid": "70c7af0e-e5aa-4f4f-938c-1462cde60c6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245977, "uuid": "c32d7a6a-14a3-4755-9da6-c9b991a96e0d", "value": "12288:sXQUCGPwNUSF7/emvvKCxT7JszBDPzgyNZL/3+26XsF4/:sXQUtwNUSFqPCxT+vlZLBWo4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626245977, "uuid": "9312d6fb-efdc-435b-95bb-a9a6cc853a05", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626245977, "uuid": "817b51f8-f412-42d4-a008-1137176ce8c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245977, "uuid": "ab6addbe-0bd1-4022-bf7e-1135ddd2bd51", "value": "Proforma Invoice CINV2021000000000231 TRN #100038927800003 remittance swift copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5689bcad-e49b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626264138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264138, "uuid": "83c850df-3b14-4d5d-b78d-129d561e8f9c", "comment": "Malware payload (AgentTesla)", "value": "5505179cd699659f83e26933d114b041", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264138, "uuid": "020d0401-bb03-4198-887e-df0b9a9069cd", "comment": "Malware payload (AgentTesla)", "value": "a8f660af5a534e485b3921fbf08308b423e21e24006c0d479673afa93f0e0a67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264138, "uuid": "2fbfb691-9d01-4201-bc3c-b1186b906065", "comment": "Malware payload (AgentTesla)", "value": "670f955f45cbe738b9728c7c09d5af2a94b79ff3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264138, "uuid": "1c5ab864-48f2-443d-81fc-0f33f8585b96", "comment": "Malware payload (AgentTesla)", "value": "408e730376992b927423088207f90e71dea833120142ac5bfe2ac44dc72e4f1e69144fffcf12ec4f5878dfe68895a706", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626264138, "uuid": "e5107bdf-c327-4ffe-81fa-e6fe3373f06e", "value": "T1E3159D2C23FEA509F237FF71AFA0F2859F66667A9229914D1DC4020B5861D80FE77931", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626264138, "uuid": "e96f08de-4c8c-4c51-b7b2-bb33389014f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626264138, "uuid": "6120c288-a19c-49d6-b683-3ef9be5f7490", "value": "24576:xmIKAfwLcS4I28WYpGT2uw6pAaJvdH3k:4IKAYLLl/Sq63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626264138, "uuid": "67d8c905-72ee-4763-a92a-29881d5b1d47", "value": 929280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626264138, "uuid": "c72eb535-d266-4386-92e8-9d7b2ba6c626", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626264138, "uuid": "61136ae7-84f7-4296-bf8a-82bc60f6937c", "value": "5505179cd699659f83e26933d114b041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be60790-e4a9-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1626270053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270053, "uuid": "4931ba12-2278-4ebd-bf2a-184783d4f8af", "comment": "Malware payload (DCRat)", "value": "ee26949c4c945a20569abddbaa487709", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270053, "uuid": "8f34d032-5e81-4f48-9259-0c71111b3afa", "comment": "Malware payload (DCRat)", "value": "a9d6aa7ef3fde33eb2df6b9c3ec92965f066049cacba533ffc09a877133b809e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270053, "uuid": "4d8b4f75-13b5-4643-b127-9c9babdab51b", "comment": "Malware payload (DCRat)", "value": "f8cc243ccf026fcf2cfb58361f1eaca93338e0ee", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270053, "uuid": "bc080819-e758-4bc9-ac98-0223cde32f47", "comment": "Malware payload (DCRat)", "value": "f72a1ce8bc87bd16d106a7af89cb36dfe09ff158d1efb846bd04650fa6e5b2d0a114111b4939f5d2c264c4ece77e301b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270053, "uuid": "c11ee286-5b9a-4204-b8d6-cd864dfca07d", "value": "T132852383EBC7B8B6D983263004A9B30A9CF7DF25171146CBAB1C1415DD362DDEA3E191", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270053, "uuid": "b9d8c81f-0658-4ab7-9882-a23ed5619aae", "value": "a1a66d588dcf1394354ebf6ec400c223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270053, "uuid": "83aeaf0b-49db-4632-80a1-391229d07f9c", "value": "49152:q5+hFutsk4BKFY1nxQIah2V+IROY4aal//+9h8DpoJW:q5aFZktVIRb4aal/G9iJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626270053, "uuid": "0135077f-7ed8-4ac7-961f-5d721a2ddbc9", "value": 1779634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626270053, "uuid": "9a00c0cc-e6b6-4246-bc13-e062f0f27a9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270053, "uuid": "6fd2ad5d-c606-4b65-82e4-e3f93f168c63", "value": "EE26949C4C945A20569ABDDBAA487709.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96d1c26-e4e0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626293993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626293993, "uuid": "09cf5e1e-241c-470c-a1fb-cbacf5fd96af", "comment": "Malware payload", "value": "a3f97b5cc3e49515010a186a56172b78", "object_relation": "md5", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626293993, "uuid": "1da99f5f-78b6-49ce-833b-5c311c3be059", "comment": "Malware payload", "value": "aaf2fc168d40d3cb6ceca9a96a6aa61cb7a76afe08724bbfcd18d279098d6bfd", "object_relation": "sha256", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626293993, "uuid": "4b946998-da31-4899-aa7a-bad5d9615ce9", "comment": "Malware payload", "value": "fb9ad2292b8ff1ef422fa6dd51fef6129216eea6", "object_relation": "sha1", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626293993, "uuid": "d366dc75-c58d-43cc-a823-502f19fc063d", "comment": "Malware payload", "value": "d3016df41dc78065588576a9cf8fc23ef796ac9b89724f1bd1e214e1c4e6e9c5a3f2e26f235e33ad5f81bab71ce84854", "object_relation": "sha3-384", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626293993, "uuid": "3aae7a57-538e-420b-af6a-e4308248596c", "value": "T140F4DFA59EFBA2DDE1F3523A8839087E75127A676C2C2444EBF105C14FFE1129F66720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626293993, "uuid": "2e0adef3-b8d2-43e4-b3b1-e9ac4ec4e6bf", "value": "d65b30dd8c9856808552250c7cfb0efa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626293993, "uuid": "132abf8c-ca0b-4347-bffa-e8d4fcc22a7a", "value": "12288:pXBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJu:lB/Qn0rbD8UZUDtgIiemI51Mwtewkmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626293993, "uuid": "41a167b2-1cfa-4a71-96eb-80f9d4fe6ec5", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626293993, "uuid": "95132d67-8e99-4d20-8b70-9e95cc13f71e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626293993, "uuid": "65327263-2e8c-4a61-a9ad-bf04bbfdc9fa", "value": "MFC42u.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a6b036-e4b0-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1626273420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626273420, "uuid": "ec1a7e62-cc31-4bc9-a56d-09aad122c05e", "comment": "Malware payload (ArkeiStealer)", "value": "7dc04c099e434e8d7128094ca400683e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626273420, "uuid": "545ffab7-3b6f-4786-b271-d8b09e8d7d03", "comment": "Malware payload (ArkeiStealer)", "value": "ab8d377d550ebae841ab75d2d6257fb38960efc049037bbd2468483871897e5d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626273420, "uuid": "8f1377fa-ce5a-4909-a086-c6aa7d037209", "comment": "Malware payload (ArkeiStealer)", "value": "efca4dad94bd2e73b785caaca9f44c46843ee704", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626273420, "uuid": "91c69813-230f-440c-aa4b-2132c4dd6114", "comment": "Malware payload (ArkeiStealer)", "value": "4f9bd862e3bedf92900d74251849118ea40f769ea7c8f424fc46eb0d3995a48c242a043f39b97207c57eac45debd36be", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626273420, "uuid": "97ccc690-6c1b-4b90-b918-22961029bae4", "value": "T16F16F04122F04211FEC4A7A5EE7D3B9B0AAB3F833501C97E5974218D28A1AD55EEF347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626273420, "uuid": "45d0e277-6b1a-4314-82e0-ff6b943be2d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626273420, "uuid": "ddf4525b-54d8-4574-936d-f927abfa6561", "value": "98304:GhER59YPBX9Qv8X61pJFWR+oTrd9kLNUPeLGMSn1jjYSWI:5R3weu6lFWRNZOLNUPec1j05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626273420, "uuid": "34d3c5e0-0138-43f5-a5e6-8ebd693053fb", "value": 4408832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626273420, "uuid": "41546e3c-50cf-4a13-8435-5cafe637a580", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626273420, "uuid": "5f4857eb-92e3-4074-84e2-641cdca07028", "value": "Bear_Vpn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4594b614-e4e6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626296322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296322, "uuid": "3caf2549-5bf9-4e6e-b919-61ced80713b7", "comment": "Malware payload", "value": "2b14fc50dc0a34e20227188361632651", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296322, "uuid": "0e7a0f22-eee2-408f-8f91-4e9900306bf2", "comment": "Malware payload", "value": "abd3fb464cbd52f7e90764ce618719324e254e98481e42db2ebd21f151a6783d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296322, "uuid": "e1172dfa-9196-4629-98d5-545d6c3c5961", "comment": "Malware payload", "value": "9f23640dda674102084e09348e672312d8a9709b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296322, "uuid": "fd954213-fc98-4f08-9691-16d8872a40a5", "comment": "Malware payload", "value": "b582c634bfdf3d0e3c1072ab5ae171c29636fbe8b33563aaf2d5293f40ba46ca8552f6169f779102949a72956fa6f9f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626296322, "uuid": "554544b6-12fc-4e9c-b7c0-4b214bf3525f", "value": "T1CE749E7B079C0A27C7BED2B97A60F046FB9088933B12DE4F47C761C65467A0225C6D6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626296322, "uuid": "55d390cf-2acc-4f4b-9e73-096b6a8e718f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626296322, "uuid": "8db778b0-b2ef-4e3d-af53-3b2844fd6142", "value": "6144:VvqlIJ9wE9WZ0jCqfpZm3CUIoALn+3v/e983he1bEuJQ6OpK:Ul29wRonOIoA+/jxAo8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626296322, "uuid": "c4778fbf-d0c9-4373-9ee1-d55ab0b59309", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626296322, "uuid": "998e54ac-e9af-4a5c-9d88-236994a004d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626296322, "uuid": "bb774646-5877-41e3-80cc-4b07945ab695", "value": "MV CHINALAND TBN pda request order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae7b4c4-e4a4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626268092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268092, "uuid": "c3ed783e-6b05-45de-b6b6-5fc226a9c38c", "comment": "Malware payload (AgentTesla)", "value": "b4e07ea196d05192e6ce60536dfba515", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268092, "uuid": "f3ce7aeb-8663-4e36-b512-bb5273f1aac4", "comment": "Malware payload (AgentTesla)", "value": "abd99e485e5c7b462f2dbaa2c8e3eae71faa79b15921fc94ec3827920f3b4a6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268092, "uuid": "6c56cb20-a953-4d79-a8dc-6af44da64f24", "comment": "Malware payload (AgentTesla)", "value": "665d2ee28dcbafbc8cffdc42d17cadaa953e4b4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268092, "uuid": "057b3b35-8b9d-4eed-ad9e-a1105acef01e", "comment": "Malware payload (AgentTesla)", "value": "7e678dd2ecdd925aed1a8d4985bd91d993e6aff75626fdd26a55b0807a4b25845b9524d33ff40671ad4858e53b9fa517", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268092, "uuid": "cdf826bc-b2aa-4ab5-835e-d3906a52f4f6", "value": "T1E515BD2323844A27CBBE46B9B650E050F761ACAB7B00DE0F1AC371D6597BBC05596D3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268092, "uuid": "ffbc9d0f-3d54-42eb-8041-847f715711ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268092, "uuid": "a09328ae-89bc-4cbf-a186-f6525aa95649", "value": "12288:EBQUCGqNxb7nLFmBzT+FGZs/ZYz8bdUaXiBL9gmk+0:EBQUcPXLFmZTUws/Kz8/X6Zxk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626268092, "uuid": "d4b94c69-1649-4a07-b63e-ec1ffc69e85e", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626268092, "uuid": "fe5d9494-c7aa-456a-9159-750a934b7e82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268092, "uuid": "24d5435a-f2ed-44e3-b77f-0fe63c552fa7", "value": "K15oy6h836rIyrn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a05afb-e4b9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626276886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276886, "uuid": "d7f0a610-02c6-422a-b901-58c6e9e6e1c4", "comment": "Malware payload (AgentTesla)", "value": "8eef3680d8689ce1a333d2a5f29d03ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276886, "uuid": "ad2695d0-5106-40f6-94bb-bbf43f5948a0", "comment": "Malware payload (AgentTesla)", "value": "acd7329f6a182c9bfa1b899cf41933c93a6d0403abc3c99741b79c6bd81d6816", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276886, "uuid": "1c4b5d6f-c555-430a-ada1-44f08e15f440", "comment": "Malware payload (AgentTesla)", "value": "48ce4b2edfda50469d20b9172438f820f8e69d55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276886, "uuid": "f0eaa329-f2ba-4444-a6cd-0f2940b0797e", "comment": "Malware payload (AgentTesla)", "value": "3ecebb1afdeeb142c3bea8f1844fad6ccf45e6bf02094f98ee6f90c1d25814019f4b301ce28f3413b92ebed5029198a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276886, "uuid": "9738e424-75f5-46c7-b8d7-7521884fb743", "value": "T17A058C2C23FDA719F233FF349FA5A6449FA666B59225DD0D2DC4024B4821D81EEA3D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276886, "uuid": "96c83db2-eefd-4ea5-a3d6-90b6fba0aaa8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276886, "uuid": "ddb9b01c-cd88-4088-97ad-04520ff8cdfd", "value": "12288:EY3q5S8rNls9XOd4+QCxwHYS3l4ri59WPORW+Y3D/DsaTLtdyY9A:EYXu+Y0eri5wPORxY3D/Ds8dyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276886, "uuid": "688c5a45-9c8a-4b0e-ae7b-d6cc0e0bbb7a", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276886, "uuid": "a76af35d-e90e-4b91-820a-ee965f2ad943", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276886, "uuid": "ac2101bf-0d20-4f80-907d-f07a15dd31df", "value": "8eef3680d8689ce1a333d2a5f29d03ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5fdbb1f-e4cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626286605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626286605, "uuid": "ce093d5a-ea03-4d8b-b3dc-ea49a78751bb", "comment": "Malware payload", "value": "24d8314780baac363d1578377b9173e7", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626286605, "uuid": "2d5a3480-f1d3-466c-82f5-38019f56a8f1", "comment": "Malware payload", "value": "ad072f8cc15066beb6cbca682b2c032766daa1be0c5603efa840773d888bfdfe", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626286605, "uuid": "eb2c033c-ac4d-45bc-8a81-8c94daddc941", "comment": "Malware payload", "value": "877ca8527ca122f3fdd68e2b2f97592b8bee0d96", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626286605, "uuid": "4d48579b-74f1-4243-96c3-45c017c52397", "comment": "Malware payload", "value": "af50e131e566268287b4ebd720a1cd481fe9966039c86897b00f2c8cf2dd09682c1ae1b1c4b65bfee168395f20e0178d", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626286605, "uuid": "4563efcb-de6b-4b7d-a00a-2d858546caa2", "value": "T12651861AFD47D15C9B79236BEC978962FF1B801B9DA2104C75ECC2495F3080996BCB8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626286605, "uuid": "bce4e7eb-28f1-4801-bfd3-1fb56c2e0002", "value": "48:Ax14jiLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOCBozlp:7GhrffvIypvK0elkEYZ8Tzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626286605, "uuid": "abc9e997-90d6-45a0-b2c7-9752b5dbaa45", "value": 3130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626286605, "uuid": "7bf184b2-a850-4eb0-a6a4-c115dc262f3f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626286605, "uuid": "a6b2e3bd-c71c-441f-9c1e-10bda8e5945c", "value": "VZ0SLDW3.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c06916a-e459-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626235908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626235908, "uuid": "979b1c02-2027-471c-b620-c6181514d1f6", "comment": "Malware payload", "value": "8250c5d565f3b0c2a5b95632fcfab508", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626235908, "uuid": "6608aa55-5e85-458f-b918-ab9930a963ce", "comment": "Malware payload", "value": "ad7f4a352b6997b298a50a0e716cdd4b95a54af6ba49b082c30a7983bb083c15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626235908, "uuid": "741a7266-7c48-4951-a87c-23af65684697", "comment": "Malware payload", "value": "eaaaf2cc8c2236a35705375dece57f48c340db80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626235908, "uuid": "8725e2cb-49d8-49fd-baba-2c8c45b08631", "comment": "Malware payload", "value": "e74f5b70b2ad288898e93ab25e4a486b6ab7e2262fde5030d480cc7c8dae5daa6034ca8b6a81130664f8b461600ca2ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626235908, "uuid": "babe54f8-9cae-4d46-88ca-26b9715b6538", "value": "T177D42361F1879C7DD4199D7233194A904A1E68C7AA096E33366C0BAA1F10FCBB5837F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626235908, "uuid": "797af2bb-8bbe-490f-8431-c79696aa4c60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626235908, "uuid": "ea232df2-e1fe-4b54-9be8-a117b8a362e5", "value": "12288:DDrQ47uELrXJy2Mda/Rb/kOhCQBMNqjASycbyW2mrgzrcDoVc:DDE1yr5y2Mda/BkOhCQBMNq0TvS+Yz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626235908, "uuid": "3f888416-6756-44c4-ae4f-92fd0cd4ce99", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626235908, "uuid": "e243badf-a256-4abd-9e18-cc08f29ade4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626235908, "uuid": "325db850-3e0c-468c-a556-afe29b317691", "value": "8250c5d565f3b0c2a5b95632fcfab508", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e40429-e489-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626256329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256329, "uuid": "768edc79-0cb1-41c2-bcd9-d9a7f10da637", "comment": "Malware payload (Mirai)", "value": "3a7854ade97c869376ce8cad0c519bed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256329, "uuid": "8a586ff8-c6e9-45f1-9939-cdd110422f17", "comment": "Malware payload (Mirai)", "value": "b0f1e00059d971ab2d432a62773b0ae8a8df124c2354bd1dba806a1185bd7e08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256329, "uuid": "36305e38-c660-4396-9263-a0bcc2afe4ca", "comment": "Malware payload (Mirai)", "value": "8d3f121dabd5ec003b5d4ea3897830da79ee9d47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256329, "uuid": "2b675966-6aac-44d8-b656-44a49cb2fe23", "comment": "Malware payload (Mirai)", "value": "07c12ac23c72ad78e84eb2b2371b2603870ac7404fa49aec2a6785bcd72155e5e600fcd693c5f8900769bb5ad139ee67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626256329, "uuid": "f9a57989-eb43-4114-b561-fe8f9ad56a64", "value": "T112431852BC818A16C6E05276FA2E85CE3B2523E8E2DF73078D211F6176CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626256329, "uuid": "9e081a67-165d-4599-b404-003a4ecd7764", "value": "1536:xuXJpW+QpwAqEn8A0uqJRMGDuJ2nkApXhR:xuaP6uEXe2nnRhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626256329, "uuid": "fcf4a514-dd42-4a16-86ac-fc12e8ed4604", "value": 60460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626256329, "uuid": "ddb38093-d19a-4d8d-b6e3-5386833e6fe5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626256329, "uuid": "2fc96f72-0473-458a-a9c4-b4584d91183d", "value": "3a7854ade97c869376ce8cad0c519bed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3927bb53-e4aa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626270531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270531, "uuid": "e795ae18-2658-4385-8e24-9ea71b84564d", "comment": "Malware payload (AgentTesla)", "value": "31e838a075a0df704b67e979c9b2e0ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270531, "uuid": "5bb0127d-a0f8-4430-8cf6-46f8a7de3a22", "comment": "Malware payload (AgentTesla)", "value": "b13d86e398cddf186780ceb3ca9c8f9ff88c957ceff53aeb00de3f5207391159", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270531, "uuid": "02c21b76-9196-4fd2-a063-f55ff1cc47f8", "comment": "Malware payload (AgentTesla)", "value": "8e3047303e2c5bc2fd04e93bfb0964321e43513d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270531, "uuid": "ef0f6cf7-61dd-42f3-90ff-29e854fc1aa7", "comment": "Malware payload (AgentTesla)", "value": "2dca4b7eb366476f537c6ca552480ffe83a06b3f4c8abcb5089540947c42eb516ce82a338a9ed153fa9f666addd25ce9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270531, "uuid": "f2fbb549-c5e2-4dff-a0c6-8ae4d2ddec8f", "value": "T1E791C6B513640493CE9681A6DD7DFDA905D2F21AC1C72BD0B72DFAF30B27321512B980", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270531, "uuid": "9a97b028-a8f2-4a65-b33c-7ed2172a0295", "value": "48:AR61asnUBNQYC2gXTXysXLjVzFUwaNiKu0CCGFuyUgs81+WpTyzrpWZxrBi32Fjk:+UaDNQYCjXnzU3Nny6rZ2FjQgn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626270531, "uuid": "c264f0fd-8113-4d1d-8ef3-e214e7b50a60", "value": 4249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626270531, "uuid": "08a4dc0e-3040-4b8b-9cdd-542a8a93cee8", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270531, "uuid": "5304519d-95c4-4e1b-a786-3317a0f9312d", "value": "New Order_013842.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e84bf9-e4b7-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626276289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276289, "uuid": "b211de57-f0d4-4e29-9ade-482a69880a89", "comment": "Malware payload (Smoke Loader)", "value": "d260c619e6cdc77e9d78d24c02c2f392", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276289, "uuid": "47740863-7db4-4c3e-ada1-a07bac25b16e", "comment": "Malware payload (Smoke Loader)", "value": "b148a9228e806a666a057a6d69180ed21dbdc26ee28e754b00e98efdcae15c66", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276289, "uuid": "6e724173-0e4a-48c9-85d4-bec926d67958", "comment": "Malware payload (Smoke Loader)", "value": "48a465f1cae9ec287a596a6e51267471ca680f73", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276289, "uuid": "018ac44c-8b10-480c-954f-4e7522afcc01", "comment": "Malware payload (Smoke Loader)", "value": "19b9732c176876f93644dfcbe9e9cc0d1622fdd13a978a928c881a94a543edb77ba22a7c2ddad42b4ce9b7dbd89918c1", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276289, "uuid": "63f25941-bd0e-46f2-85f0-422af825da2f", "value": "T14914AEE072E1C432D6F7053024B4D7A52A7BB9326AB4858F376137AE0E313D199B674B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276289, "uuid": "0a2138b0-f7e7-4887-9c83-c76913ba69ed", "value": "cf8113cdf9d71dde8baf28192dd4ab3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276289, "uuid": "b0ec70f1-3c5c-432e-ab4e-5318addc0afd", "value": "3072:IBNmOsIvNFhdF41yKTdTKji6BaXOBHm5z7H6XHU+:wtNTdF3KTd+G6cOBqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276289, "uuid": "c1fc33e7-94d9-4db3-9647-ddb045934c36", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276289, "uuid": "1da731fb-8690-4cd9-9e6a-8158aff39918", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276289, "uuid": "50306ab1-6475-4b86-93dd-43f0e2184423", "value": "d260c619e6cdc77e9d78d24c02c2f392.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7dd7381-e469-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626242827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242827, "uuid": "dae32863-2ac2-46c2-87f6-e9d5bf9564c1", "comment": "Malware payload (AgentTesla)", "value": "d37c38f76bdc21dd0566b8e1bc1aecc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242827, "uuid": "08a74931-0a9f-4926-900b-1269e38961d3", "comment": "Malware payload (AgentTesla)", "value": "b17d0c45bc91842bbf2697f36ebf04961ce3b1c6856ceb7883f5b8a725d565ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242827, "uuid": "59640d91-7ecc-4228-b852-6930f2ac7f01", "comment": "Malware payload (AgentTesla)", "value": "4ca4678ac29afd25cd0d181de9163a700bfe0ec5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242827, "uuid": "ed42aa80-f181-48b5-9790-9e907cf69e10", "comment": "Malware payload (AgentTesla)", "value": "2be09b4b6aff2f7b013c09377d00d02dbef661513a700cabdbefea00d204c59f13649a1a9260dc3f6771d2fdbe5e730d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242827, "uuid": "6e6677e3-fc81-459d-bef5-bc5b77a79a59", "value": "T15A92D08D60B4E828F420F9F8376BCD15B96B9F77291D2577DEA3EC3A4141058227A332", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242827, "uuid": "c4b50811-0e09-4f5a-b5d1-78adfc1192cc", "value": "384:2AfAaLLQuFayBf5OceIwHv6HW1tVWGO7YoiBFe+wTac9ltGaek:2taLLQuBf5qp2YnFTwTaalMaek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626242827, "uuid": "201a26ff-f9c4-4f05-94f1-02c0c34c31bd", "value": 19671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626242827, "uuid": "bf6beee5-77f3-4223-9814-9e9a00655a1b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242827, "uuid": "acdd2c14-046c-4069-a029-d789d4b08916", "value": "3278_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686add79-e4c0-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626280060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626280060, "uuid": "c1db4a2e-c12a-4276-ac8d-abb324e20979", "comment": "Malware payload (Smoke Loader)", "value": "a264af8f7ed226954afde7c6d8abef8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626280060, "uuid": "a145ef43-f85b-465b-bdbf-bec8434f23c2", "comment": "Malware payload (Smoke Loader)", "value": "b45b46943761b574b53d2938b6e6c331d778f77bf1690d3b09a07450867118b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626280060, "uuid": "c56f09ec-8968-4c44-a9e0-b26fb6ffd4f1", "comment": "Malware payload (Smoke Loader)", "value": "2f0af707ae10b4c951754502b0706a584d854958", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626280060, "uuid": "8fcf2901-0d9b-42c7-809a-b4626b95c54a", "comment": "Malware payload (Smoke Loader)", "value": "abd92bc98ff2e1f60bf6eaf6b5f6915262bb28cdc67ff64cf968d366c635d51836f4e87a8ab2551a5ba91104983fac62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626280060, "uuid": "848906f3-aaed-4429-91da-2031c739ae5e", "value": "T1EC14AE1036E0D031DAE71A306474D7A12A3BB9323A71968F3761E7AE5E303D2DA76347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626280060, "uuid": "10da0610-eb80-4ec9-b9e0-40a476578422", "value": "f9c1cf1b2cfb3ee96a94f56e9a89c09a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626280060, "uuid": "fcd56578-87f4-48cf-ad8a-1fc484ebdbb5", "value": "3072:OBNmvUkeC4b2NIk6/EbA5zWz8BAO4fm5lakUguSH:icU8RDw5qwOO4kNui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626280060, "uuid": "5922115a-8987-4d7c-9b98-7c477ff88c6e", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626280060, "uuid": "84bd64db-4f73-4f58-abeb-55cad45a77a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626280060, "uuid": "650cc8cf-4463-4661-a9b7-b2a08937fb9b", "value": "a264af8f7ed226954afde7c6d8abef8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bf25b2-e482-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626253540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253540, "uuid": "497001ca-4cc3-433c-82ce-742da60f41be", "comment": "Malware payload (Mirai)", "value": "4da8059896b21ae406d82675e8ebf6bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253540, "uuid": "de3a67f5-f348-411c-8e0c-e42180be7445", "comment": "Malware payload (Mirai)", "value": "b47176340e3e0e02092d5121d210724c13b082538c9ebf0c9294cf22c6737ff1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253540, "uuid": "d9fd68a4-06f7-4a4d-920e-59ab4beedde8", "comment": "Malware payload (Mirai)", "value": "7f35f5cb222d0784541d03e0a97fb317e592e341", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253540, "uuid": "eb001c4b-faec-4e9b-a90b-5baaadbc68e6", "comment": "Malware payload (Mirai)", "value": "9c11a797c517327bb295c5532e65f4e09a0d40a4e139fe2a595da34914adbb42c78b199bcfecfebc8ad237be010b3959", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253540, "uuid": "457dd13d-b9fd-43be-a7ed-4a5dbc1a7458", "value": "T183C2F1885BFECD2AF49F0176523C082EA04768E35FEDC291261C9EE975821EC1836CD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253540, "uuid": "753e7222-6fd8-4ec6-be86-7fe11040e84c", "value": "768:YlmvZdquj8SvVyu5asfu6QdREokpD1+ih6N/SuFrb:YlmvWo8Spa4RQDklhh+/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626253540, "uuid": "1b604728-1199-4033-9833-6329098f7824", "value": 28012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626253540, "uuid": "d621521d-f2b5-4435-81e0-153541b8d084", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253540, "uuid": "0ae7672c-476d-4c6e-ba57-6ba1dcd0f37b", "value": "4da8059896b21ae406d82675e8ebf6bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c5735d-e4b5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626275280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275280, "uuid": "b69e67a0-a22f-4a43-8971-00d68e0e673c", "comment": "Malware payload (Mirai)", "value": "20444947b64a20b46feb212048be09e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275280, "uuid": "6feba5ef-76da-4182-86ac-10fd136597aa", "comment": "Malware payload (Mirai)", "value": "b4be8b70f5eb0db6cf385f647df8953430fe508d1e3f7b3b19fff2ab453ad4a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275280, "uuid": "68494967-6fff-4d6b-9266-d36ef02a1421", "comment": "Malware payload (Mirai)", "value": "ddaf22ce08e4dc32c8b1de15e29edd5d094b0273", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275280, "uuid": "f9b496e0-55b2-44a4-8473-04f1e5b00d8d", "comment": "Malware payload (Mirai)", "value": "f13af41fba8ed3d5e3a918e668a9274f1a567b8cf2c2564a4d183253973c34020d2ca046ae4e27f68ac49a211f5b393e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275280, "uuid": "d2a4a6bc-3487-4dc5-8e95-9a2a21f6cd4a", "value": "T1F5216576B6D4EC33D65611B65185AF4B2361CDE16446FF0BCE511402EC392E0D1323B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275280, "uuid": "eaee00e8-16f9-49a7-a8f6-c3527987b582", "value": "24:Fle8M85FHxgxCl6ZSiSZSLRBCifGHw/rGuWp6G8ruQc3PbzNfTbr:fl15sSi0SLRBCisw/rSpJwHcffN/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275280, "uuid": "cb854ba4-d436-48f4-8618-2855376ac509", "value": 1184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275280, "uuid": "ea9b00d0-c8d4-45e1-9228-8b8c1b4039a3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275280, "uuid": "0c4b2c9b-d733-4e54-a58b-16bb20e0846d", "value": "SecuriteInfo.com.Linux.DownLoader.531.5750.19979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13332cdb-e475-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626247704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247704, "uuid": "d625ef22-14dd-4ed9-9027-ff6306140ba2", "comment": "Malware payload", "value": "ea87589021dfc9970180f30c087aeea2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247704, "uuid": "a1cd2a05-3ada-409b-b822-20f01bcbb9f4", "comment": "Malware payload", "value": "b4c3a3f4675e7f98b7fa1552aed85914681de85737cbee6d7c131e2377581bda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247704, "uuid": "3b9f9d65-9fd4-4b24-b993-ec7a05e60780", "comment": "Malware payload", "value": "a4042ec4bc5d51a1307aa7681a79d3ce6394c11e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247704, "uuid": "b76d9501-bc0b-4524-ba89-179960cce250", "comment": "Malware payload", "value": "a68350dc9c8f3ff712e5505e9d5dd5ddf16bbaa6d2e8fe535b4bd6cde34caef352cac4e6107a696c16ad0187cb649ac2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247704, "uuid": "24b7682e-49cb-4291-84d0-4f1d7e23f1f4", "value": "T1C6F2F150F942769AE0B0AF71B5BE0E96276101A661DB331386DC1370ECE006347BF26B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247704, "uuid": "62037e18-2910-4498-bcf6-6cf4cfb2a03a", "value": "768:qdemQK0dWjHH7Gb/MfB9ox2yHP1JdvDbhYg/8swtL3UE:UeJKz7iksbtzPhp8s0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626247704, "uuid": "0d73a47e-bbad-4eb8-9c4e-df7b9ffdbaa3", "value": 34928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626247704, "uuid": "d9028196-c550-4104-a5ed-3e2543c7edc2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247704, "uuid": "f6fc8836-8932-4f61-9636-b4a0aee4bc85", "value": "ea87589021dfc9970180f30c087aeea2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a631aee-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626245999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245999, "uuid": "eca3fc57-962f-47df-be51-bd3abd2c572a", "comment": "Malware payload (AgentTesla)", "value": "086423c6e932ed25fe2d1d5ee297596a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245999, "uuid": "39f41d10-951c-46f7-9f4e-a67e16b957dc", "comment": "Malware payload (AgentTesla)", "value": "b586f0ad8c0a59dce27f0da449d5b4c7abb402a0e5d297831e73331442debb8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245999, "uuid": "fdde00af-0402-4df7-9131-70e0838d218e", "comment": "Malware payload (AgentTesla)", "value": "6cac16fa71f33a3ffc71589376f30df5d7ec67d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245999, "uuid": "0e0541d7-12d1-4f02-915a-50a59186adf5", "comment": "Malware payload (AgentTesla)", "value": "3f55e157b4ffaf76599bf858dac91143ee02be8e8f96cc21e8ca6cb563682c231508990d451a7f37acfab7b1d6e8264c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245999, "uuid": "04fad9a4-6009-4b22-9b5a-d9d056341da8", "value": "T1EB25AD2C23FEA709F237FF31AFA5A6449FA666B55215DD0D29C0024B4821D81FEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245999, "uuid": "e5d023f7-a6be-4a3b-b083-362c83abe4df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245999, "uuid": "b97b7589-112c-4071-815e-92807cfbc6a5", "value": "24576:x1pgRHTuhFlGZAI2b1/vbYOA9j8t2w7o9okna:w6XY32b1HER9It26+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626245999, "uuid": "d5e723cd-ff83-4c5c-a8ef-72b7df32c651", "value": 973824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626245999, "uuid": "58091d9e-c629-4403-a0d0-7ab04aeb8228", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245999, "uuid": "2b1da5e6-0fa6-4c1c-838f-60931371a3ec", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce14c252-e4e7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626296981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296981, "uuid": "72df8be1-7669-4029-8b97-547c6fa321d8", "comment": "Malware payload (Formbook)", "value": "78df6987b12a77a4d38c4d08665ebe18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296981, "uuid": "d6b143f1-b7e4-433c-83dc-8d15d7bfde51", "comment": "Malware payload (Formbook)", "value": "b6e96276c116a1100b52ca6fcb369e22b4faa30bbfd48df68942fae3feffb15e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296981, "uuid": "e72a148c-f205-4167-abfc-6621480c36ed", "comment": "Malware payload (Formbook)", "value": "639595a07bd375349f8371e577252087ffe37247", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296981, "uuid": "ea8a51e3-2bb0-4194-8515-555410eebe51", "comment": "Malware payload (Formbook)", "value": "93de48d5d1eb700f4a2c8bb8565c84c83dc1977ede3d62a09751887ec575d9297058193c60fea73761b854cad56a77e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626296981, "uuid": "77cdf46c-4156-40f5-87f5-db8fb1c8004e", "value": "T10D2412253291CCB7C3370A701F3B5E25ABAC922401A61B8FAB50DBEAB945DD71E5F107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626296981, "uuid": "8fa06add-8e7b-4eb2-baa6-898862fd306b", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626296981, "uuid": "65833ccd-fa78-4386-8cec-4f52d1249761", "value": "3072:iBkfJpRXATwMdFCcGbWW496EByWq0vJBKVonPM5Z7dfWdolMR5mlkplZnyIjhPc9:iqjIKuYiBdoZpQPgSH0mUZFoZcMqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626296981, "uuid": "e0bbe35a-c30d-45bf-90ed-9179997cd9c9", "value": 217278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626296981, "uuid": "9aca69be-c7d3-4b64-b5db-94d148ebfaae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626296981, "uuid": "eb28e9f1-ed56-484b-a09f-691f1a2b79ec", "value": "QUOTE.0050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600d7fad-e48d-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626258141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258141, "uuid": "253d20c3-6d11-4e08-9095-c77031f5f35a", "comment": "Malware payload (RaccoonStealer)", "value": "19193f7938a8279e16e69822b9f48bd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258141, "uuid": "0500fc75-f5e7-4afc-b978-e10defcfc518", "comment": "Malware payload (RaccoonStealer)", "value": "b6f5feb289fd7da5864f5bd46d084ed5a38d9e5ad822abaafa4be4d766e78114", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258141, "uuid": "7b370b8c-59ef-4735-b317-cb6e2413051e", "comment": "Malware payload (RaccoonStealer)", "value": "f6a0597b8bf3ea3a1e0baf4c3ffc4b876e709aad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258141, "uuid": "35ce27c5-c4a0-4216-a21b-6da19678b0e0", "comment": "Malware payload (RaccoonStealer)", "value": "bd8a43a47ba75c57fca1d4d8404710cda2c7cd0a803c349b1a226bec35e195de7b90230401a5505d1c90ca238742d438", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258141, "uuid": "0fd81cda-591f-4d3b-a9b0-4db779ee872c", "value": "T188255B1CE5EC7076EB6C01F552D0E3FBE2FF0A70AF4978BD026279689A07939C518859", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258141, "uuid": "811d0176-3186-48eb-882f-34f8347dcbc9", "value": "402dfb3297778d9c2b52b12fdd6ff9eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258141, "uuid": "e2ea9348-bc34-429f-9713-b1b873f8db1d", "value": "12288:ZKG+XAOziyXRXi0JMOfKSRdIwcYc7G+yAdtkfX4q4NjBiT:sG+XzOyXtJMOLvW79dQQjBiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626258141, "uuid": "358a877e-95db-4623-a375-4132b707c271", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626258141, "uuid": "1039dd32-f9e8-404c-aa92-d4aa953cf23a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258141, "uuid": "60580297-a95d-4a1d-8db8-98ccf8eb022a", "value": "19193f7938a8279e16e69822b9f48bd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5affeaa0-e49b-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626264146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264146, "uuid": "c16bc2f6-1309-4485-a75f-287632f9e6ac", "comment": "Malware payload (Loki)", "value": "ec828e99a232757f55a16cb330aa127b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264146, "uuid": "03942c53-7298-4107-ac7b-6e9e9084c74f", "comment": "Malware payload (Loki)", "value": "b7414d73458a789c8e8aa260b0a6b423d181cf5d9189f13a2c0f4f00f7c3b6cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264146, "uuid": "fa4b4f7a-6f8c-404f-854a-c463a10186f3", "comment": "Malware payload (Loki)", "value": "0b4fea8c713d14611322f1dd37a067fbe88252ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264146, "uuid": "e87cdb4b-6f0c-4012-a842-6b734a26c80c", "comment": "Malware payload (Loki)", "value": "5d2a79b093177a0bc9dfa033fd74a885212a598d39efee1b69543c43079d55ceee5b26fc44d151d2fc6bab77088fcd0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626264146, "uuid": "b3a110f7-18c6-4d16-a5c4-a2e1b1682d0f", "value": "T10F158D2C33FEA109F637FF719FA4F2859E66767A9226914D2DC4020A5821D80FE77931", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626264146, "uuid": "052c3821-dc1a-4f62-800d-cc1d630a534f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626264146, "uuid": "6c6fffe1-be1c-4e9c-9c4e-ed251dc8c619", "value": "12288:UelImFRzfbsI9bWAYfxYY4psKuQmsluQxkYG+lkSzl4enhEoa87yz3zYh00mXN5J:FlBz/JWff4Z9HGERZRhENGUM2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626264146, "uuid": "ca324669-a9a4-493d-9e07-c568158ab19d", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626264146, "uuid": "3fe03a39-8878-4f9d-a390-57f1b3c10ab7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626264146, "uuid": "f9f04a50-c02a-47a6-8659-a30f6772c744", "value": "ec828e99a232757f55a16cb330aa127b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a28cb57-e469-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626242670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242670, "uuid": "569e8128-5e48-4024-8b09-cc8646109c65", "comment": "Malware payload (AgentTesla)", "value": "980142930cbd2fc3cb784ab4dc012a21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242670, "uuid": "728c9f46-49ed-409b-840d-42ac2470e502", "comment": "Malware payload (AgentTesla)", "value": "b7561cc2fcd2d9f668a4d6127ded0a4d9b7d2bc47fa60bfc1e56d6d25120251d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242670, "uuid": "dc85c8b6-14f1-4d1b-bdec-42dfd39f009a", "comment": "Malware payload (AgentTesla)", "value": "9cbe5f2308a686c550ae08c5abf0f87dd854063b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242670, "uuid": "56a97f9f-cf11-4288-b921-0bde3ff69ffb", "comment": "Malware payload (AgentTesla)", "value": "525250253a85cf02deaed950e7bcdbc8cdaef3d7e005c015ef5b48b204d87bb06f4e79c87ed3fa4336772de670ad2c54", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242670, "uuid": "09dfeac3-879b-4c76-9f61-9bcbf5f3915b", "value": "T1E4C4235B939190A8C64E1394024A096750F38FBE171828ED78EB42971FD5DBEF9C98F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242670, "uuid": "3c2ebd42-4f5f-4e01-ab35-899f1069dadb", "value": "12288:lvUjlEkoj8uxgPpsmL/q36GdGmhLpV97BPHuYxaPosHWfqsF:lMZuk+qGAmPzBOahsHCqsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626242670, "uuid": "81667f2e-1716-4473-973f-a678173ca42b", "value": 569955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626242670, "uuid": "876be1b1-f055-4580-97ba-933451f285b4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242670, "uuid": "f015766b-8a18-47eb-8464-174da45a05e4", "value": "List Of Products Q002-O417729.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b8633c-e4c1-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626280542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626280542, "uuid": "15092d94-a3e2-4036-b8b4-8b3c0639e89e", "comment": "Malware payload (Loki)", "value": "36dae96c9425608f4d2441ab5c38130f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626280542, "uuid": "d0a27a2a-15f9-4553-afd7-e9374d9f074e", "comment": "Malware payload (Loki)", "value": "b79368e2c5cb9664b5552d02c7c20ce0ffc6adf26f252108fc2a945146247094", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626280542, "uuid": "abd7a992-bcf7-4a34-91d6-08bcaf024735", "comment": "Malware payload (Loki)", "value": "b492611f1031865d2a7765b1cb8d9918849106bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626280542, "uuid": "1869a4e5-f6d0-4135-8d83-ab24788742d5", "comment": "Malware payload (Loki)", "value": "5f69b33b8bb205f26c316ee690d0c43fd600b66b2f5152970f70972230bf984af97fadf2aff4d838f00afed369efe232", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626280542, "uuid": "dec91ddb-06c3-47b8-a75a-047af2200905", "value": "T1C7E402267740EB4EC27ECE7D49626C00A7E0E6778307FBC35DE715E9058E6A98B31291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626280542, "uuid": "051568d7-9fe7-4496-bf9f-5d4e03676cc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626280542, "uuid": "c725e004-d42f-4762-b657-84917b0c5429", "value": "12288:Ubt6I1WTmVf0p2PwWSUExF/veNIyWvtZqHJv3C5+rxAPLbxjVCCCCCWkNh:UpRUTqIeexF/veNIyKDqHl3qhnHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626280542, "uuid": "7c80e1cd-7eaf-40bb-afdb-3532816c162b", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626280542, "uuid": "a60eb2cd-4855-44fa-a6bd-974bde06d343", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626280542, "uuid": "1b6db0f5-c547-48d6-a40e-171793ba485b", "value": "36dae96c9425608f4d2441ab5c38130f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68528df-e4b2-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1626274258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274258, "uuid": "14703ff6-e8dc-4ff0-a302-70673f19e253", "comment": "Malware payload (DCRat)", "value": "015eec51eba9532a027065d7d570064f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274258, "uuid": "a4e1d39c-b839-463c-8a1d-a7ac6cda4ada", "comment": "Malware payload (DCRat)", "value": "b86d183bcb90ab5e8a1aed3645fc03659d9d4bbca191c9cfe27594734600a6c3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274258, "uuid": "4a7afa2e-05cf-484e-9697-7482dcb49b56", "comment": "Malware payload (DCRat)", "value": "eaebb23a0d2edbddede415f2ac3915e037d0a706", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274258, "uuid": "4091758b-b9fb-4190-8ab5-167d1054d768", "comment": "Malware payload (DCRat)", "value": "3ac9abc3a441d7c8f43886f133f39e283c8e2648b9313ffd9d9f2d0d918e13bee0fafadd7e6fcf25ec552bac05aebd0f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274258, "uuid": "3b5cace1-486c-4f27-b181-3396988416e2", "value": "T18A45172B3A84DD01D0391637C9EF842887A8ED423762DF1B7A9E339C64653A75D0E5CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274258, "uuid": "19b84cf5-0b76-4229-a391-ab6102eed321", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274258, "uuid": "a2d9e291-a48e-4d7f-9fdb-73b34d159f9a", "value": "24576:LWcYbh21+UXEvQqZShZXWl1K4+2ddqel018+4:1nUvQqWXukel013", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626274258, "uuid": "6d77a717-6c55-47c1-913f-f5b0bacd2350", "value": 1183744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626274258, "uuid": "85a7578a-c0ac-40b3-abc1-d2ffc36b0b8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274258, "uuid": "a65f2b5f-b3f1-4095-b73f-c47ce88e7721", "value": "015.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbd5c13-e4c0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626280069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626280069, "uuid": "8f09e686-590d-4893-b03a-a33b0233776a", "comment": "Malware payload (RedLineStealer)", "value": "1130aadc21e61f9fc3ea418177382a2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626280069, "uuid": "56e11291-8b5c-4f4c-9ac5-27290c32b5a3", "comment": "Malware payload (RedLineStealer)", "value": "ba313b84b44bb158c77aacd4fc959014ac5d3af815da80938937168f2305b85f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626280069, "uuid": "079984dd-c538-47ee-8ff6-5ad67682318b", "comment": "Malware payload (RedLineStealer)", "value": "5fb214164c29f63b3e8cf9b330bc3f1b1326a064", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626280069, "uuid": "3df496c2-f548-439d-b966-6709fb560b1a", "comment": "Malware payload (RedLineStealer)", "value": "eb4b960be05d67aa17d9fcfdce0532014eb5e31773b5cb677b55bc53c2b3a433d0e3b6bd6e5731c2584045418bc773e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626280069, "uuid": "206103b7-a706-4c8f-ab62-ee140460ac0a", "value": "T13E84452864BFC01984E3EEA12DDCA8FBD99A55E3640D743701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626280069, "uuid": "b84e5387-74ef-4f7a-ac5d-2f9e286ea258", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626280069, "uuid": "2c6f2506-9835-4a0b-a3b0-cfa3782baffb", "value": "12288:iASwK3vb6iJ7YMcx6rh5Z3nIeLTm7bpqmpmF:p/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626280069, "uuid": "601c6081-78a5-4413-8420-ca9491ecd534", "value": 395656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626280069, "uuid": "fab5c923-3628-45b4-8aea-a915344ed921", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626280069, "uuid": "261ba56c-11d7-4e6d-b703-19e395832c7c", "value": "1130aadc21e61f9fc3ea418177382a2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bdbb948-e4b7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626276039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276039, "uuid": "7b8311f6-65e2-4a9a-b603-998c547a47c3", "comment": "Malware payload (Formbook)", "value": "bce6b0dd0454052f8952f5174c26cec0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276039, "uuid": "cb90da45-b462-4b3b-9fa9-3bb2f1f11ccc", "comment": "Malware payload (Formbook)", "value": "ba41a0e0bfc666b2f37abbb5fe9373d77922ea90b4f7c975e9aaaf27edec129e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276039, "uuid": "1d18f955-b459-4c73-978c-80c4c34983c3", "comment": "Malware payload (Formbook)", "value": "523634a588553545ef240cb445f4867c8ca26e1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276039, "uuid": "b417b9aa-e3fb-43ac-96d7-11d9bcaeb58c", "comment": "Malware payload (Formbook)", "value": "abbf2dfa4909732bd7262689b6342a4b8c0f19fc198ec433fa9cd0f26963e703cebaace4495a22d0d13168cae930a86a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276039, "uuid": "9b3555f5-302a-4baf-8c3e-485ae5c2b173", "value": "T1A3E4235182D34DBDE129DE32330C8DA0590E55CBA70E7A73755C8B9A4B00FC36AD6AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276039, "uuid": "45c32a34-fbb5-4d84-8121-041a3818d944", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276039, "uuid": "a8e29a7f-aa33-4898-bed9-f4a37f473808", "value": "12288:1DrQ47uELrXJy2Mda/Rb/kOhCQBMNqjASyERJLeCLG9x1IER4BJK3VMChzseH:1DE1yr5y2Mda/BkOhCQBMNq0eHno1f37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276039, "uuid": "c4181c25-1da4-475d-a505-4569ac8a89c4", "value": 711152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276039, "uuid": "c72357f8-1ecd-42db-bfe8-7ee56cac0294", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276039, "uuid": "85783696-30dd-4614-89c4-1c55f5114107", "value": "bce6b0dd0454052f8952f5174c26cec0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa981b07-e474-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626247663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247663, "uuid": "8b677e5b-c364-4549-8343-39a5a8398ee7", "comment": "Malware payload (AgentTesla)", "value": "a7f6751cde4aa8e6819bd0e80a6d2659", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247663, "uuid": "e4516754-df58-4d6d-b968-2911bf0d5cd8", "comment": "Malware payload (AgentTesla)", "value": "ba62b8b54d27d67747de2d3a89012d81b9f5b51a6b7137fad783b9aae4ad9dd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247663, "uuid": "45e74f19-ecc4-4fc2-b0b8-9b5ee882ae5d", "comment": "Malware payload (AgentTesla)", "value": "0705691c55158700a21a51a3b19eb1062accfa79", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247663, "uuid": "f752f9b1-11ef-49fe-9cb7-2fb46ee6db56", "comment": "Malware payload (AgentTesla)", "value": "0f4c92bfe2ea4cadd3bcfc758755875a010af00b2061b6fb6b691286775a90ab54d4dca1dd035f6382e44e1d89ffe485", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247663, "uuid": "0e0dad9d-a230-4112-9ff7-57b1c605a672", "value": "T10B05E07A07DC0627DB7E92B93AA0F006F760AC923B21CE1F46C771C5552BB4169C2D6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247663, "uuid": "4eddfa4a-2b3a-4142-b7c6-6c1504887602", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247663, "uuid": "e019c78b-f273-4d2c-81e2-1409d807c3a4", "value": "12288:dhlN0womxXDn9bH7t+GlCszJcoIaE1pqo/+Jv17a6MC0ODvMVkMqOevmkRz:dNZr9bbcGUKJcM2qo/k9xk+Momyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626247663, "uuid": "886ab186-e144-447f-8c0c-5874ad28382c", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626247663, "uuid": "225218ea-7a78-452e-9256-85e073d1f627", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247663, "uuid": "b47e78bd-9e1e-44a2-805e-fc8be440b115", "value": "Bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f1ee26-e46f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626245107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245107, "uuid": "65494f1b-14fe-41c7-b3f7-f647c9a97b3b", "comment": "Malware payload (AgentTesla)", "value": "32ab803c18d9bae9cadb88d8e2147222", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245107, "uuid": "4631ccbc-4f9f-4da5-9dda-7c37c1bbd884", "comment": "Malware payload (AgentTesla)", "value": "bb2d8a5080ffb21df4c00ad759031768481a5ab675fe9657cce78e5a9e8791fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245107, "uuid": "7a782f3d-9d85-40f2-9bf0-6678dbdf3f0c", "comment": "Malware payload (AgentTesla)", "value": "8328a3adc533c3133e77847b5020240f907bd181", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245107, "uuid": "c659c220-b0c1-49df-b488-359a01d13492", "comment": "Malware payload (AgentTesla)", "value": "df8615b6d539ff448e433546682ae26126e51d76a36245c0e39b62d5eb66d9458d57e7ee68e713a93879d0f59181ded0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245107, "uuid": "bcdcd8fa-842c-4407-ab50-62346eb63bc5", "value": "T104841214B118CB4BDC7A8AFBA667D4101DB2AC0A50E6EDCD8CCCB24554B735127A3EB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245107, "uuid": "eb4a6f1e-5f5a-49df-84d8-f1f518d333f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245107, "uuid": "1424c0a8-afcf-4366-bb73-0d1c92bf16be", "value": "6144:UhbC/dIVYS1tYydndTHtuuUabxCsfLMywFcqt9gAKn22vy1JDNze9cXOT:QC/dIVYS1VdH8yCAdE4lZ6fQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626245107, "uuid": "02df5776-8fb1-40a8-8061-89558af9ef20", "value": 402944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626245107, "uuid": "6a0d7d0c-d329-45a3-b9d0-38dab7e9c9d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245107, "uuid": "cf417551-4c48-4428-bf16-ac9cbbe8e9f6", "value": "New order #0953 56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b70154d-e4e7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626296761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296761, "uuid": "4778dc56-999f-45f8-854c-2c857d98fd28", "comment": "Malware payload", "value": "907712ce2526aca772cac76d1d8672ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296761, "uuid": "d3a52126-f77e-4419-877b-62e2cdc1a62f", "comment": "Malware payload", "value": "bc7c349c8520b727dcf45df70ada1e63e5d38a5ffe3f314b6c61a9971b5f7cea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296761, "uuid": "f1afa241-8a97-434a-8ef7-e555b072db5f", "comment": "Malware payload", "value": "b23ac2d08197086da52eba44741822a0f62048e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296761, "uuid": "f48219e8-1107-4a3c-9cd4-d6c3346d1f19", "comment": "Malware payload", "value": "776b6abefde92268e0f008f3e1c93773f307e6ba648b6cf9f93a0bbba94e5172ed7f95b4c065f9911e53bdd540c5e2c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626296761, "uuid": "74bb9489-992e-4021-8f51-7b21d4229c81", "value": "T14625AE2E23FDA74AF637FF31AF95EA449FA627B942159C4E58C006472420C42BDA7C35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626296761, "uuid": "9f6bcf96-f106-4982-8ce5-fe662f1f52bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626296761, "uuid": "8f4235ef-42dd-45f3-9d32-ece21dbef0fa", "value": "24576:qBoSHZ+NBgNr1+Ve9vlOKG4hGRBU16o3/sMzc263AsXs/:bNBgNhllOKG0eB2tY263AsXs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626296761, "uuid": "ca19986e-264e-48e4-afd7-fc79615e1b6d", "value": 1004032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626296761, "uuid": "6976125b-00c6-4338-a9f8-0469a6d28794", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626296761, "uuid": "4ca20553-e138-4342-b7eb-067e3b09226f", "value": "kxNrcrVHF8114F5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd68d5d2-e492-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1626260472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626260472, "uuid": "6bb95742-fde9-4c8e-ba96-e17a5adaf948", "comment": "Malware payload (AsyncRAT)", "value": "2c5dce407cc334568c42027d97f7d0e0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626260472, "uuid": "fa277995-63a6-499f-846a-a4178abda9a9", "comment": "Malware payload (AsyncRAT)", "value": "bcf7571a4d9b25fabdc2d6120b1b2d7bd8446ea2bc3a5da1d4127954920067de", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626260472, "uuid": "bd08eee4-142a-4a75-a85f-fc0eed69749a", "comment": "Malware payload (AsyncRAT)", "value": "fb650fc54f1ca91a3239ff261491d242cd5cb240", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626260472, "uuid": "adc32486-bff3-4de6-81b3-fe69ea32c575", "comment": "Malware payload (AsyncRAT)", "value": "563c186896af1a550d318218e582bd53acb625b6592c349cf2111cfc89553bc4bb3b175b4f2105aaee09a85cecd0838c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626260472, "uuid": "b9714350-a698-46e6-9306-c328240784a6", "value": "T16DE4E1A677C06BCEC22A8D749C90BC00A3E0E6769307EF4B6CE725D8488D7D94E7615D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626260472, "uuid": "03713ecf-2b9a-49c7-82f5-e436c7d3a6de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626260472, "uuid": "531934f8-913b-4b52-96f3-faae8bfd6fdb", "value": "12288:u5ki3w7RqrDgiPJv7nCohxXZHUt4CrOx15wAHm5/jSZtPR1rEuNCSUUA:u5dTrVPJvmoLX1UqtG9heZ5Ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626260472, "uuid": "a0938edf-3839-4803-b0fa-22aceb9117e7", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626260472, "uuid": "bb3056b8-1d74-48b2-94cf-2aeca9e93c52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626260472, "uuid": "9e76ab18-63a0-45ea-9c56-10da55b50700", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb9741a-e437-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626221092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221092, "uuid": "7bd0538d-1bd8-4c9e-8bd8-196752f8ba4f", "comment": "Malware payload (Mirai)", "value": "9ad9423fd6650af3872cb78902e4a4ec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221092, "uuid": "5e47a2c8-4f94-46ca-86ef-eeb5a2f95625", "comment": "Malware payload (Mirai)", "value": "c014333302604fc100a0f095be65ac3b762f9384b0590934463d0cd9ddbc6089", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221092, "uuid": "87b57b5a-376f-4278-a95c-9221428e6513", "comment": "Malware payload (Mirai)", "value": "03d894d6dec14b67f49d0bbb1e9c443aa2802d95", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626221092, "uuid": "b0fa5430-c073-4dd9-a05a-0a2248927a8a", "comment": "Malware payload (Mirai)", "value": "436c436204e2141884a3dc9d240d226e55bc9b876f6bac228b117727eb97619c322b5d1468edea1c6b175285c2e0e15b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626221092, "uuid": "6a88e019-b089-494e-b087-e91296a99abd", "value": "T15064D08AEA016F21E4C525BAFE1F434973634BACE3EB7101DA209B3437DA55B4F76045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626221092, "uuid": "6c78d862-821d-4035-a804-9d06b98d57a5", "value": "6144:fYFJvwe1gKCYVl2szoabE5wKSDP99zBa77oNsKqqfPqOJ:QFaeHGszoabEDSDP99zBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626221092, "uuid": "fb9488ca-f4c8-492f-b741-46f52efbcf1f", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626221092, "uuid": "892ee792-7b6f-4927-9931-091d9bae86cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626221092, "uuid": "bb00f692-796f-490a-adfb-91e266e802d3", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d5ff4d-e469-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626242872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242872, "uuid": "bb0628b4-0545-4150-b64b-a0b78b205b67", "comment": "Malware payload (SnakeKeylogger)", "value": "46583d666a308acb3dd0b2cef3d500ea", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242872, "uuid": "5bfe537d-9d4f-4122-8256-d33692e15881", "comment": "Malware payload (SnakeKeylogger)", "value": "c069ccee71010d0f2121631409c8f9c96879d1097bde257eff61dcf0e9e55296", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242872, "uuid": "cade298a-e975-4dd8-b7dd-7dc21837ecb0", "comment": "Malware payload (SnakeKeylogger)", "value": "6cb969276bc4fefc9cc57de404593f8c0acc7838", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242872, "uuid": "e28e616c-843e-4ddc-b6a2-57309df7ace0", "comment": "Malware payload (SnakeKeylogger)", "value": "99a663055335a28211caa97ffe2d408570b0de57f3127332d5c06e7bd34038cd1d6f492ad5ae8c653e2117946faa1407", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242872, "uuid": "0451d609-4532-4e3e-9378-17b964af8491", "value": "T124C4238625DEB6C1D56AC44204ACA2C3D03D572F37F3374B79E4435A2AEF2A06B6D85C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242872, "uuid": "d0fd8d5f-b693-4613-ad15-1fb0f4741c44", "value": "12288:0l25LZS0qOCzg8G+2DcMpBvGLRUZCJSM20YSBD+PzhQ:0lD/OCUL+dMp1LZCayBYhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626242872, "uuid": "891d427a-714d-41bd-b8dd-895356fbaeeb", "value": 594091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626242872, "uuid": "cb687ddd-7d72-4c43-87e5-f000a3db6622", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242872, "uuid": "2f0d9d96-7358-4baf-8aa6-d3a013fac72e", "value": "finance.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461caaec-e4c3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626281291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281291, "uuid": "7ea2b016-04db-4437-b17b-ede28e83ad16", "comment": "Malware payload (Formbook)", "value": "4fce8340b8819f756b9e3afedf5917fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281291, "uuid": "17984ffd-3b39-4087-8e7c-047d23c3fb4b", "comment": "Malware payload (Formbook)", "value": "c36fa12719f133f394b113938584b1d693d4741df4e40d34958dcee239ecd153", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281291, "uuid": "956a1f25-4ba5-42c5-a8c2-a492d13539fa", "comment": "Malware payload (Formbook)", "value": "23db92ecb94c2d37d0f02a5109a0cce8caf87ab1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281291, "uuid": "49976ee3-670a-4f74-97fb-dc0a6526e49d", "comment": "Malware payload (Formbook)", "value": "29745041bc6c34dba881df1870293fce927365d13ffb0dbf88a255bbcc1eb17c4ac67e0db1be8c9a6179dc6bfd4bd2fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281291, "uuid": "ab185f99-e703-4e05-abaa-95ef3d863eb6", "value": "T141058C2C23FE9619F237FF319FA0E6449FA676B59215DD0D2DC4024A4821D82EEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281291, "uuid": "02e8067c-ff04-4ad2-ad10-6741a1543f5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281291, "uuid": "8809f996-115b-42b5-89bf-c9120d9b090c", "value": "12288:zwMv4TArNls9XOd4+QCIF5opyAOGDgZHJJNDO3z7fz93WGXg1SK1ZJdqMRdkjejH:zwx6yAOGKHJDOD7fzdWGSQKRcVvDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626281291, "uuid": "2c13ef37-7803-4e49-b6df-2c0ae770fcc6", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626281291, "uuid": "d237f836-920f-4e2c-8ee7-c52caf788cbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281291, "uuid": "76b7b826-e457-4c05-91cf-84efc72100cf", "value": "4fce8340b8819f756b9e3afedf5917fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8866a870-e48e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626258638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258638, "uuid": "2189783d-dec9-468b-a228-9ebc128e8864", "comment": "Malware payload (RedLineStealer)", "value": "4548c1921ba4a1561dc2f480136f1f1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258638, "uuid": "7085008b-7b59-4a0d-b8ea-01a41d004311", "comment": "Malware payload (RedLineStealer)", "value": "c436c6b3fef9c92ce0f8edd8e3e1c57875126535997db3e1b0889b5114ec26e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258638, "uuid": "25a79809-bcac-4a3a-bc72-325d05e9fdc2", "comment": "Malware payload (RedLineStealer)", "value": "c4003a35d84abb54233b7ca3db0ea256da6ebea2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258638, "uuid": "76b67c2f-65d5-4849-9d87-62c63caa753c", "comment": "Malware payload (RedLineStealer)", "value": "5b888eb4f20a76d3f53790f82bb343e6aa5b780de7e3a05dca5c17311548e60aefc4888cde3cb2cc846a13fd119506dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258638, "uuid": "5fe1283b-a4b4-4357-9b83-a8f6161e209d", "value": "T1BD84352864BFC01985E3EEA12DDCA8FBD89A95E3640D743701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258638, "uuid": "808a9855-cb58-42e0-99ab-cf0991d5c577", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258638, "uuid": "d5fd51f3-ed56-4864-b33b-3736e0e5fb2e", "value": "6144:DwKqovbeea7ghcsaxiFrhSnJSLTmDVwifH:DwK3vbeea7ghcsaxiFrhSnJSLTmDVwi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626258638, "uuid": "6c4ef40d-9868-4315-a291-6fc3dd556341", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626258638, "uuid": "83878e92-bc9b-4adc-9719-8b74eefd7e8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258638, "uuid": "289b26fd-403c-405b-ad97-7c8b09070958", "value": "4548c1921ba4a1561dc2f480136f1f1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1203a336-e459-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626235677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626235677, "uuid": "ceacea38-6ea8-4618-b153-95c822b76822", "comment": "Malware payload (SnakeKeylogger)", "value": "7eb3371fc863fd51c74b684cc1d0be09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626235677, "uuid": "5e63c9b0-6338-40d0-b699-ed1056601935", "comment": "Malware payload (SnakeKeylogger)", "value": "c637accfd39f444936924babb193cb60ffa70e9689c614adf12a45c64741202e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626235677, "uuid": "034193f8-0751-4f1e-a66f-5457c0f6d394", "comment": "Malware payload (SnakeKeylogger)", "value": "3dc5194188d68d5f00b17c817e063afd32b5a357", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626235677, "uuid": "6ef1e146-4335-41b9-b771-ec12f8979597", "comment": "Malware payload (SnakeKeylogger)", "value": "4b87cc4bed5ccec8937d177b439d1bb70868516797170fa00ab891e4af5ef82f5714de940df3a898a098f95c30bbfdca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626235677, "uuid": "aa045970-82e1-4241-8611-ce8d2fbc0856", "value": "T1DEB49E82A4D00766D42E20BAE4EC78F912DDF91E6444EDCF54F0E79A907B34FC68B619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626235677, "uuid": "cae6f0c3-84be-4275-9bca-cad5d29ae9b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626235677, "uuid": "14c0cd4a-40a2-4357-83c7-b3c6246fb509", "value": "6144:vNR4LL0Qo10GvqoWAplNC0KkUK8/UN8FEhPk4eQiyYPLj5G:vNR4LLzD0OhM2qVehw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626235677, "uuid": "49b4db70-9f76-4bb6-8bdc-e7968df928e8", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626235677, "uuid": "ef5706db-4220-4083-a284-b609f2935168", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626235677, "uuid": "99056a92-e05c-4800-b23f-5f3db25aa984", "value": "Amend QTN TECH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45befc6a-e46a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626243065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626243065, "uuid": "88eea9b2-9358-48e7-81de-d85e94fc9321", "comment": "Malware payload (AgentTesla)", "value": "fbfa5393111ad25de794e3ef2e4ea06c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626243065, "uuid": "c8f3ddc8-ac06-4a69-824d-c47644270bdb", "comment": "Malware payload (AgentTesla)", "value": "c6fd9282c24208cef50b3a0ba70b26b4dc941db1c3d32972b16f59d52d5d3c40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626243065, "uuid": "d710343a-539d-4d4b-8da7-4c0f9e8aafea", "comment": "Malware payload (AgentTesla)", "value": "457266b59700d161ae36478a79b70db4fe9fe9dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626243065, "uuid": "e28fadfd-731a-4b3d-a6d4-d38e75167bfc", "comment": "Malware payload (AgentTesla)", "value": "d25cf34159aa3d5aa49774eaaaf205213ac7091edf5b343c3cc49d963044e4baed767d04064485f2d9a764f81fbd032b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626243065, "uuid": "98808fe7-f9e7-4fc4-b920-87dcf83bb9b8", "value": "T1ECC4235613D9A18FD0577CBEECDD2CCC32816B6E8A72BBA2505C2917C11B13E9535C47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626243065, "uuid": "8cd5a37a-9854-4e7c-b28b-3148900af857", "value": "12288:WFvKtUxPtW2nCFJ9z46PYFwsDcdbzd4sVwqCzVJ9+a3:vGxPlQwFwBpdV1I9D3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626243065, "uuid": "1c29164b-d205-44bf-9897-ecde395401e4", "value": 551954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626243065, "uuid": "bcec78cf-34e5-434e-b158-f4028d2f390a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626243065, "uuid": "b4d990c2-5b1c-46e7-a25b-a362ca7b85ef", "value": "PO#4500488718.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf5b64c-e4b3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626274699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274699, "uuid": "8cb46c2a-514f-4135-8a21-7e545b44eec4", "comment": "Malware payload (Mirai)", "value": "5e3a31dc0a966ba9dcc37af07baeb271", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274699, "uuid": "02f41a0f-a766-4a5e-8ab0-7467ac3bc4a3", "comment": "Malware payload (Mirai)", "value": "c834b71a223c21047b5bfb64b8b066cda8553e14b609fe397cf3525b91e047ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274699, "uuid": "438657bf-4b25-4458-b665-4ca6436d4ca9", "comment": "Malware payload (Mirai)", "value": "1815b365ae775504169ae6a7bdee36a4d0777678", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274699, "uuid": "09b55c75-a6b5-40b2-aa3c-c89ee25c805c", "comment": "Malware payload (Mirai)", "value": "6a7b23f1b193b00ea4412eba41e41fbe7c591bc0280fbdd1adca0c4139a60f1d991a549f532896e00a928a49d1eae884", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274699, "uuid": "a19790cb-de7b-4953-b890-ac0957a01bcf", "value": "T17B831786BDC28912C6D423BAF62E10CE372563E8D1DF32179D152F5137CA82F1EA7661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274699, "uuid": "44bce1ca-20e6-4436-8ed0-8e00703e9722", "value": "1536:OtJyFoanbTKwXz6U/A29mfrtr1zua41QlfBVffjSDtOHC8zOIByDi5:wJIoan3pi1zuafZLjgQC8zrBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626274699, "uuid": "7ac09bcf-0157-41c3-82fc-a0c6389feddb", "value": 87036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626274699, "uuid": "5dcf1bad-74c4-440b-814e-5265cadf026c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274699, "uuid": "cac509c0-d369-4321-aba5-c647ec7337fe", "value": "5e3a31dc0a966ba9dcc37af07baeb271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf01efb4-e4af-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626272930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272930, "uuid": "22ac2a02-635d-44b1-a322-73f91fc76940", "comment": "Malware payload (AgentTesla)", "value": "f76ce4db822731292d0f771d95f2605a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272930, "uuid": "c4a8a976-9d6b-4301-9e57-3fdae2db2719", "comment": "Malware payload (AgentTesla)", "value": "c85be461c71e3ea06d59b1e1ba431c349cbe8d587e7844b739eebb9c7d5125cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272930, "uuid": "0dadbaa7-1236-42d0-ba01-acae78123814", "comment": "Malware payload (AgentTesla)", "value": "a17c412a138687d79fb31aaa7d130fe61dffab6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272930, "uuid": "890634f5-7561-4b4e-b9d2-e333fcae724e", "comment": "Malware payload (AgentTesla)", "value": "c0564098d0ca4132a29640c84b66147bfe2b8aca4adabae994573d254e05a9bef9f2ed87d34b6bbecbca27249c983cfb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272930, "uuid": "6ed4ea8d-da03-4e4d-9f1e-5bdc2562fe0a", "value": "T11AC4F151D8ADBF6ACA89173071EA590B801CADACEE04F463B327F0DB77F109855749B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272930, "uuid": "519c8392-1393-4795-800a-4720ae80def0", "value": "12288:2PwSAr4+z4ePnxM4BFt5vkvO/hI3mDUu8jRC6kX/xRUiXMuH:2Pw++zvpM4BpQl3EgFCjksH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626272930, "uuid": "13dd5bae-ace1-4304-a3c9-3e737595b3f7", "value": 567304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626272930, "uuid": "11af5038-e01b-484b-9e5b-190fccd36804", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272930, "uuid": "0bccd0d8-1e3d-41a3-a8d8-8a43eea2a625", "value": "PO-New. Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14108af-e4b5-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626275484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275484, "uuid": "1fb0013f-c2f9-4e32-be5e-f271bd1f2ce9", "comment": "Malware payload (RedLineStealer)", "value": "796545b6e97ad3117b6517a21edc4d4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275484, "uuid": "2480674e-4596-4162-8057-e994dbf28d69", "comment": "Malware payload (RedLineStealer)", "value": "c8855f3f5ff5042afecc442789f020f6264216ec09bd950da6e3d5e9d92c806c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275484, "uuid": "7074249c-c4a7-45f1-8c16-47a66358d85a", "comment": "Malware payload (RedLineStealer)", "value": "7917f94940e3f0db918295b17f213e049a055cf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275484, "uuid": "b0c18064-5f67-4058-96ed-0a090922e543", "comment": "Malware payload (RedLineStealer)", "value": "ec023e5e3ae9b8187127cd2057a61a39b527a504deb91fbbdfb4fdd1d2c404edf7fa0fbe38b962789bb6ba12d58e9740", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275484, "uuid": "86d952ae-0ba5-404a-ae02-8bfa1f1e6d68", "value": "T11054E01136A1D872E6F79A306178DBA22F7F78332AB4894F37542AAD1E303D19576307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275484, "uuid": "5ea3d9df-47fd-4e9b-ac80-c452fe276c70", "value": "ad9f6c8b0f38d755f66fb877c364f60e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275484, "uuid": "a11a2f8d-c7f4-45ab-af06-ff821a05ada1", "value": "3072:2QBNmFK4AYVx1OkS2u0hUwDC+It49lAmpbJuN0bJxF5RhUGWRcHB:24QWFkwmD92mpduAJmNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275484, "uuid": "287d96ac-fbc1-40a5-a394-3fc4c7009a8f", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275484, "uuid": "d6ab0dc4-0b01-4149-a3c1-5277ff20eb76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275484, "uuid": "37868157-559f-4c43-b74f-dd258ec5208f", "value": "796545b6e97ad3117b6517a21edc4d4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79369df8-e474-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626247446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247446, "uuid": "1aefc78a-ba2c-4618-a004-1a6833a15d7c", "comment": "Malware payload (AgentTesla)", "value": "e58635ce72e2dc6a704fa01f155e385c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247446, "uuid": "8344f626-9640-4e7f-a564-3fe2f934787c", "comment": "Malware payload (AgentTesla)", "value": "c9c015ddaa67fc81b96feb311757e4fc7705f3c9dfa6e624df78e8893986cd4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247446, "uuid": "faa5e9df-7672-44a8-8b1c-5a6bad51a71d", "comment": "Malware payload (AgentTesla)", "value": "7e33fee15c89c24770df25703baf947ae75a768c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247446, "uuid": "897687f3-3c2d-4a03-839c-7f3d6497942a", "comment": "Malware payload (AgentTesla)", "value": "d87493e74bf37c2c46507421c2c2c4e5ce7e0e4aa51ab605e7efc4085aecc9af20c8d711d53999529f9b7a75c82af521", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247446, "uuid": "0343fd6f-fbf5-4088-8350-94df4588918f", "value": "T1CA2518772020387FF8C278F158DCDE75A9289C930F46B196A2D73D676ABC187B910276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247446, "uuid": "91b17390-3392-4de3-aa37-7b4bf76221f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247446, "uuid": "b2dee493-b83d-43cf-b88b-8e15fefb2a71", "value": "12288:RFP6dJwUeoqsd5OwTrnNd3+6A8Nn9MJyUvn935Uxbu2Al3vS+JDrgebAqDsh5rIx:R4dm725OwTjNlNO5l35adUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626247446, "uuid": "d72915e2-42af-4fcb-aa35-a5fd80099bba", "value": 1008640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626247446, "uuid": "88dbd939-02b7-4faa-90f1-7f0df0f487e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247446, "uuid": "20fa6260-869f-4f33-8466-e27e56a75a34", "value": "fda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fde2952-e4ae-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626272314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272314, "uuid": "715308ed-9893-4532-b0c2-31d6b7501a75", "comment": "Malware payload (Formbook)", "value": "d29881266e4afe72e70109bc71b6371e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272314, "uuid": "e95b4ad2-1b13-4e79-afe6-7a5e06bc6241", "comment": "Malware payload (Formbook)", "value": "caba8bdc24b9da25a337a24142ef84d24e234a4500e809f8e0b8701606f7b083", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272314, "uuid": "3b07ef8c-38a8-4c92-89c1-f6fc19543294", "comment": "Malware payload (Formbook)", "value": "ccbde28ef816b9d3147cda1205ccd47bffcbb612", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272314, "uuid": "f267cf5a-926b-47a8-b889-0ed3d287061f", "comment": "Malware payload (Formbook)", "value": "8567471e53c9abfa1ac28d643e54210c6154e082550c2321d9e8776f3f8a598fca0567ea4c984d20288cd2e984c40c00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272314, "uuid": "fd2a4069-dfb9-4ff7-823e-8ffa14480ab7", "value": "T15B0502747781BB4EC33E4EB989929C2097E0D6738307E3C7ADE326FD528D6A54E21152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272314, "uuid": "6be4cd26-09b4-4e98-b39c-95fdaf527048", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272314, "uuid": "a725b5f3-007e-494a-a2de-7a56cb53b013", "value": "12288:j7A86DvH1zvxG4eAnur96uarQTECJIcKgYlcOPRi5UyC/nx2O2ebDy4PBrgSFqaY:j7mvxZG4eSOvrImYlcFUyC5Vfy4Pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626272314, "uuid": "cba91dce-d118-428c-9361-1b8f9093562e", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626272314, "uuid": "380fbbea-91da-425a-ad83-67682eb4dd13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272314, "uuid": "ed525fb8-1f7d-4ab2-9db1-60e5088f32b1", "value": "order spacification pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55cbf076-e4b6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626275733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275733, "uuid": "559daa6f-5089-490c-a0aa-ea014e08bae4", "comment": "Malware payload (Dridex)", "value": "29f09520cbf6dda64cd28081c01cb7be", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275733, "uuid": "315a8c0c-45ba-4b82-ae72-ca78d5cfb663", "comment": "Malware payload (Dridex)", "value": "cae068c4c59a4082133d44bdc9db33444b759f8f465a24b37b84670243bd5104", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275733, "uuid": "56be1c80-d191-46fa-8aa0-fef2d3aa447e", "comment": "Malware payload (Dridex)", "value": "94391f975fd348eb905ca684a579ca6f0f2374a9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275733, "uuid": "d71e8ec3-2e1d-4cc2-83a4-8da56db8aa16", "comment": "Malware payload (Dridex)", "value": "e6b61334a8e88dca072d5e208302108c35febfa42bcd2814c3895c6baf7e68226ceb32a060182160f1cf0ca8b9d4096d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275733, "uuid": "3d673593-a55b-4697-a64a-6fcd086126a6", "value": "T1EBF448E5ABA4CEB5DB01C1718C9D1A546374CC118A49AFC77265B03CFF3AB798E881C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275733, "uuid": "b724f7c7-5b7c-4cf1-9bea-ff6d46af0728", "value": "12288:PRYbXrlUc6XS/CwRl+4MW1H5onZHBDznxcp/c0UGtkbByxlFYd2DrpWdS:gUc6EjDMW1UrDjxcNcfgZI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275733, "uuid": "efa23b2f-0093-47a1-860a-19af3974671e", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275733, "uuid": "c4c8547b-8b3e-4285-9f51-1f8423685ef4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275733, "uuid": "2ef19b31-d411-4ebd-a85a-3b31a5b62f21", "value": "Receipt-6218387.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b907f4f-e49c-11eb-875b-42010a9c0053", "comment": "Malware payload (Pony)", "timestamp": 1626264684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264684, "uuid": "1813d0c4-a891-4a2d-a427-e078b7769747", "comment": "Malware payload (Pony)", "value": "d72b77266894e5e723fe7504ec9b6c52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264684, "uuid": "7d256f07-7345-4cd3-8723-86c03c7ff857", "comment": "Malware payload (Pony)", "value": "cb2e1d1d944f5eeabebe9ca9a111ca8d709774147ecaf6faadb885731792358c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264684, "uuid": "fada8c82-e370-4f6e-89dd-66a771025351", "comment": "Malware payload (Pony)", "value": "c78f52e769b57c932b36796f92f386282c9d1171", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626264684, "uuid": "e702531a-469d-46e1-bfc1-fb9f0f88eb6e", "comment": "Malware payload (Pony)", "value": "c788ac362f5d48906e094401e6aead573bd2cc4cc9299e5cff271573e8d059ec143d7260d133446032eebbe029d07540", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626264684, "uuid": "b1d1b617-c82c-4ae7-bf48-30267f45d3da", "value": "T12F14F12565415C2FE4A064B9A676C418E030D8354FE5943FFDDF460ACE2E2AE70EF9AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626264684, "uuid": "cce8857e-17a6-4fd2-aff8-3fa83f16e61f", "value": "4ba127fe6eacb6b5853313f4b9c03263", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626264684, "uuid": "670337ea-5034-43fd-ab2d-cfbc621541c2", "value": "1536:BN+Phu25tO1Xei4eI9KQDpMbYpXsv51Bv4mE0Emt6+iHlikUDA+EQDgzK7:ePhV21XTIDpSmsvMwt6+QlikUDAmgzK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626264684, "uuid": "1ac970c0-b58b-4a61-9a5c-2ab3967da38b", "value": 201376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626264684, "uuid": "cc6c94ca-6af2-4501-914a-879c65fc3443", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626264684, "uuid": "fdc14d81-e1a9-4c3f-b15a-07ec13764416", "value": "d72b77266894e5e723fe7504ec9b6c52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7161f34e-e448-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1626228535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626228535, "uuid": "43311d1f-c9be-449d-afff-294bee56cb2e", "comment": "Malware payload (GuLoader)", "value": "bc3bfca121419774d3295f5baf068daa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626228535, "uuid": "e4196cc8-0249-4c0d-9a7a-fe3d89eab513", "comment": "Malware payload (GuLoader)", "value": "cbb5963cb2227c9eb66586357aacbac1fad76ad6205ecd232a91f14d885bb8b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626228535, "uuid": "8622d6fb-2930-45c7-999a-78fe026b7546", "comment": "Malware payload (GuLoader)", "value": "78f7eb593edb208767d3213df011668a9f585618", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626228535, "uuid": "26a4c102-bd4a-4f57-b0ec-fdfab6b5e418", "comment": "Malware payload (GuLoader)", "value": "224f2f5ef266144dc404ed1f656e53ca425cfebe7ea080b7d5289599614f7ebb94cb9fb5ceaf2d8d5a2b8794faa20c81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626228535, "uuid": "61853d55-bb7b-4759-a8a5-51520ed2075a", "value": "T197C33996B6F7BC56D4E449322974C5E1AE3E6C323C038A0BB28E775C3C38156456EB1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626228535, "uuid": "956a29c4-5076-4295-949d-96252be7b8a6", "value": "08004291c3f07c876b9b6067b960b137", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626228535, "uuid": "0b187fe0-82dc-479c-9abb-378693667792", "value": "3072:lMWcrpFS1tp/+HnZFa1yplJrZj2nGoxX17cfD8iNjiC605NT2:hcjSRun/aAlrZSdxX17cfD8iNjiC605N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626228535, "uuid": "dc0b301d-f840-4660-a499-3e20632963de", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626228535, "uuid": "f961b07b-a740-4648-8d09-a2847de2a06a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626228535, "uuid": "264a84e2-c79d-4dae-a925-5bf349f09559", "value": "DLGSMAAL.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d8a339-e4bf-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626279685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279685, "uuid": "ba0d0a31-5beb-4ee1-9c55-88f61886093d", "comment": "Malware payload (RedLineStealer)", "value": "8dcda8a0525e16dc886a87a8a4dab81a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279685, "uuid": "49712e24-2e5a-4471-9782-5d7cde90056d", "comment": "Malware payload (RedLineStealer)", "value": "cc8ac2d85b81d9aa5a6ab1247ec147bca81b36c97e8b9282cfebf566aa4b94a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279685, "uuid": "f397a746-bf8c-4673-8bfb-86582b23ae5b", "comment": "Malware payload (RedLineStealer)", "value": "cd850d7c70309440c0f57ad240fa5e5280ccf0a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279685, "uuid": "8522c60f-8cf6-4d25-b0b6-e3707c412fd4", "comment": "Malware payload (RedLineStealer)", "value": "09ecadf9272f41f75e5f0683a39547db3bcdf91d2ddf0d9f75aa9e4bc7f4650eaedd6acba2ff5abcf3aefd1f25cbc70a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279685, "uuid": "b87a54b8-f55f-4f38-af2c-d37244b7595f", "value": "T19AC45D9D325072EFC867C876C9581C60EA21747B930BD607A09322ADDE5E69BCF251F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279685, "uuid": "e3ea4a65-71c1-44d5-beea-16ff5c70e1c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279685, "uuid": "823d6f36-73a0-420c-ad45-ebf4dd547f6f", "value": "12288:kSt8i3xZZXQUCGbwyRZrfRPeVDJSatbiucBAKI4Rri+vefEPGomSZhfhz78q2zZG:kSt8+QUSyRcSahiuYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626279685, "uuid": "caa704e4-d146-4dd8-93b2-61f3d23aa4ff", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626279685, "uuid": "2edd7bf8-5894-4ea4-b164-d6a20c41e639", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279685, "uuid": "a5a1a5a0-d9b0-4573-b467-478addcefe5d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002c293d-e4b3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626274301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274301, "uuid": "a88f9e61-a262-4c5d-880f-600b22890496", "comment": "Malware payload", "value": "0ec7c9a8fa6bef0326b7e8ea36e78787", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274301, "uuid": "7710959a-083c-4b14-844c-1ac89ce00e47", "comment": "Malware payload", "value": "cce5e27d0906d99ceba84cc364183e5c63f9cca22c1ad80baa38bc58ff48f550", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274301, "uuid": "4f2cf47f-54fb-4552-9864-3d97c0d198c7", "comment": "Malware payload", "value": "58fdb9a23e13428edbd6fa904f1e0afd94a3e71b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274301, "uuid": "d2be95ae-fcaf-4468-92e2-e67097dfe02b", "comment": "Malware payload", "value": "daa5b1197ace56ec9bcb9e689df8806272cee40bd4b6a207913f05c0ce62b9253513ed60703c0309b7d4ec2cc18eb0da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274301, "uuid": "83b97a4d-2046-4fdb-a5c5-a806b658c03f", "value": "T15F94BE7B479C0A27C7BED1B97AA0F006FBA088933B10DE0F5BC755C25527A0265C6D6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274301, "uuid": "a0744e63-fc22-4607-8478-d198bf7ed47d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274301, "uuid": "dedd45a5-b128-4d35-8d28-e57af70bc5b1", "value": "6144:gkUIjGjWGVJCUgqaNX7Ue97dR60ytlSsqFwvmgXf/BzzAnnCas17Wfjmwy:gkUQdoJtMNwqdatlLHf/BzzAnCb7Wfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626274301, "uuid": "28bb063c-7aaa-4928-ba80-187c13134bda", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626274301, "uuid": "e08f0672-9da7-4917-a5ad-5fcc989d85dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274301, "uuid": "07ac776d-5545-44d4-a8c1-5f8e0ea42fd4", "value": "Proforma Invoice CINV2021000000000231TRN #10003892780000101 remittance swift copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aafe0fee-e4d6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626289620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289620, "uuid": "c19c7cef-8c72-4d94-ae11-b213103738fa", "comment": "Malware payload", "value": "cf1af8277a86596fc04df4adbddb0702", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289620, "uuid": "ba5033e1-1712-410e-9ec6-5414908c6dbf", "comment": "Malware payload", "value": "cdcc50360daab3bda1f658df5d13f1c205c64cc628a06d4e887fecd84d7c7fcd", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289620, "uuid": "a0f2005f-5b21-4b45-a362-2bd6b47930db", "comment": "Malware payload", "value": "782bf3d84a0f4432d36f31ae35925de0ef2142f9", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289620, "uuid": "2a2da981-b925-46f8-a87f-70b2ddbe76d3", "comment": "Malware payload", "value": "32048e27442172a95413cce84f4e39b17d621828d04d8aa85aa5a04d784388d30a7600b8e9de8a38eaf2d839b46171f7", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289620, "uuid": "f03416f9-12b8-4013-b47e-195fb74d5ace", "value": "T14AF448E5ABA4CDB5EB01C1718C9D1A586374CC418A49AFC77255B03CFF3BB798E88186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289620, "uuid": "104d173e-4ef6-4592-b5e7-2b121ed32534", "value": "12288:mRYbXrlUc6XS/CwRl+4MW1H5onZHBDznxcp/c0UGtkbByxlFYd2DrpjnqO:RUc6EjDMW1UrDjxcNcfgZI2oO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626289620, "uuid": "0d454cc5-c33c-49a3-b5ab-4b238f9c3d3a", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626289620, "uuid": "fb38a556-fbe1-454a-a5e7-00468c1a95b7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289620, "uuid": "3bfeb5cd-521b-4b66-bd81-5a4700454efc", "value": "cf1af8277a86596fc04df4adbddb0702", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc76334-e4b5-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626275207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275207, "uuid": "4c6d8108-ce48-4655-89de-bf63dbf1de29", "comment": "Malware payload (Smoke Loader)", "value": "860a7fb9a614e3cfd0cb666baa425523", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275207, "uuid": "8a3e3ca4-10e5-4b83-9f4f-40b9498d329b", "comment": "Malware payload (Smoke Loader)", "value": "ce1a457a5bd8763fde41a27081d5a885b66aca31b123ee42885e29bc8cfdbda5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275207, "uuid": "cd040148-868a-4702-921a-fc8c24434735", "comment": "Malware payload (Smoke Loader)", "value": "126289e5096a69da6af2bfa80c46a4d2c53a9e6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275207, "uuid": "25ce2b65-6427-4239-adb8-0e9948d897b7", "comment": "Malware payload (Smoke Loader)", "value": "d48a6f00bcc8695f9746933faa0bfebccd525f1a717415a6d806d2e324785f445b3826efe49fb99587e120ae0d7f8ee0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275207, "uuid": "dbf196ae-a8fb-4f78-af2d-8c71bb1e6ed5", "value": "T115149D6136E1C432F6E709302C7C97A01A3BB9F36AB1854F37551F6E0E312D1AAA6357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275207, "uuid": "380d9b5a-84dc-4e68-90f6-a5e0c44af461", "value": "f9c1cf1b2cfb3ee96a94f56e9a89c09a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275207, "uuid": "d18972f8-76e6-489b-b119-784b11aea88a", "value": "3072:YBNmzoNC49UWCV1OQOINTfjVC2MuFem5zQxujmOKHk:AyGUpV1V1NrJCXurQ6mO6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275207, "uuid": "73bce8f6-f63d-46a0-8209-af669bbdecab", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275207, "uuid": "6a536517-d53c-4c50-8549-f7bc7c6c36cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275207, "uuid": "e8d3414b-5a61-4545-87dd-a142e02008df", "value": "860a7fb9a614e3cfd0cb666baa425523", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b97f0bc-e48d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626258134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258134, "uuid": "9fa2f094-fc89-4243-a3e4-de9bf9355004", "comment": "Malware payload", "value": "6dcbe49f06a9b4c38217582be8f05029", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258134, "uuid": "df40103a-91eb-4387-844c-0f56bed79c09", "comment": "Malware payload", "value": "ceb0cf0cf3a38706cc3363453fcb3d057d8de94a5978087878086468f7505619", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258134, "uuid": "0fa5deac-ab45-45c1-bff7-7eec39aca3f5", "comment": "Malware payload", "value": "7f322652aa24b1734ada904d06362937fcf873f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626258134, "uuid": "54323232-b966-4ad5-b016-d9299fa4c984", "comment": "Malware payload", "value": "9d56524cbde76f250e7f01a1edaeb853412211bb1d839e8d93d92e38c11034e9a31e9edf10524f203d7e135822864c89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258134, "uuid": "41461bb0-bf20-424f-8a99-495760f8ac8f", "value": "T1DF45AF22E692CC37C13326389E2B97645E3ABE50393869463FE42E4C5F356C53F25297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258134, "uuid": "64588356-5d55-4c55-826a-41c9da53c818", "value": "fcb44a1a3fc4e1e98c43d377bd1fddff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258134, "uuid": "724cd6bb-ca56-4da4-a028-b01a95347f37", "value": "24576:jBoara9t7QhFjBRfUYUgaOr8m3zFlpoqzY2as3/Vjpl3S:jbetY1RfUYqwoyYGNjpl3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626258134, "uuid": "979425f0-1661-4fff-a406-bc1e3cfc183b", "value": 1271808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626258134, "uuid": "14293376-c385-4dad-844c-99ac57514bb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626258134, "uuid": "ff971b5e-63e7-493d-81d9-d95618dffb7d", "value": "6dcbe49f06a9b4c38217582be8f05029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e83f202-e4b9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626276983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276983, "uuid": "c5bfd417-4fa8-47fb-a46d-cb8a9bac5d20", "comment": "Malware payload (AgentTesla)", "value": "949f8e44a8f9af126d713f71922c6236", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276983, "uuid": "80e9309d-c04c-4c39-b6bd-c3b06b37c7df", "comment": "Malware payload (AgentTesla)", "value": "cf3f60295611af5ef3e9c80a9ab1a09928431a8c4a1561f7139267db480e05cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276983, "uuid": "2ad352c4-aa47-4155-ae20-38b19b6ab979", "comment": "Malware payload (AgentTesla)", "value": "18ae8c0be20713522cce4acb101ffc96a2b85a18", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276983, "uuid": "4d57bfcf-cf8f-4d2c-b1a8-cdb8dc5ffeaa", "comment": "Malware payload (AgentTesla)", "value": "e0702a8494305d7fd399c590a8cac569b68ded4ba3616ecc67e2304c4163da949ae6345cb63c363fd46f5e73c2ab4f67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276983, "uuid": "0cdf2ce2-d32d-413d-8b45-7d3fb5f551ca", "value": "T17F25CE987640B6DFC80BD93689645C74AB20BC7A471BD207A0D33EADB97D6D6CF101E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276983, "uuid": "dc6a0d75-0fa5-4483-a2ab-531cc072b2b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276983, "uuid": "f3040fc9-901a-4af6-9e07-4a375786e9a6", "value": "12288:Ew69qCmxXA6lyC/v9FPHv70bVYiIYj2Ul5f0BJgVxTx5+c5INX0uDxBECIQtMg/c:EwF3h4wHobBIslJMM5rIF0Dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276983, "uuid": "10694de3-2b25-4320-9257-f96cb9cdda7f", "value": 963584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276983, "uuid": "587334ae-6d03-4646-9083-776ad5bf2438", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276983, "uuid": "5beae6ca-5d17-4238-9488-e2ac8e7610d6", "value": "949f8e44a8f9af126d713f71922c6236.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28756927-e4eb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626298421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626298421, "uuid": "a77b7d26-bf21-49e0-84e8-2aeafc801c06", "comment": "Malware payload", "value": "320ca5b0ed608c151c60cbf152ebade5", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626298421, "uuid": "04000022-2713-440c-98c2-b797f20f7f18", "comment": "Malware payload", "value": "cf3f967a86596792f4196f9c9fbb29d47aeedd5d9283a57d0cc28bb93113f4cb", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626298421, "uuid": "315af6ed-0966-4a09-ad14-1f9d69386c86", "comment": "Malware payload", "value": "a32d62d7c2ab1026153b8b5b52eb13b36b873981", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626298421, "uuid": "d8f68eb5-649c-4cf3-bb75-abb2a8e38988", "comment": "Malware payload", "value": "729d1459c9c345b99465133ed8e443a33d861823120e52269dbdd8a0b9c67d8f46c3ba4799e44a92256eed4c1f5029d2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626298421, "uuid": "f1ffb4aa-e1f8-43dc-b022-a84699d5d621", "value": "T1B71501947E8CDC2AD733D238559CC433F46B849A9E87A1270AB657AA1C34D950F07ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626298421, "uuid": "d38e8655-9591-4811-8c4c-af985259f031", "value": "24576:BiP2REH2m/XUdcc51E8j5DX6j0liIDFGVy+O:Bi+eWJdcQl1DX6j0lBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626298421, "uuid": "387b528c-b7cd-4a70-b153-d0aeaf1d7b69", "value": 924203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626298421, "uuid": "adab81da-e76b-43fb-8810-cb074e65b43e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626298421, "uuid": "384fee78-7c33-4460-ac8c-da1f457c7655", "value": "Bot3.91.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f454da0a-e4b2-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1626274281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274281, "uuid": "ad555724-a51d-46ab-846e-3b4df4c4a4a5", "comment": "Malware payload (DCRat)", "value": "f8025dea93783066a5ad550e835cb8f6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274281, "uuid": "3bddb1c9-4511-4779-81ef-3eae7e609296", "comment": "Malware payload (DCRat)", "value": "cf84be2a0d26ffd76a445e6a288e1dc9d61ff01bd00e9c4dac583e86215c207f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274281, "uuid": "b27cff23-5b7f-44dc-89ed-c60ebc023eb6", "comment": "Malware payload (DCRat)", "value": "87c0d2ccbeae7fb343d74ea681e0a5b379c7f693", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274281, "uuid": "3d5c9f4e-6ded-4dc8-ad2a-b2d98d959f95", "comment": "Malware payload (DCRat)", "value": "f7be67e21c1670a349e13a27bda69d19e291e6f4ad78e528927dd56ac7034de24350e5addc4ae1107a8823822262e769", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274281, "uuid": "3baa8c56-d192-419c-af33-8664210ee2da", "value": "T18545127B006554AAC6C81731F0740F0F7ABCDA351A80F5A9B00EB3AADD1D9AD96F8375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274281, "uuid": "845d638c-4f91-4c79-939b-30c57c691de0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274281, "uuid": "25998fa1-c711-4d88-9c55-240cbba6a09a", "value": "24576:QGPvkUMqitSeaEtjxIYBd9VJrC6L5HW2YAMysN3hu:PPTMFtjxIy9Vwc7CyEhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626274281, "uuid": "f7d5b76c-2e1b-44e6-bae3-0c6281d5b29b", "value": 1261056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626274281, "uuid": "2eaddef9-39c3-496b-b011-9c42a7a8aaaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274281, "uuid": "ba87ef5d-ead7-4e15-a8c1-10e6c39540c0", "value": "F8025DEA93783066A5AD550E835CB8F6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fdfb560-e4cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626286541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626286541, "uuid": "519a7d0f-ecbc-4017-b9aa-eeb1a9cf15f6", "comment": "Malware payload", "value": "3818a2d55ed6098f44394f0816311888", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626286541, "uuid": "ce871605-dc61-4c60-bef1-b35293e19a96", "comment": "Malware payload", "value": "d00c7bfa4a6820162f26ccbb02b8232cbcf4610ce201ac8a99b07fad3e01c888", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626286541, "uuid": "dc0d2a80-1cda-47b4-8266-e87c75151f99", "comment": "Malware payload", "value": "acbd4e3268c55f30c7d4777d2e514d0db90642ab", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626286541, "uuid": "eb50725f-d3a5-4477-9f8e-41b176084e63", "comment": "Malware payload", "value": "866273563612f2481f16f3eb44c68324db9e00f52045bb7eb11926888454af53290e9f57e2c22e4469f635b542c8e7d0", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626286541, "uuid": "7fb060a0-7d44-4dad-9c07-d87f2e1eceb2", "value": "T14951861AFD47D15C9BB9236BED978562FF1B801B9DA2104C71DCC2495F30809A6ACF8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626286541, "uuid": "20ece7cb-59f4-4031-b9b9-d6f7ff8bc6e8", "value": "48:AEWh48iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBoze:uGhrffvIypvK0elkEYZ85ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626286541, "uuid": "7a950fa4-4a82-4e25-a60f-f267317532c8", "value": 3140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626286541, "uuid": "e0a78c1a-8f17-46bd-b837-4e6f706edcf8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626286541, "uuid": "5f7c0b7c-6b2e-4ac1-b2f3-3fde8824b6e6", "value": "0puJWF1z.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8558258b-e4b4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626274954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274954, "uuid": "56daf55f-efbb-4754-a99b-c7afbcafd17b", "comment": "Malware payload (AgentTesla)", "value": "27cbc615d2a1fef5e46ae9d91943812c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274954, "uuid": "4f31b515-297f-4bf1-9585-ab75783062c0", "comment": "Malware payload (AgentTesla)", "value": "d0638a8dd7cdd32f69d17312f76a526f025c29511dd2fd9ba7bddc51867bc912", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274954, "uuid": "2cbcc9b9-46a2-4197-b606-550303fb3771", "comment": "Malware payload (AgentTesla)", "value": "3fbf2e5f093f0e2d6376f7baf634395137ada0ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274954, "uuid": "b8789aa2-fd6a-4220-83ab-19080255e5dd", "comment": "Malware payload (AgentTesla)", "value": "0aef507d3b3071e974ccf9d215d29ecbae5afbbd6414e1ba547ac1370a4f7180c1568f9fd3053344272e2266155a1b60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274954, "uuid": "14aa6fba-ffcf-4614-b4de-5a63e6564cce", "value": "T1E183F6D9162C07E8C12CFEF1315F7B1E53E0512FA060C53BA58492AF7D523DA1EE4A9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274954, "uuid": "d23d7210-c36b-4d7a-8613-13fc0dfebdd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274954, "uuid": "96a3fe82-190f-4c74-b1ba-14ef66d36d65", "value": "768:1Z2a1sFIImSgH8P3wvLMotg+ELeVt9te6jYecKU/GflxKegwgWg1hi:z2TWImSM80LM6FIye6WRegwgWgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626274954, "uuid": "dfdfffec-ed7a-4075-a678-963322abc8b6", "value": 80760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626274954, "uuid": "9bee1c6e-82ec-4493-b5b5-aa56b957ee70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274954, "uuid": "3157ef0e-02b1-4b96-a1a4-9739f9c07c0a", "value": "27cbc615d2a1fef5e46ae9d91943812c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2612c13-e476-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626248508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248508, "uuid": "04578978-1d58-4ee0-849c-d665c66f84e9", "comment": "Malware payload (Mirai)", "value": "2bf763683d7e19fb487154ce7e4b5eca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248508, "uuid": "b17a2238-082d-4539-9405-78df80667007", "comment": "Malware payload (Mirai)", "value": "d0baea22a88c4f126549f772b235caa899591d6484ce3764530862838de68d10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248508, "uuid": "7242c65f-269e-4814-9790-f4052dc0c85c", "comment": "Malware payload (Mirai)", "value": "9f14220ba755308b82bccaf9519f149c641ae23d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248508, "uuid": "8f3af948-6932-497e-ab31-18f9514fd417", "comment": "Malware payload (Mirai)", "value": "6071f897efa68c20bd99a193fdeb6911f79c3296e4012a118c37f4cc04644e8d8e4277634f13af5079d115996b8f9fae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248508, "uuid": "31cc1abb-9793-4c0d-818e-987224405c34", "value": "T17EA2DF0921CDEE32D170943AE13CC347AADB47B652FE723A2E180699E49581AD3BE945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248508, "uuid": "7802e87e-0f02-4928-9703-76d0131df7ec", "value": "384:YD5mog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbnhymdGUop5hXb:YDgoh/DxCvhdR4IjWVFbS7s3UozJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626248508, "uuid": "2947e9ec-3921-44f8-b544-3b3cd3759b9d", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626248508, "uuid": "147ee03f-46ee-41a2-88ff-56ec8ffc1466", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248508, "uuid": "df8387b4-5776-4e29-831b-6cc5752ac882", "value": "2bf763683d7e19fb487154ce7e4b5eca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13928f77-e4b6-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626275622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275622, "uuid": "89c61a66-c0d5-4d14-b4d7-ec3331422c56", "comment": "Malware payload (RedLineStealer)", "value": "c7e720f1a0c42dc4f772eb2460089665", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275622, "uuid": "63016cc7-4073-4fb0-8cc1-b162ca2e089f", "comment": "Malware payload (RedLineStealer)", "value": "d125379e8708c90bd0f34a7b36a1684c3fe3e5dd56915b1087de4c4f86a725de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275622, "uuid": "db128997-ccf3-471b-83a9-fd9e9118a08e", "comment": "Malware payload (RedLineStealer)", "value": "66ab8d59bb1ca9e2c153b8edc70ae07658bd9492", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275622, "uuid": "eb2a7d57-54a4-4fb3-9c55-bc9b5f1e06b9", "comment": "Malware payload (RedLineStealer)", "value": "bcabe3265e67856cd502bdcce7022d6ff5c6e788796031c2dc41cc76843165ed92476994286a548262b210941a04b05c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275622, "uuid": "8b569c3c-6ef3-41ad-b4f7-b46e223f1a20", "value": "T145B4126536A2D536E1E3147015B8C2A0163BFDB33972868E3754132E8E712C6EABA717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275622, "uuid": "3ffd0cd2-274e-451d-81e1-abb4e7f214b0", "value": "743d5e3ef77cdeb459cdc4beffed62d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275622, "uuid": "dd84624e-d970-433d-9ab5-8d34ef414376", "value": "12288:4WyRQ6YJ1qM1QpGiFRzSA4rlZk0ZW6WtvPXTZYrNNYGvpZuyfa:4Wye1Rm+3Jz+tvPXTZYrJpVfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275622, "uuid": "4d9f2df0-5928-4713-bc49-0ffc9bb569cd", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275622, "uuid": "bd773511-9a7f-4220-9dd4-e6097376e1dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275622, "uuid": "07faa9fd-c1ec-4435-af0d-edc95eac4501", "value": "c7e720f1a0c42dc4f772eb2460089665.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99b31ac-e4b2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626274263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274263, "uuid": "7bc7922f-dee3-4ea5-a28e-e8f3adf2a51b", "comment": "Malware payload (AgentTesla)", "value": "120e69ee7aca1d1b88952dfc5971f7ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274263, "uuid": "02c4ee7a-fc2a-4a78-b4fd-57f960259ed6", "comment": "Malware payload (AgentTesla)", "value": "d293c745db6e0844cbcdb8d291db460af1a3fea19c7b0d224d0c2054c81c28de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274263, "uuid": "5aa42071-7dbc-41b4-ad7d-f03799a83fd4", "comment": "Malware payload (AgentTesla)", "value": "f6fc1e18e366999fed24fc6a87f1eb17a1d3ddec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274263, "uuid": "389e03a8-254e-49e7-9720-51cdb0618c11", "comment": "Malware payload (AgentTesla)", "value": "163a3c869913e656ef6ece2ca6ca078f55730b1a904a32273c1d4fa0b96ca340f466c59c21bb5a8f205c8d23530cbde0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274263, "uuid": "a3d79dce-5240-46e8-b548-76271448e378", "value": "T13F65BE2526340E17EB2D927459628C34F275DCE726B19AF334C63DAB39BA601389D33D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274263, "uuid": "3ebf2dea-ff29-48df-b0d4-6c1649ec0b7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274263, "uuid": "ae90d0a7-43c2-4999-be7a-f5fc8531b929", "value": "24576:MinHiYWLIUT49mGcVAMbI4FNBwSAbEMfUfV7zyXwYGSwr:Rnrg49mGMrpNBwFbEyUftzp3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626274263, "uuid": "12f08034-a9d5-4728-8feb-67ec35a62c8b", "value": 1482752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626274263, "uuid": "1314b941-7e81-4247-804c-7e1f9c988b6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274263, "uuid": "ac064302-134b-47a0-96d9-0de9d755365a", "value": "120.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315bf821-e4c5-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1626282115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282115, "uuid": "2f2f5b12-9288-42fe-904d-7d25b5fc24ac", "comment": "Malware payload (RemcosRAT)", "value": "31fd82fae29053db56c426de8dfddb2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282115, "uuid": "2318b837-91e3-4b0d-a38e-08063a9b6b1b", "comment": "Malware payload (RemcosRAT)", "value": "d2dd16e82f0e925fd7983769306b87e1bf89217dd0ab15148985666578904848", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282115, "uuid": "2a4d5605-3dd0-4304-bd90-7b0f76ae8413", "comment": "Malware payload (RemcosRAT)", "value": "93dfd72f5ebd44f94396e9ceabce0011b2c6617a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282115, "uuid": "5d1b0148-0e69-4dc2-82b8-03875ce7e22d", "comment": "Malware payload (RemcosRAT)", "value": "e540060c6dc66bd6491be1d9cd3b161cc0a1f9f3cd061092665e289f73687ddd09b6ba68f7e7683c3261b66a2f078b26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282115, "uuid": "e7811a6b-616a-491e-9560-b561c40f9206", "value": "T1D953A3243AF9701AE97BFE3106D6B061C67A7AB27D0650171789CA1E06038B2EFC15FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282115, "uuid": "283f1652-6bea-4a4f-b0be-cc1ec2dc4f37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282115, "uuid": "29c98f2c-2c8d-4ad9-ac2c-731f683a71b4", "value": "1536:/Dz5idmKjcZ7GaV5lFe/BTadZtU85zFzP:/Dtid3U5lgZadQUlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626282115, "uuid": "573041c7-23cb-453b-81d1-5ea2f4197c3d", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626282115, "uuid": "0a0daefc-87d6-4af8-a0c5-d80933dcb92f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282115, "uuid": "8d8db45d-1437-444a-95d7-92fb6b78502c", "value": "31fd82fae29053db56c426de8dfddb2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d49af92-e482-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626253332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253332, "uuid": "e8b91976-98d9-446a-985b-8e303e6cd8f1", "comment": "Malware payload (Mirai)", "value": "d8b1cd7dd4c79bb00403ef72dc2dfbee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253332, "uuid": "34c8ea32-f325-4d64-803c-cb3f8d6f83ac", "comment": "Malware payload (Mirai)", "value": "d329aef09b07a179d7f98e87d74fed3eb424f0664b2c3bdcc15d615eef71e514", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253332, "uuid": "6952ddaf-6c6b-4dac-b9c2-38230b8b5810", "comment": "Malware payload (Mirai)", "value": "f0ba8de3caf2d4ef58f520ce0b658732bb782e52", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253332, "uuid": "9e0c988d-c7db-4526-9ad3-7dc80299e401", "comment": "Malware payload (Mirai)", "value": "4e5a54b1ef4e64ad828bbb0ffad9041de904653504283696ec8e8d06f7a3b2bf767b7a0ebc70e49954cab14fab272adc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253332, "uuid": "87c16aee-c5a6-447e-8dcb-0ccbe242d3d1", "value": "T1F864F1DAED01AE79F9D547B9BA1F070973B6CBE8D3C3B110E224C61439ED2468B255C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253332, "uuid": "062d6625-3b6c-4326-b532-276397ebb725", "value": "6144:7O/QJHZweEL/NOjCHm7FZZnczsKqqfPqOJ:78QpZsKCaiIKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626253332, "uuid": "da146035-f793-4cd9-b07d-4bae122a8740", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626253332, "uuid": "3b91cde5-3bb3-4388-b79d-00ea69d18397", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253332, "uuid": "a9ae5f0f-7fb1-4733-93e1-d374d4702306", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1039ebde-e4e1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626294085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294085, "uuid": "c082894a-6808-4ef2-9011-7b88fc2d81f9", "comment": "Malware payload", "value": "67736c803c7c0897a744ed61a8c38439", "object_relation": "md5", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294085, "uuid": "9967251c-b049-4af8-bd29-3548f87cc2f6", "comment": "Malware payload", "value": "d332d831fec34137d376cd3cc09892dc0f8875a2d7192b743aeda96cab2735b4", "object_relation": "sha256", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294085, "uuid": "17b8397a-078b-447c-a27c-11b8b0ad0460", "comment": "Malware payload", "value": "5a5cedb014a794865cc8cb39ee88e28aaffee5c1", "object_relation": "sha1", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626294085, "uuid": "61a7d6a0-73f1-448d-be0d-119c5aea9c57", "comment": "Malware payload", "value": "1ca720e3d0d5d5e94e38458aaf49b53d196ba4fa8117e8849a8eab93618d95887d5846b0ca779a0f7540f761d0be30eb", "object_relation": "sha3-384", "Tag": [ { "name": "64-bit", "colour": "#F63C47", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626294085, "uuid": "a260626c-237a-497a-9007-fcda1ceb4dcc", "value": "T121F4DFA19EFBA2DDF1F3523A8879087E7512BA675C2C1544EBF105C14FEE1129FA6320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626294085, "uuid": "8ebb347a-4a70-478d-806f-cd1be5273ff0", "value": "d65b30dd8c9856808552250c7cfb0efa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626294085, "uuid": "f8c486cd-191a-4846-a49b-3e9bbba32c17", "value": "12288:QXBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJ:KB/Qn0rbD8UZUDtgIiemI51Mwtewkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626294085, "uuid": "49354ec8-f3da-475a-a5a0-efe0bd07d9ac", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626294085, "uuid": "21e2c56d-22fb-45d5-9e6e-3abed909c0ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626294085, "uuid": "3a8b4177-f48b-453c-89a3-29718d681043", "value": "VERSION.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f559be2-e4a5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626268367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268367, "uuid": "8168e7cd-defb-4da0-9aec-381c9d3877a5", "comment": "Malware payload (Formbook)", "value": "8ffcf0648e735253bbcb3f9cebe072ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268367, "uuid": "cf0fc9af-3507-40f9-9446-56a3f39c476c", "comment": "Malware payload (Formbook)", "value": "d476f0d6936a06df598e0d45e9b80a4bc1e97880fd72351ecbde5fcb0dd2a96f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268367, "uuid": "49281c80-334a-4d1e-bded-9a0bc5e712ef", "comment": "Malware payload (Formbook)", "value": "39fed8e31ceed5d263ba77cf58ea7c6755fe6ffb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268367, "uuid": "cd2140c3-2e4b-4979-8218-24917080cb97", "comment": "Malware payload (Formbook)", "value": "6a386f93e4dcd530c46ada926440473fbf51316ea080a86d0259d18e8ec9762e308e3ca63984e602a9e615d5d96d2ee2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268367, "uuid": "4a92d2ec-eddb-495a-b6ae-ab6be4ad5e3c", "value": "T1B70502667390BB4FC23E8EB949615C1153D0E2779703EBD7ADE316EC158F6A28E221C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268367, "uuid": "1088b502-6e14-4f20-8b92-767272821ad0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268367, "uuid": "be0a9cac-5b24-43f8-9619-0bcf21b56789", "value": "12288:QKqGrTK7/LaBFSQbd24yknclEvo0fnAHeOq5gxIwI2l6rdHduoo5+5m8t8rmlHqW:t3rTGLaGuUZkMMAXGgiwOdno5+df2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626268367, "uuid": "00753b80-16c5-4071-97f5-f10051bf1808", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626268367, "uuid": "9edb1e0f-8275-4dc7-a9d7-7a9f43843b10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268367, "uuid": "c64d06e9-858f-4c7f-bcc3-df6232630166", "value": "Payment Advice pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece32401-e470-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626245922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245922, "uuid": "d3e98228-9297-4980-a00e-1808c0cfc2c4", "comment": "Malware payload (AgentTesla)", "value": "5065a638099d7cb852101a279665eaec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245922, "uuid": "c580e904-b74b-4e32-904a-c1bc39df3c1b", "comment": "Malware payload (AgentTesla)", "value": "d47d28326953ea628f813610312145619cb7cb86e24470fd39050eeddef8dac8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245922, "uuid": "fb7fdd61-2830-4d1a-bb81-14995d926803", "comment": "Malware payload (AgentTesla)", "value": "ceb0f712407631b5473762b120f0927e1d88bb56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626245922, "uuid": "f1b56b18-81e1-4daa-a172-1ca806a53d91", "comment": "Malware payload (AgentTesla)", "value": "c756a17b38bd624e0f6011ab855a63fa8f8da1a8ab731bccd2e3e2522f42a9a8e2390f38eabd99e3386c0a44f87c147a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245922, "uuid": "17d463eb-b919-4e8a-9471-77413cccf6c4", "value": "T1F5058D2C23FE6649F233FF356FA5A6449FA666B58225DD0D1DC4024B4821C81FEA7D32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245922, "uuid": "41e43420-9355-4003-b681-cc16597b1f8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245922, "uuid": "3630ad2d-675b-4e30-875c-71498896731d", "value": "24576:xfgSEZ4xXODSFFIh/ovHTd6JW1sciRsb/hyDVeb:PJxDfo/GHTcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626245922, "uuid": "0090f395-b9c5-45ea-9865-580a78d99aa8", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626245922, "uuid": "43cfd17f-52bd-470b-a73e-27635d030303", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626245922, "uuid": "f6a46ae7-706f-4d21-9f14-02574c74bf57", "value": "SHANGHAI SHIPPING SCHEDULE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14881baa-e491-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626259733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626259733, "uuid": "b00d052a-3239-42b5-8f4d-2aa948c331d1", "comment": "Malware payload (RedLineStealer)", "value": "202deabe317b2f51a43bd3384cc061c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626259733, "uuid": "b8f634ce-fce6-4689-975d-65fb97555a5c", "comment": "Malware payload (RedLineStealer)", "value": "d58e01cb4776ae39f756a49aa9845bfcc4b48f34fc8023ac3ef0019e08421452", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626259733, "uuid": "229213c1-5467-4d70-8df0-ec433d51cd0c", "comment": "Malware payload (RedLineStealer)", "value": "92d7e204b789d9162dec9dc1bbd3995d12d741dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626259733, "uuid": "b3423348-0b36-422d-8995-77efd5aea232", "comment": "Malware payload (RedLineStealer)", "value": "71263edfc5c48f79302a4ff6f90ca1de2713fcb1e75fa75f81d897fc649c10237c1892c0dd3a5c66c19b7936440d8bf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626259733, "uuid": "1f22cdc0-b279-4078-b757-18d5720d5b34", "value": "T138A5334141A5BB41CA6B8F720E8B1D64ECE89486AC78D79B53CF74C08CEAF5607D1B29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626259733, "uuid": "82ed1552-d5c9-40dc-a778-cddd2d188464", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626259733, "uuid": "83c1f64b-4bef-4737-8c24-a78783d97439", "value": "49152:L6fmehZHn/mSPCVbRwpTu006npGtdmKxo8qtkVhsXF:W+yZH/mSPCV8S0n49o5tkVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626259733, "uuid": "617780f3-2817-4f01-9bb4-372f6f090067", "value": 2132648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626259733, "uuid": "89ba20ea-ada7-47b6-9087-2e039a385c16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626259733, "uuid": "df1469e4-76ae-40ec-8495-02de0d812665", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2269e617-e4bf-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626279513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279513, "uuid": "2234ccf6-d422-4bf1-bc41-41cd221292ca", "comment": "Malware payload (Mirai)", "value": "cbe8d37b59c38dfb130ac5ca5fbd6418", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279513, "uuid": "6faab62f-a83e-4518-b13f-b5040198acf7", "comment": "Malware payload (Mirai)", "value": "d69bd67ce5eb195720af734b208b6011fb3f7904c15ac2cb70ed029cd9ecc002", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279513, "uuid": "85dd6196-f45c-4175-a830-b439e033c9ac", "comment": "Malware payload (Mirai)", "value": "26dfab05f7a7a7bb772323c5ae31cec398dc43df", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279513, "uuid": "7e9fd34e-1f62-477f-818f-b89d2c2a0380", "comment": "Malware payload (Mirai)", "value": "c92fa1957806288de7537bb6baf831db9bc5d054fa558df35674ed962ce459fbb9d65e84af765beb4fa0ba5c6cc7289f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279513, "uuid": "caff6938-757f-43a8-8ce8-0cd0e8b49be6", "value": "T132530747B44180FDC149D03447ABAA76C8237EBD1B3AF39637D4EE3A2C6AD221E59C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279513, "uuid": "e49fea3f-c20d-41f0-a03b-65c8b88c37d2", "value": "1536:anF9U0FferGtOW4/RWo4mz8kkRqwehJOlQ5M7WR:0FK0UrUO3JWvvRqweOlr7WR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626279513, "uuid": "9c737ad5-f6ee-4e67-9fbf-e823c1539155", "value": 62720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626279513, "uuid": "7ba44693-0de8-49ca-b25e-abc88232df34", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279513, "uuid": "b0499fa5-39e9-4db9-b682-55105e9c3750", "value": "cbe8d37b59c38dfb130ac5ca5fbd6418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2395beb0-e475-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626247732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247732, "uuid": "c795e772-bf7a-4a00-bcb8-7bc6a82964ac", "comment": "Malware payload (Mirai)", "value": "8af9cbc1cb2f8dd5dd3548dd185a0732", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247732, "uuid": "57e83707-6bd0-4116-9f66-a0d448d7632c", "comment": "Malware payload (Mirai)", "value": "d6e894c9261efefc116e35d2b8f19f49a2e0b12a21b0517aaeaaa1d0c3cae8c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247732, "uuid": "c9c9fb5a-26bc-4375-8b9c-11bca46f41bf", "comment": "Malware payload (Mirai)", "value": "3753e1e401c287bff0342bb7cd2174166e601a38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247732, "uuid": "fc63327a-10c8-4b29-8227-9f6d9776fd79", "comment": "Malware payload (Mirai)", "value": "d800bba78e32e1494f5a2669a48e6318977d77ffc23c07a68978d543657553f9f2d86f0e2e1651b959877550275a13df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247732, "uuid": "8873b07d-17ae-43ea-a6a3-81570658947d", "value": "T1FCA3C61D3E219F7EF39C82390BB78E21564833D622F1D185E19CEA055EB028E745FB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247732, "uuid": "fdd21e64-b07c-4589-b6d0-7cbfa404dba5", "value": "3072:eONzUZymXkcHSUgMIYGc08tCYJ8Rs68OOR:eO5UZymUf0xlJIs6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626247732, "uuid": "423db95f-b480-4530-98bb-64f362386fd6", "value": 100772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626247732, "uuid": "ffb2d5b8-f503-48be-82d1-668dda52bc66", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247732, "uuid": "ed6f0ff2-900e-47b5-a7d8-2824743dac5b", "value": "8af9cbc1cb2f8dd5dd3548dd185a0732", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a049e15f-e4e3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626295186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295186, "uuid": "ab66128e-c93e-4fb0-9883-a82ba4445ada", "comment": "Malware payload", "value": "cd0650a304a2fa6b3e7f80946189a0ed", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295186, "uuid": "e835475a-1a8f-4283-be25-e2b211153fcb", "comment": "Malware payload", "value": "d70d71fc8b0e460d2d9d428a05335e9cc8ac3bed68d4fcfa382da0a65eed873d", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295186, "uuid": "6925d24e-971c-49fe-b0af-5e92e205927e", "comment": "Malware payload", "value": "948e9ec20c3c04dcea1833604f5d8737a333a7eb", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295186, "uuid": "ad82cf80-c375-4280-984d-2aa404b29284", "comment": "Malware payload", "value": "75aaf73c965772d139ef7f29d7d8145e640afad47e34229f13d399d7fa1ceb20d6df49e4b42e127440a4c9d56220c8f5", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295186, "uuid": "67f97eb3-5fbf-4f94-9ca8-5da4dbc8c4de", "value": "T1E4F458E5ABA4CDB6DB01C2718C9D19586374CC118A49AFC77255B03CFF3BB798E88186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295186, "uuid": "b7aac984-6ee5-46cf-8099-9581b14e2d90", "value": "12288:jRYbXrlUc6XS/CwRl+4MW1H5onZHBDznxcp/c0UGtkbByxlFYd2Drpy:MUc6EjDMW1UrDjxcNcfgZI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626295186, "uuid": "159b1542-aeaf-4af5-9aa2-d18d98aa3d97", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626295186, "uuid": "669b7b9c-fb75-482b-82fa-083ac5b43043", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295186, "uuid": "db4360bb-8880-4182-8e30-787764086d73", "value": "cd0650a304a2fa6b3e7f80946189a0ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75d53bb-e49d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626265133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626265133, "uuid": "9bf9c548-97de-44cc-9be6-7be371118aad", "comment": "Malware payload (AgentTesla)", "value": "c90a16f574f5f928f644f2c210fb05ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626265133, "uuid": "1639764a-5bcb-475d-bf6a-7a5534601f56", "comment": "Malware payload (AgentTesla)", "value": "d73ac5b5ebc31853340c31b240cf4b197e86a0fe7a63e41785dc547927a4951e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626265133, "uuid": "b5667280-acce-4778-8d43-b1a4781467c8", "comment": "Malware payload (AgentTesla)", "value": "e82cd7aa4be4729112c112f5fa8f8e09d935e51b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626265133, "uuid": "cf0962d5-e6ca-426d-8877-c806f75a6915", "comment": "Malware payload (AgentTesla)", "value": "3dc83eec6062707115fe61ef54e406914824eae2b85ee423151e38892ca706da28b1a11f31db0830fb74481d20e54f52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626265133, "uuid": "d2ef51e3-0e8f-4ace-bd51-5998d926e07b", "value": "T106F4AD2363C446EBCBBE82B9BE40B050F7616CAB7701DE0F1EC37286556B60155B6D2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626265133, "uuid": "c238693a-775b-411f-b2e4-d7c0dfd09398", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626265133, "uuid": "eb64f2ee-3d7c-4b22-a08d-55c2d1c9ba7a", "value": "12288:69QUCGYJmjZ3eoyMjL7GB6k3L80MkzUYBDHmw6zGagNQhqLmKZM6J0I+IG:69QUdjZ3eXMzGBXL80VUYdGsaiFfP+IG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626265133, "uuid": "d1560351-02c4-4498-9716-7f97c10fe59b", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626265133, "uuid": "9f097d43-03da-4bb4-bc35-938a28e2ea7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626265133, "uuid": "33c165e0-63ad-4bd6-a317-cf52fb8ba987", "value": "PO1000028354.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f20a7c-e48a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626256834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256834, "uuid": "1cfb1038-aafb-4203-8456-5cdcbd17609a", "comment": "Malware payload (AgentTesla)", "value": "2fc11cdebc27214a7d68f16f59d697b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256834, "uuid": "0969bf37-3b2c-4e8b-abaa-dd49423a5fc7", "comment": "Malware payload (AgentTesla)", "value": "d75eb4b0aa7e4081d40dece5bbb1a6b988120b311b88418edd399d455525a4da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256834, "uuid": "eabd394f-9e69-457b-823d-660aee0a7b96", "comment": "Malware payload (AgentTesla)", "value": "d0206cd68ea1419c4c020631717b3cfe641742be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626256834, "uuid": "d2d161ed-ab44-469e-bdff-1e203d07af10", "comment": "Malware payload (AgentTesla)", "value": "e35b56050594fe9c61009f0edaaf35ca0e6a20a32c78307d6b842f67ff1c3ba5bd2d8f320a1cf529e5498d31bf2bcfff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626256834, "uuid": "5a378a75-93a9-4729-8d4b-8cae3aee02c8", "value": "T17EE4BE2733844A27CBBE42B9B650E090F761ACABB701DE0F2AC372D6556B70154D6D2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626256834, "uuid": "7c2c8500-fe41-4bef-b408-aff2c9a0daa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626256834, "uuid": "939212e7-a045-4e86-8934-c3143286deab", "value": "12288:ApQUCG16DrlKjjhYiBpjjVAW4jU8vy2VMyyORGZZ6p4z/:ApQUMBMY4ZV4U8qaMyyO4Zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626256834, "uuid": "008d19d4-e68c-462a-88fe-0826c7b4b675", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626256834, "uuid": "96ca72fb-8be4-46ba-92bf-e7f5e256209b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626256834, "uuid": "7dd19ab7-03de-454d-967e-5a9eb1d782b7", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6a5e40-e475-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626247695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247695, "uuid": "32fa37d5-b5c8-4e68-b587-1da91b9f7c3a", "comment": "Malware payload", "value": "f7065ef42e080290f5558408fab1ab13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247695, "uuid": "6588680e-029b-41a3-b91e-18153eafe88b", "comment": "Malware payload", "value": "d78637578ae926e613575e929c69534ab18892f952b2ca9e9623d3cd5c4e2a81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247695, "uuid": "b5dbe556-6e49-4ee2-9e2c-47b1ac818ad5", "comment": "Malware payload", "value": "fd2147765a3adb03bd2eb90481aac42a3706a8af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247695, "uuid": "eb2932c6-8427-4697-a4c0-46ef69043596", "comment": "Malware payload", "value": "a5445196711b42a932f81393a91769c817783288b635e23f49a01cca7b66c80afc2e98c2ff5e61d605d871eda1cede2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247695, "uuid": "d19d3343-b0db-4652-98a9-f83ada914a97", "value": "T1E703F12D538944D9F84EC4354AC52B359DB10BD91843F063E234A794ADC7DF6BCA3BA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247695, "uuid": "52009a27-d747-4917-97c3-1b4f8a1d211c", "value": "768:TPWl1tts6OsBOViUEUQjo7OLhbvPGljzMZv7GwqMJgGlzDpxYsQ:al1ttwsBOVJehbr17GHEVrYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626247695, "uuid": "38b00426-d2aa-4553-9115-b9a67385b6cd", "value": 38796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626247695, "uuid": "642f27a9-383b-4088-bf4c-ec06449a5433", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247695, "uuid": "dc4e444d-4d2a-41b9-bc5d-ec8f3137ea3e", "value": "f7065ef42e080290f5558408fab1ab13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be97fe04-e4bf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626279775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279775, "uuid": "94af6445-8398-4f92-a18e-f06e791ad281", "comment": "Malware payload (Dridex)", "value": "76590750b6933c89a6fd7007812a5897", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279775, "uuid": "2c9bfa8a-321d-4760-952c-a9b21ce0fde0", "comment": "Malware payload (Dridex)", "value": "d93210076662115315a8713a18a86f22051c45ab7216129daa9b5638a76dac43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279775, "uuid": "9f619aa5-7217-4b6d-89f4-f698b8980edc", "comment": "Malware payload (Dridex)", "value": "804357d2db86df848cf52369236fde45fd61db2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279775, "uuid": "6232a6ba-3bf3-4485-807c-c4abd6f72f1c", "comment": "Malware payload (Dridex)", "value": "fdd2f7f8872a1a9472f28891ea16db5c86dbc294ab5202058b0149426d79dcd4c700eaec03f9303c7558c2d972b91757", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279775, "uuid": "2756ab86-59c3-475e-89eb-ff22d90567c8", "value": "T197F302D1B38B11FEFD5D6470960BA9A612A70C29C37CCAE7E110DC917DE48FB283552A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279775, "uuid": "0a191659-4cec-4543-9ab4-f96973cfe72e", "value": "e92132005097daafddd51d9c4d138d88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279775, "uuid": "f6ac80dd-8ec9-4ff9-a3ff-54c4830a07af", "value": "3072:a7p3dQo86PI7e2seiJPWZ6Ox1uTQjY48+STfLbh9w47sIF:g3dyj7NseoPOx1KQU5TTbbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626279775, "uuid": "f979eabe-d14d-4159-b5b8-2214f5b5c215", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626279775, "uuid": "ea184afe-c9c7-4246-8264-a7515033491a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279775, "uuid": "240f1435-b0f3-4b5f-8958-e9a8334a5495", "value": "76590750b6933c89a6fd7007812a5897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b70c9b-e453-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626233376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626233376, "uuid": "b3a64744-ca8c-4e3d-9d9c-19aee22b9b55", "comment": "Malware payload (Mirai)", "value": "9a0dbc1396148770ee7da1dd0b74044b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626233376, "uuid": "f0b81677-26ab-4c9d-9565-b2da077b6d3b", "comment": "Malware payload (Mirai)", "value": "d9c1cbc98a756f5774c90476ee90e9658fc85812e71d9ea0f7a80d7be732bdea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626233376, "uuid": "af441805-5389-4652-a277-9fa676a9eb5d", "comment": "Malware payload (Mirai)", "value": "504bda9185d5a6b657aefd426a193551ca6382a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626233376, "uuid": "493ab666-3f40-4115-87c7-79493ce0ab35", "comment": "Malware payload (Mirai)", "value": "b24b33612ec55e1260d87ea8e2620c1d398339ba2b058bbb67db715b533ae08bfc0a07eabfc525b9cfe1a64e4be44b96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626233376, "uuid": "463f70fd-e94e-4e76-b953-398a5c22d131", "value": "T1E1335B32B93A2E17C0D4A97A11F34724B2F1275E25A8CB2E7D720E4EFF54A40A1576B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626233376, "uuid": "06e7354f-2ce7-4dd5-aec5-ffdd33c98f58", "value": "768:F2oFxxNq9KaLfLM1/e0t1TYJo71xtOZ6OqPYj4DD2yLO+bN2vTy:F2KxxNSVfLM1/VttYK1xkRWpPC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626233376, "uuid": "9fa4e878-237e-4b1b-840f-069d5c654c13", "value": 52276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626233376, "uuid": "0f32c91d-f810-4761-ac95-a8164746df50", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626233376, "uuid": "55feb3f9-f8fb-4517-bd92-d148aa74dff4", "value": "9a0dbc1396148770ee7da1dd0b74044b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3504ef2f-e4aa-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626270525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270525, "uuid": "d2daea32-2144-4b29-a5a4-1cbd6e100051", "comment": "Malware payload (Formbook)", "value": "ebcbbbb4c2920b3df80cd824ddd4e232", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270525, "uuid": "c52118aa-c13e-40a9-ab3b-94bc5125b8c7", "comment": "Malware payload (Formbook)", "value": "dab3e0845261a8d943d13693fcf901601ce609d6557ac447ef588024a1f52013", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270525, "uuid": "733ddea9-e147-4dbf-880d-0a136cd3306c", "comment": "Malware payload (Formbook)", "value": "d1fbd70a4dc14fd9e8942626b1dd3d9a593eda38", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270525, "uuid": "58770092-4d05-4dae-a4a0-4827a9bca177", "comment": "Malware payload (Formbook)", "value": "34fc46d1bf0fc33c5a1ecfd9597c69b0ba0d1280d4e700ebef082f1f1cd22c040ae1ed032f22a40e9f2f7af37259149c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270525, "uuid": "c26e4d65-b90c-4f3d-b5b8-a3f3d6ccdf4a", "value": "T16FF2F7BCC86741588F46A7B82B1B9F14158D3B2DF385E132363CA77417E2D3A921293D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270525, "uuid": "122e8c5d-431d-4054-9a40-befd3b74dc41", "value": "384:GySc+xpRacv28nJduZj8ZXNwmx9Rz5AX3ZCns6ugT/:Gyf+zRT/XUYZX+mlz5KKsfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626270525, "uuid": "9bfa1c9d-39d6-40ce-93a5-daaf62a58ae9", "value": 36330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626270525, "uuid": "a32df117-94ec-4609-82f6-8cb3d344c146", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270525, "uuid": "fb9ed6bb-c6f3-4f02-80eb-f378fa92b71e", "value": "RFQ NO.35208.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ecb517d-e4a7-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626269226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269226, "uuid": "09cc8fb5-bbe5-4057-a005-78cbe7b54172", "comment": "Malware payload (Mirai)", "value": "2983c249ad9871419796c29ecaf98df6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269226, "uuid": "a865b231-0683-44fd-a608-fd17ce3b194f", "comment": "Malware payload (Mirai)", "value": "db3e928836ab034c84dfa521dd9e0285e67fae747135911366f3d4d8dea1bea6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269226, "uuid": "f113c9ef-9ffe-4d44-83c1-9b025e5618ce", "comment": "Malware payload (Mirai)", "value": "9358b98698898363f14b0f99e1bd1e19cf6a622b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269226, "uuid": "3dee0313-5bc2-4c22-948a-78377c861fe8", "comment": "Malware payload (Mirai)", "value": "a4fd82a55bde588016d98e3af8c8aa26c25c5fb9d06ab093723c105e61a20ee904415915db9df116e1368269bb8f0b20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626269226, "uuid": "5d8db5d2-7009-436f-9495-015261e50bea", "value": "T147432925AD792E26C0D4B57A51F78714F2F2220E26B8C61E3CB21E4EFF04B4065577BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626269226, "uuid": "e308779f-4581-4997-a665-929b9ae05917", "value": "768:TXon00+q9wp3C+vactfa1sDHHYAzsv6WswWSHoXdss63B/9JO+zC3f:TXw00+SY3CaactfI6Hvzsv6vwcGJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626269226, "uuid": "223e0569-926f-4982-bca4-6b9990fe1847", "value": 60116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626269226, "uuid": "329a4f78-3de2-451e-9bf6-a86c95c0648e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626269226, "uuid": "ebfb033c-85cb-4e8a-92ed-caf7f9fea0b2", "value": "2983c249ad9871419796c29ecaf98df6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84698265-e48f-11eb-875b-42010a9c0053", "comment": "Malware payload (Glupteba)", "timestamp": 1626259061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626259061, "uuid": "61413dbc-bc8f-45eb-ade1-e479a18239da", "comment": "Malware payload (Glupteba)", "value": "0a9bc10f43db0a9549a966727264170a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626259061, "uuid": "842cfbc6-6d72-41e3-99eb-47918dcd7ced", "comment": "Malware payload (Glupteba)", "value": "db724681d71bd9cc6d6272e1fb68e52509a453b16c6b2bf3cf3040b6169bb1e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626259061, "uuid": "469b7997-c79d-49b3-8d81-8ecc806da476", "comment": "Malware payload (Glupteba)", "value": "408ec3bf82729361ac0b67df521e790fcfb33c95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626259061, "uuid": "4105ce28-49dd-47f6-b44f-34300624ca45", "comment": "Malware payload (Glupteba)", "value": "4cbd9c323b227ff069a5ba47ad7f8a26fe2dc3c7d3c8ff561b638f54c27747b4bec5da2bee3f55e4b1cfefb4c2ba5a2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626259061, "uuid": "43fb4cef-bbc3-48e4-b39a-f235e363aade", "value": "T1572633E3B170E423D3450D3A66B0959B687BF17211550AAF5B20BA9D0F9DFF0A32BB05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626259061, "uuid": "ec87cf51-6327-483c-9a64-ba51cba9f87a", "value": "7804ce5f4ecb7c822f91970dcf2f863f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626259061, "uuid": "6c3899bb-5dd3-475b-9a6c-a29eb34510e2", "value": "98304:Tn393ukLqjTa4P2YKp20aFDsIah+/54E/9v1MMRzaPD:Tn3Buko+4Ps27FIxg+WrMMRza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626259061, "uuid": "a29a72a5-553b-4ba0-94a2-8d490ab8afe1", "value": 4597248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626259061, "uuid": "8051e6b3-e72e-45bd-bcc6-2240c4e1926a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626259061, "uuid": "9c972e98-9ab9-46aa-bd7a-117155229e16", "value": "0a9bc10f43db0a9549a966727264170a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d18b06e-e4b7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626276283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276283, "uuid": "f2632424-2319-4b46-9542-2b0532ed1337", "comment": "Malware payload", "value": "2dedc3dfa09be884b673da3fc23b14be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276283, "uuid": "3d3d99db-8b14-441f-8bbc-52b68f7a332a", "comment": "Malware payload", "value": "dbe10036d4c3b406a2396da6c87062803b44ff5fa3b29bc08222d818e5b99108", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276283, "uuid": "f2e93bac-6e8b-472e-8566-3b85482a8fe3", "comment": "Malware payload", "value": "4972e2ede5f4eac8bba69691108074891d0cbdf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276283, "uuid": "fdf170db-8a85-4578-b61f-066c57b462a1", "comment": "Malware payload", "value": "e16a32d31eb48f646072c8cb82e93a7e2b3e3ae3037bfed124bc18d95f3b46f28eec4ad263045f3fd9f1d92551bcf0aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276283, "uuid": "ea9d6e21-09e5-47fe-a5c4-6a735658407d", "value": "T14BF3294773E860F9E0B6973489B24645E7B67C7157718B8F0760366E2F336909E38B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276283, "uuid": "b8b542e0-563f-4fe1-9454-3a0f4b776059", "value": "e44fb8625920664349d927b39e5614c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276283, "uuid": "f8ea32e9-4f5c-42fb-8452-2bff45bfd9d3", "value": "3072:nz8qB8b+YWRzy5T9Ixj2Q5C2APy1LofKkcf1JcwQe9uJ21tWDF2:nz8Tb+JRzy5TYjB0PPy1LaXM16k9uk1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276283, "uuid": "35807d41-1252-4284-8d68-43f2763f147c", "value": 157696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276283, "uuid": "a2327abd-a290-4155-b771-d970dd85f988", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276283, "uuid": "e27e1303-3132-48dc-bd4d-61439962b9b0", "value": "2dedc3dfa09be884b673da3fc23b14be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d595d92-e4c4-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1626281813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281813, "uuid": "ca4e6209-a8ac-4d48-b7d8-916ce13d448c", "comment": "Malware payload (AsyncRAT)", "value": "b8ee42b4bb4bb7d20002b215808f6747", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281813, "uuid": "299ffa22-6b71-4509-b463-b3a342a9d18d", "comment": "Malware payload (AsyncRAT)", "value": "dc81e6913c8125ddd7bc255d3950cfe00e92d9c68b1c0651a5e3a1a3bc9f0eb5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281813, "uuid": "4e49c4ea-5178-4514-9cec-6130f5afab1b", "comment": "Malware payload (AsyncRAT)", "value": "1f0e0bb5974e58283de7a3d146b414c2bfd4c76c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281813, "uuid": "aa86628d-030f-4397-bb00-072d44bb3406", "comment": "Malware payload (AsyncRAT)", "value": "6f5787eff9e5fee12ed56ea7ac5efc2dfb43f69950969fe6a8131e2c121671e961da1837ded61612ba9cfb78ad4cd9c9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281813, "uuid": "de8a3a6c-8910-4468-9e5e-c14e944bc4a2", "value": "T1E1B48D823145DC8AE14329F248AFD57061B97D9E8164C60E3787BF2BA5E7343349B78E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281813, "uuid": "093e71ba-541d-4d3d-957c-833c16916056", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281813, "uuid": "607617a5-6e87-41a2-b488-60c523cecec0", "value": "12288:4yA1HVP+Kjuq33IFK56pCGLoUUgSityjK:434FZpdM2dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626281813, "uuid": "f66b2217-2c19-45e6-b51d-cc2cca9947d6", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626281813, "uuid": "7f8b3886-bbdb-4b7e-8f90-d7069396ca7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281813, "uuid": "d94edf20-1a0e-45b8-b750-e3fc22852ff3", "value": "QuoteGMC77399940102334PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d214b83d-e4b5-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626275512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275512, "uuid": "91dac218-7737-40c5-a989-1a118e8eb53c", "comment": "Malware payload (RedLineStealer)", "value": "c42d8bbea1cae01c0d90ff347c7829c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275512, "uuid": "655e783e-79d0-437f-8706-40b697e4e848", "comment": "Malware payload (RedLineStealer)", "value": "de15be4aee425a370393c000963c7bf158fbba3edbf82cf8cdb9fafef836bc81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275512, "uuid": "094195cf-a3e5-412a-b8af-ba92efd1e281", "comment": "Malware payload (RedLineStealer)", "value": "5672de13d43bb867a58965a738af3b6701f0a89a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275512, "uuid": "d5e6945b-3e46-4359-a8ca-6bf935d996d2", "comment": "Malware payload (RedLineStealer)", "value": "7a8b166ed09462a2ad108c80b207487a0488ef10b3ceba20eb258355e0af803aa5b5c82ff62aa4ba0acb6bdfa9bab1df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275512, "uuid": "be3d417c-ce80-47e6-9fda-3fdb0dbc6961", "value": "T1B534DF2136A1C032E2E34972297987A56E3BB8337735CD4E3B50162E4F727D1AA69713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275512, "uuid": "497a1ac5-f963-4f31-b44d-580164c9f6fe", "value": "5d7b93d08d190770e760b272506bac79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275512, "uuid": "718ce9d0-5660-4c16-9928-f24580d884d0", "value": "6144:JTU8u4OJo8OFdAJQLk0pyjSXEQreVA0fTP+V:1P8OWQIlSXE+0fTP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275512, "uuid": "94768d34-82ca-4adb-b184-f7af3dedd4b2", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275512, "uuid": "a0721e9f-b2df-4d29-a745-31171fb0df76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275512, "uuid": "0f8505e9-3f4f-4572-9ef3-a58577d2ff9f", "value": "c42d8bbea1cae01c0d90ff347c7829c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00fb6cf-e4a3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626267832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267832, "uuid": "286fdc25-cdd4-4434-bf12-50e8ae0e02dc", "comment": "Malware payload", "value": "51f6c0ee649c2897feebc48de8877e31", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267832, "uuid": "d6c3da53-a743-4c50-80cf-6e593ffb10b7", "comment": "Malware payload", "value": "e02deee48433f3f55851ed16b2a513304f35a05e9aee1099c17045c18a5050d9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267832, "uuid": "563bd1f0-ef79-4163-9f0f-d44b6af4eaf9", "comment": "Malware payload", "value": "321f647005e618050e9cdf8eadc8f32664e32b4a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267832, "uuid": "6475763f-6b82-40db-8145-3ad068f05fbf", "comment": "Malware payload", "value": "c140140ae7b98cf4747ebcd74a66bb9dbcb09a0302a28d00bd47af4d8fa5fbc384f1b5aa381b12fdce73541ab6ac1425", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267832, "uuid": "f5eab71f-3c80-4d0c-939b-3efaee2c2953", "value": "T1AE5161324981EA496F2A6D393DD370B707CB9C3E56D1F87E4166637408BC23BEC1A145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267832, "uuid": "80a58645-1be5-4fa5-aa45-7f5b50610f22", "value": "48:4LDtXiWhuBJLaPASepblNZBbAiTFMZ8kGZwH0tQbUh8nUCf:4NDuraIRtVo8rwRbWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626267832, "uuid": "79a6db15-a867-444f-8cbd-422b199fadfc", "value": 2981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626267832, "uuid": "b9ec907d-23fc-43c1-8bad-b5f76def6c26", "value": "text/x-msdos-batch", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267832, "uuid": "9c58e04a-f24e-4f6e-a354-ef348203c3d4", "value": "ContactohadqbfpeDv_m_Iw_Zm_%5BzYf_(574111595Contacto.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427840b8-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626246066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246066, "uuid": "4b632f1b-def7-4f9c-8f19-ac113f300340", "comment": "Malware payload (AgentTesla)", "value": "7684649d9bf97643567e6c0fd06fe3b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246066, "uuid": "02b79e87-d20d-4ede-8360-b55dd3e6de04", "comment": "Malware payload (AgentTesla)", "value": "e0b3fcb3222d5ecf19ff109d58976e4339de347456c4dd111d6e4cc4d803914d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246066, "uuid": "5891afdc-e1e0-4364-aecc-0054e85a15a3", "comment": "Malware payload (AgentTesla)", "value": "5caede9a9dcba8952ff988e1e0be139e2c6874e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246066, "uuid": "7973132b-26e5-47ee-a502-34d32000924c", "comment": "Malware payload (AgentTesla)", "value": "0cd6d478f71f6d2e0b14af91be6221e3cc5f1922e3f221e8d75391104cff0848b8eb43e28d8666b00e2db6278c9d1b60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246066, "uuid": "bc84526d-44ef-4b2d-9c95-fecdda43e362", "value": "T1E3057B2C23BE6709F237FF359FA4E6449FA676A99215DD0D2DC0024B4421D82EEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246066, "uuid": "cfe2b0b1-70f9-4772-8a57-c60cad4afceb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246066, "uuid": "e2939f1f-67bc-49c8-9ae9-ba4d9f94385c", "value": "12288:K6IBRSNrNls9XOd4+QCSg0A3EOfB7lf1F82VmFikDZkpAMibXLafWLWzgOE0EWcK:K6og0GWMkS2MibzTDc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246066, "uuid": "f9745d85-f0e5-4bfa-a4fd-ac1286dfffa6", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246066, "uuid": "6337a02a-af3d-4dfe-9a4b-50549d6c2fca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246066, "uuid": "867947d6-938e-4f70-bd12-44897278dfa6", "value": "Shipment documents pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291b22ab-e475-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626247741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247741, "uuid": "ba606ca2-ce2e-4ec1-b93c-aac9e3e55dc6", "comment": "Malware payload", "value": "481d5d00ada8897718c57e99c1c7f992", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247741, "uuid": "9bad6286-d4d6-49ef-9a3f-49e769101278", "comment": "Malware payload", "value": "e0bc010b184a59555f295ef444ce8debf2ba64c3b1a387ff35470f2f53957992", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247741, "uuid": "5c8f80d6-4a59-4886-8a77-2107b263e473", "comment": "Malware payload", "value": "4e33a5d645fbd114af73bb39645364b8a8f15c79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247741, "uuid": "c99da583-9cd0-42c8-aae7-87f626f7f6f0", "comment": "Malware payload", "value": "73f84c1756215f53c3272193e57fd2054999aeac564f1e97350a1e8b4eee0b645461a33426b08fbb25abe5fed9dc8c18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247741, "uuid": "a8824b40-927d-46b2-9ac3-073da57fe890", "value": "T12403E11C54E70E9CDCDC493CB15AB733AAECE3C611AA8B69631558089F28506FE9E47C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247741, "uuid": "c22b8589-d53d-44ef-ba3e-c98feb7409a0", "value": "768:1CTCqdab2OtraT3jLMLVqz+3c9zSvnQp+bQsUmPDJmG6lF/WRp:Mab2KMvMLsq1I4nJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626247741, "uuid": "255aa77c-0992-4c8a-8dec-cabdf458c285", "value": 39164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626247741, "uuid": "0d47dd28-def7-4026-8105-45b3546babb9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247741, "uuid": "23bacbaa-26de-4af0-ab57-75e160d8ce3a", "value": "481d5d00ada8897718c57e99c1c7f992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed74e44-e4b9-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626276957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276957, "uuid": "75a4add8-0ff5-4ce8-9175-fa26e9cdecf2", "comment": "Malware payload (AveMariaRAT)", "value": "e1c3891695a70f6cecaa417acc69bb75", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276957, "uuid": "80c7987b-673c-4f92-a640-52819e4471d0", "comment": "Malware payload (AveMariaRAT)", "value": "e150f981d43106895ce64ebce7b41ae17b0eed49baa4cfc0d8d09c98dd208e8f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276957, "uuid": "f6fb49bc-285d-4b07-ad10-ea8898554ee2", "comment": "Malware payload (AveMariaRAT)", "value": "794aebe0e020616346692c17329df1f406153c51", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276957, "uuid": "33df23a0-b13b-4a30-8343-b4b1f29638d1", "comment": "Malware payload (AveMariaRAT)", "value": "b36a8e314affedb9c92755e9ab8f5fbbed399b969df63065e359021b7f805ca64725917f61936da6123f0898bfec4848", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276957, "uuid": "28d9c9d0-9d90-4366-85f5-de23c50efb2d", "value": "T1CDE42320D2938DADF55A8E72330909A0560EA5DB560B5A73355D0BBE0F03F8E5D8B9F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276957, "uuid": "29a08b64-86c8-4185-ac0d-a7bcf0d18f43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276957, "uuid": "58eb0522-ac59-4eca-b8e2-c010d81ad070", "value": "12288:oDrQ47uELrXJy2Mda/Rb/kOhCQBMNqjASyA6rwAaG8lRdpimFjJQOoRrd9eSkRej:oDE1yr5y2Mda/BkOhCQBMNq0d3aG8hLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276957, "uuid": "ccaa475b-8c7f-4b83-9183-7cc9b02c2e47", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276957, "uuid": "a7b7430e-e4ca-40b8-8133-de4f064133db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276957, "uuid": "43cc0182-2aff-48eb-aae9-ceb0b5cf42bb", "value": "e1c3891695a70f6cecaa417acc69bb75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acbc7a2f-e44a-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1626229494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626229494, "uuid": "2905f0b1-67c0-484e-9f81-cd06709d2e95", "comment": "Malware payload (GuLoader)", "value": "7fb3aaf58328ae011bebff3f12a13fea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626229494, "uuid": "f1f6f50c-1891-4c19-8292-162231d4a567", "comment": "Malware payload (GuLoader)", "value": "e1e293cbd9c3deeabfdea61324e45217067414499d34ab8c6add548bb8c926ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626229494, "uuid": "dbb22060-72af-4876-8e24-235c8d04c1d4", "comment": "Malware payload (GuLoader)", "value": "c7b819f97655dacfe5693df3c40f09c5afedf74f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626229494, "uuid": "b0619bd8-73ae-42c4-8b9a-6d5ebc0d190e", "comment": "Malware payload (GuLoader)", "value": "e0ec8557b20c06a1d45030d834db72ae8e683298f402e8d8b89171a3a5428b068eb1c33efe5e853a1b49bb00d4c6722c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626229494, "uuid": "b4f4e7f2-3380-468b-ab22-db518c4e15a1", "value": "T14D344132DBD0DB19C5483DBD7831986761016811F21AAA9F5390FEB936E16A37DEE303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626229494, "uuid": "d6c3dcab-a10e-46df-aeda-1cebd7fd7c1b", "value": "91c52bc398fe162761407fc34944ce70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626229494, "uuid": "b25593aa-def3-45c6-acee-8562c44f389b", "value": "1536:g7x0PQWcBJgtp4OqCn5VqYJHD9u583kAEJhyCuv0q614eep5CrBG9YrtEc727APe:AJvBml54cHDfEuv0q62eepkdGl8Gl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626229494, "uuid": "4c27ffd2-71b2-4a68-b046-e22f8e2e5b43", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626229494, "uuid": "deae4d3c-821f-4722-8ff9-977aa9016c65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626229494, "uuid": "6a1ca98b-25b3-4d31-87f5-aeff07748ab7", "value": "RFQ-PO874849404.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee97003-e499-11eb-875b-42010a9c0053", "comment": "Malware payload (Pony)", "timestamp": 1626263481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626263481, "uuid": "2dce388b-148c-4f72-a341-de4cdadcaf83", "comment": "Malware payload (Pony)", "value": "d06d9ab44cb15aa62b3fecc4c4c9a418", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626263481, "uuid": "7ad902f1-4c30-4b58-afdf-5064f6cd8ad8", "comment": "Malware payload (Pony)", "value": "e1f5413f378bcab6974118dd7c0667789628fb12559012beafa0a2df7c26fb1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626263481, "uuid": "620a6494-be98-4c3b-931e-8a247ea47725", "comment": "Malware payload (Pony)", "value": "182e6de9c707d1b34197830247f1c4a7da017f02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626263481, "uuid": "0eba10c3-d95c-4502-bd6e-3aedde84f844", "comment": "Malware payload (Pony)", "value": "e955fad0c25e14d17651cb1e6663791722a00616ef0de840f3a95c5bc24b706f36b3556de4bc7adaeb0f3230b1a75f00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626263481, "uuid": "2c1ef7c5-51cc-42b4-9ada-84bc1c8a1441", "value": "T11914E1119A48481BCA62F674A315C4A1D075EDBE0FE1912F2ECF1269DC3C66C79EF4AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626263481, "uuid": "e5aef896-1a10-45ac-8e0e-24190ccf6779", "value": "4ba127fe6eacb6b5853313f4b9c03263", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626263481, "uuid": "054cd97d-f15d-4826-9284-84fbd88d28ab", "value": "3072:Qo1U20uzqNvRrQmhH6oSTcB526RW0ckzm:QVumNvamt8i59Lzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626263481, "uuid": "ed86c945-3d8d-46e9-8f2c-ca430b2fceb6", "value": 199328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626263481, "uuid": "2db07625-f420-4e49-819f-c22b3ff11263", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626263481, "uuid": "cbe46114-7ad5-41cc-a896-d2f1bc8a1caf", "value": "d06d9ab44cb15aa62b3fecc4c4c9a418.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe9ff98-e4b2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626274267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274267, "uuid": "2f780905-a23e-4cd9-9954-b1c2a2417d6b", "comment": "Malware payload", "value": "57806900a0a6e79d21b824e3b9600b3b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274267, "uuid": "d82f6e4c-3cfc-46f2-9a84-34e4b82c3202", "comment": "Malware payload", "value": "e4558e38adbcd7a23bc7f1f10d48991344fd6a030689bd0f325f14164723a04b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274267, "uuid": "5cf09838-06dc-4224-9e22-54b8a89871c4", "comment": "Malware payload", "value": "1d7b81971d2303942c9e3b6cc12c155e0cfe7061", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274267, "uuid": "f277753c-0fbd-4874-98c5-4f26dba424a0", "comment": "Malware payload", "value": "a5aa5375b8fcea8fe3f9c6e60a6ad00efd27536d2f016dba1976df8622228e96d6455eedeaa3682d1a3be3c6e70cc233", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274267, "uuid": "b3ecda31-042a-4a2b-8825-4cdf1ae035c2", "value": "T1C0B423D4B05377329F17EE214324E96F3F2FBA5B68241F12AF25351325293848952ED7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274267, "uuid": "416079a7-d1e9-45c2-8ea7-1381466e538e", "value": "12288:KJYqth0Hrl54rhA8RI57bE/p4eTw8NgaVjwiYYET3pvL3:GBUHZerhAx8zQMLBK5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626274267, "uuid": "bcce4e88-5ad1-4613-8e05-20abb6068e74", "value": 522035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626274267, "uuid": "51043a67-8e5f-436b-ab51-5779122d649e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274267, "uuid": "c4b33c59-993e-405d-8af3-74328c132791", "value": "BKQ82872.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86b68d1-e4bf-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626279791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279791, "uuid": "2064ad14-2d70-4b86-9dc2-2dac9e47357c", "comment": "Malware payload (Smoke Loader)", "value": "82e269f4c66549117bbc616854560464", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279791, "uuid": "26c41025-2f34-4e22-b35d-616811a2e45f", "comment": "Malware payload (Smoke Loader)", "value": "e4c8a48cc9630445efd47fab3bc452992b4b8d0ca35ede65bbc4edb8194af3a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279791, "uuid": "0606d508-23d4-4e4b-93bb-c0790d8adb09", "comment": "Malware payload (Smoke Loader)", "value": "cb5041cbb1bdd2613d3028caba5800df22f93c8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626279791, "uuid": "fcef2c7b-e99e-46a2-91fb-cb6544aceaeb", "comment": "Malware payload (Smoke Loader)", "value": "926eb90a28b3bb546bc8f194c9cafabc74907d2989d3e5bc085d2a3179d20f0c5a3b6d071733fd4aa2a8da0620152e51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279791, "uuid": "15760db7-6b83-49a8-bf8b-338da9cfd406", "value": "T1E6149D2132E1D431D6EF353C6477C7AC6A3BB932EA70854F2654266E1E302D19A7A34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279791, "uuid": "ef4d43d4-7cbd-4a94-98a5-bbdb7724aa84", "value": "f9c1cf1b2cfb3ee96a94f56e9a89c09a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279791, "uuid": "ca1e2484-33bd-4612-bb8a-b83fac83666e", "value": "3072:nBNmnddtRpyN2Y5H6OhixaylCTKVr/h0ojm5qBUbGHcqHkbN:BeJpy9apxaeC+N/ao/GOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626279791, "uuid": "61356005-6489-4726-9961-8c147e2d8520", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626279791, "uuid": "cbc51040-3301-4faa-ba6e-3b7ab559cbdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626279791, "uuid": "91c300e5-ac3d-4b46-aa30-5d02fc9f9ab3", "value": "82e269f4c66549117bbc616854560464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6f2c61-e4c3-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626281407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281407, "uuid": "a97699c0-b387-4211-97ce-37b92f3420dd", "comment": "Malware payload (NanoCore)", "value": "ed545edff74d2835f81f865671e788c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281407, "uuid": "bd13834c-ce3e-44de-9dac-5517027b21d7", "comment": "Malware payload (NanoCore)", "value": "e511f1b91f265ce9b588ef34de7b89b659f3db66fefa2bf2e6ce21e02bda1a87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281407, "uuid": "645aca16-8197-4f6a-a62a-c19a38397f20", "comment": "Malware payload (NanoCore)", "value": "3daa14c94e57886c9b6abcf307e53241680ff7e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281407, "uuid": "f9a25e77-3913-4208-a919-28215e840e10", "comment": "Malware payload (NanoCore)", "value": "7430edda2011aa673c6dd7a32a80ea00c59c8f26e05978150d5d0a553a9dc08c8d972b48c18fc1cec3c1e5a8ca29012a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281407, "uuid": "f79408e8-5915-40c2-86ea-a32941ec1e01", "value": "T1DEC2A4092550BA18C2F706780953ED3427F883B24881D20EECE166DCDF427FA69DDEDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281407, "uuid": "125ea980-d4f7-462a-ae6a-74206595bade", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281407, "uuid": "3a33809b-55a0-49e6-b835-c942d349a88d", "value": "768:w/gZ3MwX1l+EeK2Szcliu/W6jrqlsScg/:w/+3zX1lipniaj/g/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626281407, "uuid": "c2460f61-a9d7-4295-acbd-a2c7aeb91179", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626281407, "uuid": "4b2a7d7d-8349-4855-b0ac-76cfaefa4622", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281407, "uuid": "507b3038-6797-4e65-a757-fb1e0c032a85", "value": "Aurora-Invoice-9383736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db93f6be-e4af-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626272951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272951, "uuid": "fa299a77-2a9b-4af2-ade4-01093fdfcea7", "comment": "Malware payload (Formbook)", "value": "e4d36a35ae307475874edeac6177e6bd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272951, "uuid": "fb3f8612-0848-4db4-9b24-ee8dbadf71c5", "comment": "Malware payload (Formbook)", "value": "e5501150e796ff528bd809d71380dd8214699e05450c6d083dd07cfffe8efbb6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272951, "uuid": "15888b33-d1b0-44bc-857e-4256aaeac25b", "comment": "Malware payload (Formbook)", "value": "1cabf6f2b24fa3b7c0a7735ff059aa30da58bac5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272951, "uuid": "e66f337b-09ea-4631-acbe-30ba58bad042", "comment": "Malware payload (Formbook)", "value": "081818526393e7ec8f3965009776abef591a59e47dd7bdeb46039c91feceeef416fd9a21eeb7de6d81d6968b73b2c9ad", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272951, "uuid": "e5905879-1505-4092-b6b6-a906b4d0de2c", "value": "T1B2551206F06D1B75D3478AF1A4A3B2750B247D5D3AE3581FBAC8778529BC32937E6088", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272951, "uuid": "3089e206-52c7-4a66-b509-430883fb1542", "value": "24576:A+F15DSWVG4E5ARO4E29q7L7Xe7MVgtyfAIGrqwSzZndz6ifvTZ+D:XF15ZVkA+24LK7SFoPONzhdz6ifLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626272951, "uuid": "13dee20f-110b-4ec7-b957-cea84bd3bceb", "value": 1293624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626272951, "uuid": "a0fba283-e226-4a4d-9926-d9d989fad8a8", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272951, "uuid": "c86ce211-4cd2-4b5a-8469-9e120a76c34c", "value": "kung.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02c4e34-e4af-11eb-875b-42010a9c0053", "comment": "Malware payload (StormKitty)", "timestamp": 1626272905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272905, "uuid": "a62e5b5d-7485-4110-90c8-d2885b5ef166", "comment": "Malware payload (StormKitty)", "value": "9ca6188ffa6e7610504240a8e653a1af", "object_relation": "md5", "Tag": [ { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272905, "uuid": "ec934fa6-1a71-4274-a19f-2f821bcf6ff0", "comment": "Malware payload (StormKitty)", "value": "e56be44ff82710e8a304f15c2db34bed017876b9fb36efc1b84c7ace02e6b88a", "object_relation": "sha256", "Tag": [ { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272905, "uuid": "d27f21c1-30c7-482b-92d9-a15c5840458c", "comment": "Malware payload (StormKitty)", "value": "c0cdd372d847acda3f851f9b96f74a48f9f6ba0b", "object_relation": "sha1", "Tag": [ { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626272905, "uuid": "0c7f7132-18ff-4bdf-9a06-42c3efd92471", "comment": "Malware payload (StormKitty)", "value": "5443f3f040569e810b7820ae7948da1bf222d779156b28a4718aa0d22f2b6eb893d96ef6b4169f97ac15e0e3460f566d", "object_relation": "sha3-384", "Tag": [ { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272905, "uuid": "7a0d4894-3822-4bc7-a9dc-308ee2abe4cf", "value": "T16D4513D1706B1D6DD5119877C8D2D0832B23CE54EA2248EE6B82732F697F0A26574AF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272905, "uuid": "0a10e310-2ddd-4af0-8b4a-98eef77ea172", "value": "24576:5Z18D4CGqb4SQ0eL6S/4fVpiqeNIq4ko9yyyyyyV0yyyyyyyyoyyyyyyyyyOJyyg:5ICqsD/hCVp0v4ByyyyyyV0yyyyyyyyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626272905, "uuid": "f4228b74-c562-4666-aba2-d6bd7d23d82c", "value": 1185544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626272905, "uuid": "82c5a784-9e59-4817-b722-e31a9f67d31b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626272905, "uuid": "81530023-ff78-4430-a720-f35172c68753", "value": "order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87655659-e469-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626242745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242745, "uuid": "bdd95b33-7ffc-4a46-9906-1d6ee7839579", "comment": "Malware payload (AveMariaRAT)", "value": "2b216584c4d55e8ef093e239448ebc8b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242745, "uuid": "d867b7ab-a580-4047-8a89-77d928ae1eb4", "comment": "Malware payload (AveMariaRAT)", "value": "e59dae30834e8d82c8cd20b919ae274c02ea83e07bdc9d467a8a877bb8d741b6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242745, "uuid": "12c472f4-b624-4224-81fd-65885f8bedcb", "comment": "Malware payload (AveMariaRAT)", "value": "dfe9455a6559f1e821fe6fcb721275061f27bfa5", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242745, "uuid": "a9f2904c-c5ca-483e-9d62-76ad7777641c", "comment": "Malware payload (AveMariaRAT)", "value": "af598c8d6c581ef744e68d3251624640ea09a1eb717a9067e4745f0622509a50e5f2079894f2664d761b7e195254ee42", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242745, "uuid": "8e38ed22-b580-4b2f-b1fd-339a20a99daf", "value": "T122D423B183518D68940FEEE642A7E479F7739D9A34275BBB021833FB703E6A574B0406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242745, "uuid": "e069e206-0acb-47f8-bf16-2a5ec437068f", "value": "12288:wRGW4pb0b+MXNYiR4FpJ3+fCmKv9W1oFPDcMnvExSH7lQo5vn9:wQHbAbXNYiR4FpJ37Nv9W1opwQaSH7pH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626242745, "uuid": "c3302ef6-ba35-4792-ba0e-3b4483993510", "value": 607367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626242745, "uuid": "96e4835a-a892-41d2-818c-420c547b6d7c", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242745, "uuid": "6f895b35-cd7f-4b43-9f58-f27fe434d436", "value": "Quotation for named specification new order.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d39937-e482-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626253561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253561, "uuid": "ccb466e8-a628-4478-8830-abf324b402a3", "comment": "Malware payload (Mirai)", "value": "07bd0978343b0f2c674084c5f6a64d48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253561, "uuid": "f50ccadf-a334-4f06-adf9-1b0a529d15f8", "comment": "Malware payload (Mirai)", "value": "e5e842f5454e2f1e1d66998de4a3175b5badb32f1a6d768d800b180d626128e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253561, "uuid": "11615969-2adf-4f3e-995f-613e53847fb1", "comment": "Malware payload (Mirai)", "value": "a3d79a27267705a5865d1d615469a6edad398558", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253561, "uuid": "689796d1-40a5-484d-85ba-9f731d7ccc0b", "comment": "Malware payload (Mirai)", "value": "340456965c1d4a9509dbf5573412ea7bb1010a4cd2302ebc27aac8b7782b75f45798b730156e6a5678e35ab7d8d5f4d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253561, "uuid": "6242f033-deca-4402-9f35-3d3d6e438879", "value": "T1EC33F15DA682AFE3C5C408BAC60C9757B693807C50DF393616ACE79C26E645E27DD403", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253561, "uuid": "87138b2c-fb22-46e5-9c3b-a287783d00e8", "value": "1536:lL01R+lP/2huxXkHQ7WtAudzuuWoLrdtUmf1frh:lL01RsP/2hbaGAoRLjUK1Th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626253561, "uuid": "4528bbd2-e85d-4162-9a91-6ca671b04517", "value": 51636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626253561, "uuid": "633ccb82-167f-40ca-9b51-56f139a47d30", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253561, "uuid": "e823f3bf-0885-4429-be00-9865e49b847c", "value": "07bd0978343b0f2c674084c5f6a64d48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69bae4b-e4e6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626296539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296539, "uuid": "f9f281b0-87bf-4763-884a-0d2b7e503829", "comment": "Malware payload", "value": "774a11366f132d78698d284475772942", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296539, "uuid": "9423a840-eea4-4b33-acae-7e4bce016558", "comment": "Malware payload", "value": "e5f99138b206bf4fba002cb6546e78c4aba1bc8bbd4a2fc4bdeaa4abba43c838", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296539, "uuid": "2b128b44-27ba-4747-9c47-e5c6c01ee808", "comment": "Malware payload", "value": "d8a2cb4b9fbf0860d6c64a6e1a60534055d27cb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626296539, "uuid": "035a54b6-2362-4d1b-909a-67658c11a4a2", "comment": "Malware payload", "value": "61213873b2b22184c3e883bae0add1a4a45d5fca37a13ee2d4c3e25d09917b5cec003f168179ae1c02667a2ee800f6e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626296539, "uuid": "cfb1f086-5783-4dd2-b58d-ea668e336586", "value": "T192159D2D23FEA649F63BFF31AF94E7489FA627B942169C4E18C006472420D41BDA7C35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626296539, "uuid": "6dbd7d78-2f99-483c-8db6-01a065036816", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626296539, "uuid": "348fd3fa-c1c8-42f9-adba-c4bfbcc79d6d", "value": "12288:sZHJrNls9XOd4+QC7uO1z1Zb4YAqAZsmUNyjNQWO4utiCrnplupsY5hzfEKE2D4I:sZfuwkUUj2WNujSzc263AsXs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626296539, "uuid": "a12d1301-815f-4fa0-98a7-2d1de71646f9", "value": 906752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626296539, "uuid": "5d432c3c-8744-4c35-87cb-84722631b202", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626296539, "uuid": "e446fbb2-8b6c-4440-8e5e-121cd7233701", "value": "IKMwCdywDCsFOfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2e5025-e4b2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626274187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274187, "uuid": "3de3d333-8559-47a6-8ee8-773d1b617042", "comment": "Malware payload", "value": "12a329bc5f57994a2441e2eaf1e3d9c2", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274187, "uuid": "09294979-ff1b-4310-837c-c165b8e34a89", "comment": "Malware payload", "value": "e64b645ea5e49d9ae5b7faf331a14818856f381d2d61c95a0856c1bb25028341", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274187, "uuid": "59b6c455-4c30-40d8-b3f9-db1cf519e8c4", "comment": "Malware payload", "value": "2c3744e4e6818e7289c4cebc1ef8c70c746891be", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274187, "uuid": "896ddc03-7fe9-4061-97cc-63ae13dc71dc", "comment": "Malware payload", "value": "ad6def73f62d9c6ce7ae11f20ee438e4087283cd07bde1e5641cfdc377efeb63486000188f70bcf9ac3237c2fe8be035", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274187, "uuid": "8a6a44a4-216e-4750-90c1-c05c8668f3f8", "value": "T1627423EF1D4F24CE199AD622839365D02C5C6F7F5C0C115F9EF8E381847E29AE246E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274187, "uuid": "f32a3f2d-312b-42eb-ae6f-8ec3b8044df0", "value": "6144:8Sr4xld2o1yxqZJDNA3IPACwt2hjWoDdE0oI8v2ZFzSsOGabmxt704t10:hr4yxqdF4COAjWoDFoI8u7p1a8Vt10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626274187, "uuid": "e48e6897-18b3-4dae-8d8f-277e690f07e5", "value": 361694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626274187, "uuid": "1fbebe38-850d-491e-9b90-2ce8c0b2bec1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274187, "uuid": "0589f408-fb3b-44cd-813c-ed36aa19d241", "value": "Arrival notice ETA 19th .r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28f1ad8-e468-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1626242361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242361, "uuid": "7580e713-58d8-4812-894f-6e6b04fa7fb4", "comment": "Malware payload (GuLoader)", "value": "8e359ae78aa7c48c8d15bb93f5b69521", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242361, "uuid": "aec851d9-6203-42ad-a360-3eeac2b22c60", "comment": "Malware payload (GuLoader)", "value": "e676e947b97e99ebfb59e6e9af00410653e53ea00bdcdb7d0b25bc9b0c6962c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242361, "uuid": "9b6708f1-cd08-4dee-a1d6-145a5992e4cf", "comment": "Malware payload (GuLoader)", "value": "79f9a6c8afbbbba83e2942a8f85289fe4cacfea1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242361, "uuid": "dee38063-4171-4afc-b031-b8d6d6ed427f", "comment": "Malware payload (GuLoader)", "value": "41f8bf6308b102fcde46bdb2174494a609db3539d6c81c29206b07fe871d4da28238294292e4b29a169d2b19f9e76d85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242361, "uuid": "7f30ad6e-2217-46a5-aa7f-982c4c932cad", "value": "T1CB44B40C3248E55AE054B530E5F0D8ACC1D27D326A83AC0B76907B0B55756EBFBB5B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242361, "uuid": "b0b68fe9-ed30-40ea-b3f4-bac1d05afec5", "value": "c143c7106bf933e5bdae26ae683f0c9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242361, "uuid": "e83c0a28-6d16-4834-bb9c-959eec7afd22", "value": "3072:acIFBcSP1begxhfCweRWfoZ/uZQ3jtrRO6dHpIaN+fQbXLac8S1nEATIfg:K/B1b6RWf5ZQztXfbXLaZS16f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626242361, "uuid": "f17307d0-30b9-41a7-8f44-a742985a63d2", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626242361, "uuid": "73593f5d-eb7e-45db-b1d3-447d5273f5c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242361, "uuid": "48838d8b-df38-4daf-8e6b-a7e4e159182c", "value": "payment advice.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc06f6af-e4b5-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626275475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275475, "uuid": "bcfd9bb2-38b2-48c7-abd4-3e4dfed09478", "comment": "Malware payload (SnakeKeylogger)", "value": "ee30024e19336ee7f0a8b9e9e4d23f2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275475, "uuid": "8ef3661e-d672-47e1-8663-54450e2ffe49", "comment": "Malware payload (SnakeKeylogger)", "value": "e7703afc09d5615897f8d6fcb0c7988ddfcf347047da78429aea4c9776d9e062", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275475, "uuid": "7340f8d4-8a67-46d3-a1b7-130fbb0a18f9", "comment": "Malware payload (SnakeKeylogger)", "value": "d5a34636b46ba0563f260bf51cb68dc5a2227c23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275475, "uuid": "c54eb525-c8ef-4190-a08d-4c9d4a498c3e", "comment": "Malware payload (SnakeKeylogger)", "value": "439324155b678b440bc4a622ae1f59e543fb66220487f8744d89549eeb6a15d7f44328ef5009adf21f5d19f237eaa252", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275475, "uuid": "6334813d-dc61-43b6-9216-1507c6d383d2", "value": "T184F40126B741BB0EC23ECD3988524C10F7E1E6778717D747ACE316EC158EAA98F21295", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275475, "uuid": "3a59db64-d55a-48e1-9d94-ef5beef246c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275475, "uuid": "84333736-f64d-4575-a26b-81d10dd7599e", "value": "12288:+kbPOhG0nhOm0VXCHEtDbLofKHPPWDAB2A0cSnbabTP/u4u5GmZcgQT:+kbWhAzVXCHEtkysCtNSWTQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275475, "uuid": "82a078d3-b3b6-4c1b-bc14-dc5bcd51a4e6", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275475, "uuid": "205cb27e-a733-4883-ada1-55672a72da94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275475, "uuid": "da3d18a6-f902-4861-a866-3cf9a9bb9e06", "value": "ee30024e19336ee7f0a8b9e9e4d23f2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3546e4-e4b9-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626276924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276924, "uuid": "b87edeae-53db-493f-8666-c39c5f556cb3", "comment": "Malware payload (AveMariaRAT)", "value": "ec9a437396d68e3274875fd8d2619027", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276924, "uuid": "c881ccc0-1554-4c8b-a4f8-243922dcbe2a", "comment": "Malware payload (AveMariaRAT)", "value": "e81c6b84f83b9ac8233102f31e21bfeeab4ffaa5aa4c02987ce910de908a83ed", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276924, "uuid": "6d6ce5cb-b3f2-472a-b3d7-e15b48289bc1", "comment": "Malware payload (AveMariaRAT)", "value": "dc3a2e100c2b645caf20f8fbe1fa432609d2a2dc", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276924, "uuid": "26bee7b6-9e7d-401c-b401-800e8e5bcfe2", "comment": "Malware payload (AveMariaRAT)", "value": "e106c27f8ef41beea7e329fbe06fdf9bde5608b982a9cf4aab094b80ced8829ce62d096b0dc38f79e7d99d71424d7004", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276924, "uuid": "f1f488a7-c56b-426a-83e6-cd01d0ce4dc3", "value": "T113741324E041AD3FE66647F315F215A142BF7246A9D6DBDA2FB1A48D0502FAE131BF03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276924, "uuid": "3758b6b8-8614-4148-aba6-d50912b1c69d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276924, "uuid": "cbf998bf-be20-46d2-9e42-238c442a1428", "value": "6144:/H4PTLGGtw7mbDRBFWs8XYFg4IK7RudOct2tR1L3i8WGlmZjjj:/HAHGGS7mwrXYFpIZdwtjy4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276924, "uuid": "13981cc2-0263-40ce-8da3-e971c74522d9", "value": 369152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276924, "uuid": "d79f50b9-0fc8-40d6-b6c8-321b86aa94a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276924, "uuid": "81918405-5f7b-44a6-8d7e-686e3906b7b5", "value": "ec9a437396d68e3274875fd8d2619027.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b52760-e467-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626242045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242045, "uuid": "89e124e2-0f32-42fb-9d2b-a7bb0d078f2c", "comment": "Malware payload (Loki)", "value": "f052911c3788ef7bf876ea8e0d705037", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242045, "uuid": "75f952a0-090a-431e-911c-9bfc861aa24b", "comment": "Malware payload (Loki)", "value": "e8836ab32204a162e83f9417dba35291ef06372d19088674ed0d6971ec092bb3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242045, "uuid": "57b9ecfd-1c7c-4f6b-8287-4d664cff8a8b", "comment": "Malware payload (Loki)", "value": "4cf98ff761302f31cbf8975a98a4c9a1a524150c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242045, "uuid": "ae074051-072d-446e-8834-e3ccb532aca5", "comment": "Malware payload (Loki)", "value": "d22a41569aeff9364a2fb295cbab2fec4eff5a8a1353e6bec0a513ec80cdb4a083371e35e3a590a29c31b0261d0b6009", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242045, "uuid": "5b41ad1d-de51-4ba7-a0ec-b33fe4038f2b", "value": "T1D56119A1347D4AEBCF1D0427C9B5FCBC01E572C284CB599A36ACE9E30FA13415E11503", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242045, "uuid": "43b441f9-a6a2-481d-ae76-33e6fdae6aa1", "value": "96:EoTvepZWUA8jRKQyFyQyy0eMMaWlErxB0j8Q9cJ:EoypQ2zysVyatWlEVhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626242045, "uuid": "0d852e96-032b-4c15-b3cc-9e36c3608aae", "value": 3399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626242045, "uuid": "3d6e39af-920c-4a44-8427-ed1e0984a147", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242045, "uuid": "b825adb2-b42e-49f3-8aab-fa02ef15c4b6", "value": "PO 4020169418_SHC 1000350721.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4dee341-e4b5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626275463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275463, "uuid": "5ca48814-bd80-42d4-8159-677492c95815", "comment": "Malware payload (AgentTesla)", "value": "a475d3ea6acaa7e4c8ae48faf7a4dac0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275463, "uuid": "96bc0cbf-5524-4ac0-a985-bfdfe7fdd87e", "comment": "Malware payload (AgentTesla)", "value": "e95736df9c2a8c47b059e6a26f66263043b05b1f9494420fa24e5247e3495bb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275463, "uuid": "6a39545c-b142-4091-90c6-122eea84d7de", "comment": "Malware payload (AgentTesla)", "value": "ec03927f0ee53ddef95770369fa076de310731c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275463, "uuid": "709d72cb-1113-4dbc-99e8-313944b81de5", "comment": "Malware payload (AgentTesla)", "value": "1690bb71f1e1765b9db8e720b1429d55e004ac79e836bc25fb915c04172ca7983d2f2a29b2cd9cc15b836d74caaf1e45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275463, "uuid": "2a598e5b-8add-4578-af4b-c8d19858c77c", "value": "T16D058C2C23FEA749F633FF319FA4E6489FA666B58215DD0D1DC4024B4421D82AEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275463, "uuid": "05808f76-8fd6-4840-9bbf-5f90c01c2291", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275463, "uuid": "5e7f1be3-5eb7-4d36-9358-e247fbe7fdb6", "value": "12288:gRq9rVNrNls9XOd4+QCMihphme53X3c9wStqMU/VHwW/JAZHawDw6UTDtnZQXRQi:gRq0Swe53ceStPUtHy7UvtnZQCuB9vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275463, "uuid": "3157f703-8f16-491d-bc28-997a180f95cd", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275463, "uuid": "873c6d90-c9c7-4791-a80e-7bfc9abb2f18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275463, "uuid": "f477c050-3424-4c67-b61a-cf8790d40868", "value": "a475d3ea6acaa7e4c8ae48faf7a4dac0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef72e010-e4c3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626281575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281575, "uuid": "cf4c28c2-d696-4de4-a68a-aaeb7d6d5f8c", "comment": "Malware payload (Formbook)", "value": "4d80ba34b2d38dd92c36bb9b2057f890", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281575, "uuid": "0d049648-78e4-4755-9c35-e153aedf38ad", "comment": "Malware payload (Formbook)", "value": "e96f510044e2be6e588df6baf04b49ee09a0b96404e79623cafba8465c4e24a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281575, "uuid": "cefa54e5-371c-44ee-91eb-18838f55c6dd", "comment": "Malware payload (Formbook)", "value": "f2bc31f7b0420b2ebe02f577837e855b2678e949", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281575, "uuid": "c3007476-6a59-46b7-ac98-409a796bfd10", "comment": "Malware payload (Formbook)", "value": "0c8503fccf70d5c6940dad42219b01c528bb4891aed14cbe82680effb93d47c159a9957ad629880f52511de9fd60f8aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281575, "uuid": "c16e9765-226b-4bdd-9386-7a126524a397", "value": "T125158C2923BD971AF233FE315F68E6445FA66EB54215DC0D29C4320B0471E41AEABD3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281575, "uuid": "69fb48df-7f62-4880-8816-9554f4bfd694", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281575, "uuid": "f89bdd14-4f19-41d3-8a38-c93c80a2a503", "value": "12288:s/u3ztsrNls9XOd4+QCK6ZdK2GQiQI9YwksyAlQ6EdjG7YfKRaozL92E1f7r3yOg:s/u6hGuxwCjH+aaswfy34gEcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626281575, "uuid": "2403d1d4-f2e5-4b86-9e8d-e044ac7e1354", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626281575, "uuid": "1b6c36d8-8a60-49d5-ab13-74dc7edff02d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281575, "uuid": "3ff7e879-0a73-44b5-9f3a-871945322a75", "value": "4d80ba34b2d38dd92c36bb9b2057f890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e896470e-e4a6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626269108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269108, "uuid": "1305c7aa-aebe-44a9-8d14-086372f9b21a", "comment": "Malware payload", "value": "b87124dab2f3f1170eaa5c20c28ddc91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269108, "uuid": "efecd6b1-820d-4b4f-822a-9845ab8ac503", "comment": "Malware payload", "value": "e9add2f998dd9bb96e6b6da122225276885eca7c5e0ef4e43b33196d7bac7460", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269108, "uuid": "fd5b0b7e-0e20-432f-aa8a-e9600c9a12ed", "comment": "Malware payload", "value": "1c70a8c621386cc8c0bd4b007ea08a3831d98d83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269108, "uuid": "3c24b26f-43ac-43d7-8289-0532b5c6e8da", "comment": "Malware payload", "value": "6df708b47b63c438f782008bc69c825cff517cd751fa1a8ad524db7155d736e45914ea0174593a5ee8f2d1f160795db5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626269108, "uuid": "b346f5e8-9184-4166-95c5-31158fb567e4", "value": "T1F8262916F8A254F6C1BFE13086629322BA713CA943303BD35F94A66A5A75FD47E3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626269108, "uuid": "2c85560b-a22e-4820-a8ae-41a6e1e73a28", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626269108, "uuid": "f182ff09-d39e-4b52-bc42-fc4b9d8a979c", "value": "49152:c0ByXR/+uIybSZb4iwCoSRyy7addT2gJ7IjxbU97+IBAn9V1:7ByXR/+gOZcJnI7avCwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626269108, "uuid": "6e4fb3b1-fab5-41b6-a6c4-df06e6163f88", "value": 4545024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626269108, "uuid": "2f891e06-e493-4742-bd88-6da6777fae12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626269108, "uuid": "9e994ef5-36d2-441d-a709-0cb40809f16c", "value": "e9add2f998dd9bb96e6b6da122225276885eca7c5e0ef4e43b33196d7bac7460", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6716a941-e4a5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626268461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268461, "uuid": "2375e8f7-73fa-4f58-af8e-f63023b64353", "comment": "Malware payload (Mirai)", "value": "eb694d3c5416f0a09914a914de4094f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268461, "uuid": "119e70a7-5df1-45f9-b557-1ef5ded16589", "comment": "Malware payload (Mirai)", "value": "ea18784cdf16268c9f1e4972931bcbc4196b352bd81b441ede5932565c1ddf9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268461, "uuid": "7ad011d7-ded8-4ff3-a3d7-6ff84e7dab05", "comment": "Malware payload (Mirai)", "value": "1a8710e673f77140538b9d7ba30c848d6aac631e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268461, "uuid": "deb10d1a-a29b-4afe-a2ed-e0ed6039a294", "comment": "Malware payload (Mirai)", "value": "f873e56672d95cfc93c54f513e81841004e867ea1c5d44942eca869dba0c3939a9e31da127f8d68b1e315447d9b982fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268461, "uuid": "45cda0a9-39ce-4775-a981-bdd2d4989da6", "value": "T187233AC4B483F8F9EC15457C307B97729EB7F43A603AEDABC39994239815601AA072DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268461, "uuid": "1bbb8202-8591-4c55-8a81-2bdd160b8ca6", "value": "1536:4LInPCqAAXJLE7cxtdw8NAqBNMsvk9YXPSP0Hoa:FCqxpE7cxtdw0Aqvjvk9sSMHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626268461, "uuid": "7e51f075-94f8-4490-9b93-141a9c2b9e6d", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626268461, "uuid": "33d947ec-0053-4850-befa-b787d7346356", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268461, "uuid": "74a5050f-a3e1-4310-a0a5-3e14d8f38d85", "value": "eb694d3c5416f0a09914a914de4094f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0408ba-e44e-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626231209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626231209, "uuid": "722f33e7-d670-4166-b982-4f7974542ee2", "comment": "Malware payload (Mirai)", "value": "c7ffbfe8901a00509cba17bd07945943", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626231209, "uuid": "f6ea4564-32c2-4867-9599-c1d285678c6b", "comment": "Malware payload (Mirai)", "value": "ea726b38848c39a3de5a6e8aad0128f776d7c77a2b2c25a921ddc15f847675bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626231209, "uuid": "8468a623-ec9d-469e-bb8f-77fbb20450bb", "comment": "Malware payload (Mirai)", "value": "ecc097a1ac62d32fe7b9bcfe51eb9c84fdb40b03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626231209, "uuid": "901a4e23-b0a5-4045-ab5f-79c2ce4b66d3", "comment": "Malware payload (Mirai)", "value": "f69afd041e1f2e7e492327e472c49cee64c940df113cbb30189d83c91e758a95c184c4e808638e59ca30c3e9438e823d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626231209, "uuid": "94df4258-d7b8-4887-bb81-98f29ed39368", "value": "T17D53970A3E21CFBCFBAC863547B74E309658339626E1C584E15CEA015E7070E785FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626231209, "uuid": "d8decd82-ba4b-4edc-a343-3bd129989ee4", "value": "1536:PjNpjrDujW/+mZBVJtrwySpKBKfKIsq4jQ7ZA:bNpnD+CjVwyLmKIsq4kO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626231209, "uuid": "83d2270b-0d00-4789-a55f-74749627bebe", "value": 64012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626231209, "uuid": "def619db-768a-4c41-ab24-257e37022f84", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626231209, "uuid": "794e26cf-604f-48d0-bae4-e5ee1b061307", "value": "c7ffbfe8901a00509cba17bd07945943", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d7fe9a-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626246071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246071, "uuid": "9644970d-4e38-4ab5-a6c6-d0c94100c790", "comment": "Malware payload (AgentTesla)", "value": "bd89cb141e424975d8e0719c4c116a3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246071, "uuid": "b0208479-7ec5-4131-9d29-a0235b4ee6b0", "comment": "Malware payload (AgentTesla)", "value": "eaaf0dbd2ab3f74585203a1fd6da7f3d62198d532777d1b86e5cc247d881c159", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246071, "uuid": "fbbefe98-2e4c-4707-97ca-1e29aa0a37e1", "comment": "Malware payload (AgentTesla)", "value": "6b430955f1b6c5cfa2644a6b314920398fd10f5c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246071, "uuid": "d29c3beb-d6f6-4406-80c9-817dc2680bcb", "comment": "Malware payload (AgentTesla)", "value": "2eddfdd6aba7a84372c0a34bc02580f6fe1a2f9ab775e92ef270bebcb9e37202f20f7ef1a66d8ff1c83679b482581ce8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246071, "uuid": "81394bc4-fcff-4630-9c21-6da6b626a250", "value": "T1B2157C22E3C045DBCB7D02F97DA0B298FA5C5C7A66108D8B3FD23185A57B22154BED1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246071, "uuid": "43c864d1-f7bb-4c16-8b6a-2fb43b030a33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246071, "uuid": "55200a91-5442-4291-84a2-ddad01de5a4c", "value": "12288:24QUCGIZ4DLUs3xd7o4TsDOlnWb1FCinn+oKEjgunXkw8X:24QU6e/Us/pMpb1f+32Ur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246071, "uuid": "8bf3252e-09b0-4a3b-8c71-7013e29c42ad", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246071, "uuid": "ef0c5fcb-a309-452c-9c94-d8e4bd7d3d06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246071, "uuid": "11ea2c78-ac35-4649-8124-45df3fa95f68", "value": "Performing Vessel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a724369-e4d5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626289109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289109, "uuid": "98bc4571-1ae6-4ab0-9e4c-b821d9dd14e6", "comment": "Malware payload", "value": "73f2506109fae384bc40c7ba7cb5fc9c", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289109, "uuid": "605d2f42-9228-49d6-b79a-7944a76ec9d0", "comment": "Malware payload", "value": "eb5b61b197c89ba6a19d3eaeda56d858f6bd30beaff0a43719fc5c6591e7ad2d", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289109, "uuid": "5d9275c6-2ab8-4f57-b981-d6ae34385187", "comment": "Malware payload", "value": "58785bf67005c615296afc31ead5319c6f119b8d", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626289109, "uuid": "ae3b257e-dced-415d-bcfd-70ad313e9fb7", "comment": "Malware payload", "value": "bd9faeb453dae5c98420e6104ce68ea356976ebf3d8986e9fe68e9914dd7ccc5d5ba6de9f0a42cec43798a339179204e", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289109, "uuid": "3e9a6bab-2a70-4856-be4d-7dbc12052d80", "value": "T125F448E5ABA4CEB5EB01C1718C9D195863B4CC118A49AFC77255B03CFF3BB798E88185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289109, "uuid": "b6716197-8176-4204-8f42-09d59d3c21f2", "value": "12288:DRYbXrlUc6XS/CwRl+4MW1H5onZHBDznxcp/c0UGtkbByxlFYd2DrpE9Nr:sUc6EjDMW1UrDjxcNcfgZI2or", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626289109, "uuid": "2e8d0451-63f0-4f9d-9be8-61748260d771", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626289109, "uuid": "077b3a06-5d53-43fa-b1fc-7ba9182efba5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626289109, "uuid": "8a3637ce-98b6-4e71-8dc9-5364aa1dff0e", "value": "73f2506109fae384bc40c7ba7cb5fc9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4758b65e-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626246074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246074, "uuid": "aa58ae02-7c71-4010-a7e5-ef05c225af23", "comment": "Malware payload (SnakeKeylogger)", "value": "89999fdaa07270c074c1ff9c86ce26a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246074, "uuid": "169e6067-42ab-4b68-a946-c39af01f173b", "comment": "Malware payload (SnakeKeylogger)", "value": "ec0e08b45cab17ef409d93105a7d3d4b246606af934a49faf8f2403d3ab52559", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246074, "uuid": "242b3b2a-4fbb-491c-a8f8-c145e6eafdb3", "comment": "Malware payload (SnakeKeylogger)", "value": "8c7d57edfbca0edca571e27843fbe0d972691215", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246074, "uuid": "b546307c-9ae1-4ec1-b530-b639b83eb463", "comment": "Malware payload (SnakeKeylogger)", "value": "b52be67dad2e82ee1fd0ed133e47b569c15eeda9e1266cf7996a0f65fe2967a7795f0607e4feb7d3ea6b802e8c5ee48b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246074, "uuid": "ae031ff9-0c93-4618-a5ef-1b65d081259e", "value": "T19664026132889CAEC8345BF71E676584076D7D5976C39A8928ACBF8F3535F9D0233B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246074, "uuid": "80105f78-2304-401e-9356-3cc35fb83746", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246074, "uuid": "fafa8dd3-2568-486a-bb24-6bd37c2ee318", "value": "6144:a4PQuSARTAjjiES8zQ+hE7epqivGCoE9bg4M8nIxJXxsfdEr9:aAQuSYAPmqDGCo0bg4lSJiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246074, "uuid": "3403738e-90ec-4d17-bad5-4aeb22042484", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246074, "uuid": "db1d570f-bf39-4cdf-a105-9c7e6975dc05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246074, "uuid": "20f770ed-538a-46cf-85a1-36a9901121b7", "value": "New Order Requests 006166-RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3599d674-e4a3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626267519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267519, "uuid": "192b5a6c-9eb2-4059-a1a8-4f961c3c4b80", "comment": "Malware payload (Mirai)", "value": "4298d45d8d44a28f54bf723ae927544a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267519, "uuid": "ac3dc1ee-c410-4c37-91ea-c97323cc7053", "comment": "Malware payload (Mirai)", "value": "ecaa4d0f3fdd1decc75b3f8964c0cda8de1688cd7b5e9346affe57ca12a365d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267519, "uuid": "c4588759-68ab-4275-bc2c-a611dc74e7bf", "comment": "Malware payload (Mirai)", "value": "2cbbe6c4eb41d92ecaa9298d8dcd2515bf92f07e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267519, "uuid": "28963a59-c82e-4646-9685-e860541a45a7", "comment": "Malware payload (Mirai)", "value": "2d91083af6557bc9cb546b0e9d16beaad3c22f6118dcf5bdd8b29db9d9240df32285b00313bdb9374513db7fa92a3ff0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267519, "uuid": "d2c79adc-f131-48f5-8f07-4510c53a767d", "value": "T10F4309C17881A626C7D05777FA6F018D37199798E1EA33538C291FA07B8AC1F0D6774A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267519, "uuid": "ae14a008-dffd-49da-95e7-09fddd1c1ae8", "value": "768:N1c82KhvRRTdj7tsq5sebD07B8drbonjxDdSYGSq/EanRP89UapvTLwCVy/rCxH1:Nb24Th7ttujxynRP4U8ShW+15RL+Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626267519, "uuid": "cd68ba83-604c-47f6-bb0d-425ea3384f15", "value": 56584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626267519, "uuid": "36decdff-b058-4664-b674-33f97fa9403b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267519, "uuid": "6279236a-e672-4411-8b0c-713fae8aa62f", "value": "4298d45d8d44a28f54bf723ae927544a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8c6184-e4e4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626295453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295453, "uuid": "14cb58a3-f206-41a5-a3a3-804cf2482988", "comment": "Malware payload", "value": "51cfab1e454ecb1efc6e7b131fdc825e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295453, "uuid": "2f5c112f-5987-4310-8b17-0372bf073cce", "comment": "Malware payload", "value": "ecab07fcfedf48f14ee12fa819875802f856d0a45b7684b96ebf8bea4c2bbf82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295453, "uuid": "90b86577-7809-477d-98e9-f6a80cf8a75a", "comment": "Malware payload", "value": "477760c58162e1018e61ac514d0ba425572f6a5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626295453, "uuid": "26b584b4-b7d7-41f7-9a8d-c3cfcffa279e", "comment": "Malware payload", "value": "2c5aa8735e0620784d899c749d7cbe9cafaffb2999f0fa4331c7d7d39c2b71b95265157afe0583104b3f282d955d6f75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295453, "uuid": "e3c268d0-265b-4b16-9411-04342318279d", "value": "T1DAF2B416EF644FA7DC6FDE7389A80B4630CD954B22A437363670C538F66A14B49D3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295453, "uuid": "24fcf15c-5bcf-4877-8d29-f24d4cd196b5", "value": "768:+khD/LGRhleujjQBHfxESeR1drec0e4ejQZTXgoXik+nQOk3ASDiv:TDt5cR1dh0De0ZTQW+QOgDiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626295453, "uuid": "756110e5-7444-4c7e-bcae-7c3655cada56", "value": 34660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626295453, "uuid": "23e6eccf-6a66-4d01-9537-c128855be7b2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626295453, "uuid": "5685f182-c2ee-401d-8a6c-239ac4b6819f", "value": "51cfab1e454ecb1efc6e7b131fdc825e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da8343f-e490-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626259292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626259292, "uuid": "7c800168-cb80-4358-a403-50bce4de809a", "comment": "Malware payload (AgentTesla)", "value": "1979bf184977e17db7457e69559ada43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626259292, "uuid": "2308701a-6afc-49bd-8e8c-793625103598", "comment": "Malware payload (AgentTesla)", "value": "ecaf1a09f26566f5ea8ea5b1039af1261f115c20510584e7a431412284a8f0eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626259292, "uuid": "de17fe14-4a6b-4c50-8454-42ca88753154", "comment": "Malware payload (AgentTesla)", "value": "60c7c91fbd24c19b179b5eae77990986a48f0728", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626259292, "uuid": "6cb09927-01a3-4116-90de-7e691172374b", "comment": "Malware payload (AgentTesla)", "value": "e1eb2165949807816e6c5cd9fe0c272a9e7eaf2c553293f1c8de469440fb6e34e2bbfebba3fb2292a84800196771f98b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626259292, "uuid": "04563224-9495-447b-a7a4-d47b295d52c4", "value": "T1FB15AE6C23BEA209F637FF316F94E7649FA66EB952159C0D18C40A077821C41BEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626259292, "uuid": "8c2e11c7-0a70-4e07-8b29-8fbfdde0637e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626259292, "uuid": "08056ce7-c16f-4f8c-a4c8-6d46a4534509", "value": "12288:jhKrNls9XOd4+QCkFQl2XKp07+IS2iNmd+3Op+9yTktCfXB6MEjO8BX/hzENmv5h:jh/tS14o/MOCfXBNemm7WwtmXjeuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626259292, "uuid": "c69463a7-614d-41d0-858f-145de73c5c1c", "value": 896000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626259292, "uuid": "e0908c4c-1226-496c-9fcc-32119697a8a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626259292, "uuid": "21862a04-2801-4b1a-bd3c-2ff61bd19e5a", "value": "1979bf184977e17db7457e69559ada43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4032a4fe-e4c3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626281281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281281, "uuid": "aaab7f7a-c801-40e3-b4ef-442147a52353", "comment": "Malware payload (Formbook)", "value": "bf27c89acbd897d3a37e415cf7b69ee2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281281, "uuid": "f5e86568-3ff7-4ac6-9835-f2ae52b3c530", "comment": "Malware payload (Formbook)", "value": "ed1c8e0943e3e4877bc1732debf2c109ebe42dd4f88023db3b85246f25906601", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281281, "uuid": "8ed53dec-94a8-4dcf-99db-6f9f9b431791", "comment": "Malware payload (Formbook)", "value": "7d9817c971dd7694d325685def409b5658c10080", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626281281, "uuid": "6704e7f9-0e95-4dac-aa06-0370930ffd72", "comment": "Malware payload (Formbook)", "value": "7d24d5841e098317da1261c2c1c5f28a3f812cfd3129f1c439800fa9bcd68949f1cb7fa2f33b5bc119df1243ff4e3433", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281281, "uuid": "81f019d9-a3da-471e-9d12-21be23b42eca", "value": "T1A1158C2923BD965AF233FE315F69E2445FA67EA54215DC0D28C4320B0471E41AEEBD3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281281, "uuid": "99832252-0b8b-443e-ad10-a9e0f42d7535", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281281, "uuid": "031fee39-8c6e-4293-a914-1dfca84235a7", "value": "12288:N0GQVmYnrNls9XOd4+QCjmkEgM+5JKeyu6WSYBNcyEZIp1eoHUa1PaeRCsnMdwLz:NpoBHnaqHcyEZkB0yPaFStgcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626281281, "uuid": "1aecf10b-3bb0-4987-9bcf-b1ea85fe70fc", "value": 942592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626281281, "uuid": "d6714034-2c81-4805-8bde-476040e01ce6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626281281, "uuid": "96b10334-b5ea-45e3-a654-54d3d7cbfc50", "value": "bf27c89acbd897d3a37e415cf7b69ee2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9925bfa-e492-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626260439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626260439, "uuid": "4aa5cb93-3aeb-40a5-8e49-fe3812022564", "comment": "Malware payload (RedLineStealer)", "value": "becfc00286be4d51f87ab6f89e2690c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626260439, "uuid": "4012f780-01ae-415d-bb94-cf9e4424dcac", "comment": "Malware payload (RedLineStealer)", "value": "eddbfe52ba633950c388e0303d5a04453f9ba9e3a3cdc60f9a1355707cd209e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626260439, "uuid": "80d4e934-087c-4623-b352-2adbc4c22e35", "comment": "Malware payload (RedLineStealer)", "value": "1778163eb7817aa0e33b9b89acf0a840a34d0443", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626260439, "uuid": "1b026e26-eb9b-4f57-bbb5-8747077bf065", "comment": "Malware payload (RedLineStealer)", "value": "57b469e13d0f47b22b02115b728c21cbe73609128a965eaafedddd9de9e8eaedcf086cc3bae3c13f8a329aa2584510ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626260439, "uuid": "9858f752-08d9-419d-8c08-8d6bd1eace7a", "value": "T17A6633427A919172C1A65E3649B5BA21AD3C7C200E74C5DF97A81654CB3F0D2EF32FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626260439, "uuid": "62eb14bb-7691-465a-b5b3-6af60aec4987", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626260439, "uuid": "b0cf7c4e-2d8d-4854-b79d-eef5928887a9", "value": "196608:U2K7xHJATdA88svku1bT2SuLgsn2bMlCnahYF7pS0i7:07nYEIrKL2bM0KMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626260439, "uuid": "7934399a-b249-4e24-bf64-886a894ec700", "value": 6995852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626260439, "uuid": "8f53795f-abb6-4387-80a5-1d3dc1343a7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626260439, "uuid": "61a5eeaa-04fa-4db7-98be-397a1e4483f3", "value": "BECFC00286BE4D51F87AB6F89E2690C7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d2f2c3-e483-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626253804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253804, "uuid": "58529871-77d2-4cc2-bda7-ad5d7c5df6b5", "comment": "Malware payload (Mirai)", "value": "d23c239532c8f042338968461beabda8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253804, "uuid": "164e7f48-1130-4991-bba6-1ccb3bb9fd26", "comment": "Malware payload (Mirai)", "value": "ef4841f31fdd8be7473eb34321dfd391c603bebd7c81c0fd95e79d4e3b5aeff4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253804, "uuid": "f16ee5f7-af95-4c69-8cd6-fbef990c4745", "comment": "Malware payload (Mirai)", "value": "28ed5d7cda5f6d181fe80300cc999b3c25491fde", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626253804, "uuid": "4ad5dcdc-4854-43ca-a54c-2d328cd5d554", "comment": "Malware payload (Mirai)", "value": "7856731acf5d075762f6267386bd60b3d09b14eb4a7e0910a39020c3b10c0a293668d47caa79643c4919861fbb1999c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253804, "uuid": "a104391d-7533-49b3-ae37-44a976bd1306", "value": "T15AC2F122400BB071E6B850F5DF6C8C8DA2D367BAC2D9366501404B7DBA850A7D7AF4FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253804, "uuid": "4309037b-0901-4298-9b59-5f21dc7c8875", "value": "384:+SDSBWdacuXK/IcaJixdn8r4dgTamkvKaoBCCNbIJpAuB4fgoDvj5hymdGUop5h7:BDSkwOIpJodWxok9IJ6uqtds3Uozp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626253804, "uuid": "30ae7a3d-56a0-4f9f-9d26-85cef950ec44", "value": 27468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626253804, "uuid": "45fff9fc-264b-476c-a8f0-f588efb03074", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626253804, "uuid": "deff9abf-098c-4ef4-9db9-652f5c4ae195", "value": "d23c239532c8f042338968461beabda8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8266a8f-e492-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626260463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626260463, "uuid": "69582a9f-f6ef-4669-b1a7-0a9f560d3619", "comment": "Malware payload", "value": "ec35bea91f0ae22f83ea1e6706872c2c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626260463, "uuid": "065c74b4-db58-4fe1-b5f4-854147448f96", "comment": "Malware payload", "value": "ef555f6b7972f2194ee1823bd3c0f8ad590542aac4f443fa51643b4be10826fd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626260463, "uuid": "1de1a83b-0c2d-440f-bf83-57cc3a9892bc", "comment": "Malware payload", "value": "bf63ecab3d55937c36cfbe1c2e1bc3bd93e1823b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626260463, "uuid": "d355c572-d968-4661-9d88-bda177553703", "comment": "Malware payload", "value": "1b5c4ff60f4d2bde9d7114ccf14208ccbb7592ed28cd849e3e19d3b9007aca648e36b015bae1d3ac3792f0a99ca8169d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626260463, "uuid": "a90f6683-9df0-4f0b-8c0f-6076a0c2035f", "value": "T13D6412B3C639BFFAE421A0B0A69D23DC500C638DC949E692374854161B9538B1BEF7D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626260463, "uuid": "90985d5a-bd9a-4b9f-ae5b-190bf0f483a5", "value": "3072:2glZ3FtCKXhkmHtZ9TEKzjfj/WMngyIfsJ0F7xPto:2IIKXhZtL7jOTyIG87X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626260463, "uuid": "ed624e0a-5001-4b3b-819f-82c459780f78", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626260463, "uuid": "cabec634-683f-4473-97b0-a4fd5f179028", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626260463, "uuid": "f55ce855-8f3f-4e2d-989d-eff5d92e57c9", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb16b74-e4ca-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626284474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626284474, "uuid": "568e8493-4f29-45a4-905b-662ce80cf6b0", "comment": "Malware payload (Dridex)", "value": "222d9a3950c1dd4e9d659e51e46ca608", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626284474, "uuid": "80e4590d-6ee8-42ef-abcb-07ba7d4b4a41", "comment": "Malware payload (Dridex)", "value": "f00e60f5f094abfe9448d10cb84194e73c0e0f2cb52f00d474d6420cb001c579", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626284474, "uuid": "4c395a22-cc55-4490-aa52-2bf00b88c179", "comment": "Malware payload (Dridex)", "value": "f8b456c5a5b9fafe6cd2d90774eaf78ac90824c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626284474, "uuid": "0adc9882-82fe-4272-a182-6c4b3dfc266e", "comment": "Malware payload (Dridex)", "value": "cf3878739b809fd469bd9bd6dbb6a89300cfb0417f7402b68082e41c451ffd72b359922316b2fd0473a56e45dd39e574", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626284474, "uuid": "1d0a77cc-bb30-4761-b420-69ad12be25f9", "value": "T1F2F3023232BB6AFAE276FD72065FD931273164480308DA6F76019F86D95E0E24C6FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626284474, "uuid": "1c4c385c-7c6e-42bd-84d9-729eb3324e08", "value": "e9cbee8358b331a128409a4d26e3e347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626284474, "uuid": "48b5ea28-c2ba-4984-9d8c-30ab9c7f844f", "value": "3072:QWiJzQu5JD9ko9WY1wzxWrPA0Nt7L5cWlvsRwmhnxONgkDY:QLquAkPA07X5WncNgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626284474, "uuid": "9149fa9a-b6d5-41cf-a791-940410ae5264", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626284474, "uuid": "08f2ca83-2c12-4369-92ea-5bec57bfdc63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626284474, "uuid": "69c9cbc1-f67d-43af-bb8c-336df6c1d0d7", "value": "222d9a3950c1dd4e9d659e51e46ca608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3f63bc-e4a1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626266997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266997, "uuid": "f39b487f-de33-4328-8c63-cbfa4c6ce154", "comment": "Malware payload", "value": "d5d0fa59624854378e81f60b90541c0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266997, "uuid": "2d4902f6-bcc3-494d-8ba6-82fdd8225e53", "comment": "Malware payload", "value": "f162b2e7b541e25748e8c370ef3d02e4239a876d706b97683d64ba31456c5764", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266997, "uuid": "19bece88-9e4e-49c9-ade1-754f461da685", "comment": "Malware payload", "value": "c896093557c4fd49c566991228d5b3bf8fcb89cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626266997, "uuid": "4e685601-f2bf-4c7e-a737-6913a6e415f9", "comment": "Malware payload", "value": "d21d6d76c2035f6924ca5be31e1014a4127a9863232c89a525e12d3a9f491c736740a07bcb357140eeb469ec87371e39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266997, "uuid": "63bb66a8-4857-4ec5-8511-9e8bc418b3f1", "value": "T11E21CE96A7E36D2BCD941637DCAF5B10E322BE44C69EF513E31216150C7F31A5F22149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266997, "uuid": "11de271e-35ee-4eb4-811a-688627679038", "value": "24:JKD4llMRgP9qD0at6EoKGb9rUlFSy40VzLCkIddx2HIRGIUAq3GNfW:JKMTFqDPtsrkFSy4CzL5IUR3GNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626266997, "uuid": "1d2a7be4-6e09-4343-9b95-68b6a7ccf2bd", "value": 1168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626266997, "uuid": "7bad8af8-e966-45a9-9364-27ad7f69eaa2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626266997, "uuid": "f5b5f4c2-73ed-4113-ba0e-3c0aa7ed0ccd", "value": "d5d0fa59624854378e81f60b90541c0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6a9b7e-e4cb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626284955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626284955, "uuid": "562050e0-cbd6-4d39-b528-61d4059dbe84", "comment": "Malware payload", "value": "f035afb3bbb9ddbab86705fc35ee3277", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626284955, "uuid": "9355b5c6-4c81-4df5-a405-a88a47c99c13", "comment": "Malware payload", "value": "f1da83287dc71efd8d39d03f2c349830826b9c8698b0a7bb6cc6e7eb959428da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626284955, "uuid": "c039f95b-ef7b-4cce-a025-e96e2a7f0c45", "comment": "Malware payload", "value": "749817589b2ad782e0fe24087a401621be70b9e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626284955, "uuid": "e14fd5f0-78a6-4365-9140-93919238e4f7", "comment": "Malware payload", "value": "67efde6e0c72c4ef94aa2c85a2a725f993be91c7f267b5088e930030096d1a99244e7adb43a540f88d5cc69d42e42f63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626284955, "uuid": "6d4ca657-3fa8-4c63-963e-0cf6df88046b", "value": "T149F302D1F39B11FEFD596470960BAAA612A70C29C37CCAE7E110DC917DE48F7283512A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626284955, "uuid": "2874449e-2f7a-448c-9882-81a17dbbead8", "value": "e92132005097daafddd51d9c4d138d88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626284955, "uuid": "3df23ab8-15ac-4ff8-a5dd-c8803cadbabd", "value": "3072:27p3dQo86PI7e2seiAPWN6Ox1uTQjY48+STfLbh9w47sI5:s3dyj7NsenjOx1KQU5TTbbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626284955, "uuid": "dc5895a1-eb02-43e1-86b7-950706b85b70", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626284955, "uuid": "0dc79657-c042-4574-b03a-0822cb9d636c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626284955, "uuid": "08095562-a872-4e2a-9d81-0f1a1280b13d", "value": "f035afb3bbb9ddbab86705fc35ee3277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d09bc5-e476-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626248163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248163, "uuid": "e3662e89-326a-41eb-8f5f-91db5c3d5226", "comment": "Malware payload (RedLineStealer)", "value": "392f53e08bfedeed350c92996de0c813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248163, "uuid": "55b2acfe-9382-4058-a3a4-8b8850474b95", "comment": "Malware payload (RedLineStealer)", "value": "f2c8546e61ac6f18f9d739a31134c3d47612059d16201d871d260449fe37e20c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248163, "uuid": "ff83ab95-c50f-4e8b-ab7a-1115305568c8", "comment": "Malware payload (RedLineStealer)", "value": "eed4e33f40b66b2e7045a8548da2a7574056fbd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626248163, "uuid": "478b3de6-86a7-4c9e-a710-fbe76024276a", "comment": "Malware payload (RedLineStealer)", "value": "91c08d72ff5bb3c65c9a7d4d61ece37ef5c1417778c1f89930693f47404447fa378644df31211bcfbb4f8db0d76ce988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248163, "uuid": "7bc410b5-6d17-42b7-8d42-53e8240f6327", "value": "T13844D01232A09833D7E7553460BDCBA05E7BB8336AB4414F27941B6A4F313E191BE767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248163, "uuid": "8e5eca50-a97c-4783-8898-4edc655796cc", "value": "af5acd8c4ec9956a4218fb9bfa0557fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248163, "uuid": "3843509b-d564-4320-9b3c-bea1381da215", "value": "3072:1jdlpgaZEG812VYvoJuWHkJUiU099/iuYAhUC1osqtERa5TZS3THbb:LlWmEGRYcSTH/iu5hPqtVgDbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626248163, "uuid": "15154b9e-55ba-4752-b224-c8661e76b99e", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626248163, "uuid": "7b675463-2454-4f68-b5c2-1bfef21ee7bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626248163, "uuid": "9434e3d7-af8b-4914-b069-b0dff2bef593", "value": "f2c8546e61ac6f18f9d739a31134c3d47612059d16201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a664ebb0-e4a9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1626270285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270285, "uuid": "716b844f-44f0-4320-96a1-838de5dac1ad", "comment": "Malware payload (Gozi)", "value": "1c87b3ebc5ddf8f53e585b3cf8f74f47", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270285, "uuid": "d71933bf-afda-46cf-94c9-ffa963c19e40", "comment": "Malware payload (Gozi)", "value": "f2dfc3562e150ca045557559269c3c21531bb85292864109fd2ceca4fe0f1ea9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270285, "uuid": "a61d2c89-4e48-42d2-94e6-783d48f33f1a", "comment": "Malware payload (Gozi)", "value": "4579705a3e0e8b644fcf30d4c79456b0e4f669b8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270285, "uuid": "09fd322d-de9e-48fa-a057-6f1e3c6a466b", "comment": "Malware payload (Gozi)", "value": "d254e85c0efbf8d9d9480f91967469d714f5421be72eeb6674a6c0b54919eba0fa43c0d4f62e5ad60078ef0df454ebce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270285, "uuid": "f57d6041-f127-4949-b750-49b659c3eaed", "value": "T198847A00BA80E031D6F212724F29E585536C78A80B715ADFB3D82E5F5F798E36635B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270285, "uuid": "e46041ce-73f8-4ffb-8738-d956dec05283", "value": "4c29865e356872ef0757b58734cbbb11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270285, "uuid": "7ed3e6f2-481f-42b4-8dcc-e9351ddbc7db", "value": "6144:vC8nRa6tXFOspzA7z6NZVeC8i795fubASK9beZTX3l8Eo:J0SVOsp5VWi7PWoBeZTX36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626270285, "uuid": "9dfe28c5-dc5f-40fd-a668-743814f80083", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626270285, "uuid": "cc68fb86-ded7-4ed5-8247-c26eb7435412", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270285, "uuid": "12aa5a59-45b8-4bd7-85c5-bb3ca0091714", "value": "1c8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d202d0a-e468-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626242272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242272, "uuid": "60a41908-2bf1-412a-9268-a067765c9211", "comment": "Malware payload (Formbook)", "value": "73108e333eb4aee93e604a4aa08407e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242272, "uuid": "d6f2c022-6425-481a-8ea6-0541c629b5c4", "comment": "Malware payload (Formbook)", "value": "f2e67fd733ca7d4c22f1bda695c89d4a3f8ddb4dbfd7afb7b2ee22dcb81bce47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242272, "uuid": "bf8d9791-ef58-4c4e-a94f-5217278e9d77", "comment": "Malware payload (Formbook)", "value": "cf5ec8533d0fde495da50c5b4dfa513f4b1f3552", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242272, "uuid": "88243aeb-8da2-4c85-9e02-4c9c193276b3", "comment": "Malware payload (Formbook)", "value": "e58da77f5a1891b7c872388980c53440b317d8169cdade2113116cc028e7c77797431cc28dc766eae659879403aaaee0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242272, "uuid": "670d62a2-0b6d-455f-bcc2-fb11c1bcc6b3", "value": "T1E6155A6823BDD608EE32EB3C9F64A6449EB67AF5523DDC0D1C8421476833D46ADE6C31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242272, "uuid": "73de3d93-5635-4d82-a262-40af92b26b18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242272, "uuid": "93745e9c-0bdf-40c0-a782-9a7a94aba67d", "value": "12288:5vzIC6P/2erNls9XOd4+QCo99p39aDON5FLwn/kBKc/YliS/UQaHdAB72Kx9kjMm:5vQ+99pta61EnSBQ6QiB2GtweOFmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626242272, "uuid": "7728873d-bfe1-440b-a3fa-ca504e26cd37", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626242272, "uuid": "0d5ac8a8-029d-456b-a403-f638813eaf6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242272, "uuid": "9ef8952a-ee0f-453a-9bf4-b0a76bb58a72", "value": "EB94D7mept3gdSh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8c2a2b-e4aa-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626270673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270673, "uuid": "c1b7661c-01a2-4289-8518-0c7ba992f69b", "comment": "Malware payload (NanoCore)", "value": "055faeaa9a95c35c37012a42ce2f07af", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270673, "uuid": "0c9227a3-c7aa-488e-a88e-18ab4dbbba18", "comment": "Malware payload (NanoCore)", "value": "f3d7b3821f7b0613358f580a1f94bc28d483322e83c931569126d3531a323538", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270673, "uuid": "f81add55-45dc-4a30-a52a-412baaf0b2b7", "comment": "Malware payload (NanoCore)", "value": "9d8da453e301cb72104b707247a66ceb3c7bf4a9", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270673, "uuid": "356a7bef-11a4-4761-bee6-b857aec91172", "comment": "Malware payload (NanoCore)", "value": "8f30f757c8d489e2e29960ac924a905268f2648a7c8e3e21b8c20937a2ebe3d46da3cb0593c6d22ec760b116243a1c7c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270673, "uuid": "71249960-64c1-4650-b88d-7398aafee290", "value": "T1AC319719ABA53B15D3734F37A8AAE2018331FD62ED03CF5D419053C81C56215E839E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270673, "uuid": "cb9ad647-6bab-49ec-8bc1-e07d4e5e0600", "value": "24:8eJs8hz1n8AZPKV+/eJ+vxRV3cQ4o0Ws7XQaR3+habqeh/8qx5CGO+/eEH0Wi/:8ENc1+DsPoKXv3KaeeZpvOg3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626270673, "uuid": "2f54f1a4-3b19-4b8b-b6f8-e01e9d7f141e", "value": 1523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626270673, "uuid": "b3c4a11a-7b25-4487-9b57-af20460e47b8", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270673, "uuid": "76b3dec3-5ac2-468d-a739-db984d44f3f6", "value": "IMAGE.JPG.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593134c0-e471-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626246104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246104, "uuid": "92e26631-15c8-46aa-b956-29a1f247284c", "comment": "Malware payload (AgentTesla)", "value": "bfec7ae085b7e986d7bd90dc1b40c4d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246104, "uuid": "179b2e2c-ba75-4722-a14a-cc9d88ea3cb3", "comment": "Malware payload (AgentTesla)", "value": "f47f9d673a5a84c416306dcf513c59f56b686b4a17e1b12028c22672dc71fca9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246104, "uuid": "024d323b-c24f-486d-87ef-fae90e020e1f", "comment": "Malware payload (AgentTesla)", "value": "2556f3dd9e013aebd6ad562a356ced87123817cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246104, "uuid": "3928704f-c1e2-4c2a-a82c-e4d07cdfc3b3", "comment": "Malware payload (AgentTesla)", "value": "11584940d1b17211e96e59cb720ad096f0b5546ee5e1d105458da145d97e741a007af916f641cef600acf1c3d84f1675", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246104, "uuid": "871443b1-294a-4c73-9395-0e379a8949a5", "value": "T109157D16E3C045DBCB7D02F97CA0B398FA585C7A69108E8B3FD23195A17B62114BED1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246104, "uuid": "48c48e0a-8362-43be-ad77-8c93dcd1610e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246104, "uuid": "357963fb-3678-426b-a65c-096ca592d756", "value": "24576:kqQU4uE+qBgmP+GjHIys97dtq/jTZy/H:pP4pb32GcrbWvI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246104, "uuid": "07086c7f-d2f5-4f75-a881-c7a05d72eb0f", "value": 931840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246104, "uuid": "0088a1a7-f91f-4538-b4ae-9f5a010340a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246104, "uuid": "5986d230-cb6a-4e0c-9300-37f0b4ffcc87", "value": "yIHKV1OAedyn1G1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3434601-e4b2-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1626274280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274280, "uuid": "fc6bfd90-d951-4624-a7d9-b9b974b9e8f1", "comment": "Malware payload (DCRat)", "value": "7a7c5784b527254322b6ce96f483ed02", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274280, "uuid": "11fe5d48-ae58-4874-9577-66879eb7b759", "comment": "Malware payload (DCRat)", "value": "f4c62f1bb28e7734697495b0125bcf943c6f528c297fa904865e58165e030a2a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274280, "uuid": "d93688ec-4a63-4239-b2c1-caacce753814", "comment": "Malware payload (DCRat)", "value": "03b420fd1b1cc699a5786f9f0b9b75ca43f13006", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274280, "uuid": "6e38106e-2ac5-4fb7-814f-56f3169b7e72", "comment": "Malware payload (DCRat)", "value": "77ed4d25e23bd30bc40f227dda603c4c2a57d26009d73d790d12e16e2776a1b351e18ec3eae060ba153ec251a115b3f7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274280, "uuid": "f579ee54-41b6-45f6-a12c-81b683ec587f", "value": "T142655A027A84FD05E0295637C9EF442847A8FD4A3B62DB1B7E9F339C60553A75D0E1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274280, "uuid": "7c743f90-ef91-4676-a612-764f7c9aca8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274280, "uuid": "b06db60a-3d35-4659-9029-54cdd2bc9766", "value": "24576:8VIxp6EtJICO2yzHnITYQ/qoYIilu0DefrTwbF+m+NarzLsnE/Ha34+4:P6Qm2yz/oYU7wwm17s8Hyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626274280, "uuid": "1d2cc52e-a2bc-48c9-998d-2c51f5d078bc", "value": 1469952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626274280, "uuid": "313e9e33-906a-445e-81d8-029eb7f63fe3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274280, "uuid": "44e4b59a-8ded-4d1f-9835-230d29d165a3", "value": "7a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4649bde-e4b7-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1626276402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276402, "uuid": "1375cd4e-cf66-4f08-acff-455a4166efc4", "comment": "Malware payload (DCRat)", "value": "2fd35a47c26de70495d7abd6e8704e1d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276402, "uuid": "273159ad-13ee-4f87-8ecf-bfb85e760e5b", "comment": "Malware payload (DCRat)", "value": "f60133f0545df116739879fd080e0fc688aece721a4123612ebaa479c2c551e0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276402, "uuid": "33aceab7-cdba-4245-90c4-90b905f00e53", "comment": "Malware payload (DCRat)", "value": "f157f9515ba04c7532e1908b578fe37a873cda76", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626276402, "uuid": "bed10a6c-3509-46db-8d3a-fea8211acb43", "comment": "Malware payload (DCRat)", "value": "40ab97831673c013cd9405f2900aa37a98fad34ab0c10a54abdbdfc7658d834a52db75b1aa14d3d6959d8134d3a07749", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276402, "uuid": "117d36dd-db7f-4b33-b95d-21e6c1bf28f5", "value": "T1DC6549027A47DE07C02D1637DAEF887407B8BD803B66DB1A7A9B376D65113A61D0D2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276402, "uuid": "7f397e8b-1333-4442-9668-147d556fe32f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276402, "uuid": "6a22532e-80dc-4543-a748-8dbbdfc90633", "value": "24576:U2G/nvxW3Ww0tYljB+gXeLBMCjGCgPIKaRG7XBey/nz+JeIB+46:UbA30YxB9uLpkA0j+kIAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626276402, "uuid": "4b49ef84-d395-4e8f-b6eb-8dbd4751a70f", "value": 1470054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626276402, "uuid": "867f9f2d-a660-4240-b1b7-9237a7c2115d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626276402, "uuid": "65f631e1-4f14-4376-97cd-65dd307baf2c", "value": "2fd35a47c26de70495d7abd6e8704e1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5395a01e-e4a4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626267999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267999, "uuid": "76d61d63-a219-4232-a158-a74a0f8a13a3", "comment": "Malware payload (Mirai)", "value": "0e1b35532b87759f87301355e9fa1d70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267999, "uuid": "2fa2cb1f-e1bb-4a19-a582-56976ba23c13", "comment": "Malware payload (Mirai)", "value": "f61085bfb975ac092e8d727ce28dffc4d8f8974a2be437a1871aa99774863e7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267999, "uuid": "eeec9e41-2615-4885-aac6-7e91e202823e", "comment": "Malware payload (Mirai)", "value": "e5ecb2a8504d22ecb7ca887793303629b6332cc3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626267999, "uuid": "4489162f-fe9f-42a0-8118-fbe474c80dbd", "comment": "Malware payload (Mirai)", "value": "e6d9c96186213e9fd864010d2fd9e1fd4d1731478430c4c811e27ead63ac4fe1032763dfd901f993323db9fcb0bb632e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267999, "uuid": "3eaa50bf-af0b-4d96-817d-e8cbf29ac942", "value": "T116C32A46EA408B13C5D61777FAAF414A3322DB54D3DB330689285BF43F87A9E0E57A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267999, "uuid": "46a74b13-6cbf-4bf8-b489-8a2584144465", "value": "3072:IZMu4C+u2dLhLRE90bYK5h9T96NOI+5/YtM/9gM/:eMu4C+u+RfbYK5hb6R+5/AM/9gM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626267999, "uuid": "74417022-c77a-4c56-bb4d-91cbe9892fda", "value": 128047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626267999, "uuid": "b7a7af9f-bcdd-4288-abfb-cafebd68649a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626267999, "uuid": "237d3217-cb7a-4178-a969-1228fb43ac81", "value": "0e1b35532b87759f87301355e9fa1d70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08477ee1-e4aa-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626270449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270449, "uuid": "0c5f570a-7cc8-4542-a9b3-30e42953fcb4", "comment": "Malware payload (NanoCore)", "value": "b5b56914cbe7ebaaabb85b54942e42ac", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270449, "uuid": "deb842a9-7530-44ef-9e1d-fc02641598cf", "comment": "Malware payload (NanoCore)", "value": "f63a9a50113ba633bc752bee1f9a690eb074753757db02c7f1115aafdc3e0ddd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270449, "uuid": "fa2fcf0d-c1e7-4b50-9fae-02180eea3b59", "comment": "Malware payload (NanoCore)", "value": "906253e90155df8ff78f853abe8a13c47ffe0e24", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270449, "uuid": "b3c345ff-1d15-46d3-a30d-e98796fa018b", "comment": "Malware payload (NanoCore)", "value": "4650ea6a6e4b720139d1f1fd04df3a8be235e611e7bf3fc453cddd1148e041af4e148d431f3ffd3ac3a157f550588e0c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270449, "uuid": "a3eac716-6d7c-4e6b-9f5c-fa08088b739d", "value": "T1991340ACC45746E88F856BB86B1B6F51018DB66DF7849533363867752BE6C3A402383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270449, "uuid": "6ecf6b27-460c-489a-85a6-d5635af04d76", "value": "384:yY+liXVDmqO8PZzPuPm4G4Ol5pLChuzo9DVwoWeUtB:ypl24GhlGV5iB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626270449, "uuid": "1fe31ed7-dddd-4ef4-aa0c-ebeef8cd0b2a", "value": 43920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626270449, "uuid": "48591f1d-e8e6-44d3-91ac-fc4e2a123dbc", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270449, "uuid": "1909689c-5a6b-4148-bcd8-efb5f35a4dad", "value": "New Order - PO-LBJPS20-02801.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b04a20-e475-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626247710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247710, "uuid": "0959c644-a778-4c85-ad05-39ee47963290", "comment": "Malware payload (NanoCore)", "value": "5c36550f6c90d763d53a6971793b3ac7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247710, "uuid": "70f98114-abcf-449b-8785-39aed6aafff5", "comment": "Malware payload (NanoCore)", "value": "f6c867888f3fa738dcf2dc9639efeab55cbb0392c284d3fb25487d062d1e783c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247710, "uuid": "617cc4fe-ea14-4636-a48f-e01c64c5b60f", "comment": "Malware payload (NanoCore)", "value": "c8686a8b3dec64e854e988f25b02f4af817b78d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626247710, "uuid": "d1ecb0da-dcac-42a4-b3ad-ae0a3c2ebfcc", "comment": "Malware payload (NanoCore)", "value": "f43608fab5b8adb4fcebc1077e81926bef74a6b978e16c993f84d14b275bcd17c5adf0cbd964845780c45d7297dfa3d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247710, "uuid": "545b3498-fb81-4ea3-862b-0379059d12a1", "value": "T1ADF43B2C23BDA609F13BFFB4DF60A6049FE576669725D14E3DD0428E1421E80EE76632", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247710, "uuid": "b14ec237-d32c-4b70-9f1a-448ee77388b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247710, "uuid": "34f92e8d-6010-4d3d-b64b-cdbc7fc2c069", "value": "12288:ast/ul+RgXN5GnTOdU+CHpZszbzTFeGUpi47ISwPFEc9qvO6yx/P:ashU+RyzTFe7tIpPFEBax/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626247710, "uuid": "f66d9104-f2b0-40e8-b8f3-7a57baf2173b", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626247710, "uuid": "ce3aab44-4ff1-401c-8646-964dd4204811", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626247710, "uuid": "fda67629-2948-4ce2-a495-ee06a0a51766", "value": "5c36550f6c90d763d53a6971793b3ac7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "390aaa40-e4b6-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1626275685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275685, "uuid": "8561d5b6-ed90-445b-a46c-7c643417e102", "comment": "Malware payload (TeamBot)", "value": "197f5a4cb71e38ea7b56bd1214fbbfc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275685, "uuid": "37c5fcd5-8015-409a-9762-87188f5c0e7a", "comment": "Malware payload (TeamBot)", "value": "f8b60e554ed303e2debe7422bb363dcc33ace171d02388bce2e8ab5ce5364f5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275685, "uuid": "3f8d0d89-6007-4ab6-a07b-769f45d904e1", "comment": "Malware payload (TeamBot)", "value": "8e1500730abd3e46bce284bc098d541c6d8d5088", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275685, "uuid": "f390771e-a0c8-4bf4-b802-33bc3a91eee7", "comment": "Malware payload (TeamBot)", "value": "de611d78d10a56825fb575d44eadaf6e3fb8324c7585244e70fc9fece2185440f60204ca205e3d6280e1afd9a462b633", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275685, "uuid": "37fbf44a-fbea-4fa8-88f9-8c879ff6bc1c", "value": "T123F412216DA1C035D3EF497061B99B6A9D7BBA331E61544F3B9403A99F303C1AEA6313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275685, "uuid": "e695d68e-b0cc-4b2d-8b98-627680c7dde3", "value": "ad9f6c8b0f38d755f66fb877c364f60e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275685, "uuid": "738c5103-de1f-4f3b-a7f0-5676b015c522", "value": "12288:b7NDuF2bnFrhVLhsQQ6Tu577Cf65GO5YMaSJqskIovQHE7xkbXgkO+I+4:b7NKFqntiz6K7+i5Gi7wsVooEtkjgkOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275685, "uuid": "e8aea6be-5141-498c-a1d9-2971a4664173", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275685, "uuid": "d0278260-c8fd-45c2-9377-4347120a39ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275685, "uuid": "155c3e59-d909-4b8d-9ca3-f3d762804984", "value": "197f5a4cb71e38ea7b56bd1214fbbfc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb863d0b-e4b2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626274294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274294, "uuid": "de786d7a-36b2-4cf1-8f5a-61d3182f0849", "comment": "Malware payload", "value": "e8290bce2e0f4ab301d7cba6c450b0ea", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274294, "uuid": "807a9c63-2021-4ac1-ab9f-29a8c0820848", "comment": "Malware payload", "value": "f94938c13745765675f9ef82615eae42abb6616c6534cfac893d1e31ebc98d92", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274294, "uuid": "abc0c7ac-7ab8-406b-b97d-02d3df2f85f9", "comment": "Malware payload", "value": "39a47363f7c356e2ca59cda93d70648f05aeee5a", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626274294, "uuid": "324cfff2-ef99-4dde-b454-20ea104bff4b", "comment": "Malware payload", "value": "86ab2688739e07cd76bc5f82cf70199dae87d16845654b1cb9620919ff4c5c522f65afdeabc9a09d4d5dbe29a2fefa72", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r17", "colour": "#506530", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274294, "uuid": "06e73043-2936-406a-a9c2-bfd92154c782", "value": "T1F174235F1E62A6A231E94F962B059F85CC5FCDDCA13D003EF377254BA394760AA04E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274294, "uuid": "d0cd8c09-85b0-4bca-9d1f-d32e61c6d01c", "value": "6144:Pnv5CPebpcK1yGI5Wvp1VYqV1OjiMQvOZd5M6O+VaXJfDJfvR4OhTlfIOhFDLcKp:PnBjpcK1dI5op1WCAi/OO+Q5rJHaWSOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626274294, "uuid": "a9468dd2-6b22-4447-9267-dafeb8dfd192", "value": 364049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626274294, "uuid": "b7b81832-5a39-458d-8908-843a74e8d15f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626274294, "uuid": "c647a066-a583-4760-9551-ad1a17aa42d0", "value": "Proforma Invoice CINV2021000000000231TRN #10003892780000101 remittance swift copy.pdf.r17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a23ccf9-e46a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626243072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626243072, "uuid": "845ef6fa-37fa-43a9-834b-c8c43b1b9144", "comment": "Malware payload (AgentTesla)", "value": "4ac4beb390a41054c6c9a9e78e83e6e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626243072, "uuid": "0fb82fdf-576f-4880-84b3-3ac122c2adcd", "comment": "Malware payload (AgentTesla)", "value": "f9508e3d52fd619f0d3ebf24a1a9cd4c0ed1caecf46f53a18fbc5ba2831df0f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626243072, "uuid": "86876f1a-1b77-49ca-bb65-59e4580fbc87", "comment": "Malware payload (AgentTesla)", "value": "c0c006676ac1ceff9bf613c459ef6b29cf8d0236", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626243072, "uuid": "1413fe42-4b90-41b2-b07e-edee780ee6ed", "comment": "Malware payload (AgentTesla)", "value": "1cba9c3774250271dd861eb5d0e00251391cfdc90262b7463c8697735219615416cbea5bef2829704a8eec935d9ed54f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626243072, "uuid": "7c95385a-59b8-4bc9-89b3-3e96fb04916b", "value": "T10C15AE63A3840627CF7D43B5B522E851F6A2ACAB7B31DD0F65CB72A24B773414096C1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626243072, "uuid": "84a3bc0e-a94a-4dbf-9c3a-b5a099584fb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626243072, "uuid": "a2f53978-7605-452a-91b5-f3c227f327a3", "value": "12288:2IQUCG6qayqd5eYuLlTKZVbl7h2T1kLPD9+d45r:2IQU8qayq6Y65WVv2Tk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626243072, "uuid": "315dfdaa-0617-48df-9183-6437b3108991", "value": 931840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626243072, "uuid": "a6ccf968-13ab-4fda-8f75-4372ecb7b163", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626243072, "uuid": "f235f329-4085-4aef-a3ec-8a8b8d751e22", "value": "PO#4500488718.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295af8a8-e4a7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626269216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269216, "uuid": "3ba6c266-dee4-41dd-bad7-596d9044e4b9", "comment": "Malware payload", "value": "873ab149f691f4c7ac768b7d6a32035b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269216, "uuid": "2240d8b8-98a6-4a5f-89c4-9fafb12ee724", "comment": "Malware payload", "value": "f958afbd2247a0aee607ae738a0c31b93f1a760c664dafef80fcf763bd72081b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269216, "uuid": "0de3f67a-9841-4401-89aa-40e845aca71f", "comment": "Malware payload", "value": "1598b954ebe712955ed96e98451909d8eaae9ee0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626269216, "uuid": "7428ab0b-657a-4c0c-9fc9-fb9481f546fe", "comment": "Malware payload", "value": "b00d56f9e3756c83195be91dad9208d04e977395922180ef98061fe9456b117dfbf85a4162fac637bedce5b343b61e0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626269216, "uuid": "a9135692-cbb3-44fe-ad49-182c39ec77c0", "value": "T11F2116BAFBBB9B16C85450390E6B63103760CC5C0024D226BF61761DDC42651AE552F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626269216, "uuid": "37dfc71d-dcd3-41bb-b980-993d53e4da2e", "value": "24:3bNlDq3N0yTK+59kl58MAQOlhCrjSkvF6J9ld3FNTawqNs:XWVT3M58M5DvW9v3FNuns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626269216, "uuid": "c2840700-5e4b-4d00-8fc1-1451bd3a6871", "value": 1280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626269216, "uuid": "24f30117-4d51-4fc6-8e0d-00094fa135f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626269216, "uuid": "5f3fd616-b8e9-4bba-af8e-66f5195b172a", "value": "873ab149f691f4c7ac768b7d6a32035b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2945f13-e472-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626246683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246683, "uuid": "0e1ce99f-8946-44d0-a963-41a0a554c928", "comment": "Malware payload (TrickBot)", "value": "81912f51960219818c5b55a0bafa674e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246683, "uuid": "604edb53-4495-44f6-80b4-b0351935cddf", "comment": "Malware payload (TrickBot)", "value": "f95adae1cd46200a5b9d61024e3eb887bfacfe2fe63b94f1dc4e6b89edb9cae3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246683, "uuid": "e211d70a-e402-453b-8b54-5c05a708311a", "comment": "Malware payload (TrickBot)", "value": "670d7d68bc9248481d9b6e44a2df5535b98e26de", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626246683, "uuid": "25d8ea52-b695-4f6f-a5e7-426d24b47295", "comment": "Malware payload (TrickBot)", "value": "8532df8bf41c03505e215cb50aac9b2f27f302d38030c942c614911a8845277148356dab716201b417a2e72d07603fab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246683, "uuid": "c68fba03-f5ba-4ced-8165-62ba176170b3", "value": "T1AEA4CF1033C0C036E6BB037A495BDB5962A5BC608BF5C28B7F947E9D9E312868E35752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246683, "uuid": "64108fba-5745-49c2-b2e5-568f83c38260", "value": "285edb96a4eb2f97aa48802e35f98fc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246683, "uuid": "36f8c9f7-a165-4253-a1c7-6a66f6d59af4", "value": "6144:cIzlI2lTAbw3TTIaThNALS0znc1hTF8PW8yLvBYQ8YiXCn6muSL7Cw5O547fEACA:vT8wIaThNv8nc3LvBYtYuuX/Ci78hH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626246683, "uuid": "07c9674c-e3cb-412a-accc-6a27ef600c57", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626246683, "uuid": "289be164-0fde-4fe9-a284-e51d195c60b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626246683, "uuid": "643e6220-a7eb-4985-89dc-fb7a5b0e0f11", "value": "81912f51960219818c5b55a0bafa674e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b0e558-e4aa-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626270527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270527, "uuid": "d8604789-5b22-475b-8b05-d13bc8faa223", "comment": "Malware payload (SnakeKeylogger)", "value": "f55facef0c3e5c3e4b2cc6d1173a317a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270527, "uuid": "755ce94a-1adc-452d-a7cd-05cb7ccdd7f8", "comment": "Malware payload (SnakeKeylogger)", "value": "fa723e38a3449869e616127c8832a174fae991acb3b2a86eb8375d4fe1e34237", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270527, "uuid": "ddb5ac3c-dc8a-4abf-ad3a-3c6c10e63ae8", "comment": "Malware payload (SnakeKeylogger)", "value": "c44bd4cc07fede2fd0754d884ab6e1b9b7b40bbe", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270527, "uuid": "fecd84ee-9f7f-4143-aae8-befa7e9c4f1a", "comment": "Malware payload (SnakeKeylogger)", "value": "987dda5057cf7900c8bc475f59ca93dbdac7d37d2960b8dc2e25e9bb87c5f1935365d7db4eeca98d01a820cb7eaadf5c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270527, "uuid": "b9ec4646-3727-4124-baee-64ade6394cf0", "value": "T12C3362ADD89704988F86ABB86B0F6F89014C7B6EF7895532327C973523D1D7B411293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270527, "uuid": "d47f1b63-a767-44e2-8fd0-1431b110f2c9", "value": "384:lo+9KcwzRNH5CZQHydGzF/SDU6WdBaz8JRrpr5Ms0blcQY:lo+9KcwzRNH5gQHyd+XBBIlcQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626270527, "uuid": "42aa8d8f-80c7-49be-90a3-0cfa7d2f6ad4", "value": 51059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626270527, "uuid": "7eec034d-7aa7-4fa1-adf8-d5389d74f7f7", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270527, "uuid": "17284e07-24ea-4571-b872-48bffd6a4f3b", "value": "Catalogue-Product-Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87f9e67-e4a9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1626270289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270289, "uuid": "82be1d30-ad62-4c07-914b-488d97af6e76", "comment": "Malware payload (Gozi)", "value": "9453981ab8e71981bea907b3f2d11395", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270289, "uuid": "520c41be-d4fd-418f-8a88-a707b11561e3", "comment": "Malware payload (Gozi)", "value": "fa97cd35d76337ff4a523ebdd7f879359a70432a14b7377f06df29c4679b3f70", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270289, "uuid": "464a1d87-9563-490c-9f55-126f5dc5f4ed", "comment": "Malware payload (Gozi)", "value": "ca0f69ef71bf287bdd19a8a9811c1f0dd2ff50e6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626270289, "uuid": "8283f203-0678-41d4-8920-44de16ae823e", "comment": "Malware payload (Gozi)", "value": "3bf368ac862e94e4db4e78d16848f65dad25312591d833b73e493e8d41438b0ec5ec67e51d55a78562737f00062b60ed", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270289, "uuid": "344b4d7a-f3c1-4763-bb88-6f23870826d0", "value": "T168847A00BA80E031D6F212724F29E585536C78A80B715ADFB3D82E5F5F798E36635B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270289, "uuid": "2b58908c-352d-4b9a-beeb-f9bcb76d7b33", "value": "4c29865e356872ef0757b58734cbbb11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270289, "uuid": "d048c677-84d6-4c63-931a-3a4c72ef18e8", "value": "6144:vC8nRa6tXFOspzA736NZVeC8i795fubASK9beZTX3l8Eo:J0SVOspFVWi7PWoBeZTX36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626270289, "uuid": "2b87381c-60f3-4284-a7f9-b2454ca31327", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626270289, "uuid": "18fcf087-144f-4b7c-b1be-777821fa4b59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626270289, "uuid": "a288e4b0-7583-49e3-8dea-0714e644e071", "value": "945.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9f3b14-e4b5-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626275213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275213, "uuid": "97a0b3f7-fc32-4546-b16b-99a7d355bcef", "comment": "Malware payload (RedLineStealer)", "value": "1cb84d9bebb65cd72ed36cef22e59b8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275213, "uuid": "48223c3f-0447-49ac-9249-6c29d52ffd21", "comment": "Malware payload (RedLineStealer)", "value": "fb58621fe07c9c86655bd41a9e643fd98f1d3f0aad7fcc3a39f6c83421ebacac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275213, "uuid": "7c494d6a-676c-483f-a539-4ff00e9178d7", "comment": "Malware payload (RedLineStealer)", "value": "5c76d0b4d2b723e7d757a539e3f9e257c11162ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275213, "uuid": "001f6b1d-2c15-4ec6-9761-1f5c6b7477a2", "comment": "Malware payload (RedLineStealer)", "value": "6e0c7e5946b2e08bcda23f984aaec2a2586402410b31688094e4dea4490afc1f42fc513d23011bf354bf1faa49962030", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275213, "uuid": "f024beb0-c1e3-47b8-9895-234305b749b2", "value": "T1A1B4F139A282857AC06209368C5B93B9F53AFA005F3C54CFB7DD1E5C8D373891A653DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275213, "uuid": "2b38083c-1798-417f-9f6d-12d7ccac83a2", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275213, "uuid": "41f23dbd-7ba9-48cb-a1a5-f220a4f96ef7", "value": "12288:pANwRo+mv8QD4+0V16tOZedlnNKpKuyVR94+Nr8:pAT8QE+kSdbuyVZr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275213, "uuid": "a7c08014-8cf8-466b-b0a3-7c4c4c954fe7", "value": 497386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275213, "uuid": "edaaa1cc-2ac7-4142-9923-7ecaa905727a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275213, "uuid": "342f5302-a2af-4e9f-9f07-2de0b7c3fb8f", "value": "1cb84d9bebb65cd72ed36cef22e59b8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad326a35-e49d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626265143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626265143, "uuid": "ea8006f1-855d-4b1c-99b4-2d3e33b48d5e", "comment": "Malware payload (AgentTesla)", "value": "bc14a30706b6b0c68fcd39ee83ed077a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626265143, "uuid": "797fecab-8b9a-446f-a0d8-cae28f3c1697", "comment": "Malware payload (AgentTesla)", "value": "fbaefdbb1266cd0801697b4d1d9641bfe6b0583ad4139b9f88194b13e8372db1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626265143, "uuid": "cac80d5b-a107-4e14-b593-3de25c9b86e4", "comment": "Malware payload (AgentTesla)", "value": "700aba33ccb415b13fc5ee371802aede6df78bd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626265143, "uuid": "8ebc4c58-4503-4d1c-82d1-ec1bd7260139", "comment": "Malware payload (AgentTesla)", "value": "8a0a26d6ad3d1fd17954f1303ec377ec258a10e9d8e78c7d0a7201f421196ba2f9811f6c353f2055f6c9cb84f1a4d32d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626265143, "uuid": "5d00f86d-9898-49b2-9858-f0d20358f1f2", "value": "T180058C6C23BD6709F237FF31AFA5E6449FA666B58219DD0D2CC4024B4821D81EEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626265143, "uuid": "084fe588-36ce-4f23-8c50-787e7424a7c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626265143, "uuid": "4e0e028f-2135-4398-9243-0eb8d60023b6", "value": "12288:xKkGJM7SlrNls9XOd4+QC18Vth6ZUitXvRoWFJ6kWpe2DUM2y8DTQYp7VPBFvAZ3:xKRgth6+i/F6hz2zpBPLAZbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626265143, "uuid": "012fa0b0-b2b1-4415-946a-74d64c39f9b1", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626265143, "uuid": "db886716-a665-47ae-8f27-0445c4421b4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626265143, "uuid": "c1e42285-bc63-477c-aa83-777c6ff75b23", "value": "PRODUCT_.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2e4fea-e4c7-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1626282995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282995, "uuid": "76c37982-6016-4423-ad2d-b6de3bd74623", "comment": "Malware payload (AsyncRAT)", "value": "46837250817a05ae430dcce51cca9906", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282995, "uuid": "1868b97a-1e8f-4c5e-93fe-147af2899930", "comment": "Malware payload (AsyncRAT)", "value": "fc744641e634d0881b859cf8032b2c358c48389eb770d390485a595ccd23ff4b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282995, "uuid": "4acec881-3516-4b94-b724-04436fd2e09e", "comment": "Malware payload (AsyncRAT)", "value": "011aab67cf3363286f5a25334ee4c9d27f41ff26", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626282995, "uuid": "380138a3-1eff-4346-bf71-3b920a079883", "comment": "Malware payload (AsyncRAT)", "value": "10d77ee6197b2f3f482d1f58deff62aa4618887945dbcd11fba5989a1ca6fbda6c6d8f54b2a932ca046afbb3cc2fee5c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282995, "uuid": "a0aa0575-7661-412a-add1-23a1d3bcd80d", "value": "T107D4166C3650729FD737C836CA845C60F56860EB3737CA839193119CAA0DA47EF953BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282995, "uuid": "93ae936d-8a57-4a92-ae85-19bcd6dba42b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282995, "uuid": "f2c62a11-8514-43cb-9603-17496042486c", "value": "12288:uMl+aT5YPxArqJtM63JGo0/qh4qkShUGDoo3xccyXparoYdlisy5+S21y2HTefTb:uR1mrqJtM6kTqHhUGDo+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626282995, "uuid": "898c6a44-b9be-479d-befe-a2e79e60ced8", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626282995, "uuid": "21ff0162-94ad-4f55-be2d-c7e80805d81c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626282995, "uuid": "51ab443f-b250-4d09-b917-929cb6bc4736", "value": "46837250817A05AE430DCCE51CCA9906.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f9fd91-e4b5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626275199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275199, "uuid": "ea0c63c1-a91b-4632-96ac-8ce021e0d2d7", "comment": "Malware payload (Mirai)", "value": "795abfb6712024669a921cf3097d9abe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275199, "uuid": "59c4d76f-9897-4c29-bee0-a977e7c28e27", "comment": "Malware payload (Mirai)", "value": "fc94e569ba49fa37a94a411ba6cf5cb34e0e5c393ff8156e331ccf435d9a38ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275199, "uuid": "76ceb637-d6d5-49c0-8cef-2bc6a0571bde", "comment": "Malware payload (Mirai)", "value": "9279d9555105a094cccd7496c1891db9e5844f5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275199, "uuid": "b7f7d535-2e39-4dbd-a26d-71e48d55ff52", "comment": "Malware payload (Mirai)", "value": "53fb275d73fe2c3dc0730b275e1560cd254fe1439bed477069f35818d8041609d996df4a0fe053a1b3d87dfd8b8b1df2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275199, "uuid": "0e3142eb-40a9-450d-8b83-8c1804b27b77", "value": "T1CDD34B46FB418F13C4D617BAF9AF424933229B94E3EB730649285FB43F8666E0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275199, "uuid": "c65587a1-3104-403c-9f47-f41617b4bb2d", "value": "3072:f0DvinprSHrDqtVg5B3RJxQds/neqfasb2mKM/9M/zrr:f0DvinprSHrDegBJxQds/eqfb2vM/9Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275199, "uuid": "fbcdf99c-8f35-4b5a-8443-a51a816ebc4d", "value": 134572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275199, "uuid": "a343f822-39f9-4237-8243-9e357e41d3a4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275199, "uuid": "687f707e-e68c-4c44-bad6-f86e107cfae4", "value": "795abfb6712024669a921cf3097d9abe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0375a71a-e4b6-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626275595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275595, "uuid": "fdbb32bb-1372-47bf-9dc8-a126fdab82f5", "comment": "Malware payload (TrickBot)", "value": "9d8f5319f2780f487e3637ea712fe96f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275595, "uuid": "8d68a6ed-643d-4c07-a8be-92591fd7bf8a", "comment": "Malware payload (TrickBot)", "value": "fccb8dea9ab7e194eadc863a8e7658b9076fddd4b645b4241ab5b9a33997afcc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275595, "uuid": "1760c433-f559-439a-9412-fc79017350d7", "comment": "Malware payload (TrickBot)", "value": "2ab17c4e54b5881751cf637e1657f8fab2ddbf4b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275595, "uuid": "fced4d8f-9290-4cae-8a36-aae084c57263", "comment": "Malware payload (TrickBot)", "value": "853ffeecf8408a78ee38130899c3c6d053fca4934723fdcf18bac14d8e8879f22e0749518d400a5eb4b443083e296df0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob107", "colour": "#64653A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275595, "uuid": "93f49b6c-3bd7-4d6a-9f15-b8398b2652ce", "value": "T19CA4CF1033C0C036E6BF037A495BDB5962A5BC608BF5C28B7F947E9D9E312868E35752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275595, "uuid": "d1e1d511-2b30-43c3-92ec-eb764d7bb5d2", "value": "285edb96a4eb2f97aa48802e35f98fc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275595, "uuid": "2345e198-03c0-4417-a012-e98198e75e0d", "value": "6144:cIzlI2lTAbw3TTIaThNALS0znX1hTF8PW8yLvBYQ8YiXCn6muSL7Cw5O547fEACA:vT8wIaThNv8nX3LvBYtYuuX/Ci78hH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275595, "uuid": "22e3cdd7-69d9-43b2-b205-ed7b9a3ada78", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275595, "uuid": "3b47f503-f288-4c41-86ba-9ec070fa2eeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275595, "uuid": "8b4d7ee5-5b10-4d4a-b3b3-1c61236f1d26", "value": "9d8f5319f2780f487e3637ea712fe96f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5f9430-e463-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626240282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626240282, "uuid": "1f686499-074d-4671-b259-604fc263e3c8", "comment": "Malware payload (AgentTesla)", "value": "767462e90f18393bdcb20cb6c943c7c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626240282, "uuid": "71de0a82-8a6b-44e7-9e45-e6a5ec4cb1ef", "comment": "Malware payload (AgentTesla)", "value": "fe1fc2f05133e32b74a5b52cee188b7f1f2ffe98df488835c558b73629d2ab04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626240282, "uuid": "0ce8986f-0233-4cb0-8d43-66d4d9482ce3", "comment": "Malware payload (AgentTesla)", "value": "67f64f3b1dc053b1cac77e77490b36ad285af01a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626240282, "uuid": "da53dc84-214b-4df7-909b-e06c760257fc", "comment": "Malware payload (AgentTesla)", "value": "809e12464b735cd04ce01a2048601ec44ae4d0caf19f9bc619a08b898eada06e3074df2a58099266dc560e5de1a9c361", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626240282, "uuid": "916ef487-2616-4745-b1ab-5df6b63d0b98", "value": "T1A3E49D813294DF96E0731BF608AEE42043F87D5F9125C50D2E8376DA55E7B0128ABB9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626240282, "uuid": "5e1c4d70-c6af-4a2b-a806-c094d0fd692a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626240282, "uuid": "810f1efe-51e5-43ad-b671-712f1662ebe9", "value": "12288:zI199bZe0HAguRmYv1vQJM8Fut+CnJSiyyjK:zI39Ne0ggchQevJd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626240282, "uuid": "a759ad85-d5e4-4f2c-a6ec-5ac74ff6704f", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626240282, "uuid": "d95a1c73-0335-4660-9ad3-fa1aeca9380e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626240282, "uuid": "7ef472e4-d189-43b0-876f-d4d80b4ecb56", "value": "AL Naser General. Services.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3369d6-e4a5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626268471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268471, "uuid": "bc0dc561-854b-48a3-b8e3-8ca99b689816", "comment": "Malware payload (Formbook)", "value": "bc302d910397e2d1092e47029d8f35df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268471, "uuid": "525dd0a1-a4cd-4653-97d4-421f2682987d", "comment": "Malware payload (Formbook)", "value": "fefa01b761aa8ab9d5a79db0bc41cd8eaee972248cf52e4d5c2629998e9bc6e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268471, "uuid": "5d24ef78-8ac1-4730-8b35-3bb8c54a43f1", "comment": "Malware payload (Formbook)", "value": "9982779ea783defca4c9d3e95ddb92c11a838447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626268471, "uuid": "0bf372f6-f03e-4a86-9ae9-471521d7274b", "comment": "Malware payload (Formbook)", "value": "e87969d2be029c3d8ccbe071ee7138ef923b8572d22786f1816b815e2cf267b5c355ea7fd69c20e110d73b18a2a64c3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268471, "uuid": "6b86a23c-dc9f-47e7-8b06-e448ba9299b1", "value": "T19C058D2C23BDA709F577FF319FA4E7449EA67B7992158C0E38C412065862E82BD63D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268471, "uuid": "1482feb5-398b-41cf-874f-658381dccfba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268471, "uuid": "0feffe73-7c3d-4717-bdda-833049cc73f7", "value": "12288:E2iNT/VnFXwSj7V2JHLKJpBUtVOSoHL0tOV0Yd03i/nRar2hBrNls9XOd4+QCaQV:E19/VnR7VQcpqtiAOnd0Ey2hgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626268471, "uuid": "3b0b6271-a617-4be1-834a-2ad88ec9eb82", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626268471, "uuid": "98b1434a-b8ff-4de3-b594-c1c4bcdca1b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626268471, "uuid": "9222957f-b93b-4472-835d-b40e1bb2142e", "value": "1Ptfo0FZUMT7hlK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51267205-e4b6-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1626275726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275726, "uuid": "98807fdc-c048-4708-b40e-9aa453155243", "comment": "Malware payload (GuLoader)", "value": "fcfb0ec70f1419ede8a534cc95cb61e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275726, "uuid": "001761c1-5564-46cb-83d6-68567957c5d6", "comment": "Malware payload (GuLoader)", "value": "ff1b034c7060724133c6df0aa8cf5411ec0e6775d3aca83a127617340a8c588a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275726, "uuid": "3d866044-2d6b-4e7c-a346-72405d853d74", "comment": "Malware payload (GuLoader)", "value": "d3b529d77f1de00d63a75b3956d4bcf6bbce30ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626275726, "uuid": "74d6e005-a9b0-4058-a02b-56657f7ad1b5", "comment": "Malware payload (GuLoader)", "value": "d8905be5266fb52d9ea08729b4fe5cd188fe6bf56882b5c0c7945c76e2214b264eebd17f45ca78c403aa3be2e8862ea6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275726, "uuid": "f5c37ad0-46c3-4a0d-ae6b-97330e17362f", "value": "T1D24416B01ABB7CDBD884A934BB1DBC24D17AE4E05B188F696974631CDC3DE1180BD31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275726, "uuid": "915b5b16-a1ce-4717-aa41-298c2ce3f94f", "value": "a6a8fddf213e725d12277ffa52409c50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275726, "uuid": "8fcf0c48-a0b0-4f04-b8de-c125fe8a7b01", "value": "1536:x2M5j2eBXFScbssSe/W+dMa27qQ0Z9Dfs4IwNAvgiIOm72tNHLg/8A:T5FXrbVTeE2uQU7s49AMUrg/8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626275726, "uuid": "e57bbb3d-09c3-411a-b0df-9f589855eeb1", "value": 267376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626275726, "uuid": "1fea62ed-1fb3-4239-8364-837a03a27a5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626275726, "uuid": "4b5c1eda-d83a-4d61-986b-1ab7e9157f64", "value": "fcfb0ec70f1419ede8a534cc95cb61e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f9c2fc-e468-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1626242240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242240, "uuid": "ce89655f-b246-4469-8118-94cb8d3ae783", "comment": "Malware payload (NetWire)", "value": "39354b7b1d0dda28b95785b967621c07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242240, "uuid": "5eb07ea9-5ea5-4a31-b35d-c2b7ef06c642", "comment": "Malware payload (NetWire)", "value": "ff32e93cbeacbeda2437159fc90e1c0a4b6b1d7fa160a931fe80801ba6e3311d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242240, "uuid": "1b6e0f0f-68ec-460d-a18e-79ebc65cafb8", "comment": "Malware payload (NetWire)", "value": "e0e21df731ac7e2bcaa1fa1ca0a3f12936a111a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626242240, "uuid": "c43523de-1063-4883-b88d-92ff26a273a9", "comment": "Malware payload (NetWire)", "value": "9396d6bf7512a5f6ac5ed5216f3d38d8be640a7ae44236799c17cd745b59c40beffffdf4ba174447ea059c4910eff032", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242240, "uuid": "554db4cd-1945-488a-9920-f90710f902f3", "value": "T162057C6C23FEA709F233FF346FA1A7489FA666B59215DD0D1DC4024B4821C85AEA7D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242240, "uuid": "7ce93b9e-95e0-4f4a-b39d-f003a1edbc24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242240, "uuid": "81284a6c-2229-4bd8-86b5-4e1a713f0cf6", "value": "12288:btojrHrNls9XOd4+QC1KREDMALh+GMsoh4cN3K18GJTEMUzI/z55qs3IuQTL5QKL:btEKGDXh+GMsoXN3S8Gb/WyIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626242240, "uuid": "c60e0a3e-3a9b-4e29-878e-e78a89eedf38", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626242240, "uuid": "2a666463-d9c9-4586-ba02-080f94d5da1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626242240, "uuid": "8406b39a-f24b-4073-a788-0ab0a54a0f1a", "value": "PO-13918.jpeg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9678eb1-e462-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626239850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626239850, "uuid": "c1254302-e03e-458f-8168-6c77fee71cb6", "comment": "Malware payload (AgentTesla)", "value": "efe892534ed22a509bb0b30b9f344939", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626239850, "uuid": "12cdf9c9-e982-4a8e-90de-0c2d180a932b", "comment": "Malware payload (AgentTesla)", "value": "ff97bd0b382bcd07b0e71fd6249426a1d1246c52b07edd238eaa64136db737df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626239850, "uuid": "abccdc57-20fd-45db-966b-91a5384b7e56", "comment": "Malware payload (AgentTesla)", "value": "bafed1471906f41b5d36e710bde678512d8a4bc0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626239850, "uuid": "92dde48e-7e1c-49ed-bae8-fce590c5cae3", "comment": "Malware payload (AgentTesla)", "value": "8a306f8306f9339bf7c2d35002f9f91141039442836cea233c2009dc70d38345f7a198f3ee0c0ba30e517ce703714f83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626239850, "uuid": "405a2e25-a38d-44be-bac6-46466db5b760", "value": "T18475E0242AE95135F5B65F7C89B0704156BEFE626F17C83D28B132C91733982CAA137E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626239850, "uuid": "40feebcb-dd92-4759-97c6-294ab0341237", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626239850, "uuid": "d04c1b9a-b090-428b-a52c-bbfa77d44248", "value": "24576:ToGiOvTlPvLpbdMCAxbHeDzsRlkmKEjLylPgZzH942P/JA93+SXmIp7Sgs:08v5zVdAtKsRlIKyRgZzP6ZmIp5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626239850, "uuid": "743f200b-bff5-4672-91b8-14ad40950b3c", "value": 1587200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626239850, "uuid": "2cdbf54c-d0a9-4ad8-9564-fa454f0033b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626239850, "uuid": "fdb1c7a2-beb5-4679-af02-9fee7acd930b", "value": "requirement010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7bb4dc-e463-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626240070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626240070, "uuid": "11d5bf6f-2b1a-457f-8623-bec48099260e", "comment": "Malware payload (Formbook)", "value": "3d2864288037f23fd3cbc5ad7d7754fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626240070, "uuid": "a7f4d4eb-f691-4e37-aa32-9abd2763e0aa", "comment": "Malware payload (Formbook)", "value": "fffc665a528ef7890cc8ad27da9b1e1e9b5d813455875fdf591f5ddcaf86e490", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626240070, "uuid": "4ce9151d-a740-4df9-8c38-b60b3c77f5c4", "comment": "Malware payload (Formbook)", "value": "958ac5b831dcd96f918f3add94ae3b1523f56f2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626240070, "uuid": "d7aef468-2780-4b1b-8c6b-4600034461e9", "comment": "Malware payload (Formbook)", "value": "4ff15d259f19747cafd5e4a7c16c573da08fbd10e1a4f843f781e0c84e94a2111e2dd0986d495ce2434a89fc2eae0ed2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626240070, "uuid": "118c96d2-1518-4c6b-8df9-7966d4cd232e", "value": "T17B35CF1036D89466F4B31FBD48BCA05061BDFE6B5B17C90D39B2674A13A374389E236E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626240070, "uuid": "ad9ae3fb-5df1-4578-b083-dc580d8fc0e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626240070, "uuid": "a9a03e1a-e8e4-4101-9a18-0281845e8f4b", "value": "24576:bU1zwrxR4lWzWzm1ejk7ZDsLCoFCS4Jd8:40R4lEWzm1e47MCogHJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626240070, "uuid": "e4a1a423-7c51-46b3-b446-ecc156049cb5", "value": 1137664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626240070, "uuid": "ab2f7d8c-592b-493e-b1bd-572bd3524c7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626240070, "uuid": "9b8b914f-d891-4a77-8fbc-9c1d8c165518", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }