{ "Event": { "published": true, "date": "2021-12-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-12-17", "timestamp": 1639785781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "eb258ba9-c67f-4b4b-bcff-89f827187270", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8171b1-5f27-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639738429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738429, "uuid": "e5a63193-5629-4471-bba0-b8d7de25603c", "comment": "Malware payload", "value": "612e2b36c6578fd6b2e50a3d13a8fbdf", "object_relation": "md5", "Tag": [ { "name": "8.142.8.91", "colour": "#DB9B9C", "exportable": true, "hide_tag": false }, { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738429, "uuid": "61eb0c1a-3d37-4232-996d-e1a628ff9d14", "comment": "Malware payload", "value": "0229935d0e5be4cc737d5ce7085efe95d857419b77a3d2405f5ee44334a80ad5", "object_relation": "sha256", "Tag": [ { "name": "8.142.8.91", "colour": "#DB9B9C", "exportable": true, "hide_tag": false }, { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738429, "uuid": "48d5e50b-eed7-46de-92dd-2ad6747d72d3", "comment": "Malware payload", "value": "aef371f40ed9617ade697bc8e8d9739f8984933c", "object_relation": "sha1", "Tag": [ { "name": "8.142.8.91", "colour": "#DB9B9C", "exportable": true, "hide_tag": false }, { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738429, "uuid": "cfed6771-a21e-49c7-833f-45416a633e77", "comment": "Malware payload", "value": "504a1b07113caa530a8bc74934a6d2d8e2a4c65e448ef29ab3c7f6fe71e262020c9874773eb04e959d56557b6a684285", "object_relation": "sha3-384", "Tag": [ { "name": "8.142.8.91", "colour": "#DB9B9C", "exportable": true, "hide_tag": false }, { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738429, "uuid": "0b510cfc-417a-457e-bca2-0caa85ba630a", "value": "T1E1F53A16FCA604FAC57EF1308555A322BA7138A943307BD31F849AAD1B65FE46E3E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738429, "uuid": "bca6ceca-03d9-4c6b-8619-0d17380cfbe1", "value": "93a138801d9601e4c36e6274c8b9d111", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738429, "uuid": "7e38ef5a-11fa-4e75-965d-e0ad3b513d51", "value": "49152:27xm6D8ZbD+UfLOlrUm4wo5E2JZ9Kva3OG3d5CGJG9E6iVS5Ws:27xAlD+0ch/OtJZwjGNt1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639738429, "uuid": "5f9ea2ce-4665-4519-820e-4917e9030495", "value": 3379712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639738429, "uuid": "d57fd05b-e597-4809-8df1-3ab4a2f0d633", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738429, "uuid": "f8917462-3acb-4956-aadb-8ddae07438a7", "value": "0229935d0e5be4cc737d5ce7085efe95d857419b77a3d2405f5ee44334a80ad5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5d1b10-5f17-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639731714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731714, "uuid": "af34990d-df24-435e-9928-f4f7a51bcdf2", "comment": "Malware payload (Loki)", "value": "7aa78c23b3bb4df51e593aab36afdf0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731714, "uuid": "85dc640e-b46d-4d26-93d6-3ec9f8e87738", "comment": "Malware payload (Loki)", "value": "024f39768406b572ac762e43ada581d3984bfbb75fdfd62c757a7b721edc5533", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731714, "uuid": "37ab76e0-f62e-45c6-83e7-05ba10b56988", "comment": "Malware payload (Loki)", "value": "52f4b3fa0797225a23056c44e43b3d69838662b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731714, "uuid": "24de06dd-5dd9-47c8-9079-f2bdb471cb0b", "comment": "Malware payload (Loki)", "value": "75e64af5846c8d96be3baa1c19d9384c536f5474ccda490b9ff65be38bc2713c99a581c14a16ce8c3e1f34d362a875de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731714, "uuid": "fcb02fbd-94e5-4604-a462-7bcc2ddcd52f", "value": "T15B25F68525AD3B25FD7893F800AA6C94C7BA7D2A717EC68D4CC330D72973F924850A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731714, "uuid": "022f879d-4b66-4a67-8849-ee07be7e873a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731714, "uuid": "afec24c6-d324-433e-a2fb-b49d18c9c19e", "value": "12288:mKc2qP2m1UUUUUUUi1B3z/z+MXcPzBpx/DQy0iw20kxk6RZTDuSK3xUUUUUUUUU1:9VqPXJxC8ozBpx/DQuakxk6rTCSK3e1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639731714, "uuid": "88142d06-7d4b-46c7-af59-0e3891add293", "value": 1033728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639731714, "uuid": "69b06d04-cd4b-454b-a85c-903567db27af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731714, "uuid": "b2c60630-bf2a-418b-8e1d-9f20202018ef", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec9dbcf-5f4c-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639754457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754457, "uuid": "dbf2cb3b-c1a8-4a35-9aac-cb39efd76409", "comment": "Malware payload (SnakeKeylogger)", "value": "149fbec0204c2df5e5a27aaf14a76a04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754457, "uuid": "515b805b-9be0-43e3-a90f-d67fe7154e65", "comment": "Malware payload (SnakeKeylogger)", "value": "02b3d3672fa8157a7bad3ba56ef29a9f72734c4721928233598bb8de0875f708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754457, "uuid": "ca6f779c-f85b-4bc7-856b-1595d7c6deea", "comment": "Malware payload (SnakeKeylogger)", "value": "0c56f916702b593d5e257b1261c4d8be1d80666b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754457, "uuid": "e54767e0-de55-4d6a-b6b3-c73e31e867f2", "comment": "Malware payload (SnakeKeylogger)", "value": "9931691ea02dbb295ba57abc82dee0441885abd9b8fd284eecb310ab15ae5ee43b9215cfa33f88eb6c5a5d4ef624a37d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754457, "uuid": "1bb93ce6-71ef-473c-82d4-2ce27b0c29fa", "value": "T1BA8402D552B9CB5BC47A4BF5103150C087F042A26213CF4B9E9FA2DFCA23B565A21BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754457, "uuid": "685816dc-8093-45ca-8a74-f2107c73127a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754457, "uuid": "58d01230-3dd5-4a21-a741-c84add8c7826", "value": "12288:yBOwNekSy9nRjGPji5i7Vwm1/mx5QquSK3vkmyyy1pWy:yBVIkFB4i5i7b1/K5gSK3vkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639754457, "uuid": "eba5fa92-7526-49fe-8722-572ebccecea9", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639754457, "uuid": "51ba8272-82ad-4d7d-9397-0ea7b5aa6a36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754457, "uuid": "63d9c913-7e62-4fe7-9bdb-61dd897146ef", "value": "45140050955_20211215_17080693_HesapOzeti.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd12992-5f22-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639736151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736151, "uuid": "2c52423e-e85f-4578-852d-1e64e10fd96d", "comment": "Malware payload", "value": "f91479572a6eb6f0bb81ca864c172845", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736151, "uuid": "1619f741-e5a5-480f-a79a-84499fc2c51b", "comment": "Malware payload", "value": "02f0bbe79e7b4fbda98d68a49691f8a9c0b019437b146e3f509730181eb74f1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736151, "uuid": "93fbca38-5f3c-49fc-9dfd-f5ee1f468a30", "comment": "Malware payload", "value": "6e2a6ca3134426145e4e0070cb646dc8f8cc01bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736151, "uuid": "03be6715-9865-45c4-b9a9-52c8657bdb12", "comment": "Malware payload", "value": "7a936f539e4b46d7f278edb663ed5a68043dd2c81a74c27e2376ae82866a969be2cfb5077014aa980217ccc49fd54f83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736151, "uuid": "79f87cf9-a62a-4274-a49d-b4b1370f23ff", "value": "T1C5E52393F45E9EFDC507243696A1302A5F0E26330EE75660579D936F72E3973028BA8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736151, "uuid": "5a015dcb-525e-44ca-b5a1-d27d9510854c", "value": "61c3df730291850fea0c9a7171786100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736151, "uuid": "30c5506f-2914-43f8-a3dd-4e230362e41f", "value": "98304:Q/dZnW9DwKRtmy/dH/evSmYb/+Zh6j3oV:Q//WyKR8KzmYzDj3oV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639736151, "uuid": "b2f1333b-55d0-420e-936a-306a2b8e23eb", "value": 3300864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639736151, "uuid": "01c072b7-ddd8-4ff6-acb1-964b2654b36c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736151, "uuid": "c7320234-2bc9-46c0-b2ca-8d4c8dbe5448", "value": "f91479572a6eb6f0bb81ca864c172845.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0102deda-5f1d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639733871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733871, "uuid": "382f44a9-804f-445e-a65d-f506da513d00", "comment": "Malware payload (AgentTesla)", "value": "700654511648b422a9eb097dcddb3716", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733871, "uuid": "86365c56-e784-4e09-a3df-f6a9cc3cfe2c", "comment": "Malware payload (AgentTesla)", "value": "0308c033ce8a834ad623dc0637d8d1026b74b6d6a85b20f2e57211d1fbaa4751", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733871, "uuid": "bd976cab-2d86-45ca-a68d-2a5535446393", "comment": "Malware payload (AgentTesla)", "value": "5554492cbf8bbeb420b58a6af5d3a8142aa13946", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733871, "uuid": "2f977801-bd26-4490-8eb2-d684147f1c4d", "comment": "Malware payload (AgentTesla)", "value": "7ae99d852b82a60071b0c8bf285034fb67abf609d0b2e0ad840b2949a64cd33a600e31701fa7da71c688337f9268b008", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639733871, "uuid": "82be7923-f8c3-4bec-aeac-f6e248613550", "value": "T1F9E49D1A6682DBDEF535D7785A2860A003F5ADF2EB26F588FCE570CB2433B806673511", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639733871, "uuid": "82f5f974-0eb9-490e-947f-c53612e3fc39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639733871, "uuid": "1e9b95f6-0f44-4824-9860-bc80f19c6aac", "value": "12288:LGjPWTMBVjyRiItKcVpmeNCQ2Fj7/rkgGMva1+nf:LGjEbkIpmqCQ2ZbXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639733871, "uuid": "4a068fd4-e984-47d6-aaff-783fba446147", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639733871, "uuid": "2860d4cd-5115-4139-9bf7-3c33fa04cdce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639733871, "uuid": "1ed9d22a-2bea-4b27-b072-e9351e1d1756", "value": "PO#10288067439.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95349118-5f06-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639724241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724241, "uuid": "a5ec6dc0-1cf7-44f3-8607-75f5be28d28d", "comment": "Malware payload (AgentTesla)", "value": "3ae3c5b3273d73318ac5e2ff47845996", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724241, "uuid": "814eb9ee-5409-4779-97a1-fa100374f1e7", "comment": "Malware payload (AgentTesla)", "value": "0674047f1a64bce2d3765d3a6ccc3002520ddbdbb2e46a02c8cc9ce5a4378f83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724241, "uuid": "9690b1c6-b05f-4e48-9986-c21a4bb8dd0d", "comment": "Malware payload (AgentTesla)", "value": "79d10a7af56a3fb0b17c13e825306ef9033f7362", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724241, "uuid": "081c91ef-646a-4f32-b190-7d9df10cd6a5", "comment": "Malware payload (AgentTesla)", "value": "e6c8228ea512e2eaaa4d52ae3e977c062b03c6c99898cce0bac0ad428b6ff2542a3b004dd7b5716c8ae71535099bd40e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639724241, "uuid": "1c676a0e-5065-4190-b9d6-60fca8595188", "value": "T1A68423D0D48C6C09E81F7972B43AA2A12876947F9CD17EE1F53A86863D546523B38F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639724241, "uuid": "5a8ea843-4542-4dd0-ab95-9f1105128634", "value": "6144:bJFCsDkevheliIHQET98oIbfOEpqLbDmRa5nNOw2oN650d0KRE9lcFS3EI+kiW7S:bisDrhANwEpxifOEpybDwe31NZYDH9+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639724241, "uuid": "d354b73e-ec97-48c4-8cfb-37121169c5d7", "value": 388813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639724241, "uuid": "eda7805e-c5b0-47c1-9618-b410611404fd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639724241, "uuid": "367bf17c-c651-4a25-924b-f2e62e217b6c", "value": "purchase order POM21002942.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b8ec285-5f55-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639758102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758102, "uuid": "5c2a7a2e-4050-4bfe-a13a-d4c27bd3d8c1", "comment": "Malware payload (Gafgyt)", "value": "2f22272afde1bcce80edba546abe2d5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758102, "uuid": "f1d76b7f-1817-45dd-97fc-361d22126589", "comment": "Malware payload (Gafgyt)", "value": "08fe8fee792c10cb2d02f922942fbd574e66cd7cb63046be618c5e4b25ae8f0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758102, "uuid": "cbb768b6-1ab0-486d-954e-8f4a0c4045da", "comment": "Malware payload (Gafgyt)", "value": "3ab890219ab183dd715d347f586c0df2399b4951", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758102, "uuid": "1f2d8e2c-bc75-4a33-a44c-b306e1972a4e", "comment": "Malware payload (Gafgyt)", "value": "1eb956034a6e1223491dfa22b5a238175fb06707ca3af35efaaa600445a344b6a01162683dca81f20f694104976f6f53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758102, "uuid": "b4f53974-f73a-48b6-aadc-fe0b8a88b627", "value": "T16EA32A05F9118757C1C327B6F78F47493B3167B997DB33026A34BEB02BC27991A2AA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758102, "uuid": "7ad45608-4910-41f0-acb9-2c134b57d84e", "value": "3072:7e9h9oZI5hvFfKufS2faYj0+rQ0Knm4XATe:y9wZI5hNfKfpYj0+rQ0Knm4XATe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639758102, "uuid": "c80958b9-64be-4599-87fe-cd18a7f9fc5a", "value": 103862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639758102, "uuid": "a1ac54ff-2d2b-4880-899f-bde1e5ab6216", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758102, "uuid": "2f43122c-4099-4acb-987a-c4184167237a", "value": "2f22272afde1bcce80edba546abe2d5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203fc3cd-5f78-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639773008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773008, "uuid": "503f8b8c-e9a1-437c-bef8-cb938826e14c", "comment": "Malware payload", "value": "6d8a06055c1059cda4fe47582ea2a9fe", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773008, "uuid": "db114dc1-be3e-435d-a1e4-e47b6f6b41a5", "comment": "Malware payload", "value": "0b3ec79751b73aa58e7c71e691d970b00f48f6439f3d0067d269fc2ddef16881", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773008, "uuid": "e636b72f-6914-4e2b-aca1-cfa6651df6b0", "comment": "Malware payload", "value": "cb7ac52f879336973b6112dd198ed2713ead67b4", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773008, "uuid": "8a6277ba-7679-43bb-81d6-d61fe4136cfe", "comment": "Malware payload", "value": "52f6c8df924c4a3cd0edd2a51c5a18d7164b09b6c9cb4c1b4262e3e6ba5dc6b29397d997a0f07f4751d5aadd9a112a34", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773008, "uuid": "ab0b7afd-37d9-45b2-84c9-6fc5ca03c1d0", "value": "T120457B2132C79B32D493117155AEA3611A3EEC704B718287B29C7B9E2FB27C0673579B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773008, "uuid": "31dd7b90-7dcc-4f7c-a2c3-ea3284334948", "value": "24576:Blgq+3Nn7BjlpOu3LBCvAq23Nn7BjlpOu3dAMBc:BlgJ3Nn7BxwubBCvAF3Nn7BxwutAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639773008, "uuid": "f8b3e5e5-6797-4976-9820-012288efb3ca", "value": 1169379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639773008, "uuid": "543c6626-90f9-4179-bc96-5fcaa865c180", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773008, "uuid": "c41c2d73-65c7-4725-9911-de799372fee8", "value": "Deliveryinfo.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6184618c-5f79-11ec-9275-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639773547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773547, "uuid": "d89e6969-813c-4722-ac4e-d81d51cabe47", "comment": "Malware payload (Dridex)", "value": "928bb0e5a8af9664235d3224c5666a05", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773547, "uuid": "f733d5dc-28e9-46c2-93e3-d0b840ff5a65", "comment": "Malware payload (Dridex)", "value": "0b42235d0b3a9340f79d7f30a747bb13a08c50c10b9da71ae560779eb14707b3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773547, "uuid": "c41471cf-10ff-4793-be6c-fe46f1dbbe2e", "comment": "Malware payload (Dridex)", "value": "1e7721a02b34be50030b2c90373548098a0934d5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773547, "uuid": "82b66a65-3849-4dd0-91e0-4ddd242694fb", "comment": "Malware payload (Dridex)", "value": "c1c57c7cdb8881d5b9cde871a12d1b7a9d48cb0fa40f007411870841bc1b78fc9a355cd87b34e86c8794a2b30e97ab0d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773547, "uuid": "0e74e5b5-37e3-4b20-90f4-90c069f14f71", "value": "T159B4BFAFC65E1478C7E31470159143B12EA640C6097ADEAF6B2FFA9C149634C227DB7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773547, "uuid": "b4f2d072-07ed-4fa3-ae35-6f7453722486", "value": "1d03489a888f9eb61ae369ecc7b0879f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773547, "uuid": "3fe260ce-b518-48cb-82b9-7378622cd95a", "value": "6144:WlkqY8IIaCme+UOwOYEKdvfrlEe/ply5ovxlbL6B4Q08Y:63BdvlDx5O9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639773547, "uuid": "27e0ab7c-b6d1-4104-a887-1f77d91339f9", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639773547, "uuid": "40d8fa08-e80f-4e75-94a8-0960441aa495", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773547, "uuid": "43896c60-f8c1-45f1-b11e-70e699641b12", "value": "SecuriteInfo.com.W32.Dridex.GB.genEldorado.14083.18670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b0e778-5f1d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639734178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734178, "uuid": "2facadd1-d084-4d94-804f-ab6fb71a80d6", "comment": "Malware payload", "value": "0329fb0b86a0f542c95c6405d5cb8e78", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734178, "uuid": "f2b36122-7e47-48ca-bac5-6999c2f02ac3", "comment": "Malware payload", "value": "0b9d503e19f5555e2f2d13d629f9ba95f33a1317a1cc38d54daf176f52827d3c", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734178, "uuid": "ea5da384-7df5-401c-90f6-5cb453f1492b", "comment": "Malware payload", "value": "1871d26fb53a65d99bb72819e0069804cebe3443", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734178, "uuid": "659fe725-898d-4a6f-9986-166929cfc181", "comment": "Malware payload", "value": "86d4319c96270eca292cd7eb1d146df0f17494ccaeae9e2b095dbc411a85bb7875061335dac4c77912d8ba1bd2a128f1", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734178, "uuid": "d6074126-9a28-4810-99b7-32b77e22a221", "value": "T1BD16234BF582DB3BD1FB4B31655BD33581BAE43041A345676364A10E7EF2280A3EB1E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734178, "uuid": "6248aa3d-b01b-4e03-b85d-209d5cb48bac", "value": "98304:uyY5A4pIFrBvf/jMkQ0WWCowEUKIFrBvf/jMkQ0WWCowEUFIFrBvf/jMkQ0WWCo4:uV2FrBv/QbWCoyFrBv/QbWCohFrBv/Q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639734178, "uuid": "f208a365-62ad-4e78-9062-8854a2871b46", "value": 4170240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639734178, "uuid": "79c66d1f-acfc-4db4-970c-ecc34c8d039d", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734178, "uuid": "24b87858-81ab-42a2-99d2-5bd250c44f42", "value": "0329fb0b86a0f542c95c6405d5cb8e78.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244e45d5-5f4b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639753687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753687, "uuid": "a70bd730-bdbd-4967-b6e7-04ef195385fd", "comment": "Malware payload (RedLineStealer)", "value": "92e11a95d2228ad84dfb517f275fa08a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753687, "uuid": "91fa12f6-007b-4dd5-8abf-6f807edce130", "comment": "Malware payload (RedLineStealer)", "value": "0c0b1dd5d48ea667a80d3dd8488e2310752cbe5191ac0aee5b67abf9502674cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753687, "uuid": "8d2b3ed3-2de2-4219-aeca-1ddbc0f35158", "comment": "Malware payload (RedLineStealer)", "value": "b58ca1884fec5a894ef4eba3626a79492e03df53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753687, "uuid": "3661ba73-75c8-4d90-8c21-545cdf13d693", "comment": "Malware payload (RedLineStealer)", "value": "a36a26ab02c79923fc239c9289c279edf1d3d82c3d4b6b390c607c40691b9183609ccecb1c0f9c9b8021f18e1dbc63c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753687, "uuid": "b80136ed-5cad-4b3c-b608-8cf24424cc4d", "value": "T13FF3BE3139ECC4B2C5E3067144649FE49E7BE8216664958B2758126E3F70F8C8AFA35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753687, "uuid": "370ca1b5-8738-42d8-a721-0acbe357dec9", "value": "995d859dc5c5cdfbe9d72008a77e5890", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753687, "uuid": "27b8a10c-4ce0-44c5-b455-56ef3eaaa136", "value": "3072:fML2SDn5Jk085coI5qjkkuWrxpzbgqrujhsybB:fMLZ5JZ85quuuzbgwuqSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639753687, "uuid": "7450d6c1-76b3-4c76-8c76-14320a254a29", "value": 160256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639753687, "uuid": "163748e4-c97b-4df5-8cf9-69c377ba233e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753687, "uuid": "05f44068-4b32-46b8-bb32-fe6c47ab65df", "value": "92e11a95d2228ad84dfb517f275fa08a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d36d43ad-5f1f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639735083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735083, "uuid": "c1f96924-ba0c-44b0-86ac-b03024b8fd8f", "comment": "Malware payload (Mirai)", "value": "7a642c47e91d1096e4d67a6f45aac2ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735083, "uuid": "8f53acdf-56fa-42b5-bb76-67658aa2f7f2", "comment": "Malware payload (Mirai)", "value": "0c5eb74d76c92e18f15111794e9044d205ee5f16f0e0300fec28d56f4780f0b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735083, "uuid": "0b64d231-8a89-4b38-b2e8-37f7638fb5ea", "comment": "Malware payload (Mirai)", "value": "3531902027a7d0ecee72032783b36c2469aa6161", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735083, "uuid": "45f9f92a-c6fc-4776-9557-531341f6bfcb", "comment": "Malware payload (Mirai)", "value": "135711ec79ef0215536337d2d9ef0e9f77e37be3a43c2567bfd45eccad57f88573786511488a25ab17101e5e77626773", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735083, "uuid": "8eca3e50-0365-4599-b82e-c5ac87acaf82", "value": "T17CA3C71E6E158F7CF79D833447B78F219688338B2AE2D145E15CDA015EB028E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735083, "uuid": "270f2d23-75ee-43ca-99c1-2bf8e85b18d0", "value": "3072:RucT7B75gVPUbcj6/k6Sdz3DqzUNa0jLmCr:Ruc3d5ujCSp3Oaa0jL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639735083, "uuid": "87e0a530-fe9c-4c5c-8627-67121d2f201d", "value": 101148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639735083, "uuid": "d7550476-84ff-4301-9fbd-144d432e25bb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735083, "uuid": "e18205d8-7b96-491b-b054-516a787e0913", "value": "7a642c47e91d1096e4d67a6f45aac2ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2f3a82-5f1b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639733326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733326, "uuid": "40dc6089-a2f5-4247-a85f-e38f362efd3d", "comment": "Malware payload", "value": "5fb4714857091e1c62901fef79c5b0fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733326, "uuid": "083d1412-5663-438f-92ed-6bba4bb1af82", "comment": "Malware payload", "value": "0d514a1f477823e6858ac8200fd0438a162b4f3183b13e9f8b0295c200b0f275", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733326, "uuid": "d8d8aa63-931d-4d92-8a97-0147fd25f795", "comment": "Malware payload", "value": "ed91a967ab900acd2bdbd6ba83ce9818d2001bbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733326, "uuid": "2e7d4fb6-de6f-41cd-b40d-2038bc63e8ea", "comment": "Malware payload", "value": "999c81e39e4d81a465c2901a92c10b33c6ede3b86f528b2a6a36742a766f6396848463432f57d960aa0d57338869b8aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639733326, "uuid": "c40e79ed-ab18-4687-99f6-ae2110ecacf6", "value": "T11CF4DF0EBB02C541F85CEBB5AFB32F142B54F9E2AD56D31BBE49196D842B3711884683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639733326, "uuid": "40fe2253-0d79-4275-8345-6ce47b3581d0", "value": "24576:7gf0wCUv86ynYPkkfmrLC40hGYVsz7Gf7arr7bHHHHngetLpLpf3HTb0aijK6joM:72CUUyhe6TRYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639733326, "uuid": "7fdfce49-8b26-4a35-9756-402d90e22499", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639733326, "uuid": "cbce55ee-5aa0-4179-8785-717a947f5c64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639733326, "uuid": "8f344628-fc33-44c8-b9c8-cbada9c81174", "value": "PO-2706BC61 B388E715-0CB7BC4E-2706BC61 Detay Raporu Product RENWIL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193d2777-5f7e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639775573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775573, "uuid": "9d82b5b1-0687-424e-9d98-9aa90ff88471", "comment": "Malware payload", "value": "8674df0425ae6936c5c210c09b88944d", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775573, "uuid": "346055fe-0455-4326-94a3-98164a995e40", "comment": "Malware payload", "value": "0e4f03d822423d717c6c5c358753ce12be8eb351fc8d09619d305e6d4a6416d4", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775573, "uuid": "31a21c1e-8bd6-4bb9-ac73-299a8b414156", "comment": "Malware payload", "value": "ce2be14bf230f1abd5089a8945b92f95916879ca", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775573, "uuid": "7eee424f-2244-4c45-8bf0-1cad8b6e1712", "comment": "Malware payload", "value": "0481fce5588e973ef7758a56c835364c4dd6024de3ab19d5d79cb091d9ed7901f257021212c60f26f4ef27ca27ecf791", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775573, "uuid": "6803bc1c-2ed6-4231-a8bd-e8fcc3a07e22", "value": "T16A44E13179FCD832C5A3CA7248648BD05A7EB8115672658F2B64166E6F30EDCCAF131E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775573, "uuid": "1a3f3d2b-0d28-45a1-87e6-def8c2c7506c", "value": "085d4aa5e29579ffcd8f5171fcc76b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775573, "uuid": "eab04f60-d31f-41cf-a75c-5ee995b0f656", "value": "6144:n6LRYSoUnXzgPSzfNngGS7aRDjQxpgegFQuzbgwuZbUB:n6lYSoUncPSz1gGVDjQgevunnAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639775573, "uuid": "07a950c1-74d6-4a81-861d-359e3984984a", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639775573, "uuid": "53bcdffe-11e4-4697-98dc-af544e1b2d0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775573, "uuid": "096a571b-3b52-4a00-8f07-bf33241cd4b8", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f5a0f6-5ed4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639702528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639702528, "uuid": "e4b365e0-2077-4957-acfa-022845cc1460", "comment": "Malware payload (RedLineStealer)", "value": "a1e656936816803eae447dfa8a500474", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639702528, "uuid": "ff27ddd1-bb2e-46da-8663-a314de519ba5", "comment": "Malware payload (RedLineStealer)", "value": "0f31fcaa49855c3a40398e2e85604dc062bb4f51e538d689dad2851ea18760ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639702528, "uuid": "25ef7f6c-16be-4121-92ee-ee4a12014f66", "comment": "Malware payload (RedLineStealer)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639702528, "uuid": "d38be9bc-e955-469c-bdcc-9fb6ccbc3685", "comment": "Malware payload (RedLineStealer)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639702528, "uuid": "287e8995-1955-4427-9d79-79e3c07ba205", "value": 11302069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639702528, "uuid": "85c7ea98-2f6b-4125-b8e3-1801aa6d86fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639702528, "uuid": "24829dbe-88d1-4a81-9782-115105b09fa9", "value": "a1e656936816803eae447dfa8a500474.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa61c29-5f1f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639735077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735077, "uuid": "46b5fafa-db12-43d1-99e5-66c4fa6c9f2d", "comment": "Malware payload (Mirai)", "value": "fddb5039ccda3f27bb83da1d0d0fd758", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735077, "uuid": "59ffa83c-e58a-4816-b30a-7474bb8d50b5", "comment": "Malware payload (Mirai)", "value": "0f54e26404fa6163fdeca6f3db098d2fb253b285dbffaf3261f31bd0733b5ab0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735077, "uuid": "b979ca5c-62fa-4ce5-a8aa-ac3334deea69", "comment": "Malware payload (Mirai)", "value": "a16e278a8a706fc8e1b4b3af5d4f0d9f8ba302d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735077, "uuid": "6159a0a2-6951-460b-bc43-8fd7dff78238", "comment": "Malware payload (Mirai)", "value": "2b610e4385b0f9584d1357c3f4d8ba6d579c32a04e672a75de4e3d8e3349c564b09397560c2fe893e857905addb8eb15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735077, "uuid": "0666805a-848a-4711-a2d3-b8ac8fdd19eb", "value": "T129734CD9A8025D2CFD5BE6BE94220F09E920631557D30F2BE69AFCD3AD731549E02DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735077, "uuid": "e09fec84-41bd-4da9-aa1a-d3c0fdcd96a0", "value": "1536:uPbm6ylp6SibLETDMwqwGas7LDvKlQdC8s5:uTm6y+6MZwnHlyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639735077, "uuid": "7b409586-2cf2-4212-834e-0a7ab24cef24", "value": 78820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639735077, "uuid": "61f96d88-af9b-4368-8d8c-1b00674b51b6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735077, "uuid": "10ca5663-9acf-4d38-9770-82fa69c451a5", "value": "fddb5039ccda3f27bb83da1d0d0fd758", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b49565-5f39-11ec-9275-42010a9c0029", "comment": "Malware payload (Moobot)", "timestamp": 1639746170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746170, "uuid": "1bc2f6d3-70a2-4f35-8fbb-b25236b171d9", "comment": "Malware payload (Moobot)", "value": "ee01c32ff89350568ed8391ddaec57c6", "object_relation": "md5", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746170, "uuid": "e9a3e554-cfab-49b5-93d0-23b7af400847", "comment": "Malware payload (Moobot)", "value": "1057f7c24743fcab4a790a8bc61e57b0287eee07bc1f34e89dfadcf477088154", "object_relation": "sha256", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746170, "uuid": "9413d51d-140a-48db-8ccf-91afd3d92413", "comment": "Malware payload (Moobot)", "value": "f351a2c949cea89b003a5b5b9b8e2caa0b3d832b", "object_relation": "sha1", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746170, "uuid": "846a9c21-bed8-4928-9621-927a37df239f", "comment": "Malware payload (Moobot)", "value": "25b438b9097f8304c331a259645a1645bfd8aa14d169d90df81314c5c5572e69a6c173de072994c96f1e27167a816f05", "object_relation": "sha3-384", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746170, "uuid": "107f9d00-a083-42df-8ff3-2243fb3a3873", "value": "T1C9D2E744BE869D07C5C84377FB4E028D376523C8F2EEB213DD163F56E68E527099A0A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746170, "uuid": "8d68d200-9646-4e1d-b3a2-7649de431986", "value": "384:Oju92lifJdzBqSZxyFf1vgTuQqXnPT0PMJ4aZyXRi37vIzuICv7z4vKBzsMIcPTZ:OjiZz8Bf1LBTTJbzwRwFzbR49jwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639746170, "uuid": "7846bdd5-da8f-44c0-b352-3d1fa3a5b843", "value": 30464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639746170, "uuid": "b9721269-ad3f-4275-8b99-75609cb6c0f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746170, "uuid": "a2e8a246-ac85-4df4-ae40-6c6f47f91aa7", "value": "la.bot.arm-20211217-1302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9afe05-5ee3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639709166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639709166, "uuid": "ed934078-332b-448a-ad0a-d9d8fde03ea2", "comment": "Malware payload (RedLineStealer)", "value": "a032179506ed8da1a5227923d1148701", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639709166, "uuid": "fa9cd0e3-cc71-4577-87b3-ceb86bb5a315", "comment": "Malware payload (RedLineStealer)", "value": "133fd7b6a946f6e6d658a52d3eff496070bb38351cb27bc3647e0215025af470", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639709166, "uuid": "465e8286-eb62-47a9-9bf9-e53c1b958eff", "comment": "Malware payload (RedLineStealer)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639709166, "uuid": "e2fbb636-b320-48d0-9b60-0822a7b56112", "comment": "Malware payload (RedLineStealer)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639709166, "uuid": "5ef313c2-5853-4e28-af68-0a24532b2e1f", "value": 1374720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639709166, "uuid": "0608646d-039a-4f83-82a5-1c13e22c2b23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639709166, "uuid": "1b366bd1-cf51-423b-8f44-c7156bc477d1", "value": "a032179506ed8da1a5227923d1148701.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e7d8eb-5f4b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639754019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754019, "uuid": "6cf0a2a9-75fa-426e-8203-64993575578b", "comment": "Malware payload (Formbook)", "value": "3fa412e3e3237fec99a8aa0c2e44ee3f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754019, "uuid": "1772a547-3b5d-4019-8aa6-cd1ca01fe70b", "comment": "Malware payload (Formbook)", "value": "14319c04da7b0b2d6ac7734df48a79589e87f410e5496a4e01804dacdfb3e62f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754019, "uuid": "aee216d5-0d02-4551-b11c-e9076d32c77a", "comment": "Malware payload (Formbook)", "value": "1837658576e9508fa5568f6c5af58bf6bb410e97", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754019, "uuid": "91892460-5b47-4607-a4ab-f5c87432ecab", "comment": "Malware payload (Formbook)", "value": "2012400ff9b08dcc6115f0e97c2c891de5d19ea134512323a92d44ccf09edfaae0325f503619e8cd05586b5c249be170", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754019, "uuid": "6a5e3fec-fe6d-449b-a46f-9375ace62479", "value": "T1A5E42395BEB54F33D557D4B28AF3A99B365CFC2883059C0B34AAF2412132BB874D5139", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754019, "uuid": "4438cfae-4af1-4bc3-b315-3c881df41261", "value": "12288:hizsWS2ceS0pgCj5H0ZEkV9fZkUjocnXkbSf/eA4d88kVfAmMd1+KTCaak8tTCi2:isiceSwgwGRZk1gcIIfzs1k2+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639754019, "uuid": "3eaea109-d2ab-4c0e-80ac-960576dadb66", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639754019, "uuid": "9e989d48-c5e1-465b-9169-7a8e96194519", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754019, "uuid": "4c71f297-c872-4cc8-8247-e41f4d35e229", "value": "FTK-10295.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751fc42f-5f4c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639754252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754252, "uuid": "49141d92-348a-4d52-9b15-235b807e0c16", "comment": "Malware payload", "value": "0bb9f865b219fb27509b2905c00d406d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754252, "uuid": "347aae08-a14b-4a74-8eba-a6a140d66193", "comment": "Malware payload", "value": "14e476c2d4d6f77347e77f49cfebc723ad8a52d021429899ec97409d86588c9f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754252, "uuid": "d89a71e7-1e67-4a3f-b833-241a6b05e413", "comment": "Malware payload", "value": "82b37f92623873a457dd2c97c40f5c1e07d13bb0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754252, "uuid": "f2fcd7e8-f5a3-40f3-bdf3-35c821d20e94", "comment": "Malware payload", "value": "68121187763432a027bb3c49ca3223a78de5d0a9fb0fc92ec52cbd77d3c8ad54b0e4b6edf0184560f1197e34fb43638b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754252, "uuid": "24b5fc51-425b-40d0-a934-71403a7216ea", "value": "T1C84153F51533C8C6222D16870DA4353ECF5CE297634BAE19DE5D68147F8C8B2B8C07A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754252, "uuid": "d5f9a5ef-026f-4ee9-862d-dbf9d56dd5e9", "value": "48:SMhZ2rCl6Blp50riBREYX0yW6eRW5BtU8T0vEZb5:SEZAvhdT0u5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639754252, "uuid": "28f4a10a-9ad8-4d0c-915d-bb54f8cbc694", "value": 2221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639754252, "uuid": "2b708fbd-439f-4f44-9e11-2636b7b5b197", "value": "application/csv", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754252, "uuid": "401ed182-b54b-4eee-aa0d-a037e8862296", "value": "QRG03NS902KLT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa96ce4-5f28-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639738719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738719, "uuid": "d2f4b1be-30b1-44d3-836b-e653198fbd77", "comment": "Malware payload (RedLineStealer)", "value": "e4522d1481ef683d1d85c9627c830d04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738719, "uuid": "c1c77c5b-1ac2-41f2-805b-89b41fffab07", "comment": "Malware payload (RedLineStealer)", "value": "1550ed3ceb4ba286d11417e5ff368dded82fa3994de3369250090b4248e5c6b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738719, "uuid": "71c3ccd3-7578-4572-a8ab-2a22643bf7a3", "comment": "Malware payload (RedLineStealer)", "value": "48456abc7127df96474eadc86882c83f56f74791", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738719, "uuid": "8349ca8a-c058-4af1-a88f-b3f56fa9431f", "comment": "Malware payload (RedLineStealer)", "value": "e9bfe0b0b1cfb83559bfba54acc443496ffab6d7fb8ebbf3f690dd352d78e532bd86e61b689f243341324a1a865403fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738719, "uuid": "1ae18d24-14e0-4e26-9f56-4c2767aeaf70", "value": "T12FB34C6073DC8914E3BE4E75B8B1119C93F4F0532802EB5F6DC565FD1E62B80AA21AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738719, "uuid": "b8511e61-7117-4530-afaf-32c59223f10b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738719, "uuid": "bfdbc202-5380-4a3e-9064-a7343121b8e0", "value": "1536:vyXpG0ANv4eHDA7XTJ2Knr6FLURws2bZDKL//jqDbx4J9ri001:aXpLAhHDkXTJaF/vozSsMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639738719, "uuid": "6bb01e98-6647-47c0-831e-816373fa6123", "value": 108792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639738719, "uuid": "f9d6ad6c-6e31-44f4-b04d-6c221026c96b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738719, "uuid": "d7a1dde5-bb4c-462f-a59a-47446b447fa3", "value": "SecuriteInfo.com.Trojan.PWS.Steam.23630.5339.17024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bad9034-5f2a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639739553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639739553, "uuid": "cfcf86da-abec-46cb-be15-f8396613c5bc", "comment": "Malware payload", "value": "b4cad55f02a9cfa38ad8311dcaa28551", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639739553, "uuid": "a9436c3b-97b0-48e7-87e2-9c6259a37e2b", "comment": "Malware payload", "value": "15583e0c7ae805a73f306813ca10906506eb2f2ac5ffb37fbdce9783539ef2c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639739553, "uuid": "0b2d591f-8b4c-4f57-9639-7bafb3830350", "comment": "Malware payload", "value": "8e8b6d99f02637a1152e34136dc6fc607263121c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639739553, "uuid": "c2d727f5-d100-4a6c-83a7-80887abb335b", "comment": "Malware payload", "value": "436120a4eaf410ec9e562601a177820fdd4ca445f44317abf308b3aaf7b00f74e103f85e851050a17ce230e72edfe61e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639739553, "uuid": "6b98185b-c3c3-49d6-a31e-36e46af1ed1b", "value": "T10633519C716071DFD857C8B2CEA82DB8EA60747B871B9213A42715EDAE0D897DF140F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639739553, "uuid": "f200c490-defb-4e85-acc1-da1cba2a4488", "value": "768:+8F+paM8zmusY7R6UnQlkjK6fNNGL48FlxeuiMdu4bsyjuwSifxH:+a5xDsbH6K6fNNmBrnbu4ohip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639739553, "uuid": "23ba0f05-82d9-464e-9974-9c16379222d4", "value": 52224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639739553, "uuid": "b261e610-a779-4872-a6d7-45b02a4a907e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639739553, "uuid": "eb3b30db-8501-49b1-ad87-bf077909cba4", "value": "0102.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d032bbc-5f52-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639756762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756762, "uuid": "64119269-b29c-4621-bf04-aec6c3928298", "comment": "Malware payload (AgentTesla)", "value": "1f66f4fbb57897bcc3485f0976320758", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756762, "uuid": "a0f8a54a-c527-4b3e-877a-74b4a290ac4a", "comment": "Malware payload (AgentTesla)", "value": "15e6b5a93f3be05456b092ba5247bdd3c0e5968b1474809263ed4f61b2c180f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756762, "uuid": "e7ea4641-20e1-4da5-86e9-02aeaea1a662", "comment": "Malware payload (AgentTesla)", "value": "155533b0c4f19f87653c7127666af1cec5fe2e87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756762, "uuid": "772fd81f-7ba0-43f1-8c70-585602ea9aca", "comment": "Malware payload (AgentTesla)", "value": "d417e79200e37ed4568889935b983e361498f7123769cb6588ee9948ddaf82932628c7ff5a7ed0a7d86332579cfe01f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756762, "uuid": "95792edf-669a-47e0-aaea-0b01b7a2996c", "value": "T1686523433E941E75DBEE2B3750DB581FB373AB6287A0B0855BBE389F0847C521462B85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756762, "uuid": "fd3cf27f-b86f-4e27-b0ac-7ad5e20a5882", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756762, "uuid": "80444bf1-40ac-4631-8730-baa1287ee01e", "value": "12288:YXM3uuAhDd1Bg4QmpcJwpEKqJPXafXXHB:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639756762, "uuid": "3aca89d0-49d2-4be2-8fee-9059c5d52f34", "value": 1501184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639756762, "uuid": "71253af5-e9fb-400c-8ee4-850f5ccedbf6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756762, "uuid": "417935b4-edfc-4327-931d-34f6ea6ebf24", "value": "1f66f4fbb57897bcc3485f0976320758.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df4f24d-5f2b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639739906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639739906, "uuid": "9b0c4abd-0b9d-45a8-982c-401ddfb9fafd", "comment": "Malware payload", "value": "5b4e91e68c448d2069ad8c721720b48a", "object_relation": "md5", "Tag": [ { "name": "Dridex XLS XL4Macro PasswordProtected", "colour": "#BB72E9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639739906, "uuid": "857bab5f-4689-432e-be2a-421cec0880bf", "comment": "Malware payload", "value": "179d4c96f9d5de2519e804fa009691bfc04d24c717c9dcafa68b813d1ef64757", "object_relation": "sha256", "Tag": [ { "name": "Dridex XLS XL4Macro PasswordProtected", "colour": "#BB72E9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639739906, "uuid": "5696c9c3-3cd6-4053-a7d1-47a12502bb41", "comment": "Malware payload", "value": "b23450a6c7b29b36c836182b1143dcdc61fed44f", "object_relation": "sha1", "Tag": [ { "name": "Dridex XLS XL4Macro PasswordProtected", "colour": "#BB72E9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639739906, "uuid": "d69f241f-9a0c-40d1-8732-9697b075e21a", "comment": "Malware payload", "value": "135f9a7189b5149bbc05c4e754d362a6797fc600fe6ee78a1efd126c04946d57373f380e3b90364ba3bf45a7f0ea18eb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex XLS XL4Macro PasswordProtected", "colour": "#BB72E9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639739906, "uuid": "c6f5d134-2979-4ec8-8e06-4bb9182ae764", "value": "T17273010672B46870E7C1C130352F4E8362E55E371C8AA95DD3257B0E1A36D9EEB1B31E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639739906, "uuid": "5f9edc52-b655-4a35-9caf-58493b1ab3fe", "value": "1536:zPWTRt328MFswvYyR02vwjG+35oLSkyKC0LDhTHA7pJKwbVdCtC+:S/0vhL+iLNLZAVswRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639739906, "uuid": "fa184416-2afc-489d-b599-7b9172dc5bef", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639739906, "uuid": "e2d2c330-54c7-4e01-a012-f273d2b7d0b8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639739906, "uuid": "479042db-3539-4474-829a-195ba9dc2f9e", "value": "179d4c96f9d5de2519e804fa009691bfc04d24c717c9dcafa68b813d1ef64757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec0cab8-5f38-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639745759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639745759, "uuid": "a17412a1-9a33-423a-9a00-826f2c8f3983", "comment": "Malware payload (AsyncRAT)", "value": "f2bd8f4c9b7e8020c5d8ecd33cef8086", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639745759, "uuid": "9d046cb5-ed42-48a1-84e0-71ed1c3a2cc0", "comment": "Malware payload (AsyncRAT)", "value": "18912d82205dab75e777d2bb71edfae3baa4f97c042770db118354f889062e39", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639745759, "uuid": "1eee3697-6b97-4e5e-8459-029e69aa93af", "comment": "Malware payload (AsyncRAT)", "value": "3ba795798ce2fd18acee1e70e1e7ee292115ca92", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639745759, "uuid": "19157573-abe7-480e-bd9f-c9bb9a23883c", "comment": "Malware payload (AsyncRAT)", "value": "b7df035d948fa3cc665337e03c48d4691508fd8687a20ff818a4620f51b01363031322dcf285481e3785f4be1905af17", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639745759, "uuid": "3108ecf9-4c31-4cd9-b301-702be1c424f4", "value": "T19764019466F9CE2AC0760BF9107464C18BF216A63223DE4F5D8E51DF8923BD50E21BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639745759, "uuid": "9841d2e6-9b96-490d-8b2a-0fb15fdc1349", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639745759, "uuid": "36c053c3-2df3-4089-8a9f-8ca1f3c25fcc", "value": "6144:9KubGKEyXLxANtpJUo7Hm1BBqsTUxIfhLuWL/4myyy18f+V8J6JG:IuSK3LS7vm1BzoSfdxkmyyy1pWyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639745759, "uuid": "916d9995-d239-4125-8a07-e19ab7bc2954", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639745759, "uuid": "968ec8cb-c3f4-41a0-853d-906188ae6717", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639745759, "uuid": "098f8e4c-9c64-4bf1-9d3e-9637102b3735", "value": "Non disclosure Agreement & ITB docs,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45d478d-5f5c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639761204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761204, "uuid": "293a72de-d820-448b-ae5a-c6bcc6def498", "comment": "Malware payload (Mirai)", "value": "5c9c340e212bb74329579e80317de8ad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761204, "uuid": "b2b4335c-a3e5-4fb1-bb96-7f4d7cdd4f12", "comment": "Malware payload (Mirai)", "value": "18f52804424df9d72da201e9d5f0df56689137d2c3e3ac9dab796da2cfecbc9c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761204, "uuid": "84733541-801d-45e2-8726-347d0eaf38d6", "comment": "Malware payload (Mirai)", "value": "7128f2f6cc317a25830f04d795fbc9fa20be9b95", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761204, "uuid": "203f37e2-d55a-4956-b355-d4895fafc943", "comment": "Malware payload (Mirai)", "value": "de3f672f23f322a9880d90c645fda344b2fd7516b6c49be114b4f56d79f8cf3fcc02bc8ecc52ab08300c16094efcd167", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761204, "uuid": "adeff402-d9d1-4046-a0d7-7e86d80b4d23", "value": "T1CCD33B86EA408E13C0D51B77FAEF41493322D755E3DB73068D189BB43F86A9E4E23649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761204, "uuid": "666b0a28-c3aa-4bc3-8752-ea31d059ff9d", "value": "3072:QybUEGniGQYtOR7aCgk9mrsplDKZUmQBKXAVanJX+F8JyvKs4hL5AJI4+3jJNx1F:DbUEGniGQYtOR7aPk9mrsplDKZUmQBKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639761204, "uuid": "2143abc5-e10a-4061-be6c-01f10fa9d98f", "value": 142651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639761204, "uuid": "7f155b94-bb11-488c-871f-e24d1773a9fb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761204, "uuid": "77bd9126-b9e0-4eac-abe7-ceaac59709c4", "value": "pandora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede5b898-5f7f-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1639776359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639776359, "uuid": "de07b258-c4e7-45d5-a0b4-fa4d77746d01", "comment": "Malware payload (Amadey)", "value": "1256759f895dce45add52840691d10c3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639776359, "uuid": "bd4f8418-b9ed-4e12-9d82-8888031ccfae", "comment": "Malware payload (Amadey)", "value": "192a735902b1fba95b376ef8bf6478f4119dc5fde3111e4a37100884ff548af2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639776359, "uuid": "e6040db2-b505-4be1-ac0c-2cbffcec0b72", "comment": "Malware payload (Amadey)", "value": "0f1bff6c2add9f4fa472e0a44c1e16b9a22945bd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639776359, "uuid": "a46e2e36-ff0f-44ed-bcd7-e3cc58b76ceb", "comment": "Malware payload (Amadey)", "value": "055d1c6bdf3285c414c7190762b66d30cf87752de090e144e09289e42781813e6fabce495c506cff2f2076eed19bee05", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639776359, "uuid": "805d7319-22b2-4224-bf06-a064b42bb961", "value": "T11AE3BF3179ECC872C5A7477049648AE41A7AF9212660915B3B98136F2F70ECC4EF636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639776359, "uuid": "166927c4-8021-49fa-84ca-63c0aeedf30a", "value": "254f2d7d316c651aeb3e2ff6fd4504f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639776359, "uuid": "1e1b7d3b-1bb8-4ebf-b9a1-1a86d4b92cb0", "value": "3072:a5vqRXLdQiHCZEL2WQYkqf2yfVWrxpzbgqruaoFfUbB:IvqVLZHCZEL2vYpVuzbgwua6fAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639776359, "uuid": "e4c7ad6e-fca2-409e-94f6-2991dd9349e8", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639776359, "uuid": "4e83c862-3670-44cd-9284-bbb117897bb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639776359, "uuid": "4ac363dc-1b67-48d0-8026-ba304fe88aba", "value": "1256759f895dce45add52840691d10c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49eb85f7-5f22-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1639736141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736141, "uuid": "1d5e77ec-04ce-4627-84db-a8a6d3cb8b65", "comment": "Malware payload (Socelars)", "value": "aa2de9267f0d37c5233e4dc8fefa6dba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736141, "uuid": "516525c3-ae6c-41e3-8803-7ca76867ad60", "comment": "Malware payload (Socelars)", "value": "1997da6df797093ae6f749c868261dc3d572208812f6e55fccac2f537c36b3c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736141, "uuid": "1c38c3f8-30ed-4f5a-9529-6f7d6abdc618", "comment": "Malware payload (Socelars)", "value": "bab448ce3c35a741926701a0c41a1185c00c223d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736141, "uuid": "dafbc1ef-a9e3-480e-965f-f4ee163712d8", "comment": "Malware payload (Socelars)", "value": "effe115514fe0e87b858daa03b694e3655f9f7e7bde8fd6b8556ee3fbae3fb7ad4d58f8b7a636ebe6ae8e35741f7f83a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736141, "uuid": "3a0f96a8-7fe5-42b3-b58c-ef686eefa1be", "value": "T14F659E11FF42A076ECE3007382FF5AFE8D686621030854D7F3C45E696A615E27A37A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736141, "uuid": "ef9321e9-dbc9-4d58-b22b-b89dfff8a309", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736141, "uuid": "e17b33b9-ec1a-48de-9277-6fa368bf25bb", "value": "24576:KaApxEmUociWVxvX2LfeEyS2ZTU2xbVJbpNyn0iNzpdZKj:8pLfvjilVbyn0iNzpXKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639736141, "uuid": "62633318-b24e-4eba-a9a6-2f15cf2d62fa", "value": 1490432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639736141, "uuid": "2195ca99-80c0-4a77-b65b-b1165a40486a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736141, "uuid": "5c3a49e6-734b-42c1-8d70-cdfdae175a0d", "value": "aa2de9267f0d37c5233e4dc8fefa6dba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3e553f-5f68-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639766483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639766483, "uuid": "f08a3c3c-e84b-4af1-9645-1f2514cb62a2", "comment": "Malware payload (Mirai)", "value": "90d3d8625515ec0af0f82703cb072efb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639766483, "uuid": "210ec5a6-99a5-4512-ac30-daa211d74b44", "comment": "Malware payload (Mirai)", "value": "1b25542976535e7b303851f7b39898ff32904bdc4ec059fb53a40284c325ef8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639766483, "uuid": "cd3bd4a3-984b-48c6-9380-ec1c1bcdd17b", "comment": "Malware payload (Mirai)", "value": "4c821a580587c92406f6d203183650432f946379", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639766483, "uuid": "63cee0be-8003-4902-a33e-cbff84bdde4e", "comment": "Malware payload (Mirai)", "value": "85ee6144f3133f5758ae022c63e4479704fe79e7f8b174328d09de75dd84d3c3e3dbf1b5e72ac9ec4c5332cf58d301b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639766483, "uuid": "c3aefb60-f533-42db-bc40-2a4ee62ddf48", "value": "T19D930945B8918A12C5D813FBF92D118D332267F8E2DEB212CD105F7477CA92F0D6BA96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639766483, "uuid": "d7d49048-17cd-4aa3-bcb0-ba2fd7b49b29", "value": "1536:gQnhQUGxi9iRvtrqA9raRz6ckLQ4a2B/ZXm+m+U0Cuqqy6UzeIUXiZj8d4mmWd4y:mUl4RvtqMr+2ckLQH2B/5m+U0/qDvj83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639766483, "uuid": "8527a983-fea0-4185-8bd9-8366ff69fbfe", "value": 92132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639766483, "uuid": "a1185070-ff2d-42e5-8fd2-fe886eb32bea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639766483, "uuid": "2827cd5b-1112-4b89-b766-dd9b5ef01192", "value": "90d3d8625515ec0af0f82703cb072efb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f73ad4-5f79-11ec-9275-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639773554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773554, "uuid": "e60c41b6-fb84-4123-9724-07c36deac482", "comment": "Malware payload (Dridex)", "value": "9854be22f954aaf490f51a81c2d27ca5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773554, "uuid": "cfa437ef-7b1c-4184-b2ef-5466c544e8d4", "comment": "Malware payload (Dridex)", "value": "1bb547b713a473c810dce54abf20d1e8a91070026a597ef94a189ea9639b3899", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773554, "uuid": "6b1fcbc8-e1ee-4269-968f-8b4268b108c8", "comment": "Malware payload (Dridex)", "value": "b018c7ee3b055b41d697ce39b469ab8a7582da0b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773554, "uuid": "36ad3ee2-9753-4ffc-a832-5e405c0097fb", "comment": "Malware payload (Dridex)", "value": "0ebbf0bd133d6e7600622988277dbbd9fc3693756f115806b941be77752b48ea6312615b33eb3b83fe82c104f85ea08c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773554, "uuid": "ba3268a7-647d-4a1c-a996-d05b974c9704", "value": "T12CB4BFAFC65E1478C7E31870159143B12EA640C6097ADEAF6B2FFA9C149634C227DB7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773554, "uuid": "6fcdfbac-bc43-4b0a-89d5-96035a06fae3", "value": "1d03489a888f9eb61ae369ecc7b0879f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773554, "uuid": "a4e786f2-7610-4986-8e4c-fdd135666f16", "value": "6144:/WlkqY8IIaCme+UOwOYEKdvfrlEe/ply5ovxlbL6B4Q0oY:/63BdvlDx5O5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639773554, "uuid": "a07d9338-9906-48cf-9d22-05e3dd6067b1", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639773554, "uuid": "45844504-f9ce-4679-af52-87850382b6be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773554, "uuid": "b2bdeafa-8dec-4655-8d61-f72419d3b5bc", "value": "SecuriteInfo.com.W32.AIDetect.malware1.3915.11860", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd64787-5ecf-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639700419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639700419, "uuid": "fd9081c8-0096-4145-83d8-2c7ee3b07f7f", "comment": "Malware payload (ArkeiStealer)", "value": "a02815a96aefaea2375fbeae1daf7719", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639700419, "uuid": "432788b8-73fe-4e8f-a70c-9c0b1d288425", "comment": "Malware payload (ArkeiStealer)", "value": "1c5cf831daab60f538f725dcf73f44ee1379a97dc228185f4ccbdefcac678a3d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639700419, "uuid": "7cadb805-ece0-44ed-8aaf-8d61b6f64de3", "comment": "Malware payload (ArkeiStealer)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639700419, "uuid": "47604ee0-f637-45e9-b0d1-b14b50ff08cf", "comment": "Malware payload (ArkeiStealer)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639700419, "uuid": "0d424a44-4342-4f73-bb64-a564a4f1bac9", "value": 7816534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639700419, "uuid": "f7c37669-66cf-46f2-b6a2-c74151c52621", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639700419, "uuid": "657ae4c2-dc70-4c83-92f3-81b94b290920", "value": "a02815a96aefaea2375fbeae1daf7719.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f1616c1-5f22-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639736123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736123, "uuid": "f437eed1-d392-4e58-8e83-bca14b82f503", "comment": "Malware payload (RedLineStealer)", "value": "ef677ad6333124c7a8ef6ea2cb8f5580", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736123, "uuid": "da52f214-02fa-4024-9709-259a2e5926e2", "comment": "Malware payload (RedLineStealer)", "value": "1d9e3011367847fa6a2bd799105adfa4915169e4255ed26922669d457300242a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736123, "uuid": "6dc43937-8ae4-49ab-9da5-2fad7a4cea90", "comment": "Malware payload (RedLineStealer)", "value": "863d301d35f94ef0cdc4b50e901656858861e6a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736123, "uuid": "d7dc3313-70bb-4a81-933e-b992948eff0d", "comment": "Malware payload (RedLineStealer)", "value": "3e7837f2f6dc3abcb56fcea47f19c6e57efa0dc73dfde546e545c1d3ed0516cf76ddf0482af1737f7ebb02778b9d3731", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736123, "uuid": "6ff36f44-c35a-40b7-9bf3-229ae40980ca", "value": "T1A7C4E53839FA5019F2B3EF759BE878969A6FF6733703A55E205003864B13A81DDC1639", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736123, "uuid": "50b3d230-7ba2-4d46-a9d6-7c7c7557c388", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736123, "uuid": "81e1205b-eec7-421d-a646-601143928027", "value": "12288:ABd7kMpgKzEDhrqtVjxiNxumxPnCtkXHd5sOl7YBtAjS:Cyc9EFK729J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639736123, "uuid": "6dac2067-529c-4524-8c42-4cff8e2839cb", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639736123, "uuid": "fff472bf-f0e5-4a73-ae7e-7e37d3f3d49c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736123, "uuid": "4bf0e3be-23a5-4590-9ebf-07cf5fe449cd", "value": "ef677ad6333124c7a8ef6ea2cb8f5580.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c4e4ec-5f20-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639735517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735517, "uuid": "beb39e0d-2bdd-4e92-944e-a27ef74e818e", "comment": "Malware payload (Mirai)", "value": "e2fb301c608382c7e9a138282f468d8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735517, "uuid": "ad4eac5e-7104-4b70-946d-df445bbeeda0", "comment": "Malware payload (Mirai)", "value": "1ef892530dcfb8fc257f473659769e23a37c2bd33d7767b93f7a1fbf42584d8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735517, "uuid": "7cef743f-9310-47fc-82b8-6ecb806a421b", "comment": "Malware payload (Mirai)", "value": "55fa666062d894727e44a658ed26fd6e4a7c0071", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735517, "uuid": "1f6ffa00-feba-4d79-8238-c52ee3252610", "comment": "Malware payload (Mirai)", "value": "d382411dd17ff444116f0d69f6b226014721855aba5d7d78f0f87bc525f1dfc8a0758538c98d5d8f6977da03ab14c42f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735517, "uuid": "3eacec17-5003-417b-a502-7bcc1fa07e89", "value": "T12C83F79278C29A12C6E423BBFA7E018D332567A8D2DF32179C212F1577C981F1DB7691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735517, "uuid": "f7b2405e-0973-40af-ac97-23ab2e960854", "value": "1536:ssCvlPf6NDyL9Jb0+pHXlzPhha0xT8dUn6ahWNrHxKW5XnHM357jC:ssCvlPCuTxCUn1hi4Wm3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639735517, "uuid": "69eb3174-34b5-48c1-9444-a9d883fe6427", "value": 82940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639735517, "uuid": "6aae6c98-0935-4af0-87b5-d5a7064fe5a0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735517, "uuid": "3233726b-43a7-4711-90e5-bf99c3ab6445", "value": "e2fb301c608382c7e9a138282f468d8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5834e6-5f28-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639738722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738722, "uuid": "ab6c35c0-713c-4775-9401-17456f111b15", "comment": "Malware payload", "value": "dfd090775ac109e54d2cd2645f39a3c9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738722, "uuid": "b571836e-99b2-4f5d-b709-16bdc57b672a", "comment": "Malware payload", "value": "1fe1cabccee2c822eb62bd475cc0fd454c16c6520aa821e8ac00f79baa7c67c2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738722, "uuid": "ff56f796-43b1-4f4f-9853-33a6eea26074", "comment": "Malware payload", "value": "bb6a91e923224d75c7dfa34d40427083db324a5c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738722, "uuid": "17c00c6c-b3a3-400d-86bb-2d2215b58bdd", "comment": "Malware payload", "value": "d60238122a98f99e421c4f688ac0dc013ac015eb073769bd703ea4e58b62f3b65500554a750252c7c48537a886a57148", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738722, "uuid": "917c2cb7-67ae-4ca9-a865-6259be7fcc48", "value": "T16D746B10E0C3403FD5A6E2B1E559954283FE3C19799ADFDAAA4E087F7D30161A37AF09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738722, "uuid": "0f17932d-29ff-45fe-a7f6-6c974037a4aa", "value": "c222698e1e72543933982761c98fe1fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738722, "uuid": "1d116792-acd3-411e-b348-81822f99a319", "value": "6144:QaABsU0Ln/bSe0pcKSdl+l+Ty129bbPUx9VqMo/R/R3s:jABt0L/bSnpSdlBi29b09IMop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639738722, "uuid": "8c5e7279-e1d9-4342-bc22-a61af7776a8d", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639738722, "uuid": "537d0892-0d07-47c3-950e-d7fe1f7eac8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738722, "uuid": "dd730214-fc63-409e-ac41-0f483a49d3cb", "value": "SecuriteInfo.com.Win32.Injector.EQUC.24617.14091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68223639-5f22-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1639736192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736192, "uuid": "35ca2907-ece7-4fa9-87c3-e79188fef2f0", "comment": "Malware payload (Socelars)", "value": "cc29c0f03780f2e3ef6d1cb59b0d6b9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736192, "uuid": "16dadde7-8346-4ee1-a3b5-05ebeb354b10", "comment": "Malware payload (Socelars)", "value": "208ca4eca529c91a1752040e69523a4cae87b67a6b9947eab21ef683c03d8b3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736192, "uuid": "0977bc5f-394c-4475-b6b4-bbfa6396d5e1", "comment": "Malware payload (Socelars)", "value": "ee8e782b4d6350cc9f6e8fe94159ba967d8ed490", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736192, "uuid": "59525adf-1eb3-41f6-a2c6-f016583a8f54", "comment": "Malware payload (Socelars)", "value": "1fb37c8d7b3b7537e1baad82826f610f6c147d800a26c9a5968681a274f603ff09fea7fcf0faffb8dc3205857ff07d76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736192, "uuid": "f894b77c-20fa-4a6f-8f2d-a266b36cf136", "value": "T13D659E11FF42A076ECE3007382FF5AFE8D686621030854D7F3C45E696A615E27A37A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736192, "uuid": "5b790ccd-30c8-416c-b545-d0700f4b5b56", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736192, "uuid": "65593679-9dfa-4b22-a80e-a2244a6a1b8b", "value": "24576:KaApxEmUociWVxvX2LfeEyS2ZTU2xbVJbpNyn0iNzpdZ8j:8pLfvjilVbyn0iNzpX8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639736192, "uuid": "2446a809-56f6-4d53-9280-0a9e08c2f557", "value": 1485136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639736192, "uuid": "81e9f9ec-15ee-4756-928c-35d43a999ef5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736192, "uuid": "c839eb11-fb49-4feb-a460-a2d4af96ada5", "value": "cc29c0f03780f2e3ef6d1cb59b0d6b9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22469988-5f78-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639773011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773011, "uuid": "b6c64c59-8c1b-4cd5-b87f-1ca1055bbaed", "comment": "Malware payload", "value": "f0f473958e1057107cf8cb7998ab3a3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773011, "uuid": "d0422fc1-052a-421f-8b90-9aa1424adc91", "comment": "Malware payload", "value": "20b62cf77e5ef6320fc22d64a207e5287f9b04f84e79279f4f14b852973b71bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773011, "uuid": "c17a3ea0-07a4-4d1d-870e-19b6d1634e6a", "comment": "Malware payload", "value": "ab93bdbe0cf79abcea6ad353e09820048b9d2d14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773011, "uuid": "46e3b351-9dda-4ff1-a259-c1472f7c8f0e", "comment": "Malware payload", "value": "5ae70b56f313e5034352e330deb21764b37ca5de066c36523931d601d498340399ba315abb7e42e7d8db655dfcdb438f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773011, "uuid": "ffd3f683-f298-43df-9768-654794cbe6c2", "value": "T18945178525AD3B25FD7853F800AA6C94C7BA7D2A717EC68D8CC330D72973F924850A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773011, "uuid": "d84fab57-866a-4126-8eef-18625b9bf9d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773011, "uuid": "848141f1-2b3d-4d1d-928c-7e7c95541b48", "value": "24576:cVqHYiwCDSK3I8IKg8NAT6Dej4qS9qg7UGucCy1:cVqHYiw7K3Hr9DesE2UFry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639773011, "uuid": "9a8600fe-dd4e-4014-8a70-0d4599daca4b", "value": 1180672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639773011, "uuid": "76c99f61-54a8-4ddd-a3a5-7e14b8d3c6d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773011, "uuid": "54bf7d75-b8fa-4f7f-a7a9-eb9c8dd67500", "value": "\u00d6deme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89221ff1-5f42-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639749991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639749991, "uuid": "d301ce8d-2367-438f-8c20-2f22e7754c60", "comment": "Malware payload (AgentTesla)", "value": "ef7e7612681137eb61b1a3a22b3ed653", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639749991, "uuid": "d0d79828-afbc-4bc7-b0c4-3229a63f6ccd", "comment": "Malware payload (AgentTesla)", "value": "2141c32603285a6bcf47a6a92a4d3139f3f56ac3390f811e74ecd14b54de44bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639749991, "uuid": "b15f5ccf-5efb-41fe-93a9-db49f1d7026d", "comment": "Malware payload (AgentTesla)", "value": "4d414eed98269928cf5f4f982a548b9d4fd22585", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639749991, "uuid": "643eee45-8b86-4fba-916a-65ae8e7711f4", "comment": "Malware payload (AgentTesla)", "value": "2bfe841abf63c8f936367ac4b8bf30e211cd46b313ff1afd62ece7ffb281c51d5b3fd0d50b126067876163dbb81a8316", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639749991, "uuid": "6dcaf141-eb1c-48c1-92ab-0cbe2b69f685", "value": "T151B412587634C81BC2BE49FB10BD408E5BB055626792DFC69EAA92DEC0827D117237CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639749991, "uuid": "fbb842a1-490f-4e57-a7c3-92204b5ab9d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639749991, "uuid": "1efaa278-ab38-4a4d-b423-b173cdb7db1a", "value": "12288:1IagQAK9pd4C5EaexMixSKy/5YX8LhRcr1yuSK3vkmyyy1pWyj:u0zdF5EaA9EDIDSK3vkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639749991, "uuid": "8ffc0c97-d24b-4228-a62b-0030c51033eb", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639749991, "uuid": "c05d1759-9df6-4752-9b18-6b7e808cc908", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639749991, "uuid": "a25b0e3b-9b18-4b7c-b8f6-551e24e4e5a7", "value": "TT Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c558e987-5f45-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639751380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639751380, "uuid": "8aa3f53b-41d7-4917-8a0b-e88c94fe2ff3", "comment": "Malware payload", "value": "9e0ba1e7e675b592be686236abea04c1", "object_relation": "md5", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639751380, "uuid": "0921b90b-b7ee-407a-8e2b-31747a78635e", "comment": "Malware payload", "value": "217b3385ff13c5b3810c715aadba5b4f36dc6c6a6f3e668160eccf5a882bfede", "object_relation": "sha256", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639751380, "uuid": "3a07f2b3-c380-4066-a1b7-e039d4f4bd10", "comment": "Malware payload", "value": "521640599810fc63d9d4ef522c4978910628fb64", "object_relation": "sha1", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639751380, "uuid": "e8da5f1c-ac86-477a-aa8d-e9f8780805c9", "comment": "Malware payload", "value": "d5f65c3f0930b6ae53daed2e75269c3e0970f9f2e407eba67c05931a04f2ed8c404a1134d24bfb9d2279dbea3c1af558", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639751380, "uuid": "553b72a3-5fa5-4f6d-91e4-55159d5be9cc", "value": "T10B62E747ED1C10932FA8F1AED4749C547F0883315059093EB2AE5E9B12ECE2B611FADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639751380, "uuid": "930dcd59-4004-4455-882f-1eae0f179039", "value": "192:FMofWik/qcRr54E2E4iKDWKQMM41DTo1LlMqcRr54E2E4iKDWKQMM41DT9oV:FMofWik3/4dKKQ74JE5K/4dKKQ74JA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639751380, "uuid": "23a21558-6385-4b80-81c2-405141db25e2", "value": 15373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639751380, "uuid": "5c24be61-b6b3-477f-8ea0-c001dfa92fe9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639751380, "uuid": "221bf416-cffa-45c0-80b5-e5ef8c05cf8c", "value": "5y98SsD2.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6071b4e4-5f5c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639761090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761090, "uuid": "7201c110-62e1-4986-aacd-f2fb864b43ef", "comment": "Malware payload", "value": "a79a52e92a8ba9c82d0743d8a7a481b8", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761090, "uuid": "c17eb62c-ff20-475f-924f-a90e88cf5d01", "comment": "Malware payload", "value": "21e6c412b3721df0c535e9f41d43e6744e990de0ea5d3634c48cb6cd62756330", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761090, "uuid": "07db4f2d-6d2c-4a32-8196-60d5f710c9fb", "comment": "Malware payload", "value": "f3640bbacb78c8fb93cd2de2fec812f5f9419881", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761090, "uuid": "eddd1b6f-82cd-45df-99bd-e518ba7fc73c", "comment": "Malware payload", "value": "a184c0ac9b2cf08cae948355a00cef310a74cc62f62ae13caf5604c92dda4ffd1662f5e2bfe8fbb84fbe746ff3dd4f36", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761090, "uuid": "71107165-3254-4192-9e02-86f019ed8606", "value": "T13A4533F4381DD804F1AB143BA0DB59AEE6E600A14B72BD427DE3E264E0DEF87E54D611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761090, "uuid": "7fe0806e-41fc-48cf-969d-ab05f0bea6b2", "value": "24576:s6yU7IWhNZmWJfH3/7a2TEuts4HrcRSbnP:c4lRm0P79T/s4LKSbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639761090, "uuid": "c22c34c3-425a-4751-8983-4b2cb839780a", "value": 1277805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639761090, "uuid": "b8595300-c1f7-43f0-abc2-05b5e98107f9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761090, "uuid": "6e64eaa5-f4dc-4610-b4bb-ea83a6e0eb56", "value": "pla\u0107anje proton mail.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0bdf77-5f8b-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1639781190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639781190, "uuid": "804e1b10-91f8-4ea9-98e4-b899dab63e1c", "comment": "Malware payload (BitRAT)", "value": "89ba278cda54e11fcf5def480729eb1f", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639781190, "uuid": "85c47307-26c4-4947-b2b5-5bc8d9bd1e2f", "comment": "Malware payload (BitRAT)", "value": "22548397f8ffb20d88d649678c9b09013118eb159bf3b5fa3532e28051a4e2b3", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639781190, "uuid": "a2a3b52f-41b9-496e-919d-f1e92a525d1a", "comment": "Malware payload (BitRAT)", "value": "c614fa76709aaea6922468455d22169a92d2c4c0", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639781190, "uuid": "6eb025ec-570a-40c5-910b-6950d4e514c4", "comment": "Malware payload (BitRAT)", "value": "798ab52c01e94574cf87d00a81ebe43daaa95e212261006541f4f40a1bc49fe0fa44cc71cca1f7135e2da387a605c3c8", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639781190, "uuid": "59ec95e1-94b0-48be-82cb-3b747248e076", "value": "T12CA52303B967CC76CA4D0FF2A470D6E6597F34A08B24E1A573892A77AF923D11893702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639781190, "uuid": "5f70c8d6-8839-4d7a-87e7-7f91311dde68", "value": "2bb4e5a139a2a29d6e02a63c04eada73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639781190, "uuid": "d116e10a-624e-40f5-8fa7-d4325858a697", "value": "49152:9+HSEXjskn6MAZvSM1FHU0MY7Di9o8Mmcoz:EHSisxFZl1ZjMUD18Mm7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639781190, "uuid": "3664fdc8-135d-4bf3-99c1-7f60d036f6a9", "value": 2117120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639781190, "uuid": "93bddc9e-3d1b-49f7-aee9-8041f662e902", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639781190, "uuid": "58a864dd-80c7-4067-ab58-299972df517f", "value": "c614fa76709aaea6922468455d22169a92d2c4c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ff5f1b-5ed4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639702577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639702577, "uuid": "ea27edc8-0a41-4775-9b33-15d9a38235c8", "comment": "Malware payload (RedLineStealer)", "value": "b15604c4cba6d2235223513598e70aba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639702577, "uuid": "6f4c3880-d4b8-4e15-8e44-9ec883f439cf", "comment": "Malware payload (RedLineStealer)", "value": "228c17c9165eb6388eb655efb21420b7fa9d39442a5da7481f11b822651dca47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639702577, "uuid": "b9550c19-e2c4-4dc9-b669-65444e25a701", "comment": "Malware payload (RedLineStealer)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639702577, "uuid": "b3398292-71a5-4309-bd1d-8f1e37998d11", "comment": "Malware payload (RedLineStealer)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639702577, "uuid": "b19bb333-9e64-4a32-ac63-12f7767412bf", "value": 1564616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639702577, "uuid": "166f51ed-0d77-4c8b-b443-471f18195d8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639702577, "uuid": "a73595e4-5fb1-4a1f-8cbb-fe80af836cdb", "value": "b15604c4cba6d2235223513598e70aba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c88505-5ee8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639711336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639711336, "uuid": "cd442f9a-4b01-486c-a48e-be53d96ea2f8", "comment": "Malware payload (Formbook)", "value": "6243123ab66782fe15a75e0a626020db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639711336, "uuid": "62687cb1-53ef-4f28-bc4f-073c2bb42997", "comment": "Malware payload (Formbook)", "value": "24a67748af038fb71279d9494318557036d86026598cdaa8822229221b5eac85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639711336, "uuid": "93ee2b5d-20ba-4b20-a620-5cfdbd37928d", "comment": "Malware payload (Formbook)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639711336, "uuid": "9d211f2f-a1b4-44f6-a111-99ff660019c6", "comment": "Malware payload (Formbook)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639711336, "uuid": "8facc932-c4b8-4edf-8ab8-6e5f1289e4ef", "value": 1147904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639711336, "uuid": "b5399a5c-9e2e-4cea-808d-2864b5a3ed51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639711336, "uuid": "7fe57b24-f1c9-4207-a7e5-f763b3a832d3", "value": "cz7zRfrSCw0uHOt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a633c518-5f5c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639761207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761207, "uuid": "91ccd0b9-e99c-482b-864e-85542769a8fa", "comment": "Malware payload (Mirai)", "value": "30975e150acced09c00cb0237402a000", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761207, "uuid": "d748c3a5-7d11-473a-af76-bc5ee4e44d86", "comment": "Malware payload (Mirai)", "value": "260532bed90009e9153932f6d5524f9828deeb18c9d45f96046458df426b8a82", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761207, "uuid": "6eb4f45c-c9dd-4581-adc4-4b829b8d48a8", "comment": "Malware payload (Mirai)", "value": "db83d9b397bf23ea0815426e08f313f0fb20bd3f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761207, "uuid": "03be211c-4fd3-4d80-b0a7-73203caf0c92", "comment": "Malware payload (Mirai)", "value": "5fb6c747206303526d7ca8224cc3b925c5b362892aec8bd9d671973c3e472907d7f2cdc73b9c834aebb28d300abb5bdf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761207, "uuid": "468a2d31-c14b-43eb-9a4c-2ff9b3dca694", "value": "T11A4319827C81AA39C7D057BBEA9F108E3354ABD9D0DB7347CC140B9176CA51B0D67B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761207, "uuid": "f8e227c7-14e1-40cd-93ef-872b162e46a6", "value": "1536:VX3kcPLAR10ydj/BTLU8GYQ0zYJBb07Nsz2yYceZW8eXvM:VnXPLJ0Rsz2tcwsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639761207, "uuid": "9a2815b8-496c-47db-ae81-e0f570d1db99", "value": 60180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639761207, "uuid": "274ef60a-d5a5-4dc5-8c9d-9809b471bcac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761207, "uuid": "d3b6c14b-e473-40da-a30d-b62d76809588", "value": "pandora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa9db09-5f64-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639764766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639764766, "uuid": "2eb1c96c-2e41-4170-881b-797c4c2d7cad", "comment": "Malware payload (Heodo)", "value": "7ffc8b580689321818b47c53a3faefcc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639764766, "uuid": "76bef759-8ffb-4cc5-8b38-97ba36e4c12d", "comment": "Malware payload (Heodo)", "value": "26099e7fa189669812ed5117ae4f85463505e563eeece64c085bb8d0ff01ea65", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639764766, "uuid": "8724800b-3a4d-40bf-81ef-2678c0293138", "comment": "Malware payload (Heodo)", "value": "ea57ba3db0f0c774e6acb6e25a72dfdda5ec2607", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639764766, "uuid": "0ed6568c-0054-4735-b76d-ad0139b93f3e", "comment": "Malware payload (Heodo)", "value": "e4698cbb555639d9973a2ef4a89d3bdfac10108b0e148e324d6fe93bcc04d66b962cfb89daffd1df83974541ab009a34", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639764766, "uuid": "164fb081-4445-449b-92fe-aa4045aabe0a", "value": "T16BE48D5172C1C036C16E3171492AA37926DDBE708EB9869B6ED42A7F2F740C29D3871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639764766, "uuid": "30d6923d-625d-4d4d-a38f-8d9b3b8fb005", "value": "cb788e621f390567a1ec94b8d2369e89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639764766, "uuid": "6493ab0c-ce2f-485f-8a02-ee3233399e7f", "value": "12288:ZLqntrsKNni3jR34UrmTMQFQIBl+5UZF/imMG:Z2trTZwF34LTkZkom5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639764766, "uuid": "762fe9c1-b528-4e0f-b8f0-ed8e4bc4dae9", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639764766, "uuid": "cda29c3a-67ec-48c0-918b-3998df1ba8bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639764766, "uuid": "572cb9cf-4a65-432d-b02a-654d9f595623", "value": "emotet_exe_e5_0e97059a25d9b4e7835814386627e8570074969e81058690204c2550faf32972_2021-12-17__181241.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf596ad0-5f4a-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639753518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753518, "uuid": "76bc1aee-2cdc-41c0-8e75-1e1dfdff4411", "comment": "Malware payload (Smoke Loader)", "value": "f29f5339698c2df6f7aff9c34e974d23", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753518, "uuid": "e12a3d0e-762b-4baf-886a-c961322050d7", "comment": "Malware payload (Smoke Loader)", "value": "2613f2b5d02ac8a33b7498be36f7f31ec7c7726d8c77cefbcf7aa6f194262324", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753518, "uuid": "91fc333f-38e8-456d-820e-15cb38373768", "comment": "Malware payload (Smoke Loader)", "value": "6e6ca974d0642ea978aeda421e732ba13f01a0a1", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753518, "uuid": "bca4444f-0eeb-42d4-8507-10b3839781dd", "comment": "Malware payload (Smoke Loader)", "value": "4c7ed15a013e6cf11d1bb29a25e310c024bba273a579528de3b208b380e3209f690c59373d1f44cd6f78d30cbe0466be", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753518, "uuid": "7716e41f-c069-4a56-8036-0741350f0e09", "value": "T1E5F3AE3139DCE472C5A7067144A49AA79E7EF8211621D58B2F68066E1F70ECC8FF235E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753518, "uuid": "b24dbd33-83d0-42a1-ac15-21feae67efee", "value": "995d859dc5c5cdfbe9d72008a77e5890", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753518, "uuid": "45daa62f-74f2-4825-a5c7-7aa77117843f", "value": "3072:aaLoSDn55VhDYTYqdhqNkkZWrxpzbgqruIaPbB:aaLP55VhETfhUZuzbgwuzTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639753518, "uuid": "b31297d1-cd81-4116-9828-f182b52f4f1d", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639753518, "uuid": "14c9ee61-3573-4b61-8514-f28b60023c43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753518, "uuid": "f9dd9fb1-fb08-4e77-a5b4-61917e97eecc", "value": "f29f5339698c2df6f7aff9c34e974d23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a508618-5f3a-11ec-9275-42010a9c0029", "comment": "Malware payload (Tsunami)", "timestamp": 1639746423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746423, "uuid": "3da47a10-6f3c-4b26-a713-635a31ad61c4", "comment": "Malware payload (Tsunami)", "value": "dcffb04aa4ccf54137c0ac921e181afd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746423, "uuid": "91cb28c7-f248-4206-bd24-30bc0efe0443", "comment": "Malware payload (Tsunami)", "value": "2752deb9f9f9602ca0c7bd41c3171d1560b929b6a4221ab07b0bf872d042f7e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746423, "uuid": "b69a2510-fd7c-4cb6-b3f2-6c51e0ab9913", "comment": "Malware payload (Tsunami)", "value": "4dafb50d1de86068915ed71dcc97f5ccc78f6123", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746423, "uuid": "5dda61ee-bd39-44d3-99bc-0d97eae50bd1", "comment": "Malware payload (Tsunami)", "value": "0a4f9b0a74f0941d82229dfa3979bf941e20f3a9fd799e67bf51b4d7b12040f3a91bb86a4a461a82603e0042d8d8c406", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746423, "uuid": "0f59762d-d685-4169-91cf-a87f34a88609", "value": "T19C33F19FFFE728CDF0A156165BB39864E354662EAF06153039E0799E2EEB400563F84C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746423, "uuid": "cca0de1a-3764-48ac-948f-a004bdeca73e", "value": "1536:H6UKrwtboTokvNm3brUvT0meUQ0qe+atSwLJUaZlmz7/0:rKrlkkvNm340meS+atSwFUL7/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639746423, "uuid": "905629dc-357c-4240-98d8-a874273616e5", "value": 52372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639746423, "uuid": "8470a874-07bb-45aa-b475-ac18b3e21730", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746423, "uuid": "1268a4c2-10d2-4093-8eff-a127610b20af", "value": "dcffb04aa4ccf54137c0ac921e181afd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe2d91b-5f09-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639725649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725649, "uuid": "99c62776-55be-4d97-aa06-1d2899c62ec0", "comment": "Malware payload (RedLineStealer)", "value": "988b225b0c0d01670ab5785e4f31faac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725649, "uuid": "81b12379-78ea-42cb-a12d-d6a7618d6d3b", "comment": "Malware payload (RedLineStealer)", "value": "27ed8bb109d54613c4b139f3c7034ee27760ca27b2ca30d6ac91ea68e1c0d265", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725649, "uuid": "2e07cd6c-5c9b-4dac-a551-a4e55da3db89", "comment": "Malware payload (RedLineStealer)", "value": "6470d62519dc04f747f15498c6ce4334e6d75989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725649, "uuid": "d369b548-8686-410f-8970-b182eadad536", "comment": "Malware payload (RedLineStealer)", "value": "7797a9f32b478057398ef4b66cb73547701233d4abf4ec34bf1a1909e63e09aa6d79fb9ade8c90e0c2d58dbcf7e3e319", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725649, "uuid": "eab5c749-19fb-4098-8981-994381447389", "value": "T1E7841242F3E15435E073CEB05CA0E961497F79614DBC650836ECAD8F9F3BA829296783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725649, "uuid": "9116d7e0-bcc3-4877-8fc0-4708593e15cf", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725649, "uuid": "b5baadd6-38ca-48d7-8117-4524b6e9dea4", "value": "6144:x/QiQXC+km+ksmpk3U9j0ICVOGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZoglM7LT:pQi3+P6m6UR0ICVlL//plmW9bTXeVhD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639725649, "uuid": "c83ddeb7-bc5a-45f7-a1e8-450840e16621", "value": 390400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639725649, "uuid": "1b241f6d-08a2-4fa5-9c88-7decb99e4df4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725649, "uuid": "a378580d-1a69-4f55-a6ef-cd885f6a6080", "value": "988b225b0c0d01670ab5785e4f31faac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803210f8-5f07-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639724636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724636, "uuid": "ab59815f-945c-4430-92e5-5ecbbf83c8d7", "comment": "Malware payload (AgentTesla)", "value": "07a88c73fb241e8d78976306da0591c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724636, "uuid": "5c2ac62a-a702-4a89-82d9-4fd554cbf45e", "comment": "Malware payload (AgentTesla)", "value": "28cf0f22e17b87ce8e0fb4ca23a2eb0781c71219877cd28a6013ccefec6860e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724636, "uuid": "365758bc-c19a-40f2-a177-3658ebdd1545", "comment": "Malware payload (AgentTesla)", "value": "159abc2238423ba688485de348e8db18bbed4dd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724636, "uuid": "f50ecd6b-bd32-4061-b78b-0075f9ff0f51", "comment": "Malware payload (AgentTesla)", "value": "44a0d049687741d6f4aa7ac0a5500fbfbf56d67ccffe0e1385cdfc103f6f8ddc912a55e6bf4b8e51c6734cb2845721bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639724636, "uuid": "32a137e7-3a53-44e3-ac9b-3eec63250b69", "value": "T11B4423F12BF9F5ECE520D6A6D765070DF86A42EE64F8A44BDCDC82C92104E05ED849E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639724636, "uuid": "52339949-f920-4069-9062-5001273f110b", "value": "6144:ht3jWk8u/YxFneIfmDXXcGjHXr5JbU/A7rhbHHmwyjDV:OkXYfeIfmDXXVXC6hjHm5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639724636, "uuid": "b35d5b70-87ed-4e50-9e54-d07ddee54f2f", "value": 277222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639724636, "uuid": "2b20d1e9-eaed-49b7-b2ab-5dd136ecddbd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639724636, "uuid": "e937ea84-0a51-4d48-808f-e731618f496e", "value": "order_view.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bec09b9-5f0c-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639726588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726588, "uuid": "ab5f7926-f2ad-4c0d-82fb-d77480ba3d4c", "comment": "Malware payload (RaccoonStealer)", "value": "eb8e3ebeda81964df31aaa6b89834231", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726588, "uuid": "4cf10e24-ab52-4448-a25c-4e1192e5592d", "comment": "Malware payload (RaccoonStealer)", "value": "291291aa7c2cf88e2da3b71215e087be98d8e738a8d93194f9c2e9a7b77cafc5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726588, "uuid": "977ad5ef-6af4-4c90-8330-ce24115f7558", "comment": "Malware payload (RaccoonStealer)", "value": "f53b677bfc1dbfa5d194efdc2717a72c424a13a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726588, "uuid": "04cb449d-064b-4c7a-999e-4cd349020689", "comment": "Malware payload (RaccoonStealer)", "value": "e3f36b1b0b0d9f9357fbc84a3f9a0cefc6e4ce0f6dd169b6c144b54c3aca2ad2b19f4537427d1b1b28b18da94b318ecf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726588, "uuid": "ceac68b1-c18f-4b7f-8600-c53b25d85ace", "value": "T114C4F100B7B0C035F1B753F5597997ADA92E79A26F3891CF22C112EA96356E0EC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726588, "uuid": "d7cfab16-c137-42da-82c3-6b74c8436fa6", "value": "b0c21572f86ead69c6a60f10f7681037", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726588, "uuid": "2c61f51b-d2d7-482c-9137-11a0c62322b4", "value": "12288:225QTKpHuVzpTzrk185YxkLT4Bdfvk20RhpmVWONFSdurM:2x4OVzdvkpxkLkD0pp1OOdOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639726588, "uuid": "8d2622cb-1766-489e-9579-f2f780a05837", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639726588, "uuid": "897db40f-df94-43e7-b7aa-054d6f8c1ff6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726588, "uuid": "2d59e411-35b9-4452-94b9-230670311d3a", "value": "eb8e3ebeda81964df31aaa6b89834231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae321de4-5ecf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639700661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639700661, "uuid": "eab13674-70b0-451f-89d8-5ca987af20f8", "comment": "Malware payload", "value": "6d9d5846b5645ab91f1afe425443afdd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639700661, "uuid": "346257db-e19b-417c-90ad-2a71ee98e305", "comment": "Malware payload", "value": "2a640c29784cbbd0596f891d0441ca6eee93df6fac2099458d119cceeaa319cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639700661, "uuid": "95da0c54-44d7-4fe0-a40f-5dbae83db56f", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639700661, "uuid": "02956aa5-c51a-4b8c-b090-a6a02d499632", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639700661, "uuid": "f628805d-1ee0-4965-bcc1-31d6af477bfc", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639700661, "uuid": "25599214-1a81-4f61-8e5f-ba0ab16b0252", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639700661, "uuid": "9a879327-e3a8-4b05-9496-89c5098dff67", "value": "6d9d5846b5645ab91f1afe425443afdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e830d5-5f87-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639779725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779725, "uuid": "c12a459b-829f-4dbb-8855-adf6b1d3c9b4", "comment": "Malware payload", "value": "d4886eaaba8098359b70d264487b550c", "object_relation": "md5", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779725, "uuid": "8f8d4f0c-8577-4cb8-a0a4-4cd7e84d3460", "comment": "Malware payload", "value": "2ae9bc0c743b08c02a4a3b17f3d005e746a965cf1233f8ada31a3903c3021a7a", "object_relation": "sha256", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779725, "uuid": "1f5794b9-b71c-4575-bf27-29f5973c382c", "comment": "Malware payload", "value": "d4e44d49440c37d6b542e01827c76913697e14c2", "object_relation": "sha1", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779725, "uuid": "334f74d0-63d8-4a3c-b2fe-b16aa9efea89", "comment": "Malware payload", "value": "43c7a7f6f157ca949a242829b2953f7c31ea6243fb4e7c870eb543f37d1aff294d10a4f333780418e6476638c4018fd5", "object_relation": "sha3-384", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779725, "uuid": "d057190f-ea4e-47a5-b3ef-6333b36f47cb", "value": "T1DAB4B023F7D084B2D2632638EC3B96549835BE503F29595B2BE81E4D4F393C13A79293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779725, "uuid": "ef341044-d7a8-4f7d-9bb2-23a0750b02c4", "value": "3bc2da3d4673e65a1c8ca0ad8e590000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779725, "uuid": "775bca6c-3a4d-48d0-94fc-630e3a3064c5", "value": "12288:AOeA9hqg7bnNIBR8Tmnogc0PEO2ToKV8AFC17X:fR9hPbeBsmn7sp8KVE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639779725, "uuid": "941f9326-b233-414f-84e7-ee26b7d04a71", "value": 525111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639779725, "uuid": "c5a66e9e-db59-43c2-a152-1dfd1bdee869", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779725, "uuid": "8e150141-c166-44d5-82c7-b8e10a41cf19", "value": "2ae9bc0c743b08c02a4a3b17f3d005e746a965cf1233f8ada31a3903c3021a7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5b08ad-5f34-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639743881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639743881, "uuid": "0e305b6d-4a69-4884-ad50-857ee889caa9", "comment": "Malware payload (AgentTesla)", "value": "852906c79032d30f5417cd101e01c26e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639743881, "uuid": "85c8c0ce-39e8-4b3f-a023-343aa901c4a3", "comment": "Malware payload (AgentTesla)", "value": "2c334e2291aba7ecd62c89d340622d0a3d0d5589b975c9585bb571b169dd77ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639743881, "uuid": "da5f9dd8-6837-4461-93e3-4cba36f12dc8", "comment": "Malware payload (AgentTesla)", "value": "440c79a441c49ec97418e9c0100c3336ce73b265", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639743881, "uuid": "83af36af-779b-4d8c-8c0c-a705a2aa3172", "comment": "Malware payload (AgentTesla)", "value": "9f41998ac02dc8dd09fd3cc77208f76e4038af1fdd9550297e0401b2490754bc7bbe7041b40f0a2c4f424febcc37fab5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639743881, "uuid": "929a2eb8-b5c2-4645-a73c-59d88c652cbc", "value": "T197B4129066B0EAADD2790BF651BD55C18BF023516622CF4B0D4AA2DFC8227D41F12BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639743881, "uuid": "3bb6a336-1225-4455-bfaf-092dd3636dfe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639743881, "uuid": "b0a17057-caa8-4497-86a6-d98f86b79892", "value": "12288:mDKXbVi4wqVjWn2vkBCQw4LXxVvjaAr4fQfkSDEuSK3vkmyyy1pWy:yDTPn2vkrdxt5MfQxfSK3vkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639743881, "uuid": "ccb75164-66d5-433c-a371-c30c3e9b0ef5", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639743881, "uuid": "bcbd2f70-b5ba-4250-84dd-6d99193efb92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639743881, "uuid": "a2cf3afb-6093-4beb-88b0-f114708e5191", "value": "vxAGW9VKCruxcLB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8d1f6a-5f15-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639730480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639730480, "uuid": "9324cd80-a4f6-4044-85ff-136659b96a98", "comment": "Malware payload (AgentTesla)", "value": "33aee4d2de55d66808b23e3cd5934673", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639730480, "uuid": "47ed8d2f-fea2-4310-a313-41a9abec6841", "comment": "Malware payload (AgentTesla)", "value": "2cbb501cabc985c66948d92e90e87b33a4e000cac32260651f45b828a90a7dfd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639730480, "uuid": "6bcbc99c-c28e-4c52-b6c4-2212e09a50f3", "comment": "Malware payload (AgentTesla)", "value": "f5d281d1d39a34e4fd06b57e729c786ce2c7e377", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639730480, "uuid": "e348578c-b61f-44f2-bbb5-194e7fc50937", "comment": "Malware payload (AgentTesla)", "value": "85247b8434a63a68425a39fd046cf25c4dcea31010bb52baf78751f5bcb21b288aea5e2807c69ea18a7419d7458b66dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639730480, "uuid": "4669ebb3-21c1-4881-a96d-b1ffde6736a2", "value": "T1EEB412A4A1B4DB6BC56A07FB243550C08BF023917317CF0B1D9EA5DB86623D64A227DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639730480, "uuid": "ce3abe52-d56f-477c-8285-b0ff08800afb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639730480, "uuid": "170b4614-2ec1-41a5-aa3d-5ee07618168f", "value": "12288:VFryoWD0CE2Ul+V3BN7jRRuKHC7epEvhLwRyvuSK3vkmyyy1pWy:VFryoWDpE/EV3BhNRuKHuGEvORyWSK3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639730480, "uuid": "1b68aa48-0809-499e-8cde-4614c1efb25a", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639730480, "uuid": "504d3135-a5cf-400a-b80f-e499b149619f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639730480, "uuid": "9690d42e-6917-4077-98cd-330b0b134591", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.12371.16337.29185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b447aa-5ef4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639716347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639716347, "uuid": "67dd5a91-dd4b-4b9f-9444-67d1ce73cd74", "comment": "Malware payload (RedLineStealer)", "value": "acaff783beb08c00cdf45c825864775d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639716347, "uuid": "c543417b-5802-4d1a-963a-2eefc1ce1c12", "comment": "Malware payload (RedLineStealer)", "value": "2d1ddc92e6610aa51aa1c3c83fb60d8000e98dc2b5f5fa52674ebfb81be3664e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639716347, "uuid": "2f82541a-beb8-4ae0-8a57-7772fbd0e15f", "comment": "Malware payload (RedLineStealer)", "value": "e0a615440d9d8e1e0746574bc83ec337f8665a61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639716347, "uuid": "a4fcb559-2e3c-4faa-b999-d53561a1862b", "comment": "Malware payload (RedLineStealer)", "value": "d74f624635f53a9636079db8b65cfcc9341bfb8a2218c0848fca8fcf87896c6fc574fa0756558a45938185eda772306f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639716347, "uuid": "6a382522-aee6-4b89-9d0d-a205cd4b778d", "value": "T1D125BF02A3F84129F6F77F357EB466A54ABB7CA2BD38D29E0261049C0875B90D970737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639716347, "uuid": "90d9037f-d7b1-4ba7-b9b6-1ade243ded49", "value": "0ebb3c09b06b1666d307952e824c8697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639716347, "uuid": "9f91ae9b-f2ca-4bcd-b6d0-ecb19289ca29", "value": "24576:BeyvWDPuN8klcZE6noUvkYtctsL61pubim:wRuN8klcqestAQpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639716347, "uuid": "3b43fa57-5588-4cf1-9a0e-95da8e7f4036", "value": 1036800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639716347, "uuid": "9e29903e-0ca0-4aea-9ef8-14d303687495", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639716347, "uuid": "42f3cb1b-702d-4725-9fd4-d86e4d40c0bf", "value": "acaff783beb08c00cdf45c825864775d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2959f27f-5ef2-11ec-9275-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639715471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639715471, "uuid": "6da95da4-79bc-40cc-b804-e3943e1f1ac0", "comment": "Malware payload (Dridex)", "value": "abf29864d4601a7106d37160217bf5d4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639715471, "uuid": "2b5a391a-e50b-4cd0-a145-9ed60d9dc980", "comment": "Malware payload (Dridex)", "value": "2da4bed861ca469094691ec2fe93b0d193873e9078004a7289002fd99c81c743", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639715471, "uuid": "2274f58f-d364-4ac6-b852-91bf3c0ed47e", "comment": "Malware payload (Dridex)", "value": "cdc99cfc807113d7bdd9e3bee9f6cd5f24340f07", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639715471, "uuid": "2611343f-ff78-464a-8546-9504f33c1d39", "comment": "Malware payload (Dridex)", "value": "8398ab7557bf258e1520b81cba311ebe56fe414c169822d55e9e5db66cf9c6fe912795c7e6016c1f18d4919a69021ac5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639715471, "uuid": "6b1b1c3c-dbae-4244-bdeb-8e0cb84e98df", "value": "T143B4AFE5008B1341E65717BB56925E1FE5269CAE6961FF03F808FA3F702CA68F970706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639715471, "uuid": "5aa17265-3e33-4547-882d-124f1a38de02", "value": "52e2fdaab9e6e0c66f8ede7c1e947cfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639715471, "uuid": "50059e70-7444-4d43-a593-0e2e0d4e4afa", "value": "12288:qBuO7BnvXnZJ1jNPRfQISExuQlQPA/LG1nbKig1GbaJBhfSQYm9Q7JijTp9A9B2/:jQQISEzV/LG1nbKig1GbaJBhfSQYm9Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639715471, "uuid": "0723e51c-3917-4097-b369-c427880ac2b3", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639715471, "uuid": "d743fd4e-319a-4563-889d-657be78113ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639715471, "uuid": "8a3218c2-da82-4464-9168-ba6b0514ba45", "value": "SecuriteInfo.com.Variant.Zusy.410517.9250.14344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e228796-5f3d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639747718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639747718, "uuid": "99e36a6b-e977-49de-9d8e-a1af61016075", "comment": "Malware payload (Formbook)", "value": "836fd0706b4fa9686c86e18abba6e3bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639747718, "uuid": "3bf46d63-3686-4c41-aa6c-d575cfd11322", "comment": "Malware payload (Formbook)", "value": "2e54280103beef8041f877d01e3bfaa15ea5228558bf59b5ee7db10266e37489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639747718, "uuid": "e084c9ac-ed97-4be5-950b-b83fee11af3f", "comment": "Malware payload (Formbook)", "value": "294ede9653d588ad8028ac53af16862d8101fc22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639747718, "uuid": "55aa66e2-7514-403a-a44a-7914e6e7e3c9", "comment": "Malware payload (Formbook)", "value": "4310893cd4cb5e473aabad5fe17878f01cc5bef2c3e1a93e9c7197331dad9cb12cbdfb9594088227099ded8503c7a0ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639747718, "uuid": "87b5cf9f-8f73-4664-a052-b4c438a0106b", "value": "T121941244A3F4DE99D43E07FA103894C5DBF0A6B22663DF8B0C8995DB49723990E11BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639747718, "uuid": "311745d4-56b3-4943-9162-e2e11fd984fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639747718, "uuid": "1cab462e-dfcb-4abd-b8d1-6b4506ec0af2", "value": "12288:aTM117dmM73HDEjBzhY7VLka1vAGxRtkuSK3vkmyyy1pWy:EM11NSc7VLksdSK3vkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639747718, "uuid": "531ab63a-8f45-40ee-8e20-00cd44766b3d", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639747718, "uuid": "935c6835-fbea-4329-bf9a-1cb8503bbf77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639747718, "uuid": "78dd3378-9e1c-48b8-bfd8-a03ff4960c3d", "value": "1Dq7tspBV2OL5mb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d718e20-5f7d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639775151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775151, "uuid": "432e864d-3fb2-456d-adf1-973f377d77e3", "comment": "Malware payload (RedLineStealer)", "value": "762ec9cb1454d2128653287da64cf53d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775151, "uuid": "ec99cca0-4eed-4317-9b88-268f41834dcd", "comment": "Malware payload (RedLineStealer)", "value": "30ea2b66243b336c8c371b34d6588a3c5d08eb5eda6334342c5164098d900a60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775151, "uuid": "e6601b8a-b851-4c24-86be-fa11cc280e5f", "comment": "Malware payload (RedLineStealer)", "value": "17fa42e70d7779e857c66e2ca121d892ffea4ebb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775151, "uuid": "d077a2b3-f87c-4adc-879d-fe1b78bf9ab1", "comment": "Malware payload (RedLineStealer)", "value": "6aeb821d74faf192a16bfa64e5c3ceddb0094d1ad948d9fd37025aec1e1094538e222118f4dd03282a7501e883b15e5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775151, "uuid": "61f7c99c-56ab-43d2-acec-fcbf436ce93e", "value": "T1EDC4D6283AFB5019F2B3AF759BE475A69A6FF7633703A45E2050034A4B13A80DDD163D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775151, "uuid": "1b7f319a-71d3-48e2-9cd6-d7691046b461", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775151, "uuid": "63036f99-ab64-472a-9e47-7e14a8a14e50", "value": "12288:2BmbvFBCTV8tXeLbg8uC++7g2Afq5pnFvSE5BQHh36f0SNKe1J0:2BK+VCeLVDYGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639775151, "uuid": "f3f589f7-690c-45d1-bd64-ab21f37e1ebd", "value": 543232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639775151, "uuid": "b853906f-dffe-4848-984f-70048d2a680e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775151, "uuid": "e7d9302f-cd4e-4630-aed5-3d0254e1a0af", "value": "762ec9cb1454d2128653287da64cf53d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bcedee-5f19-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639732540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732540, "uuid": "0f47014e-c5d1-4047-8942-704ea4f3d1ae", "comment": "Malware payload", "value": "0bbc19eba9b81408500b3a530e42cbaa", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732540, "uuid": "c84f46df-bca8-44ab-9f51-12d88671af82", "comment": "Malware payload", "value": "30ea39f0326b125eb1c5f4607f0a4e3af8196f4104ba96ae7219fcaa1688cf20", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732540, "uuid": "708d7bb4-7dfa-47cd-a54c-aac56787352c", "comment": "Malware payload", "value": "f9dff9f81d61268576cf0f3d89fb7b26a442662c", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732540, "uuid": "e9a07908-db6e-4047-b083-dcde9e15ad85", "comment": "Malware payload", "value": "445cd8acc93efad40439b330f7252a7b116763fd68ac59c57d8480378c0ee16f5afded850df109a8f2ceb5a86d8073fa", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732540, "uuid": "a1c7747e-5380-4778-a472-b71f865fc209", "value": "T10B64232134A997DAEB336B380E884751DA61DD0FD7AE268A9DC33F550CBF6C49104B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732540, "uuid": "b11f7f53-5964-49ab-9690-ec91b5804e91", "value": "6144:Uzqz5AxaOgC7LaEBYo75oYCKmLnotvS3DEmY/b2gAE5QUz3D6ck6V5VS/:6qzWxuWp31xCKWotvS34mYKPCnc6Vzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639732540, "uuid": "137a66fb-c9d8-4ee2-b20a-cf17e9af8554", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639732540, "uuid": "dff86cff-70ac-4caa-a8c6-ad8539269016", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732540, "uuid": "0c1c4b9d-fdd1-4624-a2a2-d0cfeca5aaa3", "value": "bank slip USD (134,169.49).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce023d3-5f3b-11ec-9275-42010a9c0029", "comment": "Malware payload (Tsunami)", "timestamp": 1639746830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746830, "uuid": "c6ff93ca-a1ec-4638-901a-7e10707b31ce", "comment": "Malware payload (Tsunami)", "value": "6f3885eee3668bafbefefd2eb17f4105", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746830, "uuid": "ade6da0e-bde8-46ff-a802-731c9f4a2ab0", "comment": "Malware payload (Tsunami)", "value": "33dd6c0af99455a0ca3908c0117e16a513b39fabbf9c52ba24c7b09226ad8626", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746830, "uuid": "55b737d2-edd3-4baa-b55e-f2ba1b950e4c", "comment": "Malware payload (Tsunami)", "value": "12dff86ffceaa394adbd9355e3affe7730b34fa5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746830, "uuid": "6f44a6c7-3284-4db5-863e-0db71392eab9", "comment": "Malware payload (Tsunami)", "value": "6024a258e5554bc20be834e3613008eade9696b2c8e40a8626620daf81f52d2489543173631ba8ac0d13500bb7b87986", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746830, "uuid": "6e93bf09-baac-4fb7-be42-0430fcac4834", "value": "T1D74301085C2ADDA8F51F46337AF5D95ED51D2A906B0EF0311AF63C6E2CB862867C4B02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746830, "uuid": "6a7221d9-3700-4873-a18e-afa680f765e9", "value": "1536:Wavb41TzBL/jinSTMTFSqV9NxeZpu58wokaAx5tHf69:Xb4PLngTFSuVem7ok/xrHfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639746830, "uuid": "2b21878d-3d1d-423c-ba3b-caf09c7b6a43", "value": 56040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639746830, "uuid": "f71b7159-220f-493c-ac1a-d31828299a17", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746830, "uuid": "ed40000b-a0d6-4186-a836-147f583b3f8e", "value": "6f3885eee3668bafbefefd2eb17f4105", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bbed3b0-5f1c-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639733567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733567, "uuid": "8a112b00-25d3-4542-991a-89d10a5a5ff6", "comment": "Malware payload (Smoke Loader)", "value": "14240914a71732c252930bd99eda9826", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733567, "uuid": "d1580c59-f2d0-4885-833c-99ef30aaf2a4", "comment": "Malware payload (Smoke Loader)", "value": "33e30423aa49be107686f0ee537128f8cd5e30ab0f3dc5c543df8e34aa440067", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733567, "uuid": "26a7ea06-6a5f-4a1d-ac49-d599acf8f372", "comment": "Malware payload (Smoke Loader)", "value": "1e1c359f425e8d1a9b5f887912a0d46b4cd55a19", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733567, "uuid": "10111f2e-dfc4-462e-931f-f6d3936ff1a0", "comment": "Malware payload (Smoke Loader)", "value": "a799d6a58fb897f11c8c11289dea3ca6c66ca46be77236c278cdd6f571a1c3ecf24cfc73b2f311eb4b3d1b3993379b02", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639733567, "uuid": "1fe76ae0-3ba7-479c-9ab3-5b1c220ea340", "value": "T198059D35E8A0240BDD4F41F6FB6F85B8BD895C828B4D51C71938EA6B04361E4CAF3E46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639733567, "uuid": "afb3c09c-d5c4-4a74-a897-10aaa3275b53", "value": "29bb2b820bd51f2a76eb33c8ccd7f75d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639733567, "uuid": "d6bfba52-dad1-4099-882f-39423e87be20", "value": "6144:LVlpUCNatSGhLMWgSSc4sIGmiSP2Re8J2xiSP2Re8J2xiSP2Re8J2xiSP2Re8J2:5lpUCNnyLMWglcwwk8k8k8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639733567, "uuid": "d63137a5-6c62-45ea-b3c9-47de06ec5d19", "value": 802712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639733567, "uuid": "050e8dc3-5848-4dd0-8f54-5a632e7b7f05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639733567, "uuid": "2db254fe-ee64-471c-90aa-570678195301", "value": "DF734289KT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58ae988-5f4a-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639753501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753501, "uuid": "57ad229d-5fd0-4e03-9a48-6433982fbe8c", "comment": "Malware payload (ArkeiStealer)", "value": "b462bb5d796314c55034e08f8a901d78", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753501, "uuid": "fc94d50a-f2c7-45f6-b932-dbe43f10ac7d", "comment": "Malware payload (ArkeiStealer)", "value": "362c8347fd281146c64e7221416a5d09c516d4196d8f8eca9508965dcbbbb140", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753501, "uuid": "899919fb-5e3e-45de-977c-0439208ebaf0", "comment": "Malware payload (ArkeiStealer)", "value": "a2b36b57e4a7151f7dcd46d94b8a1aa4da59d429", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753501, "uuid": "aca80c76-5991-4163-814e-df9626769382", "comment": "Malware payload (ArkeiStealer)", "value": "2085b318b356e0bd75fb1e100ef876e82aef540a970f15125a71621c5f25d533af9b55eee2192f1696caa1d69a5053af", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753501, "uuid": "ae58123b-a891-4932-a3af-721c750ff4fc", "value": "T1F914C03934EEC1B6C5A3597048F0AAE05E7EF8215722D14B2768076E1F70E9D4AF631E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753501, "uuid": "da62149b-e74c-4872-b034-12e11f02b77d", "value": "995d859dc5c5cdfbe9d72008a77e5890", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753501, "uuid": "75854a3b-aee2-4a30-a517-6a9ee31b96c4", "value": "3072:V+LC1rEleGi78KXizHaN0ayD27Mbyjxxhh/Ud8kkmZWrxpzbgqruc+hqe5TbB:V+LnYGi78KO6N0q7MqnMmSuzbgwuck5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639753501, "uuid": "033a8707-bceb-4b55-b1a9-63d06b15cec6", "value": 193536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639753501, "uuid": "c07ec798-45fb-436c-b03e-99e9fe279a2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753501, "uuid": "857e6b55-a31b-4f0f-a60c-a0e339209f0a", "value": "b462bb5d796314c55034e08f8a901d78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c1d36d-5ed3-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639702343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639702343, "uuid": "faf96026-786e-440e-9158-b624be530d2d", "comment": "Malware payload (ArkeiStealer)", "value": "c25da77f11f69e69f72581df172966e6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639702343, "uuid": "0f77c20d-aa36-4d10-a349-924065847a2f", "comment": "Malware payload (ArkeiStealer)", "value": "368ea54781683681c17940b0aed1465ddc704966bf0963658efc89d6b5265674", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639702343, "uuid": "ed7bbf03-7008-437c-960d-d06ee907f36f", "comment": "Malware payload (ArkeiStealer)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639702343, "uuid": "6757905c-7a00-4a14-be9c-36a6218971c6", "comment": "Malware payload (ArkeiStealer)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639702343, "uuid": "3693fc3a-ae29-4c6f-9fc7-33287eb9c75e", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639702343, "uuid": "be72cf96-8743-42d8-8f85-0c5efcacae0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639702343, "uuid": "680f0217-662e-4fbd-afe7-9a94bfa87846", "value": "SecuriteInfo.com.W32.AIDetect.malware1.32671.16483", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df53659-5f78-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639773004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773004, "uuid": "26ef5d6c-bbb2-46e3-b4b1-886c726d4200", "comment": "Malware payload", "value": "5a4a2858020245c026a2f205c3245788", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773004, "uuid": "d3d37cbf-d03b-4582-80e9-a4f72d6bb18c", "comment": "Malware payload", "value": "36a3c62f71e26d1985b8a67ebb4f476ed9c3df8d6378d7c3dc84c0e06c61089a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773004, "uuid": "b5f00c94-2199-4acb-9e3c-d8d4f1b30e11", "comment": "Malware payload", "value": "b0d97e94b67a75f7a81d521e2751158b2d23179d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773004, "uuid": "fcf0b2e0-a678-4d5d-adbd-4ec62c3a9901", "comment": "Malware payload", "value": "e2c1e706c0a32c65f2985df6f3112920f07d795926f941fc524680db16088fe927ee105e1f03c41a8033b70dd32bd2f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773004, "uuid": "fff2b264-2f7e-4fc3-bb0c-d9fe5588e7f6", "value": "T18635BE26B7A7AF98E57E0B38853505A487F5AC02B321DA9F3FD971CD1931B05C633A12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773004, "uuid": "c37779d7-7af0-46da-8b7a-b020d42b78ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773004, "uuid": "a4ad0253-e4ac-4697-8b6f-d3c849cb2a8e", "value": "24576:c38Qxl7pzD2IzYyxvYB4BlgC+/b5AAPEm08TiDjnK:TQf1zCKYUgC+z5fP30siv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639773004, "uuid": "378e104f-2534-4ff8-b9b1-ecb7474fc645", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639773004, "uuid": "8397c30b-f8c6-4e39-873d-f6eadb27fa8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773004, "uuid": "6eb8d052-7a2e-4e56-b185-2b0192a7f703", "value": "JKM~0009879-445789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d097cf78-5f72-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639770727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639770727, "uuid": "4b9848e7-2637-4682-a95f-793a741f1cda", "comment": "Malware payload (Formbook)", "value": "f7874377ad02924a56d4e9d56c7c9fbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639770727, "uuid": "9d55874c-554b-4562-892b-a4d63f73ec3c", "comment": "Malware payload (Formbook)", "value": "37012511b7fa7d4628f1de46e1bc40115450a8375014446f60c31c59c5e5da94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639770727, "uuid": "2dd30d5c-f5f0-42fe-84e4-51524d309611", "comment": "Malware payload (Formbook)", "value": "fa021f73cd33ef36257851564093969b20544a6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639770727, "uuid": "f86b69fa-8124-4fbd-8a92-e365d55b898c", "comment": "Malware payload (Formbook)", "value": "8fe5bdd60b6fe7f2a6ee44470c381f13b6b4068724c1b3d923311656d524ffbd59cf93538737e2aba8427c77583091d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639770727, "uuid": "113ba37d-a03a-476c-bdfc-ae941286a3f4", "value": "T1D7A42384B9C28617C9B92EB509F79774D3F7C24063C51A571BF06FEAAF408E31A1B621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639770727, "uuid": "b696bc5e-b104-4c3e-a2b1-ca1be83d537d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639770727, "uuid": "ddca134b-bb22-49b8-9880-b01fd61aa9c6", "value": "12288:hU+/oRxad0bqy/cO3kINNoJpSfepsXAe1DivCISkDLM:hx/3d0bV/KSoyGDe1GvOeLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639770727, "uuid": "e07375ed-781d-4cff-a641-5b4d200d3a4c", "value": 471517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639770727, "uuid": "5c060a99-57c5-4425-8aa2-4efc32d1a19a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639770727, "uuid": "c86b633f-1565-42c7-aa65-cd4dd20149f6", "value": "Scan_doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc121cc0-5f4b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639753942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753942, "uuid": "9455ee89-c4b7-49d1-8036-59099c9e2dfc", "comment": "Malware payload (Formbook)", "value": "8a3a84eb4aeb564a436d199f7e18ada2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753942, "uuid": "32ab5669-8957-443a-8739-c994dbb38c82", "comment": "Malware payload (Formbook)", "value": "3744267b8221b370ef4c3d1c75959e90f832a40473f3212de045c708fd11aff4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753942, "uuid": "aa9c656d-ee0b-40da-8793-deea0bc12b90", "comment": "Malware payload (Formbook)", "value": "2e156dfb4b6795dd845b2f4e8529c8c5d53d49bc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753942, "uuid": "6e54e499-da7d-4f21-b4ba-87a2fdd9232f", "comment": "Malware payload (Formbook)", "value": "626db511b9efecabf05bec05c8ad980bd1a94ad4163cdecc1b80ad48e22229361e7ab575d9f521da0b235a6431179220", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753942, "uuid": "9153bfe9-6c7d-480e-b116-ed50da4bb6f8", "value": "T10AD2A3BCD0A706A88F816BB42B2B5F45048CB62CF795A632367C6B7057D2D7A4117C7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753942, "uuid": "f31c6a05-7ae1-4f41-97fc-9db28eafe0db", "value": "384:hEceMBUcsd7XljEXSEoIv6Tconwy5QgjxOyImvPI5Uu/gX:L9BUBd7JEXSE3v6TRwUQgFokd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639753942, "uuid": "b077ab8b-d4b6-4d8c-8f02-068d26eddfb7", "value": 28562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639753942, "uuid": "f4047882-230d-435f-82a8-d2d1a83f3eef", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753942, "uuid": "238e08ee-06cb-47a3-a999-99e44220baa1", "value": "SOA.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b65f34e-5f7a-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639773966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773966, "uuid": "c0e22ad2-247b-44ce-bae8-ef800f7db452", "comment": "Malware payload (DCRat)", "value": "01c8134275bc08d0434967fb13ea1d64", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773966, "uuid": "c7c3d39a-8972-49df-89f2-4ae13fb877c3", "comment": "Malware payload (DCRat)", "value": "386c4cdfa31b386aa8d4e50b661d3c4d9be1018fb3704b4bbac32e5d7067bb27", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773966, "uuid": "e2b52d19-8ce7-434b-9a42-6702521ee8b8", "comment": "Malware payload (DCRat)", "value": "eac609f3cdc240608d35b9b2a126b819516b6c6d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773966, "uuid": "211e0472-292c-43ef-b656-231da21db1f8", "comment": "Malware payload (DCRat)", "value": "a127fc25e6a548dcd05e28d26fcfb86c0d1c7f8afd7a765c14b99d5215671ca2874c3113aaaff465ee32ebe85fd06cda", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773966, "uuid": "74a02b38-b2aa-4970-a1d8-3be0378db08a", "value": "T1CB35F6027E46DE43C0291637CDDF84A807ACE961BB66DA1E7E9F3B5D64123A70D0D1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773966, "uuid": "6a83b468-2f21-4dc0-b478-daf0d9465bdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773966, "uuid": "f48734a0-2c13-4ebe-a35c-983a2a2f47b5", "value": "12288:cWnMTv1hoNSIhftyMgUcHGFCvz/U5D3i+y769KiO+lSdadI1HyBT5zFDIzyYat7k:5YDYDgUcHGFCzArGOMmT5qCt7myLY+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639773966, "uuid": "3a8b830a-1f5a-4da9-bbcb-44d0363685de", "value": 1125376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639773966, "uuid": "6b79ae0d-519d-438f-a8cb-2d68b1d6615a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773966, "uuid": "2e87dc1b-12a4-43ed-ab0e-8847a6efab0e", "value": "386C4CDFA31B386AA8D4E50B661D3C4D9BE1018FB3704.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f452784e-5f4c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639754466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754466, "uuid": "3b1a8b59-e1f6-4114-a9ac-ba393c2fe53e", "comment": "Malware payload (AgentTesla)", "value": "b1f6795afa6e241847ae1cbafb179986", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754466, "uuid": "a1b32797-8316-46fe-ac7e-14ea1695d21e", "comment": "Malware payload (AgentTesla)", "value": "39ea2fa5ef1c24b174518e0dee830fc2d63d39fd829f22cd1a7788f3d31c2be7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754466, "uuid": "841c95e7-fe07-400d-964a-965bc025170c", "comment": "Malware payload (AgentTesla)", "value": "8ecf6541a079a4276f28fe2428821f29ab135c1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754466, "uuid": "432d17c3-7feb-472b-b55e-e2ee8982af67", "comment": "Malware payload (AgentTesla)", "value": "9b6be6b84105b9fb12a2e280a63aa7515809f1fb96fcd3390a9252687e27457899ffea3854bb433ad00d5ad6b3dd33e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754466, "uuid": "a693b9d4-95c5-4328-b467-02a9762a5774", "value": "T10FC4D0A0F284E896E8431DB7483BDC3125A7B6AC94B4451E155E77292BF335320AFE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754466, "uuid": "5b60663f-50fe-4329-8c83-25c01ea1ce52", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754466, "uuid": "96fdb2a2-ee31-461c-ab70-b7edec89aa45", "value": "6144:TGi5em4zGGSVeAv5wsDKnnVhtehDJd3BRHdzE1sdVcRuWYNSdVhFTselZ24Hm6ap:tebIWFW31H/NEnFIUZ9Hm6aGyjAP/+q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639754466, "uuid": "a129ca50-0d63-43fd-8d8e-3482beda121a", "value": 587675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639754466, "uuid": "c16113a6-0738-4c82-af5a-3af76696d596", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754466, "uuid": "a97a3cca-1537-46e3-be7c-a0a3f42e6b56", "value": "DHL Shipment Notification1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b672f0b1-5f5c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639761234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761234, "uuid": "5281241c-eb51-48f5-98ed-eb806a4a1df4", "comment": "Malware payload", "value": "96c4063ffdde0e5875ed6616eaa7d850", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761234, "uuid": "6dd9e323-ef19-4383-9772-4aae8cdff92a", "comment": "Malware payload", "value": "3aafae4681cc84a57c539cdf1288c269fbbae4aced2b24116c581fb5aab07288", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761234, "uuid": "b72d8f6f-8715-49cf-a8ce-b0eb38800e62", "comment": "Malware payload", "value": "da316fbcf5aacd3979957486ddf1ee6fef44336a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761234, "uuid": "1938999b-1933-481b-9222-3d8c534b6706", "comment": "Malware payload", "value": "565f878960127359dfe75834cebe3ae3234734cc70bf8e258915d2c32a96d2a5fd13ca495084ad8005786771cc6491df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761234, "uuid": "2ed029fe-f26a-4901-9f97-75a8182ca98f", "value": "T18A456B123A48DD02D269163BCAEF809447BCBD413662DB1A7EAF339D25513A71E0E1DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761234, "uuid": "94469740-6868-4511-944d-1b228b8d9488", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761234, "uuid": "f7cc36ea-81f8-4be5-b816-9ab378c8f563", "value": "24576:fyMoM07qDS8VPjkkoDKZr5F0XxKO1b9Ly+4:cvWeJKjFS7b9LF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639761234, "uuid": "893344bf-cb22-4180-bdba-ac95706c79f6", "value": 1254400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639761234, "uuid": "c4eb3de5-29a1-45d5-ad14-b97714241eff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761234, "uuid": "52ff887d-a576-4a86-a56b-18b46f87a521", "value": "96c4063ffdde0e5875ed6616eaa7d850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549a6e69-5f22-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1639736159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736159, "uuid": "f74ce6d8-bc56-47f2-97be-4173295f39c5", "comment": "Malware payload (Socelars)", "value": "d9f46ad1a63dd50f80dc3d9ddc65d624", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736159, "uuid": "38cb801a-9f43-49b9-a45d-cbad2ddb7ae4", "comment": "Malware payload (Socelars)", "value": "3bb4aed6fa9fd2170c2a964e368eaeaf5e467f0d5dc9906dbca8649fe59855d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736159, "uuid": "1d830b41-ddbd-4e16-9ed6-2a9ae8d9cca7", "comment": "Malware payload (Socelars)", "value": "6e054d6264e4ba7acaf74d97b9476b9b74782e78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736159, "uuid": "53f313b9-aa30-4508-9d8a-783e98e6394f", "comment": "Malware payload (Socelars)", "value": "e38223089c9a3ecfc44a56ef2f7f46c8ef0fbdc87be69feaede1a20bbc18985d574a893650926fe4372920217bcbd771", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736159, "uuid": "e6bfa5da-bdeb-47b0-8196-a88bb944431c", "value": "T1F6659E11FF42A076ECE3007382FF5AFE8D686621030854D7F3C45E696A615E27A37A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736159, "uuid": "2b7e2d7e-27ac-44e8-9d04-2c2c057c2a54", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736159, "uuid": "5ff26b6c-9911-495d-a725-d5e58e89fb9b", "value": "24576:laApxEmUociWVxvX2LfeEyS2ZTU2xbVJbpNyn0iNSpdFKj:VpLfvjilVbyn0iNSpTKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639736159, "uuid": "aa168688-a144-46fb-9c7f-d80e09a9909b", "value": 1490432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639736159, "uuid": "fb474b9d-de84-40e8-8533-4b0c67c3af61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736159, "uuid": "a1ed4965-c80b-44fb-a007-38f585d90134", "value": "d9f46ad1a63dd50f80dc3d9ddc65d624.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "806084b8-5f22-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639736232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736232, "uuid": "d1e5ebe5-d911-43cd-9619-766b4e259c1c", "comment": "Malware payload (SnakeKeylogger)", "value": "66925f91cb5888511ac06e602d1f21c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736232, "uuid": "a3afff09-2c69-432e-82f0-108462fa43b3", "comment": "Malware payload (SnakeKeylogger)", "value": "3d724447dc1bc377b13e59cb6f4d04f062c1d992d75978d1ba8204cf8763280c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736232, "uuid": "f6a009d2-119d-42bb-ac4c-c0c551e98ee8", "comment": "Malware payload (SnakeKeylogger)", "value": "661fb323921f5b030e82c7a4dad0daf826137331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736232, "uuid": "ce225fd7-ee61-44e9-b618-11f54a70d1af", "comment": "Malware payload (SnakeKeylogger)", "value": "2d659db507f11301ddacd096cb00e408345db7ff57f0f2366e339596fb8dfcf38228143c7d673dbe3be6d14639bf30a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736232, "uuid": "f4e78454-c336-4b80-9957-7e86ec395508", "value": "T1D635F78525AD3B25FD7893F800AA5C94C7BA7D2A717EC68D4CC330E72973F924850A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736232, "uuid": "8fc290fd-b631-49a5-990e-554e83e28952", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736232, "uuid": "1f5917ee-a79e-4823-8562-53976f628c49", "value": "12288:sKc2qF9SWUUUUUUUi1BYz/z+AuSK3c3drQ7+pzEZTNeRYIdFBZ6/UUUUUUUUUJn7:jVqF0KOCDSK3oBEgYIGg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639736232, "uuid": "5a3103c6-dbf2-4486-b74c-8e53c3b2a7f5", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639736232, "uuid": "4fbb41f3-0324-4901-95ef-8bd2bc8b9b99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736232, "uuid": "1e559875-28e9-4b2a-b1f2-9a1dc259ea07", "value": "#1ORDER1#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b1b3c8-5ed7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639703848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639703848, "uuid": "44393566-18dd-4b66-9613-0fa5d62e95fa", "comment": "Malware payload (AgentTesla)", "value": "3fa274580f7ce2f685d402ad5cbf6eaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639703848, "uuid": "e80094b9-13cf-4047-ab54-2fb2740ca3ee", "comment": "Malware payload (AgentTesla)", "value": "42db9925488d67e6db55e001f16d6b08f06e7a4da9e8c2755a343ff591f08e88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639703848, "uuid": "a08b33f2-ea88-4444-a0cc-5a64ca6dcc6e", "comment": "Malware payload (AgentTesla)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639703848, "uuid": "5260a1f9-c44a-4a90-8836-b2b5541d1144", "comment": "Malware payload (AgentTesla)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639703848, "uuid": "34a3dcc6-a48e-47cd-bcba-6ed09580719d", "value": 574464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639703848, "uuid": "02a11cd5-c3ca-466a-b97a-ba86dafd10b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639703848, "uuid": "a31cdf10-2c61-4a0b-91c1-89021a12bfea", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76d1ac8-5f1f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639735009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735009, "uuid": "78b1a4fd-20f1-4ac4-9efb-503ed221c132", "comment": "Malware payload (Formbook)", "value": "1fe8e7331af0650ad3dd2699d3987ea3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735009, "uuid": "35f47767-d4a6-4470-9042-24e6331f9d2e", "comment": "Malware payload (Formbook)", "value": "433e1a346bfd9d8a139625de7eb3d4c42bc0bda2147bd31203f4ac3b49262eb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735009, "uuid": "81dd04b7-c18b-44e8-a9fb-46d9c1ebbac8", "comment": "Malware payload (Formbook)", "value": "1d16b943991469023486a04686ec20b730d502ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735009, "uuid": "3332ab70-87f7-4384-8edf-82994a969802", "comment": "Malware payload (Formbook)", "value": "b6f4b74ebd270a3e34277f40c3294f13d482d415dd4062d1c2644aef57fea97ebc1afbbc762adef09fba3281f79befd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735009, "uuid": "6819e7aa-7e5e-42e2-8911-917e8bb26a33", "value": "T13294128477F4DB5BC53A0BFD307464C0CBB416622622CF8ACD9E90DBC9267921A12BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735009, "uuid": "db286ba3-c115-4314-86f8-11304ae5e2cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735009, "uuid": "a2923b01-fd6e-40b8-b56b-6310c0aecd85", "value": "12288:KuSK3dm7ikRwL8tkP07tHpCW2IPvPkmyyy1pWy:pSK3dm2k+8aP07rZ2Ivkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639735009, "uuid": "64c19a9d-362e-4c58-ace0-1843155fb231", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639735009, "uuid": "9c11b513-461a-459f-9eb3-605f50447468", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735009, "uuid": "adf237ec-94e2-4ce0-8e67-9057a449a684", "value": "q9VO0ItTRSrphpi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0475f53d-5f46-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1639751486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639751486, "uuid": "cad2a39f-98da-4380-ae01-081b6942e3ab", "comment": "Malware payload (NanoCore)", "value": "0627db087b2bb572bc08e061f9e84e36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639751486, "uuid": "c8866ff1-7aa0-4c7c-aaad-3f7fd589934a", "comment": "Malware payload (NanoCore)", "value": "433f161ef5543f35f8df7a563533ad933b50cd07d8851e354d05ec0664650870", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639751486, "uuid": "1f26ffef-aae1-460e-a444-a1fa7ec1fab7", "comment": "Malware payload (NanoCore)", "value": "b3596be1181de1f261adefd95b2e25b3f66dac69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639751486, "uuid": "b8448fe9-78bf-4677-9cca-7473e173bc31", "comment": "Malware payload (NanoCore)", "value": "50337c517dc4b1f179ff866c6b768b211b1aa79c60a8c04bad448c167f0768628b31e2d81049ecb51abfc0031589a898", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639751486, "uuid": "3b0c1dcc-5a6c-469a-b163-9b7aca34b8e1", "value": "T1A7A412A4B7E4CB4AC4B507F6642440D88BF046123516DE1F1E9AA3DFCA12BD50F61BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639751486, "uuid": "0c7921f4-c364-4035-8937-ef0900715d0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639751486, "uuid": "7f2b03f5-a30c-4c1b-a474-2d60f809ccd6", "value": "12288:/9D4JZZcAbc7qs9V4K5O4HzRkuSK3vkmyyy1pWy:VD8cAwmqV7H/SK3vkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639751486, "uuid": "214a273e-8c25-46cf-ac68-1d9bdfdfa821", "value": 483840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639751486, "uuid": "208ae68a-5b54-4208-a48f-7e78612ffbc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639751486, "uuid": "388dfccc-000f-4b10-ab4f-f5c9ae502e7c", "value": "e5jn4kjdKc1zKDc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68737773-5f53-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639757238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757238, "uuid": "d616969e-6fe9-4f14-abd5-ad39e13639f2", "comment": "Malware payload (Formbook)", "value": "01f4a431c9623ad9bd89c62d508d2535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757238, "uuid": "18d1cdbd-7f20-43be-8eaf-6df610e03dc1", "comment": "Malware payload (Formbook)", "value": "43d225f01bf64527f716a45d052721613242eace99774e3ff5567839540047f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757238, "uuid": "5e03d161-c62b-45c8-b440-386f259f8f26", "comment": "Malware payload (Formbook)", "value": "1df681f21e1c45fb6151ba738f319c5ba9af462a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757238, "uuid": "8e9185ca-3d6a-46b8-b7f7-d122ff33028c", "comment": "Malware payload (Formbook)", "value": "80e2fd3a030093dbb0c9ea323daaa3e13d1de819b426fd0fcf38e67745e231dba3a255d95aceb47408c3ec213a509951", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757238, "uuid": "7231741d-0f84-4954-8b38-62182267bb06", "value": "T16635078525AD3B25FD7893F800AA6C94C7BA7D6A717EC68D4CC330D72973F924850A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757238, "uuid": "b0ea2da6-86c5-4c5e-b017-fdcbacdfdc4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757238, "uuid": "c218fc03-37d7-4b81-9da0-8961d80a76b1", "value": "12288:UKc2qPIYmmIUUUUUUUi1B+z/z+3g/IiNbvjnSnrjOJoF1tYYMa1LSm98zbuSK3FQ:bVqPIqEEC3+N7jSrFYYMatSK3q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639757238, "uuid": "95a302fb-44d3-4432-b0c1-b6e17388ba05", "value": 1128960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639757238, "uuid": "417eed03-622e-420f-8806-0ad82cbe6e96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757238, "uuid": "da15cab8-bfa5-4123-94ab-cfe8bb7c531c", "value": "01f4a431c9623ad9bd89c62d508d2535.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eaa635f-5f28-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639738726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738726, "uuid": "f511084c-9c4c-4f88-ae3b-6870a03890db", "comment": "Malware payload (RedLineStealer)", "value": "ffaac71ccd34cbc879ebf9caf41f6ec2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738726, "uuid": "73f0714d-9641-455a-9afc-dd537408c4f1", "comment": "Malware payload (RedLineStealer)", "value": "45be63f716b65ef3e324e22d0e7242029ed9759a70267fd06427337753174bf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738726, "uuid": "4862b8c7-9c7b-4638-897d-cf8640088cf8", "comment": "Malware payload (RedLineStealer)", "value": "4bbca2917570a5a42238eecb0d9dc529e878e96c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738726, "uuid": "0370e150-d01a-43fe-a20e-564d55fc2cce", "comment": "Malware payload (RedLineStealer)", "value": "3addd3028ed806a27cf091613aac15e6cd6b84903bc447ea901ea44afbed71f2db0a63c472480a0e6ab95a87b33d577c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738726, "uuid": "b35b5f6e-2129-4e62-995a-ea9d47cd752f", "value": "T1DB75336BD4E05842D54E3BF54F132AA392061F2461F8B2B3F7ED9B47A748403981E97C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738726, "uuid": "3edc0323-ee60-441d-b2e8-a0391aa90271", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738726, "uuid": "be31a414-baca-4c0c-937f-faf47fe355ea", "value": "24576:Xa32l665ZGk61sX+RGYguEFZr3lmOO0SbBy8c0HyF+zdiBkkEaHNYK3/sT1V:XK66sXfY/EFZJ0Rc0HNICNatsTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639738726, "uuid": "ee482bd9-776b-48d1-8fdc-65964f780491", "value": 1559800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639738726, "uuid": "9f9d0be4-e39b-430c-857f-070b35933f38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738726, "uuid": "086dd723-5414-44d6-94d5-12389a93abf1", "value": "SecuriteInfo.com.Trojan.PWS.Steam.23630.10621.22331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49494da6-5f53-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639757185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757185, "uuid": "c36f8b0c-350a-44ba-b7cf-590ceda9cf12", "comment": "Malware payload (Smoke Loader)", "value": "a3f2b91bbd85a82dc9992096aae2ccb1", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757185, "uuid": "750fed3f-4616-43d2-805e-b9b287643cae", "comment": "Malware payload (Smoke Loader)", "value": "46c5ca3a6f401ab5f7bbbb41195f7a159c49c4723eb243a14348ba78ff79809c", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757185, "uuid": "934b4877-aaf2-4f4d-9136-e99a686a0b04", "comment": "Malware payload (Smoke Loader)", "value": "b5064ae0ec938e1ba80729fb35c67e765e442e5b", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757185, "uuid": "e6efafb3-328b-4bd4-bd9e-19298081f8ec", "comment": "Malware payload (Smoke Loader)", "value": "3627c71eef192bb8b38f8d97ffcacacc494ae743392588f777b954050ec70e673ff129823fff1c91c6d1806a0e8b28d8", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757185, "uuid": "9e71b449-a9d9-4e7c-8796-d1cdaa20d496", "value": "T1DF749E10BBE0D439F1B356F84EB5A3BDA52E7991673494CF12D516EA1A386E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757185, "uuid": "c65ca789-a1df-477b-8e4c-40df7e960170", "value": "9a8dc8c7cdfd1f0f0b247a3b1f86c91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757185, "uuid": "21d6c776-a502-477e-9b4b-3a976ddf033c", "value": "6144:t87tvGN5rSUcE2arD9rZHOfGuKjEZPrsn:ivMrS/E2arD9dHOfMyPrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639757185, "uuid": "2e58a141-6581-4b5d-8eef-2b259407f143", "value": 353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639757185, "uuid": "3cc203bf-4b6d-44cc-8a8b-ea9519e3e1d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757185, "uuid": "55fc8a52-8ed8-441b-af44-d55370078308", "value": "a3f2b91bbd85a82dc9992096aae2ccb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6ed86c-5f45-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639751475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639751475, "uuid": "773fc69b-a437-4f8b-b4bf-e6b61b12dd1c", "comment": "Malware payload (RedLineStealer)", "value": "00fab7b0162ba8d6f9d4eb62c4d7c8aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639751475, "uuid": "52a4a407-ea69-41a9-b586-b42da10c770e", "comment": "Malware payload (RedLineStealer)", "value": "470d2bd493c259eb33832a891130302ec2e4d95ba77ff1cc61158c97c11c99fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639751475, "uuid": "e053e183-ba0b-47b3-aadb-2ff4969a1a20", "comment": "Malware payload (RedLineStealer)", "value": "b5fa2572f2a5f55fa1c5ccf89e4d96d627c87b8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639751475, "uuid": "9853e705-9a01-457e-bede-a3438e53be4b", "comment": "Malware payload (RedLineStealer)", "value": "8fc273ff127af729a4e23839d011af76f49fd95558f32c8783be076fb523013a9171d3679b6e460407ef13725636a170", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639751475, "uuid": "2801a3e6-edb1-4bb5-b822-065e19d6c642", "value": "T15FF3B03179ECC47AC2A3567044749BB59F7AF8215671858B3768026E2F30ECC86F636E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639751475, "uuid": "f3b76954-caab-458d-8bc0-b215c09bc5a0", "value": "2b42d753de8a258fdcd0d8efcf6786d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639751475, "uuid": "8017ba9e-15de-4a06-ace0-e0d3d5779e54", "value": "3072:DL73/fNAizRc+iT4C7jkiZWrxpzbgqrudND+bB:DLDNAizRcjT41iZuzbgwu7WB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639751475, "uuid": "46d30df7-bc04-48df-8692-a0898b32cd79", "value": 159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639751475, "uuid": "47cbcf3e-a818-4627-925c-2a92a67a63e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639751475, "uuid": "8ecccecf-c62b-48b1-ad11-b4470ebe66ed", "value": "00fab7b0162ba8d6f9d4eb62c4d7c8aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31bffce-5ecf-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639700669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639700669, "uuid": "6656372c-a7d3-4a09-9b71-a7c664f045e5", "comment": "Malware payload (RaccoonStealer)", "value": "25554b2f804c5ba6b70ebf4ac53f55d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639700669, "uuid": "336508c5-beec-4da8-b428-21e5feb3176d", "comment": "Malware payload (RaccoonStealer)", "value": "48dff412033a3a097d61ed43f3432268bc1e85c51573339686b00879e820f32c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639700669, "uuid": "28a725bd-cbd8-4835-b5d9-7311e1bc34fd", "comment": "Malware payload (RaccoonStealer)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639700669, "uuid": "a93cecfe-e31e-4537-bbfd-54e000d254e4", "comment": "Malware payload (RaccoonStealer)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639700669, "uuid": "9c762a76-5650-4b32-b3b2-abfea4da691d", "value": 1777232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639700669, "uuid": "a934f8aa-d1f4-48a5-a80e-509c34dd945c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639700669, "uuid": "4df482a0-c9e3-4d21-b511-471f6e99510f", "value": "25554b2f804c5ba6b70ebf4ac53f55d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5de824e-5f53-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1639757394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757394, "uuid": "a6753597-236f-487b-988c-626dcc07c451", "comment": "Malware payload (RemcosRAT)", "value": "43a43716c36199af6f01205f44ee65ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757394, "uuid": "2e5a7eb5-811c-41b7-830a-28118a334ab0", "comment": "Malware payload (RemcosRAT)", "value": "491db43edfcd83d095e65ab94402c6f36c7cb4570441bda2980df8b27d2d29ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757394, "uuid": "50c2b115-3e8e-49a8-93b6-c83f57f5195f", "comment": "Malware payload (RemcosRAT)", "value": "62bfec657830582f39b3d6eedcd6920dac28b06e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757394, "uuid": "a497d411-6425-4173-a72e-91cfe949e76f", "comment": "Malware payload (RemcosRAT)", "value": "33ee02f47af2f8c1cb934cb85e7f43a118d3f0279656c0fa6b0530b13ce7683972c76d59988e3875d2cb0714ea8e1fac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757394, "uuid": "a7d4d2c3-fddc-487d-8763-c9776faae2a5", "value": "T1D5642C55BE68C552C08A4DB16C72C6F01A51FE142D0D256EFB927FAFDE3A722DC0208B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757394, "uuid": "4207fab3-6304-4d57-8d58-67f7eed4dec8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757394, "uuid": "45f7592a-df3a-46d3-a801-71ce74c11675", "value": "384:PJErm3mzk1L98Lu4jq3VNXILry7dLGUgqR2qSp9oMhLPKH3nIKPtT7qOwgxK0N/g:RLmoJiuGqF6ryhGpqPSf+PQOd7Bd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639757394, "uuid": "6c4db0c4-f7f6-47fe-add8-fd531f5ee4f3", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639757394, "uuid": "2ab64bdf-1fc2-46ac-9209-86a03b935731", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757394, "uuid": "3e80c9f4-cf9a-403b-a180-25ee5e9e4faa", "value": "43a43716c36199af6f01205f44ee65ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3095f34-5f52-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639757014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757014, "uuid": "441c5ec6-6ee9-4f31-8b57-287f45aae863", "comment": "Malware payload (RedLineStealer)", "value": "ef9ecc5013dca46a01a6a4588b6bad40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757014, "uuid": "bb606a3a-2048-47ef-b2a1-2af2f342bf40", "comment": "Malware payload (RedLineStealer)", "value": "49a1576a64505be1d97c01530eca5df8e0fb677f0926919646fc47f20f6bacac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757014, "uuid": "dfe7fd11-c264-41b2-b9c2-53af22a2b5d0", "comment": "Malware payload (RedLineStealer)", "value": "6c7999888e01b7e0d8c6f592113f9d62990f2686", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757014, "uuid": "fc7f3b02-22e9-4ac8-ab18-1e08174f3cdb", "comment": "Malware payload (RedLineStealer)", "value": "c75e710fb2f0c17d7597e19a290757ce1f37be79cb9a8868ae0be992f4be7838fa392ae8ec0bfc3f2a9b660e80f64dbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757014, "uuid": "8c06b05b-44f3-42a4-a3eb-cfd1cab8aee5", "value": "T1BC058C26B1A770F8F49E09312F64BB202A51EC70A8F6974ADD443F4C5B339A5FA3525C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757014, "uuid": "189b69f8-2acf-4784-9cea-e8efb6780abf", "value": "658c41a37f11bcb3982cd8ea7b5366b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757014, "uuid": "49189b08-655a-4493-9694-c6190ffbd882", "value": "12288:dOsB8eV4kyIaibdMuuSQK4nJqdrCfNVkVmWkq3hCtFw4bnfx:8vk4fNjuuSQK4nJoVPkAhCt6onJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639757014, "uuid": "d3c49cec-1786-46c3-9d41-025af4c9507c", "value": 866992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639757014, "uuid": "0c51d5b2-3945-4667-8052-463472d69d6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757014, "uuid": "709bbaf2-cd54-4e67-97c3-666a3830c9e5", "value": "ef9ecc5013dca46a01a6a4588b6bad40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82adc929-5f5e-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1639762006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639762006, "uuid": "3e8f039a-f22a-473d-bc70-e49829fc27a1", "comment": "Malware payload (SilentBuilder)", "value": "bf2e67b6d3ee0eafc5fb49fa88e94bb6", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639762006, "uuid": "5ebecc6f-7175-43f0-8827-793d64a44e6f", "comment": "Malware payload (SilentBuilder)", "value": "4add1cacf9f64d9cdf5e23d19d95a5404727e08ff3faa99c175219e5454be829", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639762006, "uuid": "f1a53aeb-d455-4c11-a020-1cc1575676e0", "comment": "Malware payload (SilentBuilder)", "value": "dd6d305f23d6b8e5e8b60d3a9ed8b7d079e23ad8", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639762006, "uuid": "04044c34-4682-4b6d-989d-02ca6bd07ea2", "comment": "Malware payload (SilentBuilder)", "value": "c31091a81692978d59ae74ee26f5b14add4ccd032aacc4dd00cb2098ab68deecc489b3f90f384c07e44489b18cffe05c", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639762006, "uuid": "8f5c7369-bf81-448b-93fe-c531bfbed53d", "value": "T1D314CBDA5AE9EDA1CF84D1B6CFCC05815351DEC4354B4B93B648A0B8FE2B9789F84390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639762006, "uuid": "bf0f83aa-65ca-4179-a006-d9a61d724396", "value": "1536:YSNCZEBUy8Widikf6GnKy10ARFX81r3swx5/lo3NSI4pgSeborHylr:Yvq6yLiNfdjHGXbIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639762006, "uuid": "d831e0e1-1a1b-4bc4-b10e-7718e69a805b", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639762006, "uuid": "3713eec0-45c4-463b-a0a8-c833a2755ce2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639762006, "uuid": "2e439fc6-8b12-436c-99c5-6c4acf8c60e6", "value": "TermList.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b242e0-5f3a-11ec-9275-42010a9c0029", "comment": "Malware payload (Tsunami)", "timestamp": 1639746417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746417, "uuid": "ee743eef-4ead-491d-9bdb-47c948edac98", "comment": "Malware payload (Tsunami)", "value": "ceb9a55eaa71101f86b14c6b296066c9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746417, "uuid": "ed3059a8-3f03-43c4-b679-9fcc1a7968ae", "comment": "Malware payload (Tsunami)", "value": "4c97321bcd291d2ca82c68b02cde465371083dace28502b7eb3a88558d7e190c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746417, "uuid": "1883b197-219e-4230-bbcd-ad1c187f43ad", "comment": "Malware payload (Tsunami)", "value": "e3eb1e98ca477918154b9ed7bcc2b7fe757c1020", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746417, "uuid": "7d67b875-f71f-4624-bb53-ebb9cda04463", "comment": "Malware payload (Tsunami)", "value": "54eb04911b1abb20eec2dc8ec65664078bda562df03eeb8b9dc46e0b6098e4820a98ec85c49d611bea8c9753949ca012", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746417, "uuid": "5c55d072-e0da-4ff5-8cf2-f8236881e7d0", "value": "T1F32301238E237A51F0FCF8368B660F491A817C8D4C4D3A8ABD993C456072A9C5A0B997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746417, "uuid": "a6f3a5b1-73cc-43cc-9af0-bfed7258f606", "value": "768:sS5MBd1eyf7djK+oASYqklWlTQClQBSVtFDxWWVzYJWHIOc1XzeZRdmdcNm9Rm/I:ZgemxOPdYqkslkClJVtFDxWmsQIO40di", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639746417, "uuid": "ae475fb7-1cc6-4ff1-8cca-5dd7d8f65902", "value": 48924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639746417, "uuid": "30d958fd-fef8-4c1d-adac-3ecb021dbe2c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746417, "uuid": "df3eb74a-0ab0-4e72-94c2-e54798265b9b", "value": "ceb9a55eaa71101f86b14c6b296066c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233c86d4-5f50-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639755833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639755833, "uuid": "ba228f91-4205-4734-a7ce-74bdb763198c", "comment": "Malware payload (Quakbot)", "value": "9dadbfe217a7f377e0ca1bfa97919925", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639755833, "uuid": "8a8eb295-c50a-49b8-94d5-b493c4402671", "comment": "Malware payload (Quakbot)", "value": "4dfb7a9f41436ab5d642241ed14607ea304364631358f143b708011c1f90d63d", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639755833, "uuid": "5da7d992-c204-451a-9dcd-a3e60d368aa2", "comment": "Malware payload (Quakbot)", "value": "42e27199e9fa3a9d0626d06fb7d12381e26a2119", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639755833, "uuid": "6663c998-34fd-4052-880a-33945a95f6b7", "comment": "Malware payload (Quakbot)", "value": "8ea9ac47c2e0b17868b39201e803cb3d4e051fe067d1e4778a475b649f593842057cd0cffe978c16db346743287a3aa2", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639755833, "uuid": "e0026581-bb76-47b8-89e0-93e885b26ad1", "value": "T13E140209783CE8DFCB2B2532D608BFA7821B5060D9C17C2DA5C9784C5E51EBE7A8D58D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639755833, "uuid": "45f2fa56-b225-4018-9fa2-8e47159596a3", "value": "3072:CFcfEIz6t8weEGc33rk590Du99wpFlUz7o8NXKRlzpG7/UQXIqdtKcmIDYPIZE8o:CFcfEw6R9537k5WSOeME6rGj/m/58DDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639755833, "uuid": "878b899c-bf1a-42e0-a6fb-0dd32317d28f", "value": 207249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639755833, "uuid": "fc42cd5e-4b2a-4c3c-a233-6777e5e6670f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639755833, "uuid": "d1d5a08c-f5f7-4837-8cd9-c0c56c361485", "value": "BH-1273161372.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7269c28b-5f55-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639758113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758113, "uuid": "370c36d4-35a0-4d70-8988-4cdbb83d6df0", "comment": "Malware payload (Gafgyt)", "value": "c761a772825f2856cea7d10e7879aff2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758113, "uuid": "6c663b2d-c4d9-4371-8ac5-75ffe9819f66", "comment": "Malware payload (Gafgyt)", "value": "4f1c96e76d695df36f929ef99ecf4fde879317622d4c9f2d7997ce5a86534d5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758113, "uuid": "7f312570-5784-4d0f-958d-fde6ea262749", "comment": "Malware payload (Gafgyt)", "value": "505c6c998e49ee058ec1f778cfcd5421a517912a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758113, "uuid": "a5e58901-2889-4fb2-bc14-45ddfd8dcdaa", "comment": "Malware payload (Gafgyt)", "value": "11c2d2fe3d4d4d500014f9e5e557b9c85325c2c8c20bcf905d9ce0697bfb7da4a80cc2ee938606eff54bb7b12c961374", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758113, "uuid": "37f83261-ac04-416b-abec-2902b445bcaa", "value": "T1F3933A07B71C4F43C1DB59F029BB2BF15769B9E112A36181B91BAEC05B33AB81523F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758113, "uuid": "b67ded20-ff06-4adf-986e-3e7fac633816", "value": "1536:T3oCu/OcwUBvPsTbwHH3P6zMSIHsiO6aRv/lz5/5hLg6wOFO6V6qDjjofSee:T43/qUBvPs6X03IHsi2/b5hL7wOFO6Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639758113, "uuid": "c400a14e-8283-4e0b-8ffa-4590fc0070d3", "value": 92720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639758113, "uuid": "8261c198-38d7-4c89-9f02-2497f3443bea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758113, "uuid": "46062291-30c7-41b1-8ceb-27e628cfbe8b", "value": "c761a772825f2856cea7d10e7879aff2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53eb859-5f61-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639763406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763406, "uuid": "fc54eba3-caa9-4bc1-b23d-7860343bb4a9", "comment": "Malware payload (Mirai)", "value": "be3b658529c3fc01c9f2e086faa250ca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763406, "uuid": "fa2c9f11-3411-476d-9b38-2d82ee9b943f", "comment": "Malware payload (Mirai)", "value": "4f43181ab146642f8bac13495e29ece45cad8725e2993ee4bcec32cd5678943d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763406, "uuid": "f8310845-6989-440a-8224-75ae1b7ed30c", "comment": "Malware payload (Mirai)", "value": "3e9a932e965552842580b744edd148a98a61475a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763406, "uuid": "b092b44b-6a86-43b2-85cf-ab0abbab3afa", "comment": "Malware payload (Mirai)", "value": "22c04f6931dfe5751ffd30c4b78623dc00934aa56f4231b5b1973821de9bbc10bd17180da3f401e8bb35a7cdd69de0a5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763406, "uuid": "a47887d2-cd17-474c-9ce8-718669e80ff0", "value": "T1016319827C80AA26C7D0177BFA5F108E3315A7D8E1DA73478C142F9576CA81F0D6B79A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763406, "uuid": "0778a8b9-6799-4e01-9192-0f59c880c2cc", "value": "1536:at/LYbUxYVUUO03k704oVLMNKHwGKnJeZWovjHJkKKM:at/LY0GKJwpvj3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639763406, "uuid": "3741f7e5-917f-43d3-9d34-694080f3b291", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639763406, "uuid": "0685481d-8b8d-4a91-84a2-f7d2488efcfe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763406, "uuid": "26ecf20a-278a-4ddd-938c-7b5902dc36f3", "value": "pandora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a49cd1e0-5f39-11ec-9275-42010a9c0029", "comment": "Malware payload (Moobot)", "timestamp": 1639746172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746172, "uuid": "12e039cd-37a1-49a0-9a16-8da0ec259d0a", "comment": "Malware payload (Moobot)", "value": "f1d457f03497499f63aa145aa7710853", "object_relation": "md5", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746172, "uuid": "1380cc82-bc09-405b-9f27-adc77a187445", "comment": "Malware payload (Moobot)", "value": "500c4426766cf876f885e3b1dd7eb3140ee62d6be128da8f1bd61039351b3d45", "object_relation": "sha256", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746172, "uuid": "532d08e4-b6d0-464d-ae1c-5cb2ab2ecbb3", "comment": "Malware payload (Moobot)", "value": "0bfd90697daa44fe83b087b47273596dee463692", "object_relation": "sha1", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746172, "uuid": "ffb93645-1f1d-43ba-a5fa-25d9397aac64", "comment": "Malware payload (Moobot)", "value": "7c678a5ca28d1a6cf7058f8150da54fffb1b7c5a40f9f6ea7643528e581f5a4d56ab61dd5d53482ff5825f30a8f83d6e", "object_relation": "sha3-384", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746172, "uuid": "82855713-0809-48ab-9cc8-57e6a7eab20f", "value": "T198D2E744BE869D07C5C84377FB4E028D376523C8F2EEB213DD163F56E68E527099A0A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746172, "uuid": "ca22e808-f123-4fda-aeeb-807a39acf748", "value": "384:0ju92lifJdzBqSZxyFf1vgTuQqXnPT0PMJ4aZyXRi37vIzuICv7z4vKBzsMIcPTZ:0jiZz8Bf1LBTTJbzwRwFzbR49jwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639746172, "uuid": "221a0047-45c2-40ff-8607-7586228d2e01", "value": 30464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639746172, "uuid": "1c633f27-ee30-4217-9f34-78d66234db2e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746172, "uuid": "93469f81-2714-423a-857a-674275ac85ef", "value": "la.bot.arm5-20211217-1302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d94f88-5f0c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639726929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726929, "uuid": "305041a3-d807-4933-8cef-edf832d47c0c", "comment": "Malware payload (RedLineStealer)", "value": "a805499ef6fa8ccf0e2cc73326f284cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726929, "uuid": "64178120-20cf-4ca5-b442-497360ddd7ac", "comment": "Malware payload (RedLineStealer)", "value": "50141a781f85800cb02053bef01c4c5c5c030e9ebc30e19f201ec6468fd18553", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726929, "uuid": "990c565d-016f-477d-b31c-5570dc5eaf6b", "comment": "Malware payload (RedLineStealer)", "value": "27e2c5f8f04f80cc45643a254d251522ef470249", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726929, "uuid": "5ba87235-9bf3-4564-bacd-91a500934fa8", "comment": "Malware payload (RedLineStealer)", "value": "84d6594e660a79cf497d1fd3691cbbef0ea4729f9eae94228c0fa600bec881f74ba6b164caa7dee27bdc7cf014b7f5c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726929, "uuid": "d771535c-cdc2-4308-9989-f3a31b016c5d", "value": "T16DB533AA8348B4B8C9BA43353F791387570F3D201F968892C6EB4C722D65FDBD56819C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726929, "uuid": "9f9f30b5-efe5-4c85-9c41-797569849f58", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726929, "uuid": "8d7b6d65-2d82-4976-bc1e-dd20faccfd65", "value": "49152:p6JlWILV4MLYFmoW3p6a+uwbS/JJwd7GCR3wnmTciZoCChsgnbNaTKwN:IBCMLoi+vqJJw1Go3mmoTh1jwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639726929, "uuid": "708b1427-65a8-4367-b7ac-aba1832f6b35", "value": 2366976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639726929, "uuid": "68a0ab70-c04e-40e9-81cc-88b45465bf9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726929, "uuid": "4451da1c-cf53-4697-8895-b0fc28075ab5", "value": "a805499ef6fa8ccf0e2cc73326f284cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0c3a33-5f7d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639775202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775202, "uuid": "ad810de3-27a4-4e5b-9a8c-7258507c716d", "comment": "Malware payload (RedLineStealer)", "value": "d3362abc804c46d79736d6f69a02322b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775202, "uuid": "8be44e0b-4c87-4545-b62f-721cef2ed7f9", "comment": "Malware payload (RedLineStealer)", "value": "51292123be465090e62adc0b27f651b4b798eb0dda7909ac180a00a9a4c4aa42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775202, "uuid": "b45dd59e-98c8-44de-9efd-465c4234f438", "comment": "Malware payload (RedLineStealer)", "value": "3e55415d15c0719476eb4219fbf61ee8f749ad55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775202, "uuid": "f70417fb-b1b6-4e79-abae-407e4b119cc8", "comment": "Malware payload (RedLineStealer)", "value": "bd84c5d7a3546b068e998f5d86d4c53af392f2a3c4c99a4733d8116bb2ee746fefe4719742725fbf245c054b77191bf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775202, "uuid": "44a1ba56-4254-4c95-94b8-7e31ca1a7b9d", "value": "T130F3BF3135ECC472C7A796716868DBE44B7AF8E12571514B2768076E2F30E8C4AF632E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775202, "uuid": "b645accd-7c76-4234-8adf-c9effa209650", "value": "085d4aa5e29579ffcd8f5171fcc76b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775202, "uuid": "ed9804d1-c471-49e9-94dc-c137be67efbb", "value": "3072:mLdgkIVcupx0hlC94O8n3um9emAAzmwWrxpzbgqru4GKnbB:mLyAuvcq4Ol9wuzbgwudCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639775202, "uuid": "c8fad57d-b382-4302-a75c-009eb429f81c", "value": 157696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639775202, "uuid": "51b65d3d-29de-49c9-9307-d25d35ca2023", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775202, "uuid": "727b0f22-9e70-4577-af91-600f27729f00", "value": "d3362abc804c46d79736d6f69a02322b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615bb691-5f22-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639736180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736180, "uuid": "89d32f3c-4314-4de1-9260-d9dc3b3a3f53", "comment": "Malware payload (RedLineStealer)", "value": "93310ee992a3a40826a8427781426ccd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736180, "uuid": "dfc2fc97-378f-426b-a47a-d1e730bd6747", "comment": "Malware payload (RedLineStealer)", "value": "513932d9c123a34a16edb2ecc8a020b81e072635049b73e5d8072c932abdfb09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736180, "uuid": "ed932d8b-caba-43f9-96a0-641f11ee44b8", "comment": "Malware payload (RedLineStealer)", "value": "2176e60e355632dd8d752a3576aa67c09d08b19d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736180, "uuid": "8e8f8e68-2c4b-4dec-b709-6e538f0a3858", "comment": "Malware payload (RedLineStealer)", "value": "8c7d07a9276bb90586dbe2bdd958522b2e613b555162cc7ab42b550e5937efbbffd97f9067986b0fdf9e7aed0184d59f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736180, "uuid": "b01e51b0-111b-4351-ab7b-6d254488f772", "value": "T1B254F13139BCC632C66306714860D6E54E3EB4629670C14B2B66373E6F70EDC8AE635E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736180, "uuid": "ae665395-358b-47d4-a132-e2012d1bbb73", "value": "44c00401a20ce3d35e55418765dd0985", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736180, "uuid": "b8044270-0d00-4ccc-abff-f35621f5d84a", "value": "6144:ACLOcLc5i6AkU8+dES3P3Xtv6TMUcochXm3uzbgwuiB:ACZLcQ6Ju+mP3XtvocoNunnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639736180, "uuid": "672dae04-8e68-4470-8bae-a504aa31f272", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639736180, "uuid": "20563bf7-2eb0-44f6-9c02-c28351fe29d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736180, "uuid": "0722c767-d604-46de-b677-e6803939dad3", "value": "93310ee992a3a40826a8427781426ccd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f95c95-5f4a-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1639753536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753536, "uuid": "77c4ea71-1e26-470d-9351-951f05b6c9b0", "comment": "Malware payload (Socelars)", "value": "1721aa858d091d5512c07feac97af09a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753536, "uuid": "34e26d2a-351d-4c37-8f83-f6b64a612f1f", "comment": "Malware payload (Socelars)", "value": "514af49adab4cd3229a96aec0608669a1f75918edef959c98e54245f01ffbab7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753536, "uuid": "ecd0bba0-14aa-4885-84f9-5fcd32fae217", "comment": "Malware payload (Socelars)", "value": "c747dd9a872272fd35fe881bf8439d1fd3fc042b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753536, "uuid": "c1114123-3323-40c2-9643-dd09a550a214", "comment": "Malware payload (Socelars)", "value": "f6aab4f7329e321c779e452f5f0a25720dc0f65aa7c4c2a7f99ad48185555c431f81b33734c50d1dea5d4e4a6edb4cde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753536, "uuid": "0fd7aaf0-f349-4f1f-924d-0a1f405701e8", "value": "T1CC658E11E6426036E8E3007282FFDAFE9D286E21031854D7E3C46D6B7E715E27A37A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753536, "uuid": "b32ea369-7956-43cd-945d-43748a74b33f", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753536, "uuid": "b02c8114-4784-4ccf-9b27-72c436aba31d", "value": "24576:Hr/phkCUyl+/LCBxJmnljksTnpDU2xbVzip07nwReEzPGA7:Dpny6WxVlmy7nwReEzeA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639753536, "uuid": "f4cd2b1d-f741-4878-96b1-05d46ab8a70d", "value": 1490432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639753536, "uuid": "d9237ab7-0d64-4b1d-bb31-e457c443f677", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753536, "uuid": "fe7a84c2-bad9-4acc-b4f2-8a4048543ff6", "value": "1721aa858d091d5512c07feac97af09a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f0059a-5f79-11ec-9275-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639773558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773558, "uuid": "0cfc99ce-888f-4eb8-a88d-5b574f8ac40f", "comment": "Malware payload (Dridex)", "value": "6cc5a6e8805151a0b6f330bfff2099dc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773558, "uuid": "56337f02-3022-4c27-bc7d-ec7ab9351c26", "comment": "Malware payload (Dridex)", "value": "5257f6fde23867385a6fcd7f7d3cdddcce7efaba930158c7a853404480f3d2b9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773558, "uuid": "3c61eceb-9d72-4ec8-ac09-1a6598861f4d", "comment": "Malware payload (Dridex)", "value": "643ffff1fb367347e392bd9b5677261a84239c0f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773558, "uuid": "f2bb4f8f-4006-4059-b21b-2ee8620bad4a", "comment": "Malware payload (Dridex)", "value": "7a15d856d7402ddc17092177a376419aa985d9fe04cc4de6fb6e70bf932815ecf30bacdb3dc851e5249e78c1c6b14b69", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773558, "uuid": "3ceb40f6-2b70-40ee-87df-4c3b0d2ff862", "value": "T15AB4BFAFC65E1478C7E32470159143B12EA640C6097ADEAF6B2FFA9C149634C227DB7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773558, "uuid": "af258d13-13ae-47e5-a225-e8dfdb84c3e8", "value": "1d03489a888f9eb61ae369ecc7b0879f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773558, "uuid": "664a0637-99ad-4aab-ab53-e10458d9562e", "value": "6144:/lkqY8IIaCme+UOwOYEKdvfrlEe/ply5ovxlbL6B4Q02Y:L3BdvlDx5ODY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639773558, "uuid": "77e95697-1adc-4f44-8e64-1b4df9285224", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639773558, "uuid": "d911f65b-5991-4cea-b01c-ed91ae4922f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773558, "uuid": "1027205b-4158-424d-9842-a9979dd2fe45", "value": "SecuriteInfo.com.W32.AIDetect.malware1.3952.9408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2047b76e-5f4d-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639754540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754540, "uuid": "b88738f1-6ff4-4cfc-9f6c-73fca4335133", "comment": "Malware payload (AveMariaRAT)", "value": "8638030bc871a7c02edab738756282e8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754540, "uuid": "eb34f955-b9b1-48f9-b59b-bb97850d6fc9", "comment": "Malware payload (AveMariaRAT)", "value": "52d4e0723797d4e5c60b134260bafe9aeed10b186c0186906577c52641d5e9be", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754540, "uuid": "98bf4f4f-b6f9-4273-bf03-647c57d01472", "comment": "Malware payload (AveMariaRAT)", "value": "987e6418a93afb8bbd076f87bd3637e18332d5ee", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754540, "uuid": "7c4ba54f-ef28-49a2-a2fd-48a77deeff91", "comment": "Malware payload (AveMariaRAT)", "value": "ff1ef89f2172d18069e82f381954da50249d7c28f5ae0399d54ab53659d1c2336f1aff0f10297ce994f8ffb5255e4f0b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754540, "uuid": "62a7ba83-5430-45a0-9194-1ab47de07122", "value": "T1B2229D5D0ACCB3DFCD474A3F92904DB65BA3525A27B5A41F86883228C9245E3262339B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754540, "uuid": "a991a4d1-5370-489b-91bb-2cd587462404", "value": "192:i7UhP/4ySnPkaDfJpAefe425tSbgulOMZEleylHC79uH9vh4:iwhP/EM4HffYXukMZEllHC79uH9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639754540, "uuid": "fad72970-0212-4f02-be47-4d6cafda2b86", "value": 10059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639754540, "uuid": "29bb052d-ebbd-4c95-9ace-928cbacbb66f", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754540, "uuid": "0a1dbe9e-8f4d-429b-bf56-a8a2f0f1ebb0", "value": "Purchase Orders jtc tools PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a78cc0-5f19-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639732185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732185, "uuid": "0c01e78f-9dcd-421c-8201-5d79bf5df29a", "comment": "Malware payload (Smoke Loader)", "value": "19f919ed3b8b6a249822133f942127f9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732185, "uuid": "adb9b912-777f-4ded-8c8b-c7efc7f9877d", "comment": "Malware payload (Smoke Loader)", "value": "5318751b75d8c6152d90bbbf2864558626783f497443d4be1a003b64bc2acbc2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732185, "uuid": "088f7053-c599-437c-8eb0-c8d7f5d3fde9", "comment": "Malware payload (Smoke Loader)", "value": "ff6d551f5f01913f6e6e0832e5a706c1ace93c78", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732185, "uuid": "68260ede-4778-4b2b-8923-72bf4f4224ba", "comment": "Malware payload (Smoke Loader)", "value": "c95420a258baaab974681820be6e84f6ab093e0361a45ce2f8e6ece886c1c935c499017b4c644fdf8c4a6e6d737ff1da", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732185, "uuid": "8eea83ee-8eab-4ba5-a846-1207c9220d91", "value": "T1A69567F0AD01D4C1F5BE5B6AF2FD3948A1343217EBC94A4A00E7E5651EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732185, "uuid": "dc1365d9-34fd-420d-b03b-6d8b329e4edf", "value": "12288:zy0/EFUHnrtIJBa/BtfOLaZQWrS+H8UErBQLeugD72F5Xi:zy0/ECGJSfOLTmwrOgD45Xi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639732185, "uuid": "566835ae-cb1f-4258-943f-8f33500b1f43", "value": 2025506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639732185, "uuid": "9ed54ba7-c55c-4518-8f8a-4cafaa2ed4ce", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732185, "uuid": "017a232f-dc7a-402d-8168-bbc55252fbff", "value": "Payment Notification.pdf.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763b9b12-5f55-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639758120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758120, "uuid": "2ab674a3-c91f-47c0-85e4-720eeb2ffb32", "comment": "Malware payload (Gafgyt)", "value": "c7ff85839040b86c622ea05840094d72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758120, "uuid": "aba98633-2b5b-4b28-96e4-255f39dfedcc", "comment": "Malware payload (Gafgyt)", "value": "552bbbc82746e3e069a58b405adb2e6ec8c7a32c41bc1b56116411b2a18c8c60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758120, "uuid": "0297b94a-0f54-4844-9dcd-80889ea2bf96", "comment": "Malware payload (Gafgyt)", "value": "c1632da9519d2eb0360bfa220a0b7c11dca69c82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758120, "uuid": "a8a935e5-eca9-4b09-814f-2f06c9ade4de", "comment": "Malware payload (Gafgyt)", "value": "4e7159979dbe075ec2861e29867315b4de9b3c738420659c533befd90414529f69f141d5fa4a599dea2f22b88f1bfcd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758120, "uuid": "7529fcdf-c71f-447e-bbdf-1a6e5aed3ff7", "value": "T1BAB3D86A7921AFFEE06883310BF7AF20C7D521D626915386F15CE7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758120, "uuid": "a41186b1-5caa-4e3c-a2f5-d16e1038e10b", "value": "3072:C/4g3Kd1rG5hZmxgA9OKdwwjF9GhsR1Ae:O9anG5hZLHKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639758120, "uuid": "26393e15-22e5-48ee-8e03-f34ae1ab337e", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639758120, "uuid": "eac7e748-85fe-47bd-a35b-46c2773aace4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758120, "uuid": "79766df8-43c7-4e56-8b25-eda2b55c8d73", "value": "c7ff85839040b86c622ea05840094d72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448a2ee7-5f4e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639755030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639755030, "uuid": "67f17556-d857-4669-830c-192cd4882189", "comment": "Malware payload", "value": "b3a56c24b48f1acfe5e1d0437e848bca", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HRV", "colour": "#2203F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639755030, "uuid": "3b73a6ac-6fa7-4b7a-8e0c-ba9e78280930", "comment": "Malware payload", "value": "5641443683931a6bca639fde4ff27f5c7cf803a82366f20159bd53ed3115148f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HRV", "colour": "#2203F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639755030, "uuid": "f20ebe5f-3dc6-4050-80ff-891e2fb592c3", "comment": "Malware payload", "value": "6cb716c21e4b5cbe93a5c3f5f5ab82e53c51b34b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HRV", "colour": "#2203F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639755030, "uuid": "54986ee7-4f47-4565-881c-a5869f456689", "comment": "Malware payload", "value": "03ddb8c2aa15c2ac99943c688066c890cf2c7abc109bbad8aa5e3737866d49f0f8907ec072b4160364042da49e9ff872", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HRV", "colour": "#2203F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639755030, "uuid": "701510d2-1e2c-422d-843b-8b8cdeca06e0", "value": "T11514E088F1F9C91AFE81413659C4D68AE736AC1B1D6D529FF2443B4E6C39E380B9420B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639755030, "uuid": "81c822e6-87b8-4ba8-86d0-c258db8b4c4d", "value": "6144:4JwqThj5Dakt4b72Ye8wxkvYCtugx7CkN:4wqlF4f2X8d/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639755030, "uuid": "1a2f1b6c-6120-46aa-80e6-7c2e922805ab", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639755030, "uuid": "8df18902-6f18-4166-b3d8-c724ec2e1221", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639755030, "uuid": "8b620161-6954-49be-ae33-60164c9e9545", "value": "potvrda.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e082ee60-5f1c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639733817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733817, "uuid": "87e728b7-83a2-4db5-aacf-5cbc5fb755eb", "comment": "Malware payload (AgentTesla)", "value": "0cb1187216b54015b3a415dc734dbb50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733817, "uuid": "643f2b4d-7a0e-4354-91d7-6bd74c49ee02", "comment": "Malware payload (AgentTesla)", "value": "577aa281bb4792c49cc9ce19ed634d311a3327a4d0a4f4486ff0dc1c3b1bc905", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733817, "uuid": "91b00b49-c2d4-4250-b38d-cf8590516d3d", "comment": "Malware payload (AgentTesla)", "value": "677ff6f0acb8d3b176542dd5475a30e4401e3b2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733817, "uuid": "be4a3bac-06bc-468e-ac3a-e93c7ffb9243", "comment": "Malware payload (AgentTesla)", "value": "2960803ef2449ed217b2e89ba0980d2ec5b5f6c28b59b3d21187176fb69a625db41d324fdc209f8bc3ec34fe2340b8ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639733817, "uuid": "02d132cd-6e38-4cdd-960f-ae16c2ecbb5f", "value": "T16A45178525AD3B65FC7953F800AA5C94C3BA7D2A71BAC68D4CC331E72973F924850E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639733817, "uuid": "2f29fe31-ddc2-4194-bf01-eaca8fe9a5e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639733817, "uuid": "28edef43-57a3-4536-bb4b-f315e5be6682", "value": "24576:wVqmpI+CDSK35ucCp1dFCkTbCHkL30ujxoE1k:wVqmpI+7K35ucCpvMgbLLk/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639733817, "uuid": "d366157c-8279-4100-ba6b-97f82b65fa52", "value": 1244160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639733817, "uuid": "c7d92176-7eb0-40bc-82cc-c9b187c3316c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639733817, "uuid": "78b746ad-bed4-4df7-bc4f-b54dc6081890", "value": "Revised invoice - VPO200024-59 VPO200024-151 VPO210001-4142 VPO210003-8.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140055d5-5f1a-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639732615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732615, "uuid": "0f7730e2-c0c6-489f-bc23-7a56e18ca8a7", "comment": "Malware payload (Smoke Loader)", "value": "81c79c34c879724584919c5e2284ab21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732615, "uuid": "289496b5-a818-46c3-9289-9777c4561e7c", "comment": "Malware payload (Smoke Loader)", "value": "577bc27da37cb47b93124d3b85f236ba9506a456da77e0341b243d515b668030", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732615, "uuid": "6b678716-5e9e-4566-ba82-33bc535e494f", "comment": "Malware payload (Smoke Loader)", "value": "5c0836cf70160bdec5afb4e198f7a04bb8e17ab6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732615, "uuid": "8292d98e-08ea-4a67-947a-366ff298e45c", "comment": "Malware payload (Smoke Loader)", "value": "27b070096405097d052137cc714242d152cfec52b7819e6ddff2670990d847e59cfcec86534f6f6f616b20a77e26c1ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732615, "uuid": "86e5628d-000a-4943-94cb-5ddb1a9e32b3", "value": "T147E40222B5D1C072E82315719CF9E632AA76F634A6B5A64FB7D00B1D2F716938217F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732615, "uuid": "c42827a8-ff56-412b-abaa-1bec21ccc9f3", "value": "4cfda23baf1e2e983ddfeca47a5c755a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732615, "uuid": "c03712dc-d992-43a4-a1f8-030489108831", "value": "12288:NY20AljdZgBPfKfnbNQxAogJfqsUsz0cX0UbZM9mrMLzJknQ06G:C20gPgFKfbNQxAVBbIcXLZM8izeQxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639732615, "uuid": "0fdf46f2-7165-4301-9f7e-0174adec2106", "value": 668559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639732615, "uuid": "ce7f648d-00aa-4b35-9f32-2827227c177f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732615, "uuid": "99ee778d-f315-457b-a137-607805e21325", "value": "jpg01.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba89af0f-5ee0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639707983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639707983, "uuid": "669377ee-837f-4989-a061-9b80675d9336", "comment": "Malware payload (RedLineStealer)", "value": "7e27e8f6d9de3d83dcea92532dae9ed9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639707983, "uuid": "5289dbf8-7e9a-4a34-8eab-bf039944cd22", "comment": "Malware payload (RedLineStealer)", "value": "5a04f5e1bb3c5c4ff02bf55a47744b4069b729fad3ef07287a371bb343d8f574", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639707983, "uuid": "09a69e2f-34fb-4dd5-81d6-024ada1fc1d1", "comment": "Malware payload (RedLineStealer)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639707983, "uuid": "656b5997-9d01-4c59-ba6e-6167ea7fa65d", "comment": "Malware payload (RedLineStealer)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639707983, "uuid": "67f6b1c1-3f2c-4658-9759-92a230474174", "value": 1658752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639707983, "uuid": "906b45c2-74c4-461c-a2b4-557fd7b2721e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639707983, "uuid": "5bb66b55-a902-41fa-bb05-453006f5f8a9", "value": "7e27e8f6d9de3d83dcea92532dae9ed9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfee9cf3-5f19-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639732474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732474, "uuid": "deeefeaf-f55c-47e8-9145-7f8e72f6383b", "comment": "Malware payload (Formbook)", "value": "4b51ab8590fe7877d7c2a165c269361f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732474, "uuid": "9656b045-547c-435f-ba98-243c8008eb27", "comment": "Malware payload (Formbook)", "value": "5c2e79f1d476965307939ec228393adeae7f76d8f09a37b296e9fd6f89202bea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732474, "uuid": "e5dde757-c47d-4ea4-9622-c932a8a42c97", "comment": "Malware payload (Formbook)", "value": "5c68d1d1604452939d27c08abc3981104af5b5a5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732474, "uuid": "47a4b32d-d0dd-4b18-9862-632c8aa56896", "comment": "Malware payload (Formbook)", "value": "7888882cf6b49ec97b9ce6763ac077a29dae28504c6ec4769b3778a3eb076737c80cf5c590d3be6223f606d3d703d48b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732474, "uuid": "31a28e75-0426-468c-a0e1-ad3e2977b266", "value": "T18664125FF0D25587F8ABEE709BAC05059082FF11F7A10A1AE8867F1044B735A9A35AD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732474, "uuid": "7c915a7c-4224-4cd8-983f-793f3eed1764", "value": "6144:1wWm0ar9p3q0VOLxHGuwnlqImG48zUdNGJmP1/Pe2guxq:1Xar9p3ZclHGZlv4dNemk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639732474, "uuid": "6350cfc0-90d0-4580-9db4-76496d2bfb63", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639732474, "uuid": "167d6644-64a7-440d-8cf2-74d8981e2ce2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732474, "uuid": "cabfa658-5f3d-4723-8203-e72d2a06e591", "value": "Overdue Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063b4c7d-5f1f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639734739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734739, "uuid": "ff7e2469-77fc-4125-94f2-df13cc83e4aa", "comment": "Malware payload (Formbook)", "value": "7d48b0f5f977fa3bb7b0b70d4c1e6037", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734739, "uuid": "3db808cd-ee8c-48ed-828d-f79bc3d4676f", "comment": "Malware payload (Formbook)", "value": "5c32323d52315250c99fb3b2fbbb17bd1baea04fca35714d8eb17fcc48a6ee43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734739, "uuid": "86289fca-9dc8-4f43-b491-05eac9910159", "comment": "Malware payload (Formbook)", "value": "3c5710e607d5137dcba17fb9024cf9b022b6dfdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734739, "uuid": "164742d5-5999-4a99-abc0-c71023234ad7", "comment": "Malware payload (Formbook)", "value": "cddca9ade7624c326f3d3a64de5ac968b88ce498e4035c5c0f2d5d8ab520ab74cd1429c25a32ec24790b1c421aaf449f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734739, "uuid": "166a1d67-b092-46dc-947e-eb170d39d235", "value": "T15235078525AD3B25FD7953F800AA6C94C7BA7D2A717EC68D8CC330D72973F924850A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734739, "uuid": "5878fa2d-0bcc-4e5f-82e9-d16ef3927217", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734739, "uuid": "1387c693-da2e-40e9-9672-c066d32d3cd3", "value": "12288:BKc2qSdmIUUUUUUUi1B/z/z+AuSK3S/Tj4QbSjlMuUp0f6f/+wgaf7CNfUUUUUU8:8VqSoEdCDSK3SrtOlMuUA6nj1DC61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639734739, "uuid": "2197853f-b5b8-4c66-99b8-a3af4e257312", "value": 1140736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639734739, "uuid": "9e894675-20b9-4c20-8b9a-3f2508e2c85e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734739, "uuid": "2a89ba60-1d65-4420-9523-69e9f8b5c874", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d53c03e-5f33-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639743421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639743421, "uuid": "dd3ecf1d-73df-4509-8676-f8cedb894609", "comment": "Malware payload (AgentTesla)", "value": "4b88a912d8df3a433984d154352003ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639743421, "uuid": "939fd774-c093-426c-ab72-0db7d017a10f", "comment": "Malware payload (AgentTesla)", "value": "5d72d45623ef962426f8a9362dba1c8165ff00f46bf85d66c347a6e7db7be8c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639743421, "uuid": "f4664d89-52ae-40f3-b2f0-d520bb076029", "comment": "Malware payload (AgentTesla)", "value": "aa4972ce3d3e48c571c3b1f0602457635706632a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639743421, "uuid": "bb09667c-d0a8-4ee0-9c17-d834c0e79978", "comment": "Malware payload (AgentTesla)", "value": "7324b8292e34abf41bc4198e635fae7fa8c344269813f2d8f161085819fd4521fc56b833e2c980c3b38bb119666b4674", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639743421, "uuid": "3e453619-0a59-4740-9e12-fbcc98515053", "value": "T1A5D47B1A2683DBDEF539D3385A28619043F4ECF3C327E999FCEA31CB1452B4196B2524", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639743421, "uuid": "1e23bc5e-4e16-425c-b58e-3bd7bc2abbba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639743421, "uuid": "b0250951-c627-4b7f-9fa2-16504dacd85e", "value": "12288:hd9TdEIpau8xO9IMROZaA6MVzNbmRUy6CF:hdLd93OZabMVzlmRp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639743421, "uuid": "c2e8db79-6a97-4308-b16f-c033b73d8d34", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639743421, "uuid": "45ddb8f4-a97d-4cbe-9ee2-af37ed8f0296", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639743421, "uuid": "1ea35b81-8683-4487-adf8-77c2ce872b76", "value": "POM21002942.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267471e7-5f64-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639764428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639764428, "uuid": "6de37343-89eb-4934-b556-e9a5623e642e", "comment": "Malware payload (Mirai)", "value": "043085e93b357789c2fbdcbba198c78a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639764428, "uuid": "1ea289ff-c19e-4017-91c5-728f7f7b274b", "comment": "Malware payload (Mirai)", "value": "5fe5486052f2c3f5c2cbd044af660fab989df13d3564284073b1ad87bf49132b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639764428, "uuid": "cf1e5338-4bef-41c2-9946-5bec7f7e5041", "comment": "Malware payload (Mirai)", "value": "1e2861f64e680f010da6af20ff7ec7c8de3858cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639764428, "uuid": "d80ae7a4-350e-4a53-b7db-04563b7a13a3", "comment": "Malware payload (Mirai)", "value": "1a266b6e2a1aeeaf63e62ee7560891fd6e7e806250bef7cea45b5e5123d6e7b98bd2dbb43d38328c910146502f626c08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639764428, "uuid": "8dfd998a-a62f-4330-9feb-05b59e503614", "value": "T19F33198964112E6DEAD65CFD90624F0EDD505220B4A3171FA3AFFDC33933369EE61909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639764428, "uuid": "50f3f164-b50d-4664-b999-a1b7f3c58e64", "value": "768:IxbcHPaxvlCsasYaMKdaeOwdmmQXy6oWq+GvM7AGZ7OjUQy+f1prR4jHZqAQeW8:YcHIvwsjYaMKIAh08s7OjUDg1pt4NqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639764428, "uuid": "8f29e6cd-e25f-4981-bca1-ec21a9599b38", "value": 52960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639764428, "uuid": "1a6af73b-8c86-47a5-9e29-cc8c627c91d1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639764428, "uuid": "8c577522-2ba5-4c5c-a70e-3c17c67e706f", "value": "043085e93b357789c2fbdcbba198c78a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77863657-5f22-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639736218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736218, "uuid": "0fddd8be-886f-4459-8188-ad9b9d24adb5", "comment": "Malware payload (SnakeKeylogger)", "value": "83a44a25e12b8bdb8b4e201c82e4f1af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736218, "uuid": "4e6372d2-9b4b-4ef4-8351-35dcc612f4a6", "comment": "Malware payload (SnakeKeylogger)", "value": "61f15482da567dea3ff0f5bb42d37717832562ed05ce1dcd03cc1c99326a2075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736218, "uuid": "d596dacb-0ed8-4a78-8e00-be62f44527d1", "comment": "Malware payload (SnakeKeylogger)", "value": "2de5442aedde807176d0c118ecf7aa978f090ec9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736218, "uuid": "5a20ba96-2f8e-459e-9861-dc5b20cc1a23", "comment": "Malware payload (SnakeKeylogger)", "value": "5d95a73a75c88b9eb2a05b4efe0a3d3e7ff202f8872700809a989381dbde99a24d48ca832a121c3044ad2d8e50acbae5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736218, "uuid": "fcc0f567-36d6-4333-b42b-a3654cb62b20", "value": "T1FB94010476FC5B13D93C97FCA421654613F19122A613FB885FDAB1EF27B6F828911A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736218, "uuid": "ae718682-27ff-4403-a748-e8ec4b87e3a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736218, "uuid": "1671dc05-c5b0-4163-b5ae-7ee9f68b3ec1", "value": "12288:JBr0uHoA5QfJd60DnUpWkEqYk3kcUSuuSK3:EYoA5GD6WgWk+MGISK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639736218, "uuid": "38a37ea9-de1a-4dea-9f9e-70c18843c709", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639736218, "uuid": "4acf104a-ee8c-4450-a085-ce9ac6623aca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736218, "uuid": "9fe83055-f47e-45b8-984a-6382982913ab", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c34183-5f18-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639731811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731811, "uuid": "e6a36d77-1027-4a33-a785-1ef0bc400f0d", "comment": "Malware payload", "value": "b39f1ec76097bb6df263dc0e717ebe8a", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731811, "uuid": "20f52d5c-d0cf-4d8b-9009-c9efa3e0f09c", "comment": "Malware payload", "value": "62532e697e9fe12b1c6701fdba1ad1d7f868f89c1e8b8fac3c6d18179df0df12", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731811, "uuid": "41af2099-1e2d-49d1-b9e0-8a358a386213", "comment": "Malware payload", "value": "27e57a4cd77dfde1c401157f811f81227e8308f4", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731811, "uuid": "f7733b65-ea25-4ff9-962d-2571e6a6c5b4", "comment": "Malware payload", "value": "de4fdcbf4d82c40b6bef30afb6931512e02c36120be52488aaf68a20e3e81849d9618ad8e2665fc2d7e2e9958160d749", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731811, "uuid": "cc59b7c9-e886-4094-8a50-6c45b3cf5698", "value": "T18B642255FE2052C2FBE3D27A18AAD45519ECDC7FEA1809658825303EDC35CF18B53E2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731811, "uuid": "7e9088ab-ba4c-4cb1-8732-7a3184627b2a", "value": "6144:E/voentfxGqx0Yn3+moy9uj3G3xv93TM0bCNzlXzPGQJEtTnyC201Rq5/:SXnvOk9uDu3TLbExrGQJEt72Uk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639731811, "uuid": "fb860dcc-5650-48c5-8ce2-301e65b13834", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639731811, "uuid": "62c9d3f0-5364-4f94-9932-2ac933237a0b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731811, "uuid": "71c98cc3-830d-41cc-ac2c-45c951e096c1", "value": "aaaa.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ed2c44-5f22-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639736238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736238, "uuid": "f7ebb1b9-354f-4dd6-8864-335ce11dc765", "comment": "Malware payload (SnakeKeylogger)", "value": "2a42deb9590fc76a0aea63e1720a6905", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736238, "uuid": "199b11fe-b865-4589-9493-eb9307c426fb", "comment": "Malware payload (SnakeKeylogger)", "value": "62cec9a8b4c28729cecff13bce82cbc2baa634c3d30929c55ac59fcedcd423d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736238, "uuid": "087f5270-b9bf-4aa2-9089-fde048243a34", "comment": "Malware payload (SnakeKeylogger)", "value": "f35b68a9f1306b91eae690567155f2700701b86a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736238, "uuid": "b8bb52f3-5d74-4007-aabb-8e0b66eb3df8", "comment": "Malware payload (SnakeKeylogger)", "value": "4f1591d643cc7b7b25bd38b10f7cea93d068a87c87252ec8a2bba3205a334481bbaadd0f51ca8edb409b5313445ace8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736238, "uuid": "e88f7b7a-c89a-4bb9-93a2-295fd39cc7c0", "value": "T18C84029073B4DA1AC57A0BFF603898C0C7F116A26727DF460E8E52EEC5177690A217E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736238, "uuid": "5ed270a0-450f-453f-93e2-840bf7ba62e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736238, "uuid": "92e42ca6-1aa3-4eb9-ab69-5ea2a7e6b607", "value": "12288:Fuf/CqdpYBmjVLa5GYu5Q6fSjBkuSK3vkmyyy1pWy:Fuf/HKIjAsQWK5SK3vkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639736238, "uuid": "2ae26bfc-26a4-4aa1-b685-0eb9b62d47f1", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639736238, "uuid": "8cf4ebb5-7e3a-4087-a6fc-1ed6f608d7d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736238, "uuid": "1747ed24-1651-4e16-ad14-b4259bacca3e", "value": "QTH41mT3B66zHgG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29c4a3c-5f0c-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639726921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726921, "uuid": "80fa2c7e-1efc-4f1d-bec5-ea46ac7a8d4e", "comment": "Malware payload (ArkeiStealer)", "value": "1c1d9d5cc8f1119e2935a8dfb9b2f09c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726921, "uuid": "e16e008a-0beb-4580-bca4-8f3ecdc3d6e9", "comment": "Malware payload (ArkeiStealer)", "value": "632dda82d31fc39812656606c7d8250ee1f4b6ec8144e233f7c99d2c0072b8cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726921, "uuid": "f9cf5c04-5a4e-4662-8c1c-41ca62b17d58", "comment": "Malware payload (ArkeiStealer)", "value": "f65f75d919f207e94557ab775be36a6d181edd9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726921, "uuid": "35f4f091-9ff2-471d-a3e9-9ea9dfa88ed6", "comment": "Malware payload (ArkeiStealer)", "value": "bcd69c336f0d988c03aeffdd11c31f73f27dc15420ec57a222cbdb64b5ae79d39e10450eed4a9efec3bde5e55f2b6929", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726921, "uuid": "a64690a7-9060-43e7-bc4e-d1ef018a3fce", "value": "T118D4121374C3D575C6B219302CE09BA8DF7BF8A156B4451B63A42FBE7FA23912A71702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726921, "uuid": "ecb6e3f2-0e1a-41b8-b791-6aacd7043ad9", "value": "2bb4e5a139a2a29d6e02a63c04eada73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726921, "uuid": "085d0144-3116-40d1-a45e-611073ee88d7", "value": "12288:DGQLwrMTpE6mINmbnJfhYwE6lTFxR39fLGcXwY8gJNUvW:D5wrAE6TmjNhYwb5RoYXEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639726921, "uuid": "7f885c84-f3c2-48b9-9dd8-4cd3559b13fa", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639726921, "uuid": "74883442-7c0c-4674-9599-a7ed315dde3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726921, "uuid": "470b9ecb-2492-433c-81e3-7a24db1df6f1", "value": "1c1d9d5cc8f1119e2935a8dfb9b2f09c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71048533-5efc-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639719886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639719886, "uuid": "29e74bed-9e4a-40a0-821e-250b17431bc7", "comment": "Malware payload (Quakbot)", "value": "98508480a50f229324042e665c07aa1f", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639719886, "uuid": "c1328708-231f-480c-83a4-02e0de63b278", "comment": "Malware payload (Quakbot)", "value": "6547a7982fb2f07ed961a492bd0181e8192af0b76abd6aa295121b43f1cc3b99", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639719886, "uuid": "30d7487d-7c36-476f-9414-a5e7bbbe8f1b", "comment": "Malware payload (Quakbot)", "value": "db70936818890336480135b3e7083ec78fb734fc", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639719886, "uuid": "0f1c3e23-4fb2-4d5a-bfb2-4f80cabf1b5f", "comment": "Malware payload (Quakbot)", "value": "d709a3a65cd0e6a6cd92420a31590f3ecd947c66cce0bae465b4680c9c8dd30b5c71293cf3f8c3e058b9708e21720ab5", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639719886, "uuid": "6a093ce1-ceca-4997-aaf7-65b3aa24f2fd", "value": "T17BD39D47ED090A43D8648BB8FD0B1D3CBB2D192DA9E123FD14260DCB6EA52675D9F04E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639719886, "uuid": "26a989db-05b1-4e40-b07f-e267699d237c", "value": "3072:2GowZK/FGOztQNL0cBLJUq1dJZvPpz7+fp7KG:8wQ/0OzSNLJNUydJZvPZC1KG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639719886, "uuid": "50882a94-961d-4f9c-a90f-75b8cc30816e", "value": 138856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639719886, "uuid": "257562a8-9f0f-49fc-b059-6b2149690ed8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639719886, "uuid": "76057caa-816d-48f8-a810-e8f28b6bf9b7", "value": "ut.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86fd5ccc-5f19-11ec-9275-42010a9c0029", "comment": "Malware payload (DanaBot)", "timestamp": 1639732378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732378, "uuid": "1cddd8d4-0a4e-44ad-9ff3-7a89663394a4", "comment": "Malware payload (DanaBot)", "value": "8c735fa907ed1b1a7f6251e231a408c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732378, "uuid": "42e49e8a-bb5c-484c-abdd-1942fdd74be4", "comment": "Malware payload (DanaBot)", "value": "6777ebe2c39e27f0bee03860b02a8ac080e3ab98375d933d6bb4ca792cc046ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732378, "uuid": "69d20567-f819-476c-ac19-9aa686dfcb6a", "comment": "Malware payload (DanaBot)", "value": "cf0ca250948d9da9278c882903a74cdc4bdbdd3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732378, "uuid": "cca5b48b-f3e0-4d1e-8e10-d86f1d0b6b7d", "comment": "Malware payload (DanaBot)", "value": "3a233c3ac52d5957fb99e3ff4484e41923030c52d33ee34f86b881ffc82913e56e09957221190c0403622e0f7b92f9a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732378, "uuid": "22f8bb21-30d5-4b85-9ad1-f63ae1afc203", "value": "T1C6852334B4DAD272C7B798359BB0C7D64A6ABC106B01915B3718169D1B22FEC8EC634F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732378, "uuid": "a0c49660-5d99-47b2-917d-fbec27aaa0c0", "value": "44c00401a20ce3d35e55418765dd0985", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732378, "uuid": "cf632890-149d-4fee-b99f-d923cf49643c", "value": "49152:iaywtfx/FSFBlkYw27nsTWuxda375UjlI:EM/FSFoY5sTfxdarSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639732378, "uuid": "23b6dcc7-1663-420e-975e-37832f822d84", "value": 1763840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639732378, "uuid": "9e2cca93-d850-42ed-9831-9c1ccfd38a6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732378, "uuid": "5f122c58-daae-45d4-91b9-8c5f251bb075", "value": "8c735fa907ed1b1a7f6251e231a408c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea395cae-5edb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639705916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639705916, "uuid": "12511f33-047f-4c49-bda8-09d418a709ab", "comment": "Malware payload (AgentTesla)", "value": "3fc0dcfea36d33705cfb0161f419253d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639705916, "uuid": "11d4d058-211a-4ffa-9757-ffadf2c30b26", "comment": "Malware payload (AgentTesla)", "value": "67f03c11010b672902bcaa4d961241650d4d9f68cb6f63fb32787d93863565c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639705916, "uuid": "c62afc7d-833a-4bbf-b084-eb472a17d3d4", "comment": "Malware payload (AgentTesla)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639705916, "uuid": "4ab37f5f-d9d2-464e-9b28-9578506d9062", "comment": "Malware payload (AgentTesla)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639705916, "uuid": "f814aa3f-2c12-49a7-9fba-021f7b1c75f3", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639705916, "uuid": "590d53bd-1fb8-4f82-ad6f-9cb6b265e6d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639705916, "uuid": "e9c3a1ee-e4ad-48b5-83f1-33250db068d2", "value": "payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e3dc48-5f39-11ec-9275-42010a9c0029", "comment": "Malware payload (Moobot)", "timestamp": 1639746174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746174, "uuid": "d7e530c1-2a83-4a73-8b1c-c562ff95cb9b", "comment": "Malware payload (Moobot)", "value": "d55c805a1c8e856f361d8cec26013a7e", "object_relation": "md5", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746174, "uuid": "217399b1-2c3e-4af2-8f49-cc7eab4b5844", "comment": "Malware payload (Moobot)", "value": "6a5a3b77680a270c157f5bd5219f43a616161a869f99ac4c05ad76b942cb0ce9", "object_relation": "sha256", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746174, "uuid": "3348d1be-0f57-40d6-9766-f0cb0acb1b5d", "comment": "Malware payload (Moobot)", "value": "6ffb14d33fef6f1b163b73ca118f3a15b5490a36", "object_relation": "sha1", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746174, "uuid": "3e732c92-04d7-472f-9a6c-f101abdae000", "comment": "Malware payload (Moobot)", "value": "54657cee77f401abf2afce2758ef2f2ec8bbdfcc176f6db772c6033cb06b6cd50bb747a24b1ec255d3fd2bab7efdb444", "object_relation": "sha3-384", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746174, "uuid": "444633ea-5010-4b51-bd16-0f5553457ba7", "value": "T15743E80AFD81AF01D4D812BAFF4E114933935B98E3FEB1129E116B15A7CA91B0F7B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746174, "uuid": "a0f4cc6b-990b-44d8-a134-a78b78b9ef4a", "value": "1536:ASnIL/u2ODQQDaM/GOsjMRPeMm5dlQaiH8vS/HwbZnD:2zuBaM7sjMRPeAL8vcHwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639746174, "uuid": "842201c5-008c-43ce-a724-1f01fd5ab318", "value": 55644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639746174, "uuid": "ce2477d5-0184-4a58-8188-3768433b4e8c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746174, "uuid": "9cad3f06-c1b8-44e3-b8da-a605e19a0493", "value": "la.bot.arm7-20211217-1302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0190ec84-5f63-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639763937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763937, "uuid": "46e8146e-af9a-4469-ad9b-64654017aa9b", "comment": "Malware payload (Mirai)", "value": "84aa11d022ed206ffcad74b0dc3bf4db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763937, "uuid": "97aa4e9e-c786-4bea-8a59-1148bab44567", "comment": "Malware payload (Mirai)", "value": "6cdb9423f7367b74b8ac58a96b965432291afdf4408ecb83c7021835268448e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763937, "uuid": "52fbb8cf-cb0a-40f7-ad51-e10f36e626b3", "comment": "Malware payload (Mirai)", "value": "8727c5065b2466a9d14c756ccfc31bc2137ccac3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763937, "uuid": "cb4ce9c8-4263-41d0-b5eb-10c547a4c940", "comment": "Malware payload (Mirai)", "value": "22e77e8049b853b6ea300e050d4c2c95c19f4d5d451d49f16c9ff8e04fca5f8cf2eaa9e6b157d67866ca1b333bab4f94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763937, "uuid": "d1ac1a0f-a3a4-4d7f-b2fe-f5300fbd3c96", "value": "T158B3A51ABF611FFBECABCC378AA8170528CC551921A97B717934C418F64B25F95E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763937, "uuid": "e7361180-6e2f-4a3b-aa05-71dab3a66b17", "value": "1536:rxnMgXCPta39Wox9osy9HUVHphBgt0MPergVZbXsAMd42+RIa137C:VnMgXCPta39WgN6U9rgVWgpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639763937, "uuid": "f178048c-9b6a-4271-b8e4-cc6cd6ddb9b5", "value": 109800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639763937, "uuid": "4306a833-388d-4f85-a965-82bdcb6f989a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763937, "uuid": "5a6975a6-090f-4789-a732-c05acbbcf047", "value": "84aa11d022ed206ffcad74b0dc3bf4db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930cb0fb-5f0d-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1639727244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727244, "uuid": "421193ef-c798-4083-86dc-233c5f27a7fd", "comment": "Malware payload (RaccoonStealer)", "value": "89c1d78e171b05edc8cd3fd40bccfbb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727244, "uuid": "49e0d807-a9bb-4f03-be9e-48ad16439770", "comment": "Malware payload (RaccoonStealer)", "value": "6d763522768f3769a32abd2e0a28df96d688d2b21b53bca2827d0f0b9fe7ca30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727244, "uuid": "47ddd5d0-9123-40ff-9731-e1e4b7f667f8", "comment": "Malware payload (RaccoonStealer)", "value": "64fa3495f993491853c4200ee12e68849fc62913", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727244, "uuid": "994fe9b2-572f-4a64-911b-b74928c6c8e9", "comment": "Malware payload (RaccoonStealer)", "value": "33c2d5b9af1d3628f723ad41b97a2ab2a50567b94513284226df1fd5eb5dd765ee68e955a2cd35d8b29e02538ea32d9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727244, "uuid": "781e0f31-1379-41e6-8a05-906d53ae83ae", "value": "T1EDC4E11067B0D039F1F762F85AB6936DB52E7AA1673491CF12D526EE5A306E0DC3032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727244, "uuid": "e419d846-4428-49bc-bfef-22159ccbaf9d", "value": "afbd1ec9aa4d54a2b22d4fb619de7c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727244, "uuid": "51c6925f-f5e3-4fee-b31c-a4a60d3b08cf", "value": "12288:pLZF7AXeEuX+9yTGPWOIRzg57iYTIpkPcoX:pV3shOHyf8kzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639727244, "uuid": "8fd478cb-a94e-41c4-8e47-d1389a004bb8", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639727244, "uuid": "4b28054e-12d7-4caa-b984-1e93b7476496", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727244, "uuid": "3a9ced67-bc58-48b6-9d45-d420d7e5156b", "value": "89c1d78e171b05edc8cd3fd40bccfbb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc8c0fa-5f0c-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639726937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726937, "uuid": "e67430e8-7ee9-4df9-9087-f834045c2910", "comment": "Malware payload (ArkeiStealer)", "value": "a173f8e3d291491d6d2eda66056f9731", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726937, "uuid": "901ef2c6-3218-41fd-9aff-7a23a65a6d10", "comment": "Malware payload (ArkeiStealer)", "value": "6e1ddf76e705dc1bc2652abac925a2a097341a3de1193a86854046cd92009953", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726937, "uuid": "c3eed682-4ec2-4fdc-9b06-102912536017", "comment": "Malware payload (ArkeiStealer)", "value": "5f00bd4588ce95e6f5e9f91e91b3cfba46770583", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726937, "uuid": "99df6473-697a-443d-901e-16e4d03ed5d8", "comment": "Malware payload (ArkeiStealer)", "value": "7564d922a754225fe9ab1c9c47243cd8e5a0826b19466fab5496d9b32f89739afa4e257cd28afa27437189b648627485", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726937, "uuid": "5727974e-cd2a-484d-a2f7-b5a146b93683", "value": "T14AA523BBBD508AD1CD9C43BB1FEA4A0135347C3D96D22A4971F8BA043AF25F7401795A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726937, "uuid": "2afdbbc1-c7ce-4c37-a64e-9524252e6ff4", "value": "d9051f25a2e18d0a82f0a2268199b2ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726937, "uuid": "b0f3a711-f1c1-4360-9a3a-ecaf8b99c506", "value": "49152:nltFt2MkeRE4Tcn0U8fAtyGGAHx00NcOC3vMdTK+azUhluCp:nltFt2M5REIc0F+btR0qXCy1aSk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639726937, "uuid": "07cac450-b1df-4435-98f6-d8bf57fb7ff9", "value": 2068856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639726937, "uuid": "890cdc41-7367-493c-9efb-6842a5c7d6b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726937, "uuid": "537fc7ff-db43-4456-a604-2117c4cc8f12", "value": "a173f8e3d291491d6d2eda66056f9731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44abefba-5f52-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639756748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756748, "uuid": "0dea6d71-2ddb-4338-a969-454b4156e979", "comment": "Malware payload (AgentTesla)", "value": "d9198037bef89b93e3d6fe14e99e2cef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756748, "uuid": "96eb82fd-943f-4497-8aee-c4ab44469664", "comment": "Malware payload (AgentTesla)", "value": "6fb0112287fac93ab53bb3e6b9910e6b9e9eb1131647bd249f2819a49b9d01cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756748, "uuid": "dadd98c0-6468-4f5b-bd46-75677a697fad", "comment": "Malware payload (AgentTesla)", "value": "b850888f688259b5274aed89393678f09988ee34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756748, "uuid": "e8c3a4a2-95c7-4ee6-96e2-c8ba4dfe45e3", "comment": "Malware payload (AgentTesla)", "value": "a28cae28fc2724a87128972dbfc2ba0d4873173dec9688befec04668abb4fd7f4a4adc9d144ee5569e9b574d61446998", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756748, "uuid": "14f02d11-71d3-4c2c-80e2-2ead39edf23e", "value": "T104652342DEC90772F7FE3FF05A7585B492A1AB02F922B44E04B7648D8B5769060B3F18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756748, "uuid": "1bbc685d-e98c-4061-af9c-56fa6433f2ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756748, "uuid": "3b98d413-450c-4067-95ab-11f9c74a0a13", "value": "12288:aH6/zkK7pXFTlzk6QI1DfP1CTYnC9DX2F1AjH5G8uts8id4ZylsWfq+:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639756748, "uuid": "b2310703-853a-4366-8b1a-0f92f252fb74", "value": 1506816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639756748, "uuid": "e27f754a-4158-4e34-acdd-909eb4173819", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756748, "uuid": "e746b770-36d1-4ddd-af40-334bb6fba7c4", "value": "d9198037bef89b93e3d6fe14e99e2cef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a385e2-5f09-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639725393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725393, "uuid": "4f3911c9-03ec-4da9-a3c7-6bd0dd9a9da4", "comment": "Malware payload (AgentTesla)", "value": "325460d2329fcfbdc8a4b03b48c82ce0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725393, "uuid": "2b6cd55f-334d-47a7-8359-675e120755c0", "comment": "Malware payload (AgentTesla)", "value": "70424ddb1c84c36b9acd56c4ebe2afb73ec25bee422e545f94aa1efdeda13762", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725393, "uuid": "3a33e808-bb7c-4e02-ae3b-8a717377b893", "comment": "Malware payload (AgentTesla)", "value": "8df63756b8a1ad439d28333bcc069ab82d52b770", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725393, "uuid": "4b633918-0af2-4698-a537-fd519887786e", "comment": "Malware payload (AgentTesla)", "value": "198c7ed6668e7985ed66d432cb21325a8eab5c89142a0eab63595093998ce3dc85bd41ffad565384e2a377b7b717a094", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725393, "uuid": "890c5e4f-f629-45b7-8a0e-477e0b9405b4", "value": "T137E47E74A0DB4654F02FC7B4596CFA60077131D3A9C68D3A4B2A6589DF6DF802F89A0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725393, "uuid": "acf3dc51-c5b0-4732-b607-4f88cd7af3af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725393, "uuid": "04e669d4-0551-42a2-a3af-b950ec22c313", "value": "12288:CXqiybAQ1hykQXu3VbdWYAk5xg5qdO3Y7FxtOjaAl:CaOQGDXu35dWbIjdO3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639725393, "uuid": "376f73fd-458e-4e90-9535-f9f67dfc41b3", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639725393, "uuid": "60067901-79b5-4da4-ac20-2e584a0c04a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725393, "uuid": "ddeb4b51-c555-4f08-94c3-2eb9eee50235", "value": "order confirmation#4748334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a599813e-5f5c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639761206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761206, "uuid": "539205ef-b157-44bd-b5a4-0ae11b66d261", "comment": "Malware payload (Mirai)", "value": "6439811eb35bd85b753dbb03b431520e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761206, "uuid": "125f767d-6ec4-4cc2-8ac3-6ef0ab0560ad", "comment": "Malware payload (Mirai)", "value": "71162b95d0e2e9af1edda3cfdd06a775284e85a18bd68724c43d88935accd537", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761206, "uuid": "2eefd074-b093-4a77-b43d-8dc2b6fc46f3", "comment": "Malware payload (Mirai)", "value": "f8b272bd494616dbe2420e341d8f095068300c43", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761206, "uuid": "0f71be19-ccdf-4a2d-8f1b-9d74ebcd5b70", "comment": "Malware payload (Mirai)", "value": "1f42458146388930aff970b200a11028f6217633d5f4f1407ce5a4b1700424fc88b6a83f08645fa00ad641343e7e410a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761206, "uuid": "8f771576-bc3a-47b0-83cd-72838ffab752", "value": "T1A283814A7F614FF7E89FDC3705A92B1224CD651B25A97F35BA30D818F20A24F19E3861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761206, "uuid": "9ee8be8b-4dc5-4285-92c2-b651b37706ef", "value": "1536:4tHI0VzfKg4SfwfPuw/uu9PLp98GfjHghP1q5Vpc:2HI0Vz9fwfPZ9mh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639761206, "uuid": "b44cc1a0-d7d2-4da3-9480-53e094841614", "value": 88736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639761206, "uuid": "ac950341-c470-4f8c-9f19-aa92a0fbf322", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761206, "uuid": "df3d532c-42f1-48d2-b1c8-6c3a0bb52718", "value": "pandora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4ca4d2-5f7e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639775709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775709, "uuid": "7e18620d-f459-4a89-982a-99c935e8001c", "comment": "Malware payload", "value": "e7f692b7d820271b640cf6a2520b7409", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775709, "uuid": "4f412cea-55ac-4661-8d06-6116c3dffe0d", "comment": "Malware payload", "value": "723fe07654cfbf19c4cbe7b63617f3a5aaf306c11e092841397abaeff80c50c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775709, "uuid": "97512a18-d0d0-43f0-b6b7-a2fe47cb6fb9", "comment": "Malware payload", "value": "1eefef95c6ff783712f2d1da26e9cfc7e618c3f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775709, "uuid": "565f2cf8-54a4-4db3-987e-0b6df71f9638", "comment": "Malware payload", "value": "97ef4f4a27d9c2bfc777d14f5462e15a716bfd7ccff8580b61e68a34207314b8fd23abc667305b42d9198023361c8701", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775709, "uuid": "7a6d6e10-5cab-429d-aa90-27ac5ca5ee73", "value": "T1CB26D083FC9460B8D9A6D231C9B592913731B8590B32E7C72F5096BB2EB77D01E743A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775709, "uuid": "88e7bf30-5c5e-40f8-b140-697dfe085a8d", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775709, "uuid": "153d7a34-4c07-4801-a175-778bac41fe32", "value": "49152:SmEjyuufFMLO0xrb/TevO90dL3BmAFd4A64nsfJPWBdCuL/kLymdaxBJIDJeLVj0:TEtO0vYAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639775709, "uuid": "6b61426b-ad98-47c1-8b1d-e96f9e5e2d90", "value": 4805632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639775709, "uuid": "9c69269c-e7b8-4f7a-a53b-8d3bbca927fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775709, "uuid": "98b405de-d5e7-4bb6-bc70-91e7a30e8320", "value": "rt5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c88bc08-5f8c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639781565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639781565, "uuid": "5435e691-788f-4f17-8633-0cd97192dd54", "comment": "Malware payload", "value": "ab966875c2c1e9371cacacb68201deaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639781565, "uuid": "7dac0eb5-5059-4b8f-ad29-e6ede86623cb", "comment": "Malware payload", "value": "759fef2afafc6fd1272af9f35f5d0e1d10565decb1226f0434508e47bd829727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639781565, "uuid": "0dc3fefd-7680-4bc2-985c-6fbc57c29358", "comment": "Malware payload", "value": "b7ef749538db549b7be5255c69be78587781d2cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639781565, "uuid": "abbdf683-9ea3-4a14-abb6-28085e84d5b1", "comment": "Malware payload", "value": "21564b4128a8beac410e4848748703253d9bb205d60f306a091bcf5aaf1cf614409eb236b7e4e049f5b326c60b55186d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639781565, "uuid": "871f2b3f-3ea1-4401-a8ab-b5e4fc5cea30", "value": "T195A412C063F4EB5BC1BA07F8202454D18BF5666167A2DF0F1D9AA3CFCA172D90A122D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639781565, "uuid": "afc26db6-ac07-4620-9775-fd6d2394faeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639781565, "uuid": "f25ce34c-1f6d-45cf-9239-4d444cd491ff", "value": "12288:nQYqQToTeFT2X4xkDGXAdhW/4tq6R2/00zbcjeuSK3vkmyyy1pWy:nQnQTyEC+7Adhq4ZRPVSK3vkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639781565, "uuid": "1886c3de-a084-470e-99a7-004ff63ebb02", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639781565, "uuid": "8a639f2e-6691-41eb-a715-8413592783dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639781565, "uuid": "f59ad2e9-54a0-487f-b253-2f566e83029f", "value": "D8fxGxDo2eEw9f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c0b7fe-5f3e-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639748328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639748328, "uuid": "f96b506d-2d1b-471d-b4db-fe6175ae09e2", "comment": "Malware payload (Loki)", "value": "4c758d28a9c11fb2c200f523aa214ef0", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639748328, "uuid": "5171b5a9-e0ad-4a19-94ec-719fff99145a", "comment": "Malware payload (Loki)", "value": "75aaedf7fbdb7faddc999ce0dbc13e68b3e25276e4827d6f1c49bec285b8ddde", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639748328, "uuid": "5a0cdd82-1658-4556-bb7b-2a06160f8f09", "comment": "Malware payload (Loki)", "value": "d3ae6819c371d06edd077123aec021910c1b13ae", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639748328, "uuid": "a89b8333-5aac-473b-8fc1-0a72ecb87f48", "comment": "Malware payload (Loki)", "value": "33997b7f3f3e662d4010a7aab133f58a4e620f33cf432d94ec1910420df9d2b3ae8a7ca05ce86471ebcc0b59ac94ce97", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639748328, "uuid": "6ea36f51-1fe4-423a-829b-5c458655074b", "value": "T190942365CA29BB6737E555D7BA54AD09D3B68662A32AC0DD603F0E00FF39F0DC930186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639748328, "uuid": "e917af29-5fbd-4379-ab27-47f47004a1a7", "value": "12288:6LisDKT/RL1azmyJzhqwZ8Fbd2BlJ3N3Yv32yg:6a7Z1azpJzEwUJ2RQ39g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639748328, "uuid": "e258bf74-c821-43b4-a30e-d62b8005a039", "value": 448025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639748328, "uuid": "318fca44-f217-4070-bd5e-b9f2ee3f157e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639748328, "uuid": "0da08793-c423-47ec-99c9-a0f9f267b7cd", "value": "75aaedf7fbdb7faddc999ce0dbc13e68b3e25276e4827d6f1c49bec285b8ddde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c303c68-5f7e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639775632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775632, "uuid": "1b32f068-3459-49b4-994e-38b047914b43", "comment": "Malware payload", "value": "6bc83594ba59df2f938fcd1a118507c3", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775632, "uuid": "7c7f2a69-a740-47d1-be91-edb01235e938", "comment": "Malware payload", "value": "7641734b4ef42641dea92d50a3abd8d33d8d909392668c64fba184914ab11503", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775632, "uuid": "18355541-d25c-4793-a2cd-e0dd144b5917", "comment": "Malware payload", "value": "a8596faf525597c71ff0d47553b0146d7ca17ca3", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775632, "uuid": "64e36b40-7b0c-4424-acfb-64e659627473", "comment": "Malware payload", "value": "b7458948be153cc1996ab6acf8a3fbf2ba47712959b0aa7c23c463704f892bb1f8a3b833aa841b8461210e38c4459dd4", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775632, "uuid": "59e550f1-2e7c-40eb-a10c-619e655dffbf", "value": "T1EC46230423C631EEEA430574E61411D9DD7B1CBCA42968875ECEB91E6A378CB4F6BD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775632, "uuid": "b3334010-08a4-4844-899f-dae6f72e219a", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775632, "uuid": "f88152fc-acae-4425-998a-530405de6b7e", "value": "98304:eZ0Flvd2+/QWxQLTpfg3o3zElGA1bUZ9kuCbszllQYkqKoCyyO5G9m/gWMIOztuA:eiFlvd2+/76xfso3zPww8uCbssqc6G8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639775632, "uuid": "67d12294-7371-4eb5-a936-a337737291bc", "value": 5857900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639775632, "uuid": "02b7e369-574f-4772-a7fb-d18083fd9c14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775632, "uuid": "e80a53cb-9f54-44e4-aee5-30fb65a8417e", "value": "vimful.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865ea77d-5f56-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639758576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758576, "uuid": "7a17b994-6a94-4917-b616-f9bc5ecaf46b", "comment": "Malware payload", "value": "be7eaf17f2d57b727d2d0f3390626a7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758576, "uuid": "0fcd6764-2b0e-4823-9cec-efd1cd098d0b", "comment": "Malware payload", "value": "76cd2fa50f3435ac673d7ec4bd24d06d3d461df75f968a2b49d6790ac5035655", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758576, "uuid": "4dcf68ca-a317-423f-b5c6-01e7d29312b5", "comment": "Malware payload", "value": "327ab1c59d2effd8dba8a8f0c07bbe94b99d330f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758576, "uuid": "ea521e31-3a94-47c5-b8f9-c9a9ee6e2717", "comment": "Malware payload", "value": "15853d3514239853448198dfe1922274ce6501032d7e69e90c40112844ea1d0f91a62da596e59d5426c7648463c9dda1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758576, "uuid": "6485d6b5-ef7d-4bfc-bb56-993f8fc7786d", "value": "T11735088525AD3B25FD7853F800AA6C94C7BA7D6A717EC68D8CC330D72973F924850A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758576, "uuid": "c2bec4f9-dc1b-4662-a18e-61dddb4ad763", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758576, "uuid": "dd016d42-8317-4c9c-9c70-ff2b90c02752", "value": "12288:mKc2qhLmIUUUUUUUi1Brz/z+AuSK3PL/K5MIlcfWk6jYpQRaXqRhIY3clPTUUUUD:9VqhSEZCDSK3D/AMISQeQMWWlPc1MGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639758576, "uuid": "76a56d6c-9abd-4b28-b023-a3274914fdff", "value": 1158656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639758576, "uuid": "eeabe9e0-2846-4ab6-a2a0-55ba61852e34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758576, "uuid": "4fe72f35-e0bb-4fce-a71b-f27604033903", "value": "be7eaf17f2d57b727d2d0f3390626a7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5955c20f-5f5c-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639761078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761078, "uuid": "12bcc1e5-abc5-4e34-886d-d36ea1e7ad14", "comment": "Malware payload (Vjw0rm)", "value": "02dca57d9291c141771e24ed47099e99", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761078, "uuid": "77ab54c3-67bc-4a14-a51f-bbeae3d47963", "comment": "Malware payload (Vjw0rm)", "value": "76d15369afac3929d48b5822fe81c4c39626a59f3dea4120b8b629436b86c11c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761078, "uuid": "f4c7660f-8c59-4c6f-82c1-54ad20d82c2e", "comment": "Malware payload (Vjw0rm)", "value": "4ceb5dda4962c9d87ea07e536d5fa75dd9138212", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761078, "uuid": "1d074591-8073-44f6-9346-8973c8d5fa94", "comment": "Malware payload (Vjw0rm)", "value": "95efdc27530ffffaecb318099abd817e850989273e3714ccfff7e571fe2da0e4294477a1dbc0442b04661f31d8ec71b8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761078, "uuid": "80711670-5b2b-409c-9df3-7db041d2a48d", "value": "T1D281109C284BC63C57D27B8A802DD148CDF548B47F28E2B5148CDAC5360E97987B69BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761078, "uuid": "032fc812-b72a-411e-aabe-8296ccf72440", "value": "96:SABNo5DRk2c24ZRMHXE6/BI/+Ys+fJebDdQqR7bJyKhFOS4UK:zSa2c24ZRMlBImYs+fJeHfRfup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639761078, "uuid": "1f9e3c86-fbf4-40b8-bffb-c95d67eaad67", "value": 3882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639761078, "uuid": "9f02ea97-6477-41f2-8a90-9d44c7c6e411", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761078, "uuid": "262e1703-2819-4aef-99e7-5500e8fe6558", "value": "Payment-Comfirmation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2563f9a-5f0c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639726948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726948, "uuid": "d77f6328-25de-43e0-8218-dacf9554734f", "comment": "Malware payload (RedLineStealer)", "value": "661d3cec0376b3b5f817c8e48d8833df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726948, "uuid": "1c0ad885-244b-4e6a-a84a-651813755dfe", "comment": "Malware payload (RedLineStealer)", "value": "775edf3f9d355adaf2efca7c4a6c9285a48e502dd6ab8fbf87c819553c5d84be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726948, "uuid": "d7f8b51a-4cdc-430f-81de-3671b00e3328", "comment": "Malware payload (RedLineStealer)", "value": "aad76846e96737c41191055c47807456797b515d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726948, "uuid": "8f589ad3-7b80-46bf-9e6a-8d08fc799fa1", "comment": "Malware payload (RedLineStealer)", "value": "1c39170cfb1ea8a62a196aec19eb82674769b64edb10adf1086d560d926de2f711a254afad85a881f6c9d81bc5d477b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726948, "uuid": "db4116d8-0bb3-49bd-ab06-ef537af29554", "value": "T123753316C790792DCE8B4B38E9162B400703F5B37AEF63D6D314971B96600BD9A68CF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726948, "uuid": "a129fdda-fb1d-4241-b8a8-804ad6086a3e", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726948, "uuid": "a2d53248-4116-4a87-989a-37b20930d144", "value": "49152:XSwAnzdQelfAnbMFY7nAQ4gN7ljqzhWfjNaFU6NVr:XNAnzdVlfGMG7ns47QNWfhSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639726948, "uuid": "af1edfc1-0e01-44aa-812b-9ebd54453c0e", "value": 1655528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639726948, "uuid": "39d23953-a9f7-4da6-83f7-6d43e44cd47a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726948, "uuid": "489a651b-8943-4a47-8380-298461f11450", "value": "661d3cec0376b3b5f817c8e48d8833df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b428dd4e-5ef8-11ec-9275-42010a9c0029", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1639718280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639718280, "uuid": "62f6bdfc-d6a1-463d-924c-a91590704091", "comment": "Malware payload (ParallaxRAT)", "value": "69113dd327820ae7bff3419bfdb28873", "object_relation": "md5", "Tag": [ { "name": "DREAM VILLAGE s.r.o.", "colour": "#B836FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639718280, "uuid": "bdba647b-6830-4055-b32a-13c6e58de762", "comment": "Malware payload (ParallaxRAT)", "value": "7852cf2dfe60b60194dae9b037298ed0a9c84fa1d850f3898751575f4377215f", "object_relation": "sha256", "Tag": [ { "name": "DREAM VILLAGE s.r.o.", "colour": "#B836FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639718280, "uuid": "605162e7-8da2-47d1-85a1-b04a9cbf1a97", "comment": "Malware payload (ParallaxRAT)", "value": "6b3531e38944c90f962d23efa4dd52e6d2dd86c0", "object_relation": "sha1", "Tag": [ { "name": "DREAM VILLAGE s.r.o.", "colour": "#B836FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639718280, "uuid": "f331d50c-16e3-476e-af71-f49e57f2c900", "comment": "Malware payload (ParallaxRAT)", "value": "5d4501d03bc369e70ced0b59094744291520f6fdc4bea61612488ec118d9bf3c8f6d665dbde6c9a74159d6b4a5554408", "object_relation": "sha3-384", "Tag": [ { "name": "DREAM VILLAGE s.r.o.", "colour": "#B836FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639718280, "uuid": "ab0956da-ef5c-4934-92ed-25aab197cd18", "value": "T136D57D23F98440F6CE23073149B8F6F9B2BDA5B5073B41DB9285A7183B755C24B1B1EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639718280, "uuid": "57fa4505-ec66-4438-b801-9c02b73420db", "value": "32982b69fc32aa33e0c2228e5e7ef271", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639718280, "uuid": "116eacd2-41ab-40e8-9061-fe511e7ceec3", "value": "49152:90CBiAsXzvGSzPer16YTjd5k1IFQHiu+g3uox+V22Hr333cvAkDEJgNCNZHqAH+b:GciyAWcY3YIFQHR+gRx+eEYCNZKAH+AC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639718280, "uuid": "40d31936-c0c7-413e-8414-867621e9c72e", "value": 3019296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639718280, "uuid": "d9908541-2c2f-4524-93c4-91f953e8872c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639718280, "uuid": "92ed4db5-ed61-4a56-9c7b-59a8df6ae84e", "value": "7852cf2dfe60b60194dae9b037298ed0a9c84fa1d850f3898751575f4377215f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe63f170-5f62-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639763932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763932, "uuid": "8259a52d-fff3-4ba0-b42b-6e4ede49894b", "comment": "Malware payload", "value": "36344632710204212d8005d22fb90dc6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763932, "uuid": "22eaa8d0-bd36-47fc-ab2b-00f293d94cbc", "comment": "Malware payload", "value": "799cbd34ee14d6f458820cd3b26303314565080d17330427d2315acc8836e0ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763932, "uuid": "5a123b07-ae06-406e-90bd-4219c79f74c2", "comment": "Malware payload", "value": "50a0abe764097b56192e0fe7908d81a43498fa8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763932, "uuid": "a4473024-51e5-444b-b8ce-eb6c6d4b20b3", "comment": "Malware payload", "value": "4a53900c3636fe3c98a13a1499dc7219f1b6b4cf92aa8cfde132e19aadd2ce71713eaf37bac1252883bdc2086f06e092", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763932, "uuid": "221cff5b-f390-4943-8196-dee9a41aa345", "value": "T16221BDAA57D3AD17CC540237DDAB7720E321AE49859FF613E71252150D2F62A1F22246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763932, "uuid": "4a293166-22d1-4e74-9028-c944a9fd7048", "value": "24:wB4llMJWqY3D5KjEoSqeEk/rUlFSy4JzLCkIddLBIZOIL5nNf+3:F//N3DMwVrkFSy4JzL2IL5nNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639763932, "uuid": "5af1c5fa-1718-493c-b994-a5efba942cee", "value": 1144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639763932, "uuid": "8c5a1958-bf43-4e00-be15-421872fa5717", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763932, "uuid": "a3279c0c-3ec3-49f6-9971-46f6157fd69b", "value": "36344632710204212d8005d22fb90dc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4695352a-5f28-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639738712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738712, "uuid": "86194ca7-b1b4-4aa4-a22e-39669b928df4", "comment": "Malware payload", "value": "52e413fdda17fc466e537daa876264f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738712, "uuid": "836f6d6a-c459-4549-b516-1d97a2ce0294", "comment": "Malware payload", "value": "79d53f943bc31422487463c4990423e0aeb8960c61e8608b25222c07a4066319", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738712, "uuid": "0aa4c608-832c-4c0b-9ade-8c86b8a496b5", "comment": "Malware payload", "value": "81e89dbf1bdfb00ed2199d97306630d24ccca59d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738712, "uuid": "7980f6fa-5761-4984-be95-e5be1ea9e1f7", "comment": "Malware payload", "value": "1aca91e06c123c924b5d70618367b0c9d43ba1da8d5c413d3b2616106c40cdce1c012135e27c2de2876db8d0848d1bfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738712, "uuid": "cc553530-aaf9-41a5-8714-486d4df771d2", "value": "T126E523D7F99F8DFDC1020A31E861A4149F0A64330FF78960075DAB1F74D666693CBA8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738712, "uuid": "917bbe83-1e74-4210-b855-7328b095cf79", "value": "61c3df730291850fea0c9a7171786100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738712, "uuid": "affc4f75-2152-4678-8c24-824e201aa64b", "value": "49152:6ypju7KGOO8Wk7XububTaERZMZo9nQUg8/nrEh880i1IDQh2:6cSKGNk7kIaERZ1nQa/nex0iec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639738712, "uuid": "ad9195ef-039a-4b4d-9de6-865b8c7bff92", "value": 3277312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639738712, "uuid": "7d0ea5e9-ce6c-4701-ac2c-ee2c65af746c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738712, "uuid": "17a08be7-8250-4d4d-a852-36d819528a59", "value": "SecuriteInfo.com.Trojan.DownLoader44.16575.18.17559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6487551a-5f81-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1639776988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639776988, "uuid": "4a018e60-1b8d-4e3a-809a-f339d5ab1baa", "comment": "Malware payload (DCRat)", "value": "578edb8b414da23d4b6754bb7a0aa431", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639776988, "uuid": "60c7659b-30b9-43ca-ab2a-1294b7decb24", "comment": "Malware payload (DCRat)", "value": "7a6e41f3064591e019a73c83144ab390ef45d47d1c66e7db3b2ec17ce6c4af65", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639776988, "uuid": "f7f046b8-fc4f-4353-a813-c6e505073b87", "comment": "Malware payload (DCRat)", "value": "a43a35264d3b0731cbb28d9f3cbcd0275851ff1b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639776988, "uuid": "28e69400-2232-436c-848b-82320d29ab33", "comment": "Malware payload (DCRat)", "value": "182b8211d107ec737ed8f9ed2909c54196798fe37fa2f3f70c9edb3b31ac8dd8526bdcdeaf63748c10d4c31b838fbd84", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639776988, "uuid": "1d8afae1-27cf-410f-a69f-ea09ed7a4f75", "value": "T113159EB5637A4BB4D5CA7A3000503EB5733FAD5A5420FA1E31D25B856E07BA02C2DAFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639776988, "uuid": "8d5726c5-0d2b-4469-8077-9b3bba5592f2", "value": "296f01213812898d6cabd652a8ebadb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639776988, "uuid": "37793daa-f3e9-4b78-bd83-0b99ef7e5975", "value": "24576:EyCC01VTi/5PJAM/ygZAXeX2tlxkkfwmDQV:fYVk5PJPKgmXemX4m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639776988, "uuid": "d3712093-1365-4137-ba6b-6d25067c9df8", "value": 935424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639776988, "uuid": "cde36cd2-2ae7-40ee-b9ec-1ea8e377c90e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639776988, "uuid": "39cb0808-719b-4f62-a9ed-1e2334501351", "value": "578edb8b414da23d4b6754bb7a0aa431.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2e13e6-5f4a-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639753509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753509, "uuid": "1a9e3a2a-e28a-4110-b6e1-3fb50d694870", "comment": "Malware payload (RedLineStealer)", "value": "d0a9ed6d2bde14eb8ed5f7285d516675", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753509, "uuid": "78b87fa3-bb58-480f-aff3-a46b1ffe5c77", "comment": "Malware payload (RedLineStealer)", "value": "7b789fbdbf45318043b1b6eb3b6fe486597ae28204a137cd8d87672a9dabef7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753509, "uuid": "64b97409-8c35-429b-bea7-3400b95596bc", "comment": "Malware payload (RedLineStealer)", "value": "469118e52aaab313f133bad8df15eea486d58d27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753509, "uuid": "064c7f2a-b3c4-445e-823c-5943b3419d16", "comment": "Malware payload (RedLineStealer)", "value": "8a91f367623965102f46189fa25a0455a77dadd6a4b557712c73ef597e5b7a41c528ce8fb2950898f806d636e1a48166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753509, "uuid": "098bb846-5719-4de5-afa3-347a7916dc6b", "value": "T1D615BB2FEDD286B4ED4307F645F3AB014BB650DACF2B13D993A4F9F04A8A1741B04996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753509, "uuid": "2fa3c331-9207-41c8-bc6a-06ebdc24a28e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753509, "uuid": "a0502a5a-7bca-4047-b1f0-34bd8794f721", "value": "12288:Sx5vk2UDdpI55qA7Fk27ugKZJR1PUBnFIb6LH08N3vwBxn+G:Sx1kljqqAajgKZD1MBBpWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639753509, "uuid": "60376065-8c32-4691-a3eb-aba5aeb54997", "value": 937352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639753509, "uuid": "15ec7dc6-488b-444a-99eb-30559bf69f30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753509, "uuid": "69cf3449-4cda-4294-943c-366a60fccac4", "value": "d0a9ed6d2bde14eb8ed5f7285d516675.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbd1e59-5f22-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639736251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736251, "uuid": "8c295b8d-4b21-46c8-8d6a-6437d4feda65", "comment": "Malware payload", "value": "03a1855c352d5b3c0c3ab04fb1960945", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736251, "uuid": "39e2bb0c-fa29-4e9a-86ab-6b4ede9a98d6", "comment": "Malware payload", "value": "7d097fadced8396579af88bcf9588688053797792932f2eb4ac5dd14784329f1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736251, "uuid": "a0268139-1190-4e64-8a61-311a5f854989", "comment": "Malware payload", "value": "a37330bea14e1b0530f649ddb8d9e5da908904f7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736251, "uuid": "cf58b939-8dd8-497c-8de3-743d9406684a", "comment": "Malware payload", "value": "1340506ea9d53238e151f90b7b02c9f69b9e93a668416117840d945b7b7e1e54f6eb304ca6ee6f26931e33b16516681d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736251, "uuid": "b16cc219-6249-461f-bf3f-f7076a9496f3", "value": "T1E7D58E23B2C1C537C0776A3C9D5BA799E96A7E102D38484B3BE41E8C1F396817D292D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736251, "uuid": "bdef5152-cc83-48a9-98c5-9d975d84572d", "value": "49152:fmUDvEp5R8W6ix5JZN8BOtROB8QPFbfLHTP2cOYLEA:jQ5R8W6ix5JZ33OB8QPFbzz2cOYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639736251, "uuid": "6b91f87e-a6b1-4991-99cb-431c03c55320", "value": 2856448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639736251, "uuid": "ba20f008-1b64-441b-826b-139a64560040", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736251, "uuid": "359e18a5-6e1b-4df2-b262-b3b41305611e", "value": "Archivo.EndesaAdjunto.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03558c85-5f0c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639726574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726574, "uuid": "cd8f8340-ca95-45e0-a507-e3942975efde", "comment": "Malware payload (RedLineStealer)", "value": "5d7d4b662b71085a7f98767959c5ca2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726574, "uuid": "09564fd6-e045-4145-844d-ed919f1fe6a9", "comment": "Malware payload (RedLineStealer)", "value": "7d1359fe0f873e03ccb58b534f660d0e4b92d049ce953e7b5a584acf97b8499a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726574, "uuid": "60d60094-ae82-4d0f-8343-2327df671b84", "comment": "Malware payload (RedLineStealer)", "value": "762b0ae575728f94cebb896a346d4e332accdd10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726574, "uuid": "08ccf72c-a0ed-4b65-8e0a-0f057dd89f3f", "comment": "Malware payload (RedLineStealer)", "value": "ff2100fb96f3e4c1189fbbc85de7310e50966fcdd4aea832c3ec89008efd21bdae61390a0d6b8fee8cf80dcb03cc977c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726574, "uuid": "11120b89-e48b-45ce-9471-e3428d13bb21", "value": "T19CA4ADAA62B0CD44D6183E36C067C11847D29FC92773F74DE9B312AB9F433A68E416E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726574, "uuid": "558fc020-fdc9-4e95-afce-1d6e460fc2c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726574, "uuid": "6a23efc4-0b95-4019-892e-f754dd291f23", "value": "6144:qwsV2bOUs/pmdK/ZfgNSeTuwVoiK85B67MMkMAHB79j6UCDqONFM0t5/n8rs:2U6Us/pmdK9E6iK2wg7pH2qMBxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639726574, "uuid": "44b6d8b5-8ae1-42f8-bdd2-4c0634dd7643", "value": 486648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639726574, "uuid": "a5e996b8-770d-4f37-8afb-ad4520f699c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726574, "uuid": "c13d7adc-e5a8-416f-996a-faa90206e90b", "value": "5d7d4b662b71085a7f98767959c5ca2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b96e9d-5f3e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639748262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639748262, "uuid": "7161b498-5072-417e-a18f-4d39582f5dc1", "comment": "Malware payload", "value": "28b4871725b5c319b455bc5a56915f8f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639748262, "uuid": "0b9e1253-2e26-415a-be3e-bbaf5bdabe2c", "comment": "Malware payload", "value": "7db4cda20c5792d8448777995ffdcf74238be14704e79d568ad818eac98aeb58", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639748262, "uuid": "a3b1bf6d-8ca5-431d-aba1-91c30a63a250", "comment": "Malware payload", "value": "30401cbfeae10185a1a99fe8c14bc6c17e6ff678", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639748262, "uuid": "62928a9a-d92d-434e-b8d2-97e3584ce2f1", "comment": "Malware payload", "value": "f0ff4cd4b47f260b079322721c4cf46d5123e1bad7779355b113378bdfec5958b9bfa4a3e3feb8d026f98ab531d97f0f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639748262, "uuid": "9dfafbc8-6e8b-45f2-bf6c-433178bef372", "value": "T1B6E533F2A1BA82A49C7C7F1E12C2F79E24DC6A5094DA2599773DE683000C65F7F06DE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639748262, "uuid": "9cf65c8a-3b58-4135-bf3d-d8144f920836", "value": "49152:EBvQxkotl9xrETfNRExj+O5rTsm/Yu5LWxz5UDDXMx9oVPlMPlqiOo9pc2HD8Ic:8okotlsLLExj+O5rQWYmLWrIDXMxqrm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639748262, "uuid": "4dc2a6f7-6009-492d-afea-324d9d2d4f26", "value": 3096242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639748262, "uuid": "242609e7-fc1b-4b95-a772-aeed41fab1a2", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639748262, "uuid": "2bda61c6-d78c-41f8-99c2-b3e2f88b4c24", "value": "ssh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1aec06c-5f48-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1639752663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639752663, "uuid": "c59a6b4d-8745-432a-a570-9fb4fee1cbbc", "comment": "Malware payload (NanoCore)", "value": "0341dc65394f91f1f87453860245911c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639752663, "uuid": "74aa1850-1f30-4f60-9abe-308eb67823a1", "comment": "Malware payload (NanoCore)", "value": "7fc05895e692fd1bd314317f3a7dc0c26647c04e2cac433e70b6288564c0726e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639752663, "uuid": "39ae6b13-9ddf-4550-9e88-d784cacfe869", "comment": "Malware payload (NanoCore)", "value": "f4b30069210abf56b55577060c6edb367398ab16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639752663, "uuid": "bfe829de-38d6-46c2-a313-c6e505dd85e1", "comment": "Malware payload (NanoCore)", "value": "1742482b092b5f47bc89652ea271e6338413369aee65e60edef951f40d3cf60a53fdc1cf41e249a0b6ae07755a415b72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639752663, "uuid": "221d20a2-0cb0-4170-93ed-25248f8926b1", "value": "T108D40D5C26CF8762ED7D917A4F7E09446B1A0E0316C0E881139AB6CAD77B21E5C4FE87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639752663, "uuid": "cd8308ff-2534-4c02-9626-7b6dc23c3b49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639752663, "uuid": "2ea8e24e-1c93-4433-b8f3-da214c1bffa8", "value": "12288:SeWZJaFSopKxPeN9PMdVZ0xUesirMOhKW:HFlKxGN9eex9sXOhKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639752663, "uuid": "a3c545ef-1b08-4c81-8506-5589b5718618", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639752663, "uuid": "020ee5be-6466-4b5e-a80d-2680ceb7a57a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639752663, "uuid": "d026e217-f201-4734-b3cc-a126524e4dbe", "value": "PO94990091Dec17th2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a53e03a-5f54-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639757643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757643, "uuid": "d8deb79f-b29b-4197-a5a1-3806add1ae78", "comment": "Malware payload (Formbook)", "value": "3991631960a56d8f41ddb5e2785abed8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757643, "uuid": "25780c8a-7ea5-4281-8950-564e49bcfb06", "comment": "Malware payload (Formbook)", "value": "84fe2a2e7c5228db514d071b4857c0361c07be4de68c26b4fd47d18452217765", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757643, "uuid": "1dc05429-8931-4519-ada5-06a77dbc6f56", "comment": "Malware payload (Formbook)", "value": "835ffad1cfad92d3ea7617d0e6af58e03c4a78c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757643, "uuid": "01435174-3261-4428-bd57-a1b48439404e", "comment": "Malware payload (Formbook)", "value": "41c58d7e1e3ddd424784b4af4e0ad2c8610b672c3afe1f00c4c1eb33e9fec289be419b4dfa6b69d7f3f615f005e0dfbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757643, "uuid": "612c493f-c337-483b-b712-31005e42c4c0", "value": "T1FB35078525AD3B25FD7953F800AA6C94C7BA7D2A717EC68D8CC330D72973F924850A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757643, "uuid": "9dfc440d-bd71-4df1-bdcc-7b09e4ea7d50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757643, "uuid": "49985ffc-089f-4b5e-a06c-f5b5cb8d85a6", "value": "12288:jKc2qp0umhUUUUUUUi1BAz/z+AuSK3lLTG727Ctlk/ybHKDQZNEwUUUUUUUUUJnL:uVqp0v1SCDSK3JTE27qlk/uZNA15GG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639757643, "uuid": "0119f617-5a78-4731-b614-913934c77fbc", "value": 1127424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639757643, "uuid": "739e2fbb-fc6d-452f-89f5-e30ce31c8f45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757643, "uuid": "f6178472-9e49-4f49-a2fc-d2125cb0fa14", "value": "3991631960a56d8f41ddb5e2785abed8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33befa50-5f52-11ec-9275-42010a9c0029", "comment": "Malware payload (Neshta)", "timestamp": 1639756720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756720, "uuid": "3a04df93-c9df-4432-87f1-ae328ccd0eed", "comment": "Malware payload (Neshta)", "value": "cd1f4fa4338ae35dc3e24b7d4fdd2c36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756720, "uuid": "9c64fa73-0a9f-4e0d-92c2-c708687cf1b1", "comment": "Malware payload (Neshta)", "value": "85bccf48bd69110456515b5b1fc35fc21c6d983e67c162ab14fb7d8f66616e71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756720, "uuid": "6706c8ba-079c-4802-9de7-a4879a2b26ef", "comment": "Malware payload (Neshta)", "value": "35585771c3637ad3df287166a5873f1587003194", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756720, "uuid": "73d40acc-5258-4ac1-9326-44d12648604e", "comment": "Malware payload (Neshta)", "value": "2a3e158002212b63ac83be5cdc81f420a645b7d2a13078f40978adbf7a10cb22be047a3f112bf88dec7bdf0338ee4649", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756720, "uuid": "23ba7d3a-a199-4109-ba94-888cc79f5f44", "value": "T119157D3CAFEFE91FC0E328F467A6D15DC85915280D290D23E76B683C64B46EA779D240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756720, "uuid": "595ef786-89c4-4bb7-b5e7-33bce1b121d2", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756720, "uuid": "73bbdf4d-544b-4dd9-b9bd-4bcf2398aeb6", "value": "12288:9fJ8iuXxfprfmx1Vyxgyh0WPkpt0wKPx7j2gWLYhw2mJRGUlX2TFsiWWEd5:NJ8iufrOcxgR2WShjxthZHUlX2Ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639756720, "uuid": "cee518b3-c344-4c08-881d-2e1b7b37dd8e", "value": 961855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639756720, "uuid": "103a9dfe-0bcf-41c6-a17a-828ce279e084", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756720, "uuid": "81100643-61f0-443d-a3d9-690d8c223f90", "value": "cd1f4fa4338ae35dc3e24b7d4fdd2c36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cace12-5f28-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639738731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738731, "uuid": "dcc05efe-b17e-4d87-ad62-1a3c6a1c445f", "comment": "Malware payload", "value": "8bc94f1fd9a27f227ab419e4bd9f6e67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738731, "uuid": "2906440c-2e0c-4dd6-a554-5f0673ee4526", "comment": "Malware payload", "value": "87809b37ff95f6394de8fd7d06c458f049c467963c02cd79d3962204fe350b3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738731, "uuid": "f524ad63-08c6-4f01-9865-59454112e8ff", "comment": "Malware payload", "value": "e652e136d9bbfdbee4a5425057aeed38a205bad1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738731, "uuid": "9c7b6265-4dec-4723-b6e4-6882ab752c0c", "comment": "Malware payload", "value": "09a1c71aeda554deb53b595fc8961e6cfe9e4cd959a49bdd646bf642baa68ce190782575c21f5a480b413a7b7d6d4bca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738731, "uuid": "c45a5016-8e3b-431e-9818-8f8382a532c9", "value": "T1BEE52397FD4F8FFFD2424932991122311F0A59735EE78561872A832D71CA93612CBF8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738731, "uuid": "fa19efdc-d279-4985-b193-8e3d94c82c0a", "value": "61c3df730291850fea0c9a7171786100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738731, "uuid": "4d735e81-9b04-4d91-ab76-cd5a1ea0b5d7", "value": "49152:NirJi2KlBAWg5DMxrU9ZkOz3pFRQbaNSdjtJk8lPGDgCUTBzAljumMK0D8KAYlh4:NzpAWsoU9Zn37RlgJpomBzkjAK44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639738731, "uuid": "617bf458-6754-4242-85cd-579f72b689a0", "value": 3257344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639738731, "uuid": "2ddc9b1e-3da2-4891-8fe6-f67f2ee6f6e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738731, "uuid": "e67c791f-6029-4f2a-863e-4d282cffefc3", "value": "SecuriteInfo.com.Trojan.DownLoader44.16575.29382.12704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a794fc7f-5f39-11ec-9275-42010a9c0029", "comment": "Malware payload (Moobot)", "timestamp": 1639746177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746177, "uuid": "e7694826-0a48-41e8-893d-5e964d161887", "comment": "Malware payload (Moobot)", "value": "aa25421c330fa3b9577ad5ba72707b93", "object_relation": "md5", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746177, "uuid": "35577945-8c8d-4e6e-97bc-6046c1830b8f", "comment": "Malware payload (Moobot)", "value": "87da8039c39891730636ba788c59bdf19211ac5d2da8fd036046f0478dbc9693", "object_relation": "sha256", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746177, "uuid": "ca2618e2-2fa5-4f90-98e4-453dcf3a5e54", "comment": "Malware payload (Moobot)", "value": "f4ac0315e7b14df32964858a14db4786f0413d02", "object_relation": "sha1", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746177, "uuid": "91b4c1dd-9b6e-4689-ac2b-fccf2f420320", "comment": "Malware payload (Moobot)", "value": "7577c02179f05c8476ca2987adde23ec0bdc7bfc1e0e962d88cc0075d9abcc660f2e19988e35c370d98dd28d0e127ede", "object_relation": "sha3-384", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746177, "uuid": "016eb5f3-3c44-4a28-867b-9aee42797f04", "value": "T103D20803A94188BCC99DC33147BED92EF963B47C1236FA593B947E23EC4EE511E69052", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746177, "uuid": "cd655676-45c8-4daf-a6ec-be684362d0ec", "value": "768:GKk2ZFC/jfRbba7nFJimcvnrzZo5P+eTBn:NZKbRS7nFDcvpo5P+eTBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639746177, "uuid": "0ebe1c21-b320-449a-8973-21eff2a9d96f", "value": 30048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639746177, "uuid": "fdab7eef-cb8b-45b9-aef9-631e275fed8f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746177, "uuid": "de03f282-88ed-4c56-9272-b644a9ea9f7a", "value": "la.bot.x86_64-20211217-1302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d590689e-5f61-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639763434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763434, "uuid": "c99cacb5-9d4f-48ad-8f29-98572ab6fd70", "comment": "Malware payload (Mirai)", "value": "5c92e6dad4262bf534d47967684ae908", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763434, "uuid": "5c97f06c-f3ee-43d9-b4da-44ce74995f5b", "comment": "Malware payload (Mirai)", "value": "8821e0be4901de6e00a50290659e7fc54b48640e819e6df060afe8857248b9fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763434, "uuid": "d4374560-163e-4624-bf1f-846868be561e", "comment": "Malware payload (Mirai)", "value": "fd66e6e2e2c327eb5502485b70c30dfa95991488", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763434, "uuid": "92e80657-6e61-406f-9d95-cb1f8bc6a205", "comment": "Malware payload (Mirai)", "value": "0664b4efdd79e3a8429e848aa49aad2aaae21578a891ca57dd3e65852c866eb0281ac493835459b90cbee69e294a4457", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763434, "uuid": "639b3bf3-d9ff-422a-8cf5-cc18efa5ade0", "value": "T14F41F05A2F801F33DD66CC36054B27122ACC842BA06A63916334E960BD3E645A7D38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763434, "uuid": "0cbbaeef-1dc8-4a1d-a196-856778a42c66", "value": "48:0ff2RxnuDW326df9QOScTLmPkOTXFuXZ:0ff6xnuqNf95S4LmrTYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639763434, "uuid": "472d6227-7e7a-40d4-a8fe-e34a149eb28b", "value": 2016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639763434, "uuid": "eab9b454-2d7d-4036-8d77-c6cc0fd724f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763434, "uuid": "7a1e271c-a934-41ef-99c0-4f742f0837e5", "value": "5c92e6dad4262bf534d47967684ae908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ff7c85-5f0c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639726870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726870, "uuid": "a9ed1b20-75bc-49b9-b059-306745f57408", "comment": "Malware payload (RedLineStealer)", "value": "3a9673e78c11e3139a6a735364150cf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726870, "uuid": "c22c9c99-5688-4003-bae3-25e8a79458b6", "comment": "Malware payload (RedLineStealer)", "value": "88ac18f302d48e99ddc66cfef6b803043466c236b7b6cc4e94e54e9ba6db0379", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726870, "uuid": "a94695bb-3c35-496a-9a20-1ef91c3e0230", "comment": "Malware payload (RedLineStealer)", "value": "42bbd6a4e06cad9928170faefdc3f31eeadbe14d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726870, "uuid": "6b1c966c-6a24-485d-9d29-f0fa3615d4bf", "comment": "Malware payload (RedLineStealer)", "value": "334bceabfd34aa3acdb83dc84520d8b3e5a4edb19f2b9ab30cde0ef844ed7601dd43b3b126f498d9dcf3d43d7193d778", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726870, "uuid": "95b98011-2e21-4c00-83c4-4a43f728d4d8", "value": "T118B35C6077CC8504E7BD4E75B8F2119953F4F4132811EB8FAEC564FD1EA2B80AA51AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726870, "uuid": "64f42fb0-5bcd-4db0-984e-1080b9e3b343", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726870, "uuid": "9ac12301-b1d6-4c28-92b7-b674a6e5be25", "value": "1536:kxxG0A5/yHDsvvUqKnGSgdMQGmOjs2bZDKY/0jWBjbx4J9a00C6z0d:kxxLAUHDMvUmLKQGmovvqAsojzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639726870, "uuid": "b738a4ae-1788-41fb-92a4-19ac1f8c0f31", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639726870, "uuid": "937df086-8dd5-4eac-ae87-5ab9d4d71463", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726870, "uuid": "2dea71eb-d1d4-4ea5-9056-f2fad229630a", "value": "3a9673e78c11e3139a6a735364150cf6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80a02c4-5f03-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639723038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639723038, "uuid": "f1317c9e-a6e9-40ed-8cf4-9a7eeb2b6371", "comment": "Malware payload (SnakeKeylogger)", "value": "1b6c7276770bf608f8a44ccb6b98433c", "object_relation": "md5", "Tag": [ { "name": "bz", "colour": "#5E7FAD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639723038, "uuid": "f4fdf489-5c4d-475a-8f47-8f7de3c1d446", "comment": "Malware payload (SnakeKeylogger)", "value": "8c58e5277bfaca4ba96d32118f0f9f870006fcba628564d80477e4693776dead", "object_relation": "sha256", "Tag": [ { "name": "bz", "colour": "#5E7FAD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639723038, "uuid": "1a5e4eb9-c882-411d-bbe8-98698541d472", "comment": "Malware payload (SnakeKeylogger)", "value": "03bf7fad086fbe43b797b34527fded85579313b1", "object_relation": "sha1", "Tag": [ { "name": "bz", "colour": "#5E7FAD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639723038, "uuid": "122b2aef-b06d-41d2-a8ed-175f71bd244e", "comment": "Malware payload (SnakeKeylogger)", "value": "fa7fd9290304f9977b333b557ac62c08a044acdf05ce0273208c564cddde04a64bec761b2c8388178ccb97ffc36e2637", "object_relation": "sha3-384", "Tag": [ { "name": "bz", "colour": "#5E7FAD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639723038, "uuid": "88a9fa1d-6f33-482d-bc12-11c9b00d1b51", "value": "T1C964232AB333B5B904F78DDF0D2C0FA058FA86542AC6C2E573A29FDC59448E61C3C246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639723038, "uuid": "a84f8dd9-35f2-4d73-8c11-de8cd2215df9", "value": "6144:raTXftZgNnUFYLvphwvROGOkEIt5oLLBD0sGPYndettv823FzIJ:r0XFAUmLvzwvkGOkLDoLxL2J8EpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639723038, "uuid": "f3035055-ae7b-47ad-a048-5011d1ce4834", "value": 309038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639723038, "uuid": "6499e3de-d07b-4743-9222-87cfe487e1bd", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639723038, "uuid": "ad910a83-abb1-478a-ac4d-3813ca83461e", "value": "e-dekont.bz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d5aba8-5ed7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639703927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639703927, "uuid": "29e60859-f030-40e5-8b51-4ca16bdc3d3b", "comment": "Malware payload", "value": "12bfe94d0da2f07f658e5f9395e37c94", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639703927, "uuid": "c5e60d10-5774-4721-8d83-cb8dd6101347", "comment": "Malware payload", "value": "8ef4f5f230dfb752a82ea32d6437cec2539ac43eacdc16ec948ff4798b59c6a2", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639703927, "uuid": "c708ec82-b000-453b-af97-ffab744bd38b", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639703927, "uuid": "63647d77-f37a-4a09-96a3-3ee9cab1e5f2", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639703927, "uuid": "baaf20fb-24e5-4f6c-8cb9-7f50cfb9565c", "value": 120077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639703927, "uuid": "332f79da-1f5a-42cd-99de-b35ed88f3ec1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639703927, "uuid": "180029a3-bf2c-49ff-a701-d6f46f67f83c", "value": "985250.737.27818.77516_411.14713.97616.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b691994a-5f1e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639734605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734605, "uuid": "14cbd6df-890a-493d-b184-124bfc8b5dbe", "comment": "Malware payload (Mirai)", "value": "7d9886a51beb90e177142b1c1ce2e75a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734605, "uuid": "192f0989-7fdc-4a05-9d88-1a5b17276518", "comment": "Malware payload (Mirai)", "value": "8fb4394c5823f1b94941b613de77a0c60fa909fd8ff87fa969cc4fa6dac26e06", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734605, "uuid": "80fda93a-5c70-4740-bb8d-aec9d6c4d0f8", "comment": "Malware payload (Mirai)", "value": "8c7e1751f27143cff611e4f1f3609f4171eef459", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734605, "uuid": "21fb683c-51da-4f89-98cb-a9d355da7ecd", "comment": "Malware payload (Mirai)", "value": "190a8aeee96f60fb14311eb4577238bfc4c0b6ba2add2363f592beac8102173fa53c7bd8989ab6cd8893d7c21233a4af", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734605, "uuid": "08594278-4652-41b2-afb7-60687af85ca5", "value": "T1F0634AC4A593E8F0DD1507B53177EB334A77F536211AEAC7D3B8A923BC82A41940B29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734605, "uuid": "4853a19a-27bd-4673-a9a0-a3f924339bda", "value": "1536:m4uQwyBcqv117K/Mn9O/kbfvxk2N5rFfEftaNGqjHaS5wPrT8y5x73QC:mBRk13jbfvxk2N5rFfE1aNGMaw+8ybg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639734605, "uuid": "fc0ef048-f918-4b93-b9a3-dbeb3e5a86ce", "value": 70704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639734605, "uuid": "54f60699-092a-43b4-85ef-ce3345467a78", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734605, "uuid": "064ff8ce-289c-45cb-b22e-877b417d3078", "value": "UnHAnaAW.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d3b264-5f22-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1639736156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736156, "uuid": "91871330-9922-415d-a07c-d691aa029137", "comment": "Malware payload (Socelars)", "value": "e49dd2c1543e2548c419dbdf462e9242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736156, "uuid": "e28d852d-28c7-4c48-bdec-dc8bc74daa3e", "comment": "Malware payload (Socelars)", "value": "9256803a391489bbc1c5d71f032385fc85d9826f145c5bb90407ff8c541ebf40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736156, "uuid": "b91b8b69-6eab-4361-a0b3-d69ab3a0d44e", "comment": "Malware payload (Socelars)", "value": "593b6fdede7440648d432018f82dd1afdee43d9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736156, "uuid": "04328ed0-9868-4c97-b8d1-95f733313ac0", "comment": "Malware payload (Socelars)", "value": "23ca9fc091dbe605db18fa9b62ebf1f4a2a3c6e91c1b5d8bf35989c35e79d359597aaa07b8ffdfb10ed7638d21c30c7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736156, "uuid": "a9271a7e-a300-4e0e-9b31-7ec167e789c1", "value": "T130659E11F6426136E8E3007381FF4AFE9D28BE21131854D7E3C479696AB15E37A3762B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736156, "uuid": "825f0bb1-176b-4a91-a4b2-e36faedc24ea", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736156, "uuid": "8cad789c-289e-42ad-a0d0-f96503422ac1", "value": "24576:gvp1T0ZhIjR+IXbtCOEqmb3tUJoU4dG/9QDcahyKXBpojv6ina02fLc:OpCuZ4Ouz4+ZoKXBpojiina02fLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639736156, "uuid": "da20258d-2f50-4bb9-b74f-ea7991b93014", "value": 1521664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639736156, "uuid": "adfe1efa-405e-4484-9d75-5af059e60d7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736156, "uuid": "9aaafc97-5140-40f5-94c4-68f993f6092e", "value": "e49dd2c1543e2548c419dbdf462e9242.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99fd8dd-5ee7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639711096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639711096, "uuid": "25f6806a-98b9-4d97-9029-85f8e52504dd", "comment": "Malware payload (AgentTesla)", "value": "a5666057aeb590e18cac263c375c06aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639711096, "uuid": "0169d580-46c1-4318-b7bb-f61bc2aac4a6", "comment": "Malware payload (AgentTesla)", "value": "936691859dc35a4a72439193857700abd01e43a17eb2ed35773abde2c0eb936d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639711096, "uuid": "c5047fba-84b5-4901-a61e-730ff28931bd", "comment": "Malware payload (AgentTesla)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639711096, "uuid": "621e7489-4ae6-4f98-b4f8-61f534faf784", "comment": "Malware payload (AgentTesla)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639711096, "uuid": "84912449-e94c-4f92-9bf0-971bbc922103", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639711096, "uuid": "12222599-055f-4340-891e-d1083798f64b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639711096, "uuid": "5ced9fa9-58b5-46cc-b190-9d8f34a8fee0", "value": "COMPETITIVE PRICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152a9cd0-5ee9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639711571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639711571, "uuid": "e3595f02-7b6e-4383-9896-841f7e5e2866", "comment": "Malware payload (AgentTesla)", "value": "d8286fd4f30f72dd29f26ee9323934d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639711571, "uuid": "14211a29-6b79-4753-95fc-4cd639e9df83", "comment": "Malware payload (AgentTesla)", "value": "94fe9e482aec4bab4910b36e3d922b0df239c3c88e56d1b3372140f69d280bc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639711571, "uuid": "529eb75f-bf96-4594-9047-4694a8ad9f6e", "comment": "Malware payload (AgentTesla)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639711571, "uuid": "bd954fd3-14fc-4953-ba59-6f2ac39c338c", "comment": "Malware payload (AgentTesla)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639711571, "uuid": "6a184ac2-783a-4b0d-98de-055ce723ba33", "value": 1178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639711571, "uuid": "60213607-4d4e-41d7-b6b3-35b36c1a3596", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639711571, "uuid": "1a6f0366-27c9-46ab-ad1e-740346e80b12", "value": "pre-alert KFL031321154404.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0753ef-5f4c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639754267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754267, "uuid": "54cf42a4-c9ce-4c5d-ac37-4871f2d82f9e", "comment": "Malware payload", "value": "5157ca00be96f0241497bc9079102943", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754267, "uuid": "35433c84-f6d1-483a-883a-69f36d68d427", "comment": "Malware payload", "value": "97193126a40ebcce9e9210c32a243e18974a01506e071aeecf8c3777da405e79", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754267, "uuid": "59ff27f6-1608-4315-91cc-9ab30589d4db", "comment": "Malware payload", "value": "9d9f600c1b97465f44f0c044935f9d944e6ddc6b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754267, "uuid": "a634b361-4d7c-4be5-b193-c0fb0ca2cc02", "comment": "Malware payload", "value": "a9c967a9df9e1224c62d5a5908828f2bdd2cac26687793bf16ce70e692a59a7983b7098e14286f5b140afdd0ed721a9b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754267, "uuid": "fafa3d10-540b-495b-8084-09924ad4d272", "value": "T197B284966D0398388433D4B7AC1F443EE75600B351659935BE8CF4A00FB636DFC6EA9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754267, "uuid": "f0b3b38f-cb22-47b2-9714-9fb0884e71e2", "value": "384:e5Got66FF0yNWe70Y5xSmlSEvY07Zas3SvAL002AOobC08mduIW8L6sXs0ry3QiN:266FFFNWeb/vYNsCvALNOk8mMHvQiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639754267, "uuid": "e4086c92-d433-47be-814e-94bacbecfef7", "value": 25160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639754267, "uuid": "845a1170-488d-4799-97a6-357796a067d5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754267, "uuid": "af67629e-0fd8-4b76-9565-9bfdbe4e2fe7", "value": "Curriculum Vitae.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f02cdec-5f5c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639761087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761087, "uuid": "23aec6f5-a32a-4f33-82f4-844d8a832b52", "comment": "Malware payload", "value": "923895a84751bb9beb67373e9e5241d4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761087, "uuid": "1e5a4fa5-30fd-4da7-96fd-48f61d29a2ea", "comment": "Malware payload", "value": "983126bda297a4717f29a9bbf4ccc909851e4648ca99a721623bf0496e390195", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761087, "uuid": "92d48046-70df-447d-b977-b697b99d404d", "comment": "Malware payload", "value": "45b07571d2b31f57865096b54c5fffa51f3bf96f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761087, "uuid": "6ae11eba-0258-4594-9436-b4aa128bf724", "comment": "Malware payload", "value": "6a9a8f1a3db5644b87ad55cc04592a33e0b71717b4b6834ba5e3eb4c977cc16b51179b589bc02831f463850e6b9b1da3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761087, "uuid": "a1e7682f-415a-460e-83ee-b748cdc41843", "value": "T11313CF04D8129F01CA9D563811FE01E07FF78393C39081579ED29E2E4CA12EEDEAE65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761087, "uuid": "5d37c59e-4ed2-441d-82f8-5fd8ab1df591", "value": "768:V/CGCPox4J7n0BKW2rq/eEflhRSfwdDQWk/HQFQrLfxl1IV:QpRn8KWG0lhRSfwd8WgBLfxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639761087, "uuid": "1ddbb869-b4f9-4932-8ce7-39c9828fea55", "value": 43280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639761087, "uuid": "bb64ea5c-765f-4aa6-8e0b-f98d0d898fad", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761087, "uuid": "10a540a3-8eb1-4b82-a97d-d2789c490fc6", "value": "official paper 12.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94629d0d-5ed8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639704483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639704483, "uuid": "dc9144a6-03f4-4921-8020-b4db9e074dac", "comment": "Malware payload (AgentTesla)", "value": "4b813adb72eed9b8b08846b5bfbe4d16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639704483, "uuid": "92bbc2c3-b979-4cd0-8929-eabeacb9c8ad", "comment": "Malware payload (AgentTesla)", "value": "9a332aa9bab9e7e4df66d0ba0323f7ad3d1ee94ba706405c34ff4c7ae620e915", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639704483, "uuid": "ebca9d15-50ea-4a0e-a917-0970ec0a60b6", "comment": "Malware payload (AgentTesla)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639704483, "uuid": "397c02f7-c5e2-4cf7-850e-d6897682ff80", "comment": "Malware payload (AgentTesla)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639704483, "uuid": "916f735d-02d3-4f90-8478-182b2899b301", "value": 628224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639704483, "uuid": "76eacf73-ec8c-45f4-9056-684ccacb9998", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639704483, "uuid": "0dff9a0a-6730-4c4b-86c6-9a52c3699cc9", "value": "TT SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9437b8e9-5ed7-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639704053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639704053, "uuid": "15b5f111-ddcc-47d5-935d-34fce85cf2b9", "comment": "Malware payload (ArkeiStealer)", "value": "e4a29489252c47f33afd4f6b1209f542", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639704053, "uuid": "21c35749-ee0e-4c20-8e60-df27c76e7a82", "comment": "Malware payload (ArkeiStealer)", "value": "9aedd52a94357051a0a8f8a3be9d8dafba18261ec1ff144d8fb52818bd35eb30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639704053, "uuid": "6b16d27b-db3c-4451-b2cc-99ce9bd6bf3e", "comment": "Malware payload (ArkeiStealer)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639704053, "uuid": "d97d9f62-eb9d-4462-bb69-02ccd8db5613", "comment": "Malware payload (ArkeiStealer)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639704053, "uuid": "05f5245e-07c1-4787-a5de-ff7133eaf1c3", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639704053, "uuid": "a6c3ae77-8aca-4919-b0ab-7c3e7e1c077f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639704053, "uuid": "82ac1e48-ca85-4ca4-8af0-fb2d0aef70ec", "value": "e4a29489252c47f33afd4f6b1209f542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4667ad-5f45-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639751478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639751478, "uuid": "74412fb1-9ad4-4bbb-9b6a-62d1e4c1df0f", "comment": "Malware payload (RedLineStealer)", "value": "ab7303c77d35aecfe88f09c06a60489d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639751478, "uuid": "1ed23b1a-171d-44a9-8ba7-834db25d2a69", "comment": "Malware payload (RedLineStealer)", "value": "9b1f043a6551ef0fa8ba27fb9707b11c01332f1ad0e37ae03eadb13aaae2a7a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639751478, "uuid": "b84a3dad-a896-4905-a764-eac1ccc4d9b9", "comment": "Malware payload (RedLineStealer)", "value": "60868e86205c0453bb97f2c5e04ed2310422a0f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639751478, "uuid": "88b371b9-927f-4935-857d-60dfd65f96f5", "comment": "Malware payload (RedLineStealer)", "value": "06d9b0a822d71a8b8ec831f7b78d9f32444ffac151d13874f9423f10c43c690a416cfb37a456fe8b57d4d468d446794a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639751478, "uuid": "addfa5bd-2f5c-46d4-ae6d-5c501a5077b5", "value": "T109F3BF3179ECC4B2D5A3167044669BE18E7AFC216E21958B3758036E2F30EDC4AF635E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639751478, "uuid": "ea13b0b7-66fe-402b-a470-5205054b9cb2", "value": "2b42d753de8a258fdcd0d8efcf6786d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639751478, "uuid": "b0b96d97-09c0-4c77-a7eb-a508b8db6a06", "value": "3072:vLA3/fNm+qXAPjySJm6hjkidWrxpzbgqruTq1QbB:vLUNmxAPjyhniduzbgwuTqGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639751478, "uuid": "a6a75fa0-674c-4429-a416-3c37d6bc6b24", "value": 159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639751478, "uuid": "19c09fad-b294-43db-8deb-2299c9878491", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639751478, "uuid": "9233d7bb-80f2-409f-805a-49a0e5a1e085", "value": "ab7303c77d35aecfe88f09c06a60489d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce55ae90-5f61-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639763421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763421, "uuid": "72426710-f2da-41cf-8c31-50a72edbed43", "comment": "Malware payload", "value": "ca6fd106ff2fd2e69f4e41d6b25612ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763421, "uuid": "1bd42c3c-efe7-4353-9f97-18bfee8c2853", "comment": "Malware payload", "value": "9b8e5e096a17f44ad58c94be85882564e513c851d371b051502260f3f0f5483f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763421, "uuid": "acc1fb9e-0e31-40fd-95ba-2d2b878a6769", "comment": "Malware payload", "value": "6f4a0584b50a40b8e6b085a0844e3c7ea7c632ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763421, "uuid": "a20110ac-dc62-44f0-bcac-532cbaf3c659", "comment": "Malware payload", "value": "d14e706d530ed5120a74e8b9b79c5609fae8a251c34d219b33d4714d316d25494c34ad5e13237fbf6e17673e51aef2fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763421, "uuid": "745ec6b4-5562-4b03-8c97-30016e036ae3", "value": "T1DD21EDA797D36D17CD540233EDAB2710E322BE49859FF113F74112160C3F62A2F22146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763421, "uuid": "8a730068-b826-4b2d-96e3-362c1cfd9c04", "value": "24:vuWqY3D5KjEoSqeEk/rUlFSy4JzLCkIddLM2HSOI9Nfq:vDN3DMwVrkFSy4JzLne/I9NS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639763421, "uuid": "fd2cad7a-2831-41fc-a031-e269ab095753", "value": 1148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639763421, "uuid": "5abbd5a6-9aca-40f7-bc75-51a6ee4d4428", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763421, "uuid": "d18e81da-76c5-446e-8c0c-41b113a4916d", "value": "ca6fd106ff2fd2e69f4e41d6b25612ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420137fb-5f3a-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639746436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746436, "uuid": "145ec437-425e-4e41-8eba-511f3272277c", "comment": "Malware payload (CoinMiner)", "value": "15c8ab4523fbafd14f6eb7d7069ba323", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746436, "uuid": "d6ef6c0b-0b96-4d79-bbda-095ba9cb41ae", "comment": "Malware payload (CoinMiner)", "value": "9c68874771cec3840fdc137626264cce03b572c2cec818e4d7e2adfed24375ad", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746436, "uuid": "5f656a42-4faa-41bc-a1f5-3449572278a5", "comment": "Malware payload (CoinMiner)", "value": "d28fb90740f69941b6ad5b0c1f443a5707b7e269", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746436, "uuid": "7520f078-2e54-4ecb-a220-6e0abdf0bf77", "comment": "Malware payload (CoinMiner)", "value": "ca2eb83957369ac18d04073e648442bdf916d739f0f38efda9f6a18f5ab6ad4cd2d7e85f9fa329d0e1a148fd0c0886ff", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746436, "uuid": "7538c990-e868-46b9-9b6a-7dba38703c21", "value": "T154E52393B44E9FF9E2160EB256923912DF0F1A339EE39495835C531E51E382247CFB89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746436, "uuid": "d663157f-5945-4c0d-a444-a463047cd805", "value": "61c3df730291850fea0c9a7171786100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746436, "uuid": "45b16b0d-8b7d-4bc7-9838-dd6bfb4efd45", "value": "98304:VTqInhK/PoaLCr4MvMYe3OYnChKsLbW3k:VmqhK/TerjifnefW3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639746436, "uuid": "3885eccc-498b-46b8-9fbd-24ec60df5e5b", "value": 3296256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639746436, "uuid": "d71b1332-724a-47ca-a39a-4f9a427c5d4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746436, "uuid": "71905c53-2f44-47e9-9e2e-fe155965bf0c", "value": "15c8ab4523fbafd14f6eb7d7069ba323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4423a0-5f64-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639764410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639764410, "uuid": "be21ffe2-f124-42a4-a9ee-81c4f073b818", "comment": "Malware payload (Mirai)", "value": "5525c0c2e987e79e986e5aa8a8b9b6b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639764410, "uuid": "f2c159cd-f693-40df-8f02-11401096d410", "comment": "Malware payload (Mirai)", "value": "9d183bbd231cb7fc3484e9dfa0a6f975ef221c61d8bc78455f65d5713c580e44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639764410, "uuid": "28b8960d-0fd4-4208-9170-e71f78668474", "comment": "Malware payload (Mirai)", "value": "f7443f8d71e20d3515e04d1b9801a68a4c626aa8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639764410, "uuid": "7c6dece8-b17d-4b70-8502-8799638c6c30", "comment": "Malware payload (Mirai)", "value": "9f6523c4c3dabad2047722a31f0fe1823a2c70729285d86865cbc567e61037c67200600d9ca6e6d18170b054168cc3c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639764410, "uuid": "716c6d88-8cba-4b06-8959-d89d84eeb250", "value": "T1B8535C02B3684E0BF9E61AF5343F1BD483AEED8025E4B585A90FD7464235F33459AE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639764410, "uuid": "27db8a49-48f7-43d5-9212-ab17b25a2688", "value": "768:zipbi/131WUsTETbl1T9Q9n5pY5eEgGsllk5MDMH0a26lBHW2tdFsDMUQSDAYTCJ:zT93Egl1wYAzk5D+8NbK1DVGug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639764410, "uuid": "61cd0ff3-7c83-4401-9279-584a03275eb9", "value": 64188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639764410, "uuid": "4aa8cbd0-89c3-48f7-9b25-d2512285c96b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639764410, "uuid": "9821dec4-0032-4639-a22b-5887dff3d713", "value": "5525c0c2e987e79e986e5aa8a8b9b6b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55bf0a90-5f53-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639757206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757206, "uuid": "10b33712-7b63-4ff0-a84a-cc80db6aa2b6", "comment": "Malware payload", "value": "6f0026779d70dcbd04791f39d3734a03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757206, "uuid": "662e33b1-8bd8-4ded-b51b-560bb2747cf6", "comment": "Malware payload", "value": "9d2f77acb1a7a0e14254b2196176f11304ac207a6654cb8722ebef9f49150140", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757206, "uuid": "42d8ebf2-7814-45f9-bceb-7360fbb72f40", "comment": "Malware payload", "value": "f619032264a5cb685110df031a9beffefceb651b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757206, "uuid": "08606db9-6c16-48d6-9a7d-de363a1549b7", "comment": "Malware payload", "value": "164ab94a08fe9b814f33eaae4f164d96e9b8bedb6788aa329cd43bd1c873b32706bb4f2b7fe112ee8c66b331ef57a013", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757206, "uuid": "c3ce4e14-9ab5-40b6-812d-55c7c9dabe24", "value": "T164139D1D3983CB50FE9308B686F7FB409F2994D94733412C9355FAF08B8D1A26D45ABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757206, "uuid": "345c6242-68d1-4ce9-baad-7d3a6a3a4eb8", "value": "384:NAxPKRuPFwBGmWIMIHQliqRqh7m9MjMqRpgpvb4JFNxG/eCIl70lP/YKm+9DbhtL:NAIIGMNWNq27m96p8b4SlP/R7fhKhKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639757206, "uuid": "2b6c300a-a348-4a94-b2a9-49b195ede79c", "value": 44121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639757206, "uuid": "37cd5fdf-3a07-44ab-82b2-05fe58906556", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757206, "uuid": "791c3e4e-9d6a-4ca6-a543-00a45ab03f84", "value": "6f0026779d70dcbd04791f39d3734a03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba97b223-5f4b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639753939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753939, "uuid": "8f3d5fae-7021-4f97-99d9-01edb71620e9", "comment": "Malware payload (Formbook)", "value": "c1249b130a7fc44e715a7021742a364e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753939, "uuid": "e96e143e-093e-44cc-ad61-9a37993e3ffc", "comment": "Malware payload (Formbook)", "value": "9e3584f6cd588588f405cf4961eb8fba600887c3caa8e23263248de8557a9a1b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753939, "uuid": "5c1bf1a3-ad7a-4b01-bc31-937f877cf1ee", "comment": "Malware payload (Formbook)", "value": "1eccab5c55884e0a7d0fd6c426a960db3f16be89", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753939, "uuid": "edac6ea8-8a30-4820-84be-e4352ff925ed", "comment": "Malware payload (Formbook)", "value": "25f0a6c516c9658f45fb5a6acac276f545c80617363b33368af8a195b9975107061b74ea231b79c209fe7099f76e1381", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753939, "uuid": "f427ce13-2218-43aa-b8c7-1ffd8367f859", "value": "T17864123E30B9D37CCD768A76660B59164938FCD0F41D58218C20FE8F5D747AB892BA1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753939, "uuid": "1d7e1114-2be2-4803-97ca-4c60b917a0da", "value": "6144:BYVoQk6fWNWaVQIGYlj9Gpdd9HLIilBAdF0CQ:BYVoljOIGYlJGpdd9rJAdF0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639753939, "uuid": "6cc8cc13-5a56-4621-a1db-dbf6563e72cb", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639753939, "uuid": "5ccd2c51-b9f1-45ab-893a-92ba9f634a02", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753939, "uuid": "a2062868-09d8-4270-962a-2e5d5dbabe7b", "value": "RFQ.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6046b1a-5f1f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639735061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735061, "uuid": "50e274ca-b2db-4874-a315-f9c6fefb5d03", "comment": "Malware payload (Mirai)", "value": "c654b95dc9173498bab1051c2415fb1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735061, "uuid": "19f79611-a25f-475e-bfa1-4f47e6a71f39", "comment": "Malware payload (Mirai)", "value": "9f2e486daf44c8373a0a1a590cd33cd16a396e0a4e9b0b49e9323bfadf9e7a39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735061, "uuid": "a10dd5c9-f44c-45e5-9b89-474e1d191f7b", "comment": "Malware payload (Mirai)", "value": "501ef1fbf7ef5cd5fcc7b2f9d9078f65ffb785f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735061, "uuid": "ae711acb-b9be-42d9-b6aa-f0a8d6d30db8", "comment": "Malware payload (Mirai)", "value": "602f54f8dc7e81d7bcc9f1a8f56f4e5797a9eb4fc59aa4aaa0ee27ec5e25b41e7fb3279c5800a82e2a33cec788f10c83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735061, "uuid": "81107da3-f265-4e6c-9a92-155c80907019", "value": "T1F7734B4371280A47D5920AB4253F5BE083FFF99034E4BA88695FEB5A8635E771086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735061, "uuid": "1d85bcb5-56ef-4977-8fb8-2bed4362717c", "value": "1536:9ldfVco/Crhj11ss+Fvd6AeyQx1DSzpI/fa:zghKFvl+0pIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639735061, "uuid": "c96060bd-629f-41ef-bd1c-90d4dbbd74ed", "value": 77064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639735061, "uuid": "cb6dadb0-312f-4066-b3f7-962ee378a0e7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735061, "uuid": "654d4a5f-c606-42e6-ae94-26573ccbe4ab", "value": "c654b95dc9173498bab1051c2415fb1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768be929-5f87-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639779595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779595, "uuid": "e802db71-608b-4100-b1a6-e436b45b7717", "comment": "Malware payload", "value": "82b69706ecbaeb0caedbfc5f879a7250", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779595, "uuid": "44c0832e-1ece-4402-ba74-70265925b30f", "comment": "Malware payload", "value": "a0bb722a31adb96dd78626011adef4fe7e9aaa0cad720d739e2bfb83c5b2b8e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779595, "uuid": "2f35fcc3-90e5-4792-8c69-6632eea876ce", "comment": "Malware payload", "value": "40a6ae443614f86063b55b62039320c9540e791b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779595, "uuid": "71f11842-0005-4301-b95a-59feae74ea33", "comment": "Malware payload", "value": "4cd960198228754bfa2e84b6d663ca32fcf1b271ed3722eb0846931e6b5b5d39333962aeb5f1e16d9d9fe63e327fcefc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779595, "uuid": "27b07f9d-ccac-4e16-a95d-b6c356a57ca3", "value": "T19C35F58525AD3B25FD7893F800AB6C94C7BA7D2A717AC68D4CC330D72973F924850A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779595, "uuid": "8871ba69-0f04-4002-b254-2d3566860c80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779595, "uuid": "b01d6f79-3635-4875-9e91-e5887cb05867", "value": "12288:WKc2qWOmDUUUUUUUi1Bwz/z+BS4CIBAgPxEEzkNsAICOuSK31UUUUUUUUUJn2iN:tVqWPPKC4DIdkGRkSK3a1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639779595, "uuid": "45f54510-967d-4f58-9081-0f79d5df0b94", "value": 1073664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639779595, "uuid": "1b75a5f2-4843-486c-8766-f02cc4dc95d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779595, "uuid": "27e4fd97-9410-4ebb-a091-b4dc0fd988be", "value": "Bank Details.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5595f8-5ef2-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639715472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639715472, "uuid": "76608287-cf1d-41e5-88b7-d03b9ea3253a", "comment": "Malware payload (ArkeiStealer)", "value": "33bd29945812a1e8e7404bdc50ca248f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639715472, "uuid": "04afedf6-ea73-4130-9205-a0800fb4317d", "comment": "Malware payload (ArkeiStealer)", "value": "a0cd7c3b8bd48fcccd71e09af5751dfa98dd90b797a4272f22b213708632ad6f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639715472, "uuid": "b6543e93-07d0-4d73-b91f-292952563152", "comment": "Malware payload (ArkeiStealer)", "value": "86b379511263e633db0ffb17974df6f3fbf9ab83", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639715472, "uuid": "73170ed6-3c56-45c6-b7c1-f89cb942283b", "comment": "Malware payload (ArkeiStealer)", "value": "7de8ddf2c2e0ab7bc5720c3785d97245c47c7017ffb535e3df3cea396565d8d5c80380d4ee77404957500ad2536960cf", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639715472, "uuid": "488d543f-9f8a-4a0d-b18a-9f3c402b4724", "value": "T10605011077A0C035F1B612F84A7A93BDBA3E79A16B2594CF13D556E90A787E0EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639715472, "uuid": "913877a7-3747-45d9-95ff-b10e6109a273", "value": "9a8dc8c7cdfd1f0f0b247a3b1f86c91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639715472, "uuid": "1a571ae9-38f8-4fbf-b8c8-4b68ed1adb7a", "value": "12288:lXpoUGZY9DrG7num1HucUjWrOiqvc4vhe2ujWG1lWo5JFn5HbqjK1bODm:lXuUd9q1O9qr2FheHWGr4WbGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639715472, "uuid": "7e00d7e9-fdfc-4d7d-b0b1-cb2af3fd1cd1", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639715472, "uuid": "036216b2-a762-4fac-96af-4600c4d143d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639715472, "uuid": "2892b0a5-c4a0-452b-92c3-5b34f8210517", "value": "SecuriteInfo.com.W32.AIDetect.malware1.24699.23437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04aa2dd7-5f1e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639734307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734307, "uuid": "f743191c-3030-44df-8ab9-d5298025cc5e", "comment": "Malware payload (AgentTesla)", "value": "6e5d6e827ec4454c84a9d3bd32eb815c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734307, "uuid": "6b9485d5-90fe-4d23-87f4-3337a3198230", "comment": "Malware payload (AgentTesla)", "value": "a16f475c93da510d109b982cd2153a0a60e37b85c2549cc0c6c2fb8a70c736d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734307, "uuid": "27a9e9f4-7e2f-4835-8cd0-af903eaa493f", "comment": "Malware payload (AgentTesla)", "value": "1e7a99605e78c90890139963bfb68e8c9a350c62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734307, "uuid": "b19c1ba3-59fe-4e47-a205-0a86d9a3b915", "comment": "Malware payload (AgentTesla)", "value": "bb11d22a4a2b000fa476639378e49094ea4ee0934c3369f75d14b9f753aaeae462b655558b7608aff7b212ab71b4b349", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734307, "uuid": "36223dde-7dfb-4edd-8569-c3a8449cd152", "value": "T1AEB412C453B0EB6BC5760BF9A47991C487B21A556313CF462DDB52EF88237820E32AD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734307, "uuid": "ffc5bb5a-ec9c-4062-9bbf-3d62a791f81a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734307, "uuid": "97bb1c80-cfb9-4522-8752-7f054ecf00a6", "value": "12288:UFxpwIT3/KyPUxK4QP04NZMy4zZZLNgEYuSK3vkmyyy1pWy:U/pwCXPU6P/WZZLt7SK3vkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639734307, "uuid": "8f6d42b2-250e-4722-b46a-844676512fda", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639734307, "uuid": "5fea0919-e0c5-488a-b946-36da385e0f42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734307, "uuid": "7051b685-9281-46bc-ae10-cca4fce08dd8", "value": "SHIPPING DOCUMENT & PACKING LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d5337c-5f0e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639727578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727578, "uuid": "31005e7b-7cc0-4de3-aeb5-36f8a9d6cb00", "comment": "Malware payload (RedLineStealer)", "value": "67152b967be7058c9d7bc02353b342eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727578, "uuid": "41ee83f8-0f1d-463f-9553-3239d68afea8", "comment": "Malware payload (RedLineStealer)", "value": "a17209b819a454f90054a6de229f948177b1e421f1bd2c17d5633d64bc412c5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727578, "uuid": "3dc36449-29bd-44b1-8a40-671eda47b18b", "comment": "Malware payload (RedLineStealer)", "value": "38b63764e9be58180353cbb206f13a6668bcb9d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727578, "uuid": "32eea294-c949-485b-b100-c6e494e1b28a", "comment": "Malware payload (RedLineStealer)", "value": "2fa49b9639ac7098ec42f092b2109f8266b09ea5bccd4370aff9da1a5bf86e77c44bc79c3b60c54ea4c4b2f9033a8c27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727578, "uuid": "c2e68eb2-f45b-46d8-873e-f0f3c20296a5", "value": "T1E5A4AD3D77844D80C655193AD1EBC01847E3A79B2373D34BEA7B40932ECF3A5495A2E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727578, "uuid": "195c1934-542f-46c9-b25f-2a192845aaa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727578, "uuid": "700d30d0-f52a-4456-af34-7b59c184a67b", "value": "12288:eYHCJjl1nLYUN0Jvsd66kizWGcUddtpFEM:eYiJjlCUNQvs3RzX/tjEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639727578, "uuid": "b3829d21-9399-44e9-a395-50607ea4885d", "value": 485104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639727578, "uuid": "82f62946-d3c6-4bde-837d-0f8f2c448209", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727578, "uuid": "891d80b0-198b-4726-ac12-87690320bf82", "value": "67152b967be7058c9d7bc02353b342eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d58f63a-5f6a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639767151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639767151, "uuid": "65d06a0d-a00b-4435-b521-aa80a1fc9046", "comment": "Malware payload", "value": "840e01d333583e11b123c378fc7741e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639767151, "uuid": "790c2326-bba9-441c-a060-39bfb589eafa", "comment": "Malware payload", "value": "a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639767151, "uuid": "abfd50a8-edb2-4f14-bfa7-19f7fba051bc", "comment": "Malware payload", "value": "8b9e42afa53aedfbe89964ce50ab2dd15f7cb725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639767151, "uuid": "53584832-ed24-4f8e-9ea6-d5717203f4a2", "comment": "Malware payload", "value": "bfc6e994f88e127cc7eb3d1a48e6bceb4dbaa186c1b2058ddf357a0278d04a287b74e5c9fc2fcd23a181d924028b5856", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639767151, "uuid": "fafc3a3b-6deb-42dc-8e72-b040ad45430b", "value": "T151A4230C96D22257CDF965742835B3B7D2FBC381120604D5A3AA6F5F9271A83CE9A8F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639767151, "uuid": "878f1c38-0a5d-4a50-96ab-9788f2ebaa2c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639767151, "uuid": "be5f1dcf-8f70-4ea9-b3af-62a9611e81c0", "value": "12288:3C8ayCBzXRGDH8vk6Ssj4ThacujdpsXAeoxmm8Fr:3CpyCdEDcvJzcux/eoom8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639767151, "uuid": "b64db073-d411-4ffb-94e0-c8d4aae192d7", "value": 466946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639767151, "uuid": "2f4fba2b-9261-4204-a029-76fad11c1455", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639767151, "uuid": "bb344a7c-420e-4701-9a86-1f04ca7b4b9c", "value": "SecuriteInfo.com.Trojan.Risis.1.Gen.6650.11337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110439ac-5f39-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639745924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639745924, "uuid": "ef5b813e-af15-4e77-9cdc-c1273437bad8", "comment": "Malware payload (AgentTesla)", "value": "b98499d828c8540a40f10e2cb73457d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639745924, "uuid": "f948b7e6-086d-41bc-9c1f-2f23695de4cb", "comment": "Malware payload (AgentTesla)", "value": "a2a6e9e20be0c2faf8206f084fb1badb04a4c11d6dd47defe64a42f3e203e102", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639745924, "uuid": "4457e991-84a3-4677-b173-e9a01d47af1b", "comment": "Malware payload (AgentTesla)", "value": "6d583881d1e9a5ecfd5a28862b7869b4ccf40573", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639745924, "uuid": "b46655e6-9cb9-4400-a97c-31befda490ae", "comment": "Malware payload (AgentTesla)", "value": "784d27b081c63acce51f58c87ffc5305a970f0a14989681f96f1d317608b0cbcdf85a32abbcfd9ee2f5a090485ccfac7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639745924, "uuid": "201e4b94-42d2-4ebd-8389-3eeb6753b23d", "value": "T1D62533AF2E7422EC1E150BF61C38BFC41584FBA2CDD99215B25C8CC12D96F1979C1A3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639745924, "uuid": "40ab769e-251e-43ad-9d21-2d89989a1ad4", "value": "24576:wCBtFzR7iouFoIfM9KBTMpKvYMB1nYvLaIQANIATyAQASLHjSjx:zFzR8FoCsi2KvYMB1UHN1EASLHejx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639745924, "uuid": "b6b1d35e-103d-4dff-9476-48b96528e02d", "value": 1050768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639745924, "uuid": "e99de066-ffb9-4b7e-9c28-161f9a891bc3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639745924, "uuid": "5979b0ad-dcdc-4ea0-b85f-98c2ca8a3453", "value": "BL-SHIPPING DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d03067-5f62-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639763914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763914, "uuid": "e6ea9629-4b2e-4415-ac62-3d68b0aa61b0", "comment": "Malware payload (Mirai)", "value": "1f8d424237a16b30271a6d21a1d58337", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763914, "uuid": "0ccd931e-ee30-48f7-b37d-bf53df804861", "comment": "Malware payload (Mirai)", "value": "a2c7237836ac03be580b8743786b8d1c6e153264fb9be615f50d9795409878f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763914, "uuid": "778e1c69-031a-45b3-a3f7-cc20f8b9b73a", "comment": "Malware payload (Mirai)", "value": "c1b527d038d7089d445e8ffe66d720a5e1f97d6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763914, "uuid": "b7d521f5-65b5-431b-9341-851f3dcbef36", "comment": "Malware payload (Mirai)", "value": "20dd031e0c544f22c9342b2d3f19f04c4511adacb7304da0b3ac534bca468daaf89b8d7126b02fca08cecedcbd7f3e7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763914, "uuid": "a4b2f48b-afae-4c5b-aecc-6c516bbf8fd8", "value": "T169A3B7092E258F7DFF9A82358BB78E119658339A36E1C545D15CFE021EB034E341BFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763914, "uuid": "736440dd-4172-45d8-8283-79c062e11a02", "value": "1536:cLjZTpRdjYAhril+nv5YTPncZ1OwMSn45MlAaqPKIodZ9Cd42+RQa13/S:wVTp3hr2+vEP6fhqPKIodr2UBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639763914, "uuid": "e1e61aff-0562-48a2-aa39-6e92337ce3d0", "value": 106728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639763914, "uuid": "f6894a3d-0262-4eb2-b254-71b5f5efcc06", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763914, "uuid": "e72feaf6-6891-4c2e-aa9c-c998f7aa7a40", "value": "1f8d424237a16b30271a6d21a1d58337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6231ff-5f7b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639774322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639774322, "uuid": "29b9fb19-6c55-4af1-bf3c-5026d338340a", "comment": "Malware payload (AgentTesla)", "value": "90b6a248c369cec0a291c17cc8496df0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639774322, "uuid": "4c95abc0-ebab-4d80-bf33-9aff98dffc14", "comment": "Malware payload (AgentTesla)", "value": "a487e3820b9420120d7590d6896e38711bca8f59361acfeb469ef31737fec78b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639774322, "uuid": "886c8fba-d7d2-4603-8d3a-22c0eb97d26e", "comment": "Malware payload (AgentTesla)", "value": "e35a595a4634ae28f4580a3c9d2bbda24b4a7384", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639774322, "uuid": "e2a0d644-413d-421a-b0f7-d20dbb496255", "comment": "Malware payload (AgentTesla)", "value": "9831ed2d89be35082ae5fd3723a88c7e1288f68dc180b5ad1de785d2502d73317bf7878c04501e1d987733b1aac082d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639774322, "uuid": "b6c23e1e-7213-44a7-b820-94323e9eb56d", "value": "T155B42366F0E85CBFE66117B94A190EB6A3F4B94042AC5D4E33D49B5B32F7B4244CC6C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639774322, "uuid": "288884df-ddc8-4243-b3ce-308c7d1cac2d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639774322, "uuid": "2ebf8eab-f878-484c-abaf-ff1d8b318ce6", "value": "12288:b7sjFqNeokdqnMyW3MtExvFlS6Q8VcIuoMv566WYSzHbWoMm:YFZyp8MoS1ug66jSTCoMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639774322, "uuid": "a7576b60-d397-4821-a255-e674043b751c", "value": 521131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639774322, "uuid": "f93ac6c5-744d-48fe-9d90-7aac17e67363", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639774322, "uuid": "d057c27f-340d-4d60-998d-afd234746714", "value": "IMG_SLIP2021217_54600_JPG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d97a2c-5f00-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639721687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639721687, "uuid": "a207ef95-e496-4999-bf32-91591a1a9015", "comment": "Malware payload (AgentTesla)", "value": "c39bbef9466b99bb0bcc931eee4d2154", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639721687, "uuid": "f348736c-350d-4ad7-b005-96e8726a61be", "comment": "Malware payload (AgentTesla)", "value": "a6e8bbf4b3ec7b44f670d49a9266b436e627a9d1694c3a538362c62a13f7c8c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639721687, "uuid": "890995bc-8507-4029-a519-85df400e06fc", "comment": "Malware payload (AgentTesla)", "value": "e1c8421a6af64635e0a534c1c66e372315b8199d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639721687, "uuid": "721c05c0-d6ed-4463-848e-d28ed502a119", "comment": "Malware payload (AgentTesla)", "value": "ac345ea2d8fc4f2c7e1e3588ef0835893df81953a0e7842110830c90a42cddc4c5f15a74f71d86793de6005ed614ec88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639721687, "uuid": "f2fba9df-422f-467e-8b09-68f2b910778b", "value": "T1C22533AF2E7422EC1E150BF61C38BFC41544FBA2CD999215B25C8CC12D96F1979C1A3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639721687, "uuid": "67b99113-5fe9-423c-bd4b-57a27546e8ab", "value": "24576:LCBtFzR7iouFoIfM9KBTMpKvYMB1nYvLaIQANIATyAQASLHjSj2:mFzR8FoCsi2KvYMB1UHN1EASLHej2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639721687, "uuid": "48e6f054-9b38-441b-8e92-96e3b6ec1b64", "value": 1050744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639721687, "uuid": "5abc92e7-2ac9-4639-a01e-d1be772b14d5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639721687, "uuid": "c3365e18-8b0d-43f7-b12c-8d1916d51424", "value": "BANK SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8bc635-5f4e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639755097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639755097, "uuid": "b8678f7c-d235-4f87-88a2-b48ff612cf50", "comment": "Malware payload", "value": "755f22dd8f32a0accc8441b460278d17", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HRV", "colour": "#2203F5", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps", "colour": "#60C0A6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639755097, "uuid": "b6c25b64-1ab5-49b9-b9c8-863fe854fb86", "comment": "Malware payload", "value": "a6fa02f9402757a022db5de795fcf16391616f8789ff48646f9fdefbca3d7e79", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HRV", "colour": "#2203F5", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps", "colour": "#60C0A6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639755097, "uuid": "395b5126-6a31-4557-8279-890482e2cae6", "comment": "Malware payload", "value": "95cb88732484d9ab81a61e88ecbdafa678c07a03", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HRV", "colour": "#2203F5", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps", "colour": "#60C0A6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639755097, "uuid": "188bffd1-40a1-4701-808e-672e49b8d9dc", "comment": "Malware payload", "value": "8c3e4869ddbfaf8123d1f53d9f24225f11afd80b6d8f00c3fbe65de42312793e74c89360d06e6ecdbfd6fea03224349e", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "HRV", "colour": "#2203F5", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps", "colour": "#60C0A6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639755097, "uuid": "0e3c1d9b-37f1-4bbc-abee-488f4bf82d6a", "value": "T14FE194502326C598051D6510F4DEA20C9ABA7317308908E5B7EDDA8CBF8A675C7EABCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639755097, "uuid": "8ac39fa2-a029-4d09-bffa-19c91b25a8b5", "value": "192:VKpsD/mCDDwYE8eSsAgtvb5gAlFdQQ7azao:esLN3Leq+VS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639755097, "uuid": "a9c30795-50df-44f6-be72-03830c8d1ec1", "value": 6928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639755097, "uuid": "19361b13-f943-48b9-bb4e-7f5f1670b0f7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639755097, "uuid": "dd79b3be-8f59-4271-b548-86ecc31c7b51", "value": "payload.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8676233-5f06-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639724300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724300, "uuid": "af0f3c07-00a3-4a5b-b307-7836ec031647", "comment": "Malware payload (AgentTesla)", "value": "75461a1e61eb258c3f4cc658fd7de0a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724300, "uuid": "1f946562-5bd8-4061-92cf-efdac90581cc", "comment": "Malware payload (AgentTesla)", "value": "a71854d030cccec9d7cbba438f353e143bad348a78bbaeb9f88a2b5ad1995b75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724300, "uuid": "9ba8e607-7edd-4771-93bc-a68140200c94", "comment": "Malware payload (AgentTesla)", "value": "20452f63ff4e0240830464a5f7dd82a866f2b217", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724300, "uuid": "160910af-a275-4183-988e-c136f7d2c4ce", "comment": "Malware payload (AgentTesla)", "value": "6dbefa7c7db62dec055dbab18e8e0391fdc8cdd4e60a6b3595fa26527602925a614c75f1e4d02963692ea0c4807c6c1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639724300, "uuid": "b149a539-6553-4403-a029-60a637ccf592", "value": "T197942322155FBB1E920245B743FD6334E0FAC92D6599CB67E1604D370232F5F1B3AA2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639724300, "uuid": "ac38f788-f2ef-4558-9a83-4df8fe164c5b", "value": "12288:lsqP95v3l6O3Ryai2D7V0fxjVnWc9LW+LVmv+kqx72SrUo:bnN61atD7CtRNU+JsWqYUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639724300, "uuid": "8fd0291c-56e1-4a56-a907-c0724f593aa3", "value": 440822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639724300, "uuid": "3bc4da0d-17c6-42e9-aeef-5dd91f0c506c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639724300, "uuid": "bad5e299-beea-4762-af04-dd5478a2e036", "value": "STATEMENT OF ACCOUNT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7d67f1-5f68-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639766504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639766504, "uuid": "a84b9fe0-bf61-43ea-9f84-e344fb81bb97", "comment": "Malware payload (Mirai)", "value": "03f7fa0dc4c208894c0f66b1f015c439", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639766504, "uuid": "382014a9-8040-4d7e-812e-eb27c6f44c90", "comment": "Malware payload (Mirai)", "value": "a82e53aae4973df667cf4b3fddd44a4834ce6548df0416bc9049dc7d06e3c645", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639766504, "uuid": "7e62c55b-37b8-495a-86a8-bd436d1646f2", "comment": "Malware payload (Mirai)", "value": "ed8d660b76aa995ed58a0794be50597612bf00e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639766504, "uuid": "5f067d4e-7838-446f-9331-b9f9c56e8f85", "comment": "Malware payload (Mirai)", "value": "5baa329f26a6e7c4918c14b1eb500e489c7c5fef9f2dc14bc8be8bd146204e7e54853414aee0280d3f3c95b98b35cd00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639766504, "uuid": "77b658ec-bece-451d-81df-f1f0d6aa1ab7", "value": "T140832996E8004DFCFD6BD5BA85224B09F92177045F630F2B9667FDA36C231E5BE06881", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639766504, "uuid": "545c2dac-ad12-4e86-993c-4be497c648b7", "value": "1536:nbarwqWxoiLWzg4z+lK8ugl/H9xBdSdGxXDCpcKlPrb8Wl+j/hP9AEfKTvp:O6xkzh+li81xBdSdGxXDCWKB7uPGEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639766504, "uuid": "3b0f1362-2c0f-4eb8-9218-cb376ee96934", "value": 81044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639766504, "uuid": "b83bf2e5-128c-46a3-8ca4-c4d3f9194c4a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639766504, "uuid": "a70628f3-f421-4b35-b6fa-ba827a609fba", "value": "03f7fa0dc4c208894c0f66b1f015c439", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca372e17-5ed6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639703715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639703715, "uuid": "b4d37636-7cef-49a2-aed0-25c6a0cb84bf", "comment": "Malware payload (Mirai)", "value": "604d4fcb174174136f012237fbab2ead", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639703715, "uuid": "839dd340-e55b-4970-88f4-b58f755016a2", "comment": "Malware payload (Mirai)", "value": "a8ba90aceb8b82618746f027511d7ee052703c165f20a566cd65d502797f4eeb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639703715, "uuid": "426ccafd-272d-4f7a-b93b-eef03995dc9d", "comment": "Malware payload (Mirai)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639703715, "uuid": "2f023969-4806-4d50-884b-1ae0cf9a14e3", "comment": "Malware payload (Mirai)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639703715, "uuid": "63919937-042b-4e36-a27c-0f825544cfb9", "value": 31844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639703715, "uuid": "0d553972-91a1-47d0-a885-f9d22564d833", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639703715, "uuid": "eed332b2-92bf-41f4-8c9b-587ebec4d08e", "value": "604d4fcb174174136f012237fbab2ead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ae9ead-5f54-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639757607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757607, "uuid": "83f3f813-a06e-4964-9d73-57627e928fa3", "comment": "Malware payload (Formbook)", "value": "c120bfbcc44b1b65736f3ea0c25f6f44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757607, "uuid": "37af25b0-31a1-4e13-9e93-194c398960f9", "comment": "Malware payload (Formbook)", "value": "a95c61dfc2636d3b7420f5f22216bc5cd579aebc88285f81b7f63eeae91c18d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757607, "uuid": "d55b7627-7662-4a49-9d9e-4d0fc9a269e7", "comment": "Malware payload (Formbook)", "value": "526294c9ffa6015a18f9850e797444737cead37a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757607, "uuid": "0f86b37a-2ec2-408a-b9e3-9a958a6f1cbf", "comment": "Malware payload (Formbook)", "value": "ac6f285232bb14dd00897cd509a2936f0a2af53e50c947f640a3a9b75271cb9354a84602375ba5dfc983180ff3f40c7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757607, "uuid": "ed47c133-638d-403c-843c-2a8902e5fdc1", "value": "T1D0C4DF1072A99F12D9BDA7F48C60A0A007B97D66A93AD74F2CC17DEF31B9F404690B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757607, "uuid": "55c721a6-30ff-4263-8414-369a72c146f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757607, "uuid": "7d8d2d14-fc70-4a02-b2ff-a6802d03908b", "value": "6144:ZzoY18PTRKXpPTRKXpPTRKXzubGKEyXuD6TyY1gqmD7rWnpSaTjUkinrX/S7Qpn/:f8PapPapPazuSK3uD6GtD7y7X+apoFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639757607, "uuid": "1aedef70-c2c1-47fd-947b-e11055b902f2", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639757607, "uuid": "5feda134-7c36-4250-9129-0e3457cac01b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757607, "uuid": "9befeb06-30a0-4a70-90e7-762b4ca4ffd6", "value": "c120bfbcc44b1b65736f3ea0c25f6f44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c917eb3-5f09-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639725462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725462, "uuid": "620314fb-e0bf-49fc-a6b4-0bbe57b1ce6a", "comment": "Malware payload (AgentTesla)", "value": "a599c9aa79223f515034135cbb61e50d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725462, "uuid": "eb82e02f-9a02-4127-bd9d-736f06e84a45", "comment": "Malware payload (AgentTesla)", "value": "a974e03e51e5005b27cf9a39c1ee7f607b959be14ae985ee29be1afa1bd2199b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725462, "uuid": "3ec861e6-ba49-4e34-a74b-acfc2b6d1b58", "comment": "Malware payload (AgentTesla)", "value": "c65aa2efb32c857a19fdc612a922966d99ffcad0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725462, "uuid": "e1e85405-8dac-496c-842c-ed83fa36f253", "comment": "Malware payload (AgentTesla)", "value": "a77440af040e826dd7f2f477a22bb8112789b3a26471159cad8894c448346e88e0de347b17756949b76840ad0f3464ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725462, "uuid": "ed3b8e5c-6ef0-4b02-a56a-0b3210df72af", "value": "T174C4EF1132A8DB26C4B9A7F84C60A4B007BA7D16A676E70F1DC17CEF31B6F904690B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725462, "uuid": "d0c735b8-6e58-4818-9e81-3468fb90ccc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725462, "uuid": "669e5280-9244-42b9-827d-08857d24b90d", "value": "12288:r8PapPapPaxXHt3dzRUIsglt4bz3Tn6InJBuSK3:r8P8P8PcN9RTLmTWIJUSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639725462, "uuid": "eb761447-e661-4c12-8b18-d46f99f67e69", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639725462, "uuid": "1448f486-9d23-4a95-af2f-42cd7088e877", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725462, "uuid": "2a600f3a-dd29-4310-b5bc-0c7e2eb6b36b", "value": "ePnirgeRVNAgcFI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d46ada-5f79-11ec-9275-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639773546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773546, "uuid": "31c17ea6-c524-4978-9e3e-951abf523bb2", "comment": "Malware payload (Dridex)", "value": "167b114e3a8c687aa66deb226015ae3c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773546, "uuid": "21bee051-1a68-4922-89b9-b7832c077091", "comment": "Malware payload (Dridex)", "value": "aa273a0d181ce95a4c27507000f9d961b975fc66ec321038a1c79e7fcc3bec8e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773546, "uuid": "2b541e78-3564-4d14-99bd-50d5f16f0910", "comment": "Malware payload (Dridex)", "value": "326f520301cd843c2eef1c68c4315d54e8f33491", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773546, "uuid": "7ee21219-771d-4c22-a716-aad07921bfcb", "comment": "Malware payload (Dridex)", "value": "095b2929a7390106146202c4cc6ac0436c7a4dfd0639e53ce4ebd8bd9ceb09a231f09c69abb74a8444114143131a8c37", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773546, "uuid": "0f4e9cb9-ebb7-4f5a-93f2-76c70152334a", "value": "T1DEB4BFAFC65E1478C7E31870159143B12EA640C6097ADEAF6B2FFA9C149634C227DB7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773546, "uuid": "01f3d7e6-158a-4497-87cb-742df3ffec3f", "value": "1d03489a888f9eb61ae369ecc7b0879f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773546, "uuid": "2fb03ab2-83f3-4ba1-997d-4bcbe3c4549f", "value": "6144:ilkqY8IIaCme+UOwOYEKdvfrlEe/ply5ovxlbL6B4Q0gY:m3BdvlDx5OxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639773546, "uuid": "deef9726-c678-4e9d-aa61-c659635701dd", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639773546, "uuid": "447d108a-41b5-4271-96ff-fc3a6711581c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773546, "uuid": "f6df02d8-fabf-45c2-afd7-e7e00f0f6e1d", "value": "SecuriteInfo.com.W32.AIDetect.malware1.16650.9580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef57d8c-5f0c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639726915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726915, "uuid": "a29d7ed8-ab75-4c47-b688-9eac83b17789", "comment": "Malware payload (RedLineStealer)", "value": "ecb655450073347520ef32e93ce63b87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726915, "uuid": "3ac8eedd-59e0-4072-bf26-3eb99634acbd", "comment": "Malware payload (RedLineStealer)", "value": "aa5d64ea27f3815042af53f0bc229a7c8dd1f3cd090c1e21eae2a016136f20b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726915, "uuid": "1cf97794-43e4-476c-a191-9f2b9388870f", "comment": "Malware payload (RedLineStealer)", "value": "88975d07d6c3c530af25d9015fcbc10eb32b2fb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726915, "uuid": "e60aa70d-8692-447a-b193-b3e7470c7d50", "comment": "Malware payload (RedLineStealer)", "value": "2e8b94472dbb10eaeff9184db5cef74435b3b404cb1814aecb42d71d2537e9637493450f61918c5dcf4c2b901e812eb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726915, "uuid": "ea2ad863-5cec-4a3d-96e6-37cdd956e047", "value": "T1938533E1F39459ADE74D113D87FC4B161D2F911199CC868BA98A0C05FA36710CAAB3FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726915, "uuid": "f3a951b6-27a3-4252-af5d-fcaf718ec6c0", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726915, "uuid": "99e5b472-9f23-4117-bd9d-cf684fe54a5e", "value": "24576:HfIZX1Sg9mWqk7t9VTrVX8bnQq27dzmUc/kFDMkEaHNYK3t3r/ky8z:Q91ZmhqP737dKVsZMNaX3Dky0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639726915, "uuid": "bf50c9a1-a2fb-4911-a2f8-a88499996611", "value": 1750248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639726915, "uuid": "f17aed7b-7c90-4233-b8d5-143ef6a0ef25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726915, "uuid": "4686fb82-4912-4075-bee3-d2a9bf18a826", "value": "ecb655450073347520ef32e93ce63b87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d9d442-5f35-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639744588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639744588, "uuid": "a418f7e3-a866-4655-997a-6010966afb23", "comment": "Malware payload (RedLineStealer)", "value": "3ea8e293fbb7f3a8384cae278e4a1e5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639744588, "uuid": "fd3df2f5-0bf7-4274-bb33-5ea1a70a1702", "comment": "Malware payload (RedLineStealer)", "value": "acc909d0eaccd8b8694b9a4924c81ed4f593be09e042accab5c8ebd960a0fb4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639744588, "uuid": "575f6ce7-c157-4eaa-872b-c8a49cc99d3c", "comment": "Malware payload (RedLineStealer)", "value": "944acbfd647882b5ce13b6d9287ebe3730858d8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639744588, "uuid": "58a41807-b683-402d-aad6-4e6effbb1f44", "comment": "Malware payload (RedLineStealer)", "value": "f472c9ef848ceab032fa6be7ac9efc4e977b74836eef005eed2e3f67254a9c15b62d53d70356e56ab0c0d2360fb115ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639744588, "uuid": "4d44dbf4-20a3-41cc-ab2e-56c751eaf531", "value": "T17EA4CF10EBA1D034F1B212F89A7693ACA93E3EE1672450CF53D56AEE56346E1EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639744588, "uuid": "2f055e9b-0314-4a43-8adb-37c4f92d3e51", "value": "1371983aeb683ec0dda1a6e9e2e0f707", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639744588, "uuid": "388da1b8-4c44-4bbe-a288-bff36704c0e7", "value": "6144:ia1ko5cgCyPB+8C6bY37tIij/4HyT0qe71C/VtVQiVIoxnt6j:9VPB+8tY37tIijMygqe71C/VzQiVIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639744588, "uuid": "61543794-4bcf-4232-940b-53b5b3c58af1", "value": 455168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639744588, "uuid": "b662a3df-ee63-4180-9841-32ae9b9d59bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639744588, "uuid": "72769ef5-f549-4254-8f4c-bcc31d06f3cb", "value": "3ea8e293fbb7f3a8384cae278e4a1e5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c3cca3-5f8a-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1639780881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639780881, "uuid": "72155af3-a257-4325-8cbc-5735a80ef959", "comment": "Malware payload (Amadey)", "value": "c043653f46ac89e4a34c7c4996022d83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639780881, "uuid": "54e9b697-c558-4100-bd34-99d535ae330d", "comment": "Malware payload (Amadey)", "value": "ad30423f97f16e9b3a4fa589c069a33beb37e1dddc25d45f189f74f2ed6070ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639780881, "uuid": "43792850-1e15-4ba4-b61f-a91dc17da047", "comment": "Malware payload (Amadey)", "value": "565290ba8b0eeddb1911613755330719e8ddd227", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639780881, "uuid": "9311647f-ddbc-4f79-9a85-81ca0bb9fbea", "comment": "Malware payload (Amadey)", "value": "1d15a69ec8cf0a5bc75595a52e371322536f2271503a4ccd16ae59ed3584ad59cd656e2d7bdf156714ed6759e1093bc0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639780881, "uuid": "88d500c4-0c68-49fc-94c3-ce9a70f4e804", "value": "T114747E6AA290DF00C759193BD0538A6543F2E74766F2E79DED3752532F833F489852C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639780881, "uuid": "7be2b828-8720-4be4-9476-4a0e3fd80eb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639780881, "uuid": "245fb701-717a-4d7c-afbf-7a14947f9104", "value": "6144:anEmX3VGYgFPkMZUuwU/dsaeAqNLFYH3Z3iwmSI8H:WFBnM+/iaaeAAG3bmS/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639780881, "uuid": "fd3488c3-a916-4d5e-9b42-96a7b349fb15", "value": 355568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639780881, "uuid": "49c65c26-4811-4859-ac36-8c6ff97c68ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639780881, "uuid": "6c909edb-2dd0-402f-9590-522d2b3eb191", "value": "c043653f46ac89e4a34c7c4996022d83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489dea18-5f52-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639756755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756755, "uuid": "93996458-5eef-4407-af9a-784f57fec06e", "comment": "Malware payload (AgentTesla)", "value": "541b13066c1f1fc1708a576ff9d3fb13", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756755, "uuid": "0a120529-2229-4281-8fc4-b15067a94cea", "comment": "Malware payload (AgentTesla)", "value": "ae3850f33078fb7b48c5985888a0ffc3ac43bde6e371b03de6b1a2556b924691", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756755, "uuid": "61b81423-6a6a-4ace-a6db-bdac12162df1", "comment": "Malware payload (AgentTesla)", "value": "367d08099fe9d99554aad3102ccb355cf7c41087", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756755, "uuid": "64d5ba98-6e29-495e-b39c-d722992bc0a8", "comment": "Malware payload (AgentTesla)", "value": "10cce49821884a13f8c808acdc531ba93badabb9a2d4c83c3e0588a6ea4af03891ec90623f1133a572c56ea481dbe30f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756755, "uuid": "8f658d99-34e9-44ae-b46f-669487f87ab4", "value": "T1E8C4D01072A9CB12C4BDABF49C70A1A403BA7D66A57AD74E1CC07CEB36B5F408690F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756755, "uuid": "a5e2b323-0d4a-41e1-8a59-e541d5976077", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756755, "uuid": "2a91064e-2f58-4fe7-8694-f9d79558a1af", "value": "12288:F8PapPapPaWuyrikt60kRaEdRJqqIMpYT7bS3K4GvosuSK3:F8P8P8PJuyukt5KdRJWM53oonSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639756755, "uuid": "b5e05413-4094-496e-a2a9-9512fb5c7371", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639756755, "uuid": "060386aa-edb9-4f5b-96ac-611909c910f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756755, "uuid": "28ffc420-61d5-4ee7-9e44-c5b956242b9f", "value": "541b13066c1f1fc1708a576ff9d3fb13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953eb5e6-5f70-11ec-9275-42010a9c0029", "comment": "Malware payload (Guildma)", "timestamp": 1639769768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639769768, "uuid": "20b79a00-66ab-420e-8278-d35b95d689e8", "comment": "Malware payload (Guildma)", "value": "a67804a2ba0bb11cd4e089e7522ffbab", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639769768, "uuid": "ed28623c-9950-4a6c-80b4-cbd71b3aef47", "comment": "Malware payload (Guildma)", "value": "aeaee979d7367bf9ef0a93b01b35159a4f7fd499e313901ed62c82da1cd998bd", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639769768, "uuid": "f40cf506-9363-4248-979b-333e1318ae56", "comment": "Malware payload (Guildma)", "value": "58b3843d12deb52bae6d8c53d217fb5cd91604ba", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639769768, "uuid": "fdf6a626-38a5-4018-b4b0-678cbd2e6f21", "comment": "Malware payload (Guildma)", "value": "bf8f57fd26581b7321e30f889e2870e3d4905107903399364c32d849f0b28da41d80a720de661bc4c97a98866dfcd866", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639769768, "uuid": "9ec8d4b7-cdc7-490c-a661-b035cf546119", "value": "T146446B513BC9C13AD2AA063785BA9B66363A7D711B30D0CF77A07D6C5E316D2E939302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639769768, "uuid": "bb0dd191-a2d6-42ed-bf48-d42bcfb904be", "value": "3072:IgspAtOImXwCGjtYNKbYO2gjpcm8rRuqpjCLw2loHUvU4yGxr53qM2a8jWHcYtc:IWtOIiRQYpgjpjew5LLyGx1qo8jWbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639769768, "uuid": "c8fd5d92-f9d4-4923-8e78-5cef11159dfa", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639769768, "uuid": "dcb09aaf-bf3b-44c8-9c22-0e3c4038fea6", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639769768, "uuid": "c584d59e-2277-4524-bb9b-08d325bc9a47", "value": "a67804a2ba0bb11cd4e089e7522ffbab.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54a1170-5f68-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639766493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639766493, "uuid": "76bbda9b-e5b2-4ccf-a6ee-f7646cd30832", "comment": "Malware payload (Mirai)", "value": "492c6330f931e6092844cbb901be0029", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639766493, "uuid": "4ecbec16-1e9d-43ac-9f22-799987d14541", "comment": "Malware payload (Mirai)", "value": "af4c3e931b4707d6ea15ee0dc5a2b0c4f1f12a112ea98c0f9c242822c48a3d11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639766493, "uuid": "8f760ba8-5e06-4a8c-9206-c395ded13dea", "comment": "Malware payload (Mirai)", "value": "b8d90c5e80201b75bd77bbcd1766a16d26dc03e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639766493, "uuid": "d68766ac-39c1-4f73-ae0c-87d3a1ac2b1f", "comment": "Malware payload (Mirai)", "value": "caa9dd965eea659cd7ec60286337cfb9f3b5411f9c41c8cf4652021a33010ddc790ea217fe6e69e98a38402dd889ee88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639766493, "uuid": "a7353459-d7ce-4dfd-8594-3dd3dc8f7121", "value": "T1A0830642BC929A56C5D423BBFA2E00CD372563F8D2EE7116CD212F24778682F0DA7756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639766493, "uuid": "81b75f01-2b88-4ac6-a751-7cf09f539026", "value": "1536:q8lTrDzRUy7blIuM0EXS9fe6nzqQXbk/g+6epEmOiLwLqYd42+RsaV3:nlHDzBKIfL2KqhrpauwLqA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639766493, "uuid": "0b8f2d38-a458-4ae8-a77c-81e892e9d2a6", "value": 85404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639766493, "uuid": "0c35609c-511f-4e96-850a-6d7186e946f3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639766493, "uuid": "2ebe9835-5103-41f1-a576-310e63f568f5", "value": "492c6330f931e6092844cbb901be0029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ed8acf-5f56-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639758581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758581, "uuid": "e1897632-01fe-4032-bc18-7630276796f6", "comment": "Malware payload", "value": "e4133afba26efde5b01959df65c3eeb4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758581, "uuid": "861ab652-6e80-42e6-8cea-5e5341382ad6", "comment": "Malware payload", "value": "b30e2fa345e02eecf58f3672cab4f07b4c6f84712c7dee9a64ca3005ac7bf255", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758581, "uuid": "de9de589-15a6-4ebd-a2aa-d8662dbdff18", "comment": "Malware payload", "value": "ea2b48d0f50918e47b4657fd5774c2766c640f0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758581, "uuid": "da48d4c1-90b3-4a05-991d-647935000e65", "comment": "Malware payload", "value": "357f58c2994cf8d39c5dcdcf7c67ef8429a99c48634ecefb8fa39388c38adbd74130d9e1cda715116284b97a09509a5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758581, "uuid": "601974e3-386d-4e1c-a13d-96bbffa748ba", "value": "T178A4233A33D0DE77D001CB311072B9E7A7FDA5540329DA5D07D1ADEA2AA9CAE4C1C693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758581, "uuid": "2614aaed-3221-444f-890a-1052e0aac392", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758581, "uuid": "f9909bf9-44c5-452f-9058-27bf39055590", "value": "6144:rGiurRinBoiRshFZ+s9q5M8SQAcXTZtrhrQ5P5yVaCFB1KrAt22EmNCtI5nK0wOu:VBVRsBuKZc1Ba5BKJQnmNCtI0t5Nxpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639758581, "uuid": "5dd1e750-13ac-43e9-a3aa-0618e705d474", "value": 468645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639758581, "uuid": "e190f268-76c3-433d-89b9-b9940312d6fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758581, "uuid": "4e0f0199-b16d-4b2b-9e28-8b11878dcbae", "value": "e4133afba26efde5b01959df65c3eeb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87c9130-5f5c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639761211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761211, "uuid": "aa5107e1-a633-4b02-8c5d-e8dffef284b8", "comment": "Malware payload (Mirai)", "value": "c4e184506c6ed47c702b2c21e25040d1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761211, "uuid": "d28fc8db-6589-4b3d-8160-f64a350e98e5", "comment": "Malware payload (Mirai)", "value": "b36a3ed05c58a7dc3d01eb5267d3e06f8e4d04f7dfb585de2bd6e899a8ce8ec6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761211, "uuid": "80d0d135-a1de-4fd6-bcdf-e44b00aa8abe", "comment": "Malware payload (Mirai)", "value": "3db68a9550be7b3b22ec9ab69ae02be286c5682f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761211, "uuid": "f35a852c-47b0-4ec8-9a1e-92c5b37231e6", "comment": "Malware payload (Mirai)", "value": "e38228727b54cbb8c436edd11b88cd066b42d39bec625d373574c8d79fb5c57b92a85d33dbc6c7111bde9c61546bf737", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761211, "uuid": "09787395-6971-4dfd-ba8d-c8b3787714d7", "value": "T1FD731981BC809E15C6C517BBFA6F118E330297A8E2DEB353CD145B6477CA81B0E37A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761211, "uuid": "872899c5-1e62-4ac0-9cdf-3d58728fc88a", "value": "1536:n1nblFlufknASOgUb+AAYg+y2HNclsuxIw9mrsplDKZUCQBKXAVan9X+F8Jyv+BJ:HFlvO5bzA1+JHNcsS79mrsplDKZUCQBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639761211, "uuid": "9a93a2db-37d2-4bd4-9ca5-f5c327106ff8", "value": 80108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639761211, "uuid": "64f5985e-cf76-4b41-a63b-427b061edf5e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761211, "uuid": "339c6726-2d4c-41a4-b92d-56e93dcfb46a", "value": "pandora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f82d47-5f0c-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1639726581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726581, "uuid": "28e467f0-974e-45cd-9bfc-01c59b53ff2e", "comment": "Malware payload (BazaLoader)", "value": "78dc44b0421e21302e0c1e772b561d1c", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726581, "uuid": "eb4a6643-309c-47c8-b392-26bfc3c79053", "comment": "Malware payload (BazaLoader)", "value": "b42787297f2cc4a41689b03480f16889b12267e075fc2df6849621cae3a99184", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726581, "uuid": "7d1ad033-7b11-49b4-9484-9f2e4ee36442", "comment": "Malware payload (BazaLoader)", "value": "3bef1fd77c310f3c7787ffe271185b132ed0a1b6", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726581, "uuid": "88233566-81b3-4558-af0a-3faa1b59baa3", "comment": "Malware payload (BazaLoader)", "value": "4db58d19e37800cf4bd16888073d6f43b4d93167510e26b833d776538650e46eee32ff6090d8b3ab091ad1d40cb06ea3", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726581, "uuid": "3df85369-58f9-4770-beca-1a5cdb860548", "value": "T19BE48D157A9597BDF446C0788543C392AA2139520B2D9FFF02C4F27A1E6A7F25E36338", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726581, "uuid": "8d62b42a-e301-4efa-bc55-1032f91eb3b2", "value": "24e50a0f7fdaf459a1870e3ba403191a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726581, "uuid": "fdf05d6b-9bc2-4cde-9ee6-4974a22c586c", "value": "6144:z4KBuDI18+gWcBh7YiocrgW4EbmOcn8FKG14COVNPkohz/jz/U8Hjs/09sxghx0R:z1YZO2gW44F14CKsoFTsxkxP9b2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639726581, "uuid": "d18f67be-590d-4af7-b170-5ff1fc5d9545", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639726581, "uuid": "91f6205d-9542-4c85-95b7-bfdfa2bf6f17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726581, "uuid": "a76e6ab7-7738-4e41-963d-825d3bea6a04", "value": "78dc44b0421e21302e0c1e772b561d1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847c580a-5f26-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639737957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639737957, "uuid": "1115b420-2dcf-47fa-a98b-e799eb33b19f", "comment": "Malware payload (Formbook)", "value": "f928d8e4f5e699d3d0f3478a50619523", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639737957, "uuid": "d11e84a6-6f55-4ef5-8928-d3ba36862bfe", "comment": "Malware payload (Formbook)", "value": "b644a544f1c1495a74c879c0d831bc7d0c2be4017c1214b24d886b18e653929b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639737957, "uuid": "b42a0ba9-f2bf-48b5-b32e-bba8c46f43f4", "comment": "Malware payload (Formbook)", "value": "cc9fc2d713b89b82c721f1c6b481953f93674f45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639737957, "uuid": "283d988f-c6df-4f41-9e36-fe362b01f9bb", "comment": "Malware payload (Formbook)", "value": "e1d481f8896444bfd2a69ffce57faba3f68457696ed664f65b7819e2af7eff068bd977d712a26055b1e14c34f3f4062b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639737957, "uuid": "f37952f7-d9a6-4f73-a0fb-76e486724e34", "value": "T1E4A4238563E14D7FCC9A08B70BF2E97DF6EF51C1C951060BABBC2D27685948A4A0E5C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639737957, "uuid": "e6dce94a-4bf3-451b-8797-3676a1b22c3b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639737957, "uuid": "2d918470-1914-4270-bcc4-1852d0c53cdc", "value": "12288:SwFsmXVL3V8zxVPXHv7JnjrEoG43pRyQG3YS3F9Speb1:x1yzn3D1jrEoTyV0y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639737957, "uuid": "00862533-57a2-48f2-b0cf-72a3359042e7", "value": 483902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639737957, "uuid": "51f3e98d-f1c8-44ac-9d31-6a28481fcd99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639737957, "uuid": "ea7a1d16-355f-4fc4-9b15-e567fe69665c", "value": "f928d8e4f5e699d3d0f3478a50619523", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23aeccf0-5f3b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639746814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746814, "uuid": "1e734517-ba1f-4204-a914-6abda1008b9f", "comment": "Malware payload (RedLineStealer)", "value": "2d6ff0a2052199e1bc81c19ee1641f49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746814, "uuid": "18073d1c-8f79-4aa1-9721-750db22b76a2", "comment": "Malware payload (RedLineStealer)", "value": "b81c2ca2118a8dfad8154b514dd50baf0a818ce9c024f41c793f0a35e3e89095", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746814, "uuid": "4f5594e2-9205-4eaf-a9b2-20051f57262f", "comment": "Malware payload (RedLineStealer)", "value": "ed589a4ef4d6ae8b8cddfe5ca734da19024bc82b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746814, "uuid": "c552ba01-2407-4f73-99af-473b98242545", "comment": "Malware payload (RedLineStealer)", "value": "5fa3ca9add38b1412392feec16e933b861549e24adcad06b2ae1c3b5e743349ab08341e20d2b32db91512e7c9e36a96a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746814, "uuid": "7570cbd1-8016-45c3-a8ed-f6f32881a1cd", "value": "T13AA4BF00EBA0D031F1B716F89A76936DA92F7EE1673490CF16D52AEA56346D1EC3034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746814, "uuid": "84a7c92b-7130-4107-9045-b6c2fdce6aec", "value": "1371983aeb683ec0dda1a6e9e2e0f707", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746814, "uuid": "683e1035-e9c8-4142-840c-5ce878f6189e", "value": "6144:bLKZDvEhu7jURrcTbBm4TRVqiGjqcRQjVxBPaVBoX0/6o6qw:0DvEc7jj/pR4jqcRQjVLPaVBtJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639746814, "uuid": "e0c97c1e-802d-4549-9407-41e940a22d97", "value": 454144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639746814, "uuid": "5049074f-0bfd-48b0-a6c9-6ec75210d307", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746814, "uuid": "fd1f02fb-9061-4efe-abff-0e9b6d24e8af", "value": "2d6ff0a2052199e1bc81c19ee1641f49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ff4e4a-5f8e-11ec-9275-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639782460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639782460, "uuid": "6ddd0514-a244-4f5b-9ceb-fe55a954bb04", "comment": "Malware payload (Dridex)", "value": "bb3ce6e4d86304b8dcbfd6d459215be0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639782460, "uuid": "1c7d83a7-a64c-4b35-acad-ad82039a45dc", "comment": "Malware payload (Dridex)", "value": "b929cc97d96824f57a2ad86365b5fc5d1aaa75ab99484e207b567615d6f3e777", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639782460, "uuid": "4bcff8ed-a2bf-4895-938e-20fbec006192", "comment": "Malware payload (Dridex)", "value": "0a2c0995373437197b241fdae8aec3702fe36ecd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639782460, "uuid": "d7342b7b-cfc0-4832-b3db-cb3b59c9abbe", "comment": "Malware payload (Dridex)", "value": "12e042fade14f52ae379dde898833d49edd332ba2ac860ba3bc73a76fbe2b57f744d93dd01713d86491d230640ac3e6c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639782460, "uuid": "98a7e951-6e53-4b84-952e-d859670fa483", "value": "T1FFB4BFAFC65E1478C7E31870159143B12EA640C6097ADEAF6B2FFA9C149634C227DB7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639782460, "uuid": "3c3df63c-5d0b-4c24-a892-ee1885a469ee", "value": "1d03489a888f9eb61ae369ecc7b0879f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639782460, "uuid": "0edb3ecc-ce38-48ef-980d-7cb3fabb22f9", "value": "6144:SlkqY8IIaCme+UOwOYEKdvfrlEe/ply5ovxlbL6B4Q0rY:W3BdvlDx5OqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639782460, "uuid": "29529160-64df-4520-80cc-bc12172ea66a", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639782460, "uuid": "c398a37c-2154-475e-9f92-a368b7a272fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639782460, "uuid": "3b4070dc-c760-41df-a1b8-4875bff43879", "value": "SecuriteInfo.com.W32.AIDetect.malware1.2196.12075", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de26878-5f28-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639738725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738725, "uuid": "b0335439-38bc-4477-a39a-03b5d11d315f", "comment": "Malware payload (CoinMiner)", "value": "d766b63c440d547e643244c963cc97e6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738725, "uuid": "e0b4cb52-4fdb-4989-8381-52757a5493fc", "comment": "Malware payload (CoinMiner)", "value": "ba13336d1da0c9883df6909d88afa9444e07a6d300f186e90b9df00ee273dc8c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738725, "uuid": "178c8f4b-1cdf-4f9e-94e6-e865205b2fad", "comment": "Malware payload (CoinMiner)", "value": "8acfee0719cbd73cc005768e29f9681924539be0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738725, "uuid": "2c5b900f-e569-4397-b8ad-be7272cc0f10", "comment": "Malware payload (CoinMiner)", "value": "e67b082e37a4298463a2808a7d8c9fc2c0fea973416e9a8f1ca752da02acfdd0147103a05a6d5cc133b8a32032fbd611", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738725, "uuid": "9369ec20-61e7-4958-8401-4ded3361b5fa", "value": "T13116338069C88C6ACEF57B7015BA0E61C6A1DA05DF2B6C74C024F43D66122F95F1B7EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738725, "uuid": "3970efec-5c6e-4523-b0f1-f8612f1fede2", "value": "98304:ovQ7HqEPuOjIT1HhmCtawS/gnzQ4FUUu13ffaT1t1hoYR:o4yOjuBTtxnz23KRt1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639738725, "uuid": "2cbc5448-3942-460d-9782-27e618474622", "value": 4170240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639738725, "uuid": "5e5d4ab1-25ac-42b6-a424-35352a3158f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738725, "uuid": "06da175f-c21e-40e5-a9b9-89ecde81228d", "value": "SecuriteInfo.com.Trojan.InjectNET.14.28762.19958", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7fba97-5f22-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639736254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736254, "uuid": "f2ce4e64-b87f-4477-8a0b-13d425e77d73", "comment": "Malware payload", "value": "4f53036dfe46583a299fc315473c6984", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736254, "uuid": "0333381f-b3fc-4894-baa0-e88fd9679fb0", "comment": "Malware payload", "value": "bd7b2b9ecbdd8603c80283d0da6a2046b3266e299a8e06de6f4e370e81d371e6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736254, "uuid": "d75a7e77-1d96-4a01-80d2-c7a2074ba28e", "comment": "Malware payload", "value": "04c063b933d6acd7e0df66ef1d4fab11d1451a7a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736254, "uuid": "5d3ad6ad-c662-40f5-8d92-316795ac281c", "comment": "Malware payload", "value": "f029b007fa701a6aca04cada6807f93179fa845a90307319204fa21ba00751314f0c2c6b818b7f9704b898c4b1b86680", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736254, "uuid": "674f8aee-2513-4969-8378-c19f2313482f", "value": "T148B57E33B2C18537C0773A3C9D5BA7A99A2ABE201E38544F7BE41E4C1F3968179192D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736254, "uuid": "61679a7f-4d6b-4b2b-9a47-be15fe4b04bf", "value": "24576:3tpe5OYLEATAcmdLoIDW5Aq3VXYMY0V4aeclLpI+7puFu+UI5T4jNlaNkp52ROny:3t8OYLEAc0X+08cLpU2Ry4KRmTPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639736254, "uuid": "4450fd2e-fa26-4b09-b7ab-f93d5fe5f4d4", "value": 2483200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639736254, "uuid": "68f6377a-67ba-4729-af80-c452c5914f85", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736254, "uuid": "912e53ff-352b-4f65-972c-9c6d88fd837f", "value": "ArchivoEndesaAdjuntoFact.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30106c47-5f7d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639775182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775182, "uuid": "cf9196a8-b989-4f06-820e-acc2a35961b9", "comment": "Malware payload (RedLineStealer)", "value": "2cc70834624f85f5dd83b987ea57c234", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775182, "uuid": "a0873efa-a670-48ff-b7a6-17bbf15846ae", "comment": "Malware payload (RedLineStealer)", "value": "bd897b933617680b7ec6fb5ef77fd8f03a3ac2804fba3601231cb29dcca95f7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775182, "uuid": "dc695bd7-c4ff-4297-a047-73d7f7e0661c", "comment": "Malware payload (RedLineStealer)", "value": "cb749bd9b20896b9b879dab534e163891858271f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775182, "uuid": "cf229969-a4de-4bc9-81b0-23b23b89b99c", "comment": "Malware payload (RedLineStealer)", "value": "176ef88454b99755962577f70d4938742b11c95aaa8b362ad13d978055f6767deae83f2eae5066acca0ad1d02237c0c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775182, "uuid": "7d156421-3662-4878-b133-351a9ab3adbc", "value": "T15BF3BF3136ECC9F2C5A716F044649AD45E7AF8222660524B3758166E3F74FCC4AF236E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775182, "uuid": "b501711e-2148-4f5c-bfc3-6e5de21d8078", "value": "085d4aa5e29579ffcd8f5171fcc76b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775182, "uuid": "62e8dc60-7b1a-455e-9d40-b496f79e32c7", "value": "3072:WLu6wkIGMOWSqjz4CBILYk4wkEjNmmo2zmTWrxpzbgqruAH2yqbB:WLu5FO9WzvIclU6HTuzbgwuXvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639775182, "uuid": "b772ce2b-b089-4113-aa53-b157b6c9857e", "value": 157696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639775182, "uuid": "f6709f6c-6e27-4d16-bafa-18c39afa9c6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775182, "uuid": "fd80839e-ff5f-4f1f-92a5-54a0d8463598", "value": "2cc70834624f85f5dd83b987ea57c234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891d4e4b-5f0d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639727228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727228, "uuid": "2de84a68-7ef1-49f6-ab6d-3615015922ae", "comment": "Malware payload (RedLineStealer)", "value": "6db8088d93e21a9cb09ad8019fdacd85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727228, "uuid": "92ba73d1-37a1-4435-a9ae-cd2823d3b607", "comment": "Malware payload (RedLineStealer)", "value": "bf972730886b241c5203c17dd60bccfc9d5e74897c9aa2f0a04140be745d78dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727228, "uuid": "ec49def1-fae3-41aa-a72b-663b7ebb9ee2", "comment": "Malware payload (RedLineStealer)", "value": "ea5e0d05f5720dd05e5d5db0337c2ebd58e422d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727228, "uuid": "3a80c1db-d6be-4d6a-b166-a1059282feda", "comment": "Malware payload (RedLineStealer)", "value": "7815e9291f1a8b2b11caaf251e57ed07d75d43b1020e27e95a4a72e85a1f90cda495f478aa87f48d811a6912475ea484", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727228, "uuid": "4a589e12-7052-481f-9aa1-7a3901f952c2", "value": "T14FB5337343066F56C31F69B8A7DB790C29AF35C791A92496F21A103F3AE57E0A047A70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727228, "uuid": "5c07110f-74ad-406a-aeeb-e6553cfbb3db", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727228, "uuid": "cae18833-ce39-491d-bb9a-e673fd8d7693", "value": "49152:sQKaN8/wohHMG6H1uO/69TTzkwCx6XJpQBfCuI49MYinbaDAGN9+Naqcvj:sv/wVG6Hg06NTzf065UCc9M/baDAGPC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639727228, "uuid": "da4598b2-d202-4e62-a5cd-66af326f6c0e", "value": 2307072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639727228, "uuid": "39786bde-e3dc-41be-bfff-7c8ccd62a35e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727228, "uuid": "56d1f310-617e-4b42-867b-dfe21e277ba4", "value": "6db8088d93e21a9cb09ad8019fdacd85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6ee43a-5f22-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639736202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736202, "uuid": "3c0aa462-7024-41ac-a8dd-cc2e7f061b40", "comment": "Malware payload (RedLineStealer)", "value": "e8784f2787bbf896cec9ca3c8a59ba84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736202, "uuid": "48de890a-0c22-4a73-9b36-5079df350d7c", "comment": "Malware payload (RedLineStealer)", "value": "bf9941ee201ff64d00cd4d620a364f3ea1354a68c605adfabcd4c58e50753762", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736202, "uuid": "0bd13ab5-4118-4019-8f15-7479edd7f704", "comment": "Malware payload (RedLineStealer)", "value": "b971ce5d7486acedb68d67164740e7b03f753965", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736202, "uuid": "13805468-4a75-4bfa-a885-5ba58365769d", "comment": "Malware payload (RedLineStealer)", "value": "1e2b6f3238e48a605aacbff253c9aa453aab57940bfd617b862d19a2520515ebbc287a78bdb13f989a86b6b4f7091600", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736202, "uuid": "d174f926-ea6c-41e3-b20a-8d10f2c20a73", "value": "T1A4A4CF10E7A0C035F5B313F85A7693ADAA3E7DE16B2591CF12C526EA46746E1ED3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736202, "uuid": "a1e2e7c9-c964-47b7-80d4-49f99c046926", "value": "1371983aeb683ec0dda1a6e9e2e0f707", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736202, "uuid": "b74bbed6-99ae-41cc-a63a-9d076143b1d2", "value": "6144:g01Jb9/mZLuDW7+DgEWxzeuA+22pqg2mnGmVX/eOV+oRUn6M/5:ZJb9tq7+U9Uipqg2mnGmVveOV+/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639736202, "uuid": "f4f22443-1af8-4a0f-948a-413d1a585ad4", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639736202, "uuid": "2384778d-3e65-4366-b31e-7f1bd3c03c9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736202, "uuid": "a48f050b-851e-48e7-8c85-951c22880b3e", "value": "e8784f2787bbf896cec9ca3c8a59ba84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb2a4f26-5f4b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639754048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754048, "uuid": "0b066ec1-15d4-4e4d-be4c-48ab78bcdc53", "comment": "Malware payload (Formbook)", "value": "156881894f6358ff645dcbf9a7e1b288", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754048, "uuid": "7775d270-7250-4680-991f-c03a53fecb41", "comment": "Malware payload (Formbook)", "value": "c020f3ef2b418c8916521d40d372dc1d00b4fd03349d579827e429db3456875f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754048, "uuid": "cc7ec99b-43d3-43ac-9be6-050e41dabfe2", "comment": "Malware payload (Formbook)", "value": "a17826844753f6db82cb4a033d6c762a835824be", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754048, "uuid": "f061f664-7d8c-41e0-8cab-b139419e386a", "comment": "Malware payload (Formbook)", "value": "ed81ba95c86fe04f7d92eb583dad162c11644e0c239315d01a862664462518b56c17b93b1af6fed14bcf9121f38a9416", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754048, "uuid": "734e2131-b336-4b68-a33c-8cc5c68a3c4b", "value": "T1FD052384BAF6C666D14205761A18A89DE6FEFD84B746810B2B0C7DCB3D3EB6640CC51F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754048, "uuid": "7091d0c0-46d2-430f-949f-7011edaccb40", "value": "24576:7x7wtHofUk3AV2xk5Eq2BSJrGwGyngZzEhLxvb0:P0MkGuvThVD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639754048, "uuid": "1c5ffc57-b6bc-4354-bcec-2fba494181c5", "value": 816128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639754048, "uuid": "82c583f2-ddc1-441b-96e4-28ce3e52b7f2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754048, "uuid": "0e8baf70-bb0a-46fd-9b7c-f12e8d210c18", "value": "FTK-10294.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa686bb0-5f0b-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639726559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726559, "uuid": "92d8f95a-254c-432c-8e51-b348c7edfddf", "comment": "Malware payload (Loki)", "value": "164927a9682b5c16ef1c04b7d3e65909", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726559, "uuid": "124cf297-72e2-49bc-92d9-36c4758a3bc2", "comment": "Malware payload (Loki)", "value": "c04ef6e69ec3f131151964b0988a5f91bc7c6134b209d45c3164ebcd510765e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726559, "uuid": "608f1f09-c915-4303-b5e6-3225deef1d39", "comment": "Malware payload (Loki)", "value": "baa19a5f50316dd432507728f0696b67436b9584", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726559, "uuid": "f5b0a468-57d7-4ce9-9a0b-5c0d217ee075", "comment": "Malware payload (Loki)", "value": "481cff55bcf63ad80e817d7afca91dc949d08df4e7eb2c9653dde5e12095871fec33a60d457d2a41320b40323e9dc6fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726559, "uuid": "e72ae990-39c9-4a20-8559-b7dd2696f5cc", "value": "T1CCE4025EB356C85ACEE18D77D4A9E27D42A11F8E16009A4373A0FFEFBABE113D424111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726559, "uuid": "ed333799-1bc1-4697-8be7-09cbf484f67b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726559, "uuid": "b554c8c8-add9-456f-8b68-d05f97b8f174", "value": "12288:W/a01BLias7lpBmjHsfgxPwTDaNyDCQa+/bB1k3:S1casGsYxMKyL/nI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639726559, "uuid": "30c375b6-b902-45af-b9ab-3cf0a0385bc8", "value": 660195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639726559, "uuid": "8acd6017-429b-4616-ba7e-31b4ff2537c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726559, "uuid": "048c680f-9efa-4f96-ba1f-b07b2eb94c9f", "value": "NNEW PURCASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9593f8d-5f82-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639777587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639777587, "uuid": "c291707e-aa0e-4352-9673-502466a3df91", "comment": "Malware payload (Loki)", "value": "5f4fce1fa2f428b2ab2496fd37248b13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639777587, "uuid": "45e39810-4293-4c33-bacd-74b723f3b67a", "comment": "Malware payload (Loki)", "value": "c253922231322beae5feb62a8a53078b470cb53cc25acdf9bd22ac59fb5ce290", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639777587, "uuid": "9ef3fe87-f47d-470e-9937-fc5a8adcae91", "comment": "Malware payload (Loki)", "value": "2fc15defbf14332fe6009317ba8b03fd4b0892dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639777587, "uuid": "5499068d-d5dc-42d2-a6c2-72c094e49d1e", "comment": "Malware payload (Loki)", "value": "c9f604376ccd8f587f370c40ace772766c3f41b8d55b18d4317ba5347961e046c158658b82a2a9a751362425bf230895", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639777587, "uuid": "7de09c52-1557-496c-a650-431d4523f642", "value": "T1A8D4F1B1104757EED9894071A106A0638733AF665BF368E7F34C7E8F947A4528A0DE3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639777587, "uuid": "3bcb08b5-2ddd-43b3-a28e-afb14fb280ac", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639777587, "uuid": "3e012e21-e18b-401a-9f55-dede54a26b6e", "value": "12288:ojGUPuczR5Iigt6LC4CwICOK3fmyBvcCmPF8Nqdhf:ojvmc496LC4xInK3fdvPmN8Nqdhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639777587, "uuid": "eba9fb8a-78b7-4b97-9790-88196d235be5", "value": 647282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639777587, "uuid": "b87a3df2-c08f-41fe-aa23-44be5f25b770", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639777587, "uuid": "3afc99a0-e22a-43bb-97b5-657372bf9e09", "value": "5f4fce1fa2f428b2ab2496fd37248b13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55dba7e-5f1e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639734603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734603, "uuid": "d742090e-ec80-4ee5-b8f5-a4fef06562ff", "comment": "Malware payload (Mirai)", "value": "561789c5a5d0260bb4b0c7be4d6b4b13", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734603, "uuid": "01ba816f-110b-46ec-b594-a6c463de14c2", "comment": "Malware payload (Mirai)", "value": "c282311df0347baa09f9824a42f92aaf429c249df5a5418ec9f923e0d194bef0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734603, "uuid": "b75f29d8-1c84-4393-a2b8-0f13b95a1dd4", "comment": "Malware payload (Mirai)", "value": "13dfff4296c585fea5222e09a49acd6075c510ec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734603, "uuid": "9ef6abb2-a2c3-4898-b7f2-6a247ef17527", "comment": "Malware payload (Mirai)", "value": "c2cc9efef9af31e2ff33d390c17ae60073859ca6f6ec135e4a62d08ed175c3b4746b56d5cefa918a23976b77ef84c9f3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734603, "uuid": "3fd8ef39-a1f1-4931-ad1b-703888a81de6", "value": "T110E34D56EA818E13C4D527BAB9AF01893332A75493DB730689185FB43FC6B6F0E77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734603, "uuid": "251049cf-36b5-4ebb-9f09-1554c296a249", "value": "3072:MgxYi2gojQeTWKrsRdxcKfKw/LyCeAd27u+bn5mx61VXnu/IM/9UBqh:HxYi2gojvTWK4RcKR327u+bnExkXnIIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639734603, "uuid": "9e64b5a9-0b3c-407c-96e0-c8e3a253e3f4", "value": 156877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639734603, "uuid": "c7e6572c-cee2-46ae-9618-36f7e849a0e5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734603, "uuid": "7e4cdcd6-3540-46c3-8439-fd42068b0e7e", "value": "UnHAnaAW.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3adb1fe6-5f3a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639746424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746424, "uuid": "82f82672-5183-4909-9d39-319aa28e4379", "comment": "Malware payload (AgentTesla)", "value": "31f54cfb6359bdab042cdc879961a937", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746424, "uuid": "7ade20e9-6f9e-4403-8a68-9581a052441f", "comment": "Malware payload (AgentTesla)", "value": "c2cc25403ae69178500c522c7d88e8e3f4f5d0c25a27624b6ddba51114ebc242", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746424, "uuid": "b26c6327-a5d8-45f0-b229-2c6e1ab3d321", "comment": "Malware payload (AgentTesla)", "value": "3adb876395c38c0f56964aca08b5c9c8fe069756", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746424, "uuid": "b69678ef-2927-4954-b863-7909ebb9af83", "comment": "Malware payload (AgentTesla)", "value": "7512865dd5f88dbeaadd4b028b38e4806de28f7a72fe06514a2962da6cfad852f58646249c8d7e154abe5454d36c23e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746424, "uuid": "41f0e619-9833-40b8-964b-98a56b724f5b", "value": "T1569557F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E5651EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746424, "uuid": "9c2663ce-e069-4f76-8215-e50f7dab5e8b", "value": "12288:4a6Htqg2e2Hx/G5ac4tp8kzyqGZ3HciJpPfQ5Q48Fr8jzOpbX5:4JHt0eix/Yn4tpmN38iJpPfQe4ZmpbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639746424, "uuid": "8fda9c3c-162b-4bcb-b4e6-218539b86141", "value": 1960126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639746424, "uuid": "6b34c9ca-cb58-4b6e-9aae-956d1436ebe5", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746424, "uuid": "2cd2e790-e705-4163-aeaf-12515261080b", "value": "DHL Shipment.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29426629-5f3b-11ec-9275-42010a9c0029", "comment": "Malware payload (Tsunami)", "timestamp": 1639746824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746824, "uuid": "e888c414-8403-455b-82f4-153b95f680ba", "comment": "Malware payload (Tsunami)", "value": "9d647f2d1a9dd9a86ba18c42ff5da444", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746824, "uuid": "e19e4c87-47ba-43f2-b6a5-d08f801f0b25", "comment": "Malware payload (Tsunami)", "value": "c39eb055c5f71ebfd6881ff04e876f49495c0be5560687586fc47bf5faee0c84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746824, "uuid": "eafdded7-e36a-4ee8-afe4-2a8f7138fb28", "comment": "Malware payload (Tsunami)", "value": "b1ea87a2db9756bfe8328ac0dd1204c4501e63f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639746824, "uuid": "e0c24176-9666-4483-8184-58785b1149ba", "comment": "Malware payload (Tsunami)", "value": "67e815747beba0624df64aec7923ec0c9943d8dfa33c5bb22a2a2f59a2c6661c8ba906e009298415404faafb48f69e7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746824, "uuid": "64463d40-1947-456f-97ba-10842750312d", "value": "T19243028DA525803AC7645BB4748DEDC42EBA1152F217D9E5DE70BB0F8F760B6AC60B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746824, "uuid": "5c833485-d199-43b7-bc14-8bc8300ad683", "value": "1536:1TCcWVjVjvlSo9QktJnv9ygof5LCW95Ga1xeDhJ:gjVpSoqiFv4f5Lzdxej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639746824, "uuid": "2709c405-c0d4-49c7-8d1d-e4ce48adb17c", "value": 56444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639746824, "uuid": "99bca405-8851-4e02-a6e6-152bfbc72c51", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639746824, "uuid": "d4189df7-9177-47c0-8847-41c8a9622810", "value": "9d647f2d1a9dd9a86ba18c42ff5da444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dabfbe0a-5f87-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639779763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779763, "uuid": "cc5d5fe6-5814-4db1-ab52-88c7f638d05f", "comment": "Malware payload", "value": "2141737a1347cad9bf29d95ee367d260", "object_relation": "md5", "Tag": [ { "name": "cullinan01", "colour": "#2F6912", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779763, "uuid": "e03b4fa2-8290-46b6-9937-70c3c587e285", "comment": "Malware payload", "value": "c3de2a035ad1791dda7a7f5a38dfb2922c33f714ba9cc2d6984afbeb62df209f", "object_relation": "sha256", "Tag": [ { "name": "cullinan01", "colour": "#2F6912", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779763, "uuid": "67f46eb3-6b9b-4b3b-a2a9-771c3beadab1", "comment": "Malware payload", "value": "ec62a113b9fb4ed335214b0ce633144d48a31df4", "object_relation": "sha1", "Tag": [ { "name": "cullinan01", "colour": "#2F6912", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779763, "uuid": "23468983-36f3-4eed-a21b-505eac476cfe", "comment": "Malware payload", "value": "54eac299588ea4ae5c8f7711442586e4da252aba0a9c115d1be9c29f4d7175d36d5c5e2ea4fe55002318dc37f9ed281d", "object_relation": "sha3-384", "Tag": [ { "name": "cullinan01", "colour": "#2F6912", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779763, "uuid": "9b74c91f-d89f-4a75-99d6-f223c65cdaac", "value": "T1A62594F622246307EEC391746E02C73514445E4B06F508FE6BD7B2BE0D727266B9AE2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779763, "uuid": "f941f5f1-66c4-4d27-9ae6-8703c4ecd6f8", "value": "fcb54e41e8df228eeaa37df1acecde64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779763, "uuid": "1201c8f8-43b8-43a0-ba91-26c9bce9b31d", "value": "6144:IZ3vSB/TRhm3jMF9vdVDzThWlb49r8UQw8Mz1+:IJm98TS93MVWr8UQw8Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639779763, "uuid": "552c1437-1f0d-4038-a1e9-0a31a779b57f", "value": 981177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639779763, "uuid": "8d80a45f-3760-4f63-b348-58e79505b33b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779763, "uuid": "c18f3dbe-77aa-487c-83c4-61f6d68ff81c", "value": "c3de2a035ad1791dda7a7f5a38dfb2922c33f714ba9cc2d6984afbeb62df209f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d33e76b-5f5c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639761084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761084, "uuid": "3bf37b40-7aa4-43a2-9483-303f52cf24f4", "comment": "Malware payload (AgentTesla)", "value": "cad34bfe8198c7afb415bf354d2e233b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761084, "uuid": "9d85e729-86c9-41e2-83b6-ef8dc0027dad", "comment": "Malware payload (AgentTesla)", "value": "c4922fd4e2fe7a997e3887a2865970084805481b28e932fb8547bd2b99470bef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761084, "uuid": "4e96c3c9-047b-4595-8a11-d2702f65c759", "comment": "Malware payload (AgentTesla)", "value": "4fe356b2b8bf5ae33c375318ca058af30060cd9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761084, "uuid": "e6e60271-c20f-40f0-8685-5e1b21af6eca", "comment": "Malware payload (AgentTesla)", "value": "5d5809f479f04884a607ee5e240ab0536be80c85bc8554dd6a8711f4def111c2beee9689a94d8afccec9486c908ed891", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761084, "uuid": "5086a1cd-f086-416c-9972-def50c0557df", "value": "T1E964AD8D7260B6DFC85BD8769F991CB8EA207477530F8213A45316EAD90E99BCF050F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761084, "uuid": "77931996-3e96-4bd4-b5c6-0e170d2ef23b", "value": "6144:QfjLQcgwbGIpyITgAzsPNm4j+/QZP1T8uU95gGmXMde21:QfjkGGIyMzsPNVq/QZOuU95gGmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639761084, "uuid": "6bdd0881-2b3b-43e2-a609-041e0814868c", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639761084, "uuid": "c8b18512-6f24-42ec-9826-024e4497b37a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761084, "uuid": "eda5a33a-195f-46db-9e13-744bda6e96dc", "value": "NEW ORDER GB98759^Docx.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7f8ea5-5f8e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639782721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639782721, "uuid": "f9587c25-8cb7-4629-a430-6aa00a85ac8d", "comment": "Malware payload", "value": "dc87a34fc5b7681ee1a527dc828687da", "object_relation": "md5", "Tag": [ { "name": "core.exe", "colour": "#8E4DC5", "exportable": true, "hide_tag": false }, { "name": "dc87a34fc5b7681ee1a527dc828687da", "colour": "#1755F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639782721, "uuid": "7b28c912-df5e-4969-a470-4e7e302ca5b2", "comment": "Malware payload", "value": "c5db23f67cb6b34625b952bebd00b5ecd8a2b3d18d2ce6c1b9811e1b404ac34c", "object_relation": "sha256", "Tag": [ { "name": "core.exe", "colour": "#8E4DC5", "exportable": true, "hide_tag": false }, { "name": "dc87a34fc5b7681ee1a527dc828687da", "colour": "#1755F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639782721, "uuid": "876f0681-b060-4b2a-97c6-1795b02c56cd", "comment": "Malware payload", "value": "0163cf92843f0c9db9eeefe28af1453c510e7281", "object_relation": "sha1", "Tag": [ { "name": "core.exe", "colour": "#8E4DC5", "exportable": true, "hide_tag": false }, { "name": "dc87a34fc5b7681ee1a527dc828687da", "colour": "#1755F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639782721, "uuid": "b6140505-aef7-4ddc-a93f-db17efd21b15", "comment": "Malware payload", "value": "6b6d52aafb56613dcf7b2e1a7f6584f9c1eeb5e1b04b13d688e90800df6c09810bbd3dc2c72257d44a67286de87fd98b", "object_relation": "sha3-384", "Tag": [ { "name": "core.exe", "colour": "#8E4DC5", "exportable": true, "hide_tag": false }, { "name": "dc87a34fc5b7681ee1a527dc828687da", "colour": "#1755F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639782721, "uuid": "cd8d2938-d8d8-4b15-a9a6-b6d67e185f33", "value": "T114355A1EAEA881A4C036C17E8AA68296F7F274451F36CFCB5161935E3F339E45D39321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639782721, "uuid": "d753aed7-09aa-4746-9633-2cb8f090c217", "value": "55956b0a74386a2b95aa1e8022db25f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639782721, "uuid": "194f07e7-2f0e-4c3f-b962-1f15fbedd1e8", "value": "24576:+fNcw5WEwhPRQqzmwKi8AsvewTDBMFlk0p/4q31hYK:+SEb7TDBWhpQq31Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639782721, "uuid": "d145cac5-0904-4cfb-98cd-5c4c24e9375f", "value": 1141648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639782721, "uuid": "07509255-3d75-4627-9c53-fe2f618df2ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639782721, "uuid": "5e16b7fa-cf80-482e-b70e-f99c87a5a6e7", "value": "c5db23f67cb6b34625b952bebd00b5ecd8a2b3d18d2ce6c1b9811e1b404ac34c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33858622-5f22-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639736103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736103, "uuid": "01986688-6eab-4efa-a14a-002a30411ca9", "comment": "Malware payload (SnakeKeylogger)", "value": "a80309d282a56a8e0fb9237f4ce809ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736103, "uuid": "d636e212-6b51-4bc3-a9d1-e630844f9071", "comment": "Malware payload (SnakeKeylogger)", "value": "c5dc61816c25a935f817656f3fb0bd82d75befec444e0498d8a220deaa803582", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736103, "uuid": "2c558fcf-bb35-49fa-a8d8-a1305eeb33e4", "comment": "Malware payload (SnakeKeylogger)", "value": "a53330123f8fed23f020069a5d3602239883605f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736103, "uuid": "7befc74c-d4d1-4ed0-ba27-97f39ea13703", "comment": "Malware payload (SnakeKeylogger)", "value": "6cd5dba231d6fa206fa2f2fd5c18c99c30f26308209c2b49a6d7bee6a505190e50e4a4dc1b22d943289b724b0fe5a7cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736103, "uuid": "3027acb8-8633-4236-b55d-c0e69a520ca4", "value": "T15445332732745F5FD1AD47F442B27A1413709590A305E38C0FE6B4CB3D1ABA69AA0BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736103, "uuid": "64c318c9-0ad4-4be6-9b27-69c58f96d517", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736103, "uuid": "4fc974f7-0a05-4d1f-b77e-3aca25957ee3", "value": "24576:C/d82tM0i2WYs7H2sMMwf8KwMmwAs8NU1s2YcZEvTBGjJMHkUd0DDPGe5vu:0AYYE6KNm9xGmPcZCkjJMZd0vNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639736103, "uuid": "b078ef37-7ecd-400e-acd3-2db0ecd8cd1f", "value": 1241088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639736103, "uuid": "39d01bdc-ae43-4d89-b479-f1f65efaf189", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736103, "uuid": "c8adda4b-c2d7-4019-a5bf-9a237dbced89", "value": "a80309d282a56a8e0fb9237f4ce809ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fb34d9-5f5c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639761205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761205, "uuid": "526cf9c8-fc1a-412c-a964-6fd809977fa1", "comment": "Malware payload (Mirai)", "value": "d1d05a1e8d458a61d1e58e02bed8c1c7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761205, "uuid": "a27d1f85-3655-4968-8f0b-a6a35ef774d2", "comment": "Malware payload (Mirai)", "value": "c6e677a7f131c25eff5d55df8bd50f1b7d4a0c764567322e53158c56264297d3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761205, "uuid": "f2efbd5d-4489-44e2-8a87-fab3365cd6e2", "comment": "Malware payload (Mirai)", "value": "d37261a83ec628e6f99f4748ac8c0790b5e4d349", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761205, "uuid": "08341294-514d-4d70-af9d-862cc3712c4c", "comment": "Malware payload (Mirai)", "value": "a6cbca3e8d44c815943dacb51a39dae9b80a6b7cb8c0032fb149c84f7d606043ac647b2ade91c1b182118c3f4a794da3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761205, "uuid": "3b9ba4cd-7ffb-419e-b7e1-657965ef78e2", "value": "T1B9532AC8A0D3E8F5EC14097D307ABB629E73F13FB176E99BC7E86573A901202910665D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761205, "uuid": "77273b41-3aeb-4967-8c49-5c379438bb68", "value": "1536:bz/pWlXJcf4slZQLkAlpt7SWY/Pfd+700ngkM2e:bAXJcf4slZQLkAlpt7SWY/Pfd00+dM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639761205, "uuid": "05daef59-2225-4e67-8059-f78ba1d49856", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639761205, "uuid": "5dae7457-fb42-4f84-883b-c9315ea019a4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761205, "uuid": "7b467f8d-3d82-46ad-bf56-00ff71492984", "value": "pandora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1f37df-5f87-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639779413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779413, "uuid": "8c85d50f-aadc-4dbf-9834-b7cbce784f90", "comment": "Malware payload (AgentTesla)", "value": "ebf51c66b7a4ea06d6a43e751cd19efa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779413, "uuid": "c5031553-7c17-4572-b4b9-d8c691de8c37", "comment": "Malware payload (AgentTesla)", "value": "c7bf4126fec26b76a237fee7d8426dc80cf46f261e699c7be6d512ffaacf4de2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779413, "uuid": "8b40f453-f469-443f-bc67-a8953238069a", "comment": "Malware payload (AgentTesla)", "value": "91ff8cf6fde1768cd69254e0ff7cb43cfadf02c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779413, "uuid": "ad92a8d0-92e8-45dc-bcfa-74e181b6de41", "comment": "Malware payload (AgentTesla)", "value": "7184f6a3279e216bc719058501a1a468334e7256d28f712a5d2b772b092896196363a40adf96f12d2e0aa249f781465c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779413, "uuid": "c747ca0a-6573-4975-906d-93b4bf107928", "value": "T1E125E89D324172CEF577C875DAA82C64EB9078F7930BD247E063259A9A0D897EF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779413, "uuid": "bc481f38-1caa-42d9-ab05-3173aa2b0720", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779413, "uuid": "052082b4-f53e-4b32-a5b8-89e27a753f0e", "value": "12288:ecNKm8Gjh60Ob9UIsBv0M2rdgdaa9top6ue3AjdD2vcZFadvafszkX+J7osineeJ:eQp8Gt7qgwa9O3kvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639779413, "uuid": "41105b42-92c7-4895-8d2e-f6b0d419b10d", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639779413, "uuid": "f04a0d80-e678-4589-a2ae-736cbfb38855", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779413, "uuid": "cdf2269e-e7db-461a-a5b9-221a60177e85", "value": "COMPETITIVE PRICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b334701-5f4a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639753296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753296, "uuid": "a7408053-ce2a-43e4-9ce0-521661b1db8d", "comment": "Malware payload", "value": "ad7b9077a9202a6cdda754d17d28eb97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753296, "uuid": "00dcceb5-24aa-4092-a029-2b4478725029", "comment": "Malware payload", "value": "c893ef2ba27414ba9dce76be1bb139133c52dd8c7ea9dabdc265abd8bbaa3c85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753296, "uuid": "e77f05e4-a0d4-4c1a-a255-9d9104cfe0de", "comment": "Malware payload", "value": "aeb77660b7ce34e6543faee0f60562ff905867ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753296, "uuid": "e28214d0-f199-4c15-8a6b-c3b2f8e0d6e9", "comment": "Malware payload", "value": "774d911e0006588bdde14574cbc2f45338b590f2d66469d8ac9ecd39474e2d423ef67a5f5d930eb3c617f9a63b7f0393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753296, "uuid": "7fa1d340-d6a0-4d56-8fe0-e03aa5be7307", "value": "T117059D02B5949AA4FD7EE3301972D87003A2BDEDE570D45CFCD83C5B7ABB6824522663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753296, "uuid": "3b1e7b64-06ec-4af1-becd-982e4cb1d670", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753296, "uuid": "3f526ad3-ff46-45a2-8730-9bcf7f946e23", "value": "12288:2W+wq3olm5ajiZ/KN4Cky84mwpcK9UoQHyVQWxjMNL+Pm02rI+pppppppppppppj:T+wlm8jtN5/8e9FV1PtPjUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639753296, "uuid": "afe3abd4-077b-4fed-817c-bca2b7fcaf97", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639753296, "uuid": "e7247f21-45fa-426b-8431-eb3c29bc669f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753296, "uuid": "0ddea3dd-c77e-4d3f-ba24-c50b62ba67bb", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67353be3-5f79-11ec-9275-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639773556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773556, "uuid": "543c6f79-f172-45e7-9d75-4fa1c8d69746", "comment": "Malware payload (Dridex)", "value": "2d3807cd987d1668b90c8268e70c61b5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773556, "uuid": "bc8096fe-2975-44e6-baa3-b61ff5dd1229", "comment": "Malware payload (Dridex)", "value": "c8d544a6c242125c56e07c45351275e1e7a7af11a7b97eef9b3a4896689b030d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773556, "uuid": "900a748c-e9f3-43ce-86dd-6e22fc2aaf47", "comment": "Malware payload (Dridex)", "value": "ce0540baeb2a53deaee9a16d25c8895b9276e1aa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773556, "uuid": "b4d45066-46bf-4364-bda9-6a40df5d90d9", "comment": "Malware payload (Dridex)", "value": "33abebfa2aaec5c57c6d83f7b659f1a4d68ca36a0f57bcb8f1c60251414a8be7e42928286aa29a022c68c9101d037075", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773556, "uuid": "6861065b-1787-41d0-9aa1-0e6a2bfad631", "value": "T154B4BFAFC65E1478C7E31870159143B12EA640C6097ADEAF6B2FFA9C149634C227DB7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773556, "uuid": "de3103ec-16aa-41e9-bfc7-23abb0e8dc43", "value": "1d03489a888f9eb61ae369ecc7b0879f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773556, "uuid": "088acbaf-a5e8-4ecd-884d-72c486e33a70", "value": "6144:PlkqY8IIaCme+UOwOYEKdvfrlEe/ply5ovxlbL6B4Q0JY:b3BdvlDx5OIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639773556, "uuid": "29dbe97d-70e7-4be2-a332-722ff8fa3a43", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639773556, "uuid": "a8a08a8b-3fda-4159-900d-126065a54def", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773556, "uuid": "224b5a63-97f6-42b0-abb8-67c0b2d7f3c8", "value": "SecuriteInfo.com.W32.AIDetect.malware1.25173.16009", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb87015-5f56-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639758585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758585, "uuid": "dbf26ee5-e892-422b-922d-db0658e954bb", "comment": "Malware payload (Gafgyt)", "value": "d2735495ffcfe26fb40d983d8074a1ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758585, "uuid": "2c6fa6c6-8bcc-4d43-8ee0-532a09ff72e7", "comment": "Malware payload (Gafgyt)", "value": "c97e9773ec5f07800313dc71d77848967609fd10961874c524b9fc973bf17134", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758585, "uuid": "9bad437d-1a80-476d-9cac-ec7469f7470e", "comment": "Malware payload (Gafgyt)", "value": "6803a01a8b5ca06473cff1962d2e43c2cef98443", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758585, "uuid": "98c7a4d8-66f3-4cbe-a1a3-90e7295b91f6", "comment": "Malware payload (Gafgyt)", "value": "595b03da07aeef0c48d1b4528ea3e3d6ae9b7659bbb900ff431dffd91e9329973540c08422e9f3505b286e719b23a3a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758585, "uuid": "5bd6ff3a-4b63-4505-9f2f-a6987ffa4575", "value": "T102C33B06F5108753C1C2177AB79F561A77232BF897DB3312A6247FB82BC279A0E39950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758585, "uuid": "a50d4007-a8df-4fa6-a423-5b3cdceb60fb", "value": "3072:idwracAAviNmLpMQ1xO5hKHKSrbqlAdmyDQUJ1UX4Tn:SwraFgikxO5hKHKnlAdmyDQUJ1a4Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639758585, "uuid": "4c63a7dc-e75e-4015-a7e3-4bfccb99a2e5", "value": 118932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639758585, "uuid": "a7ed69b5-e09f-4a09-b225-0e8add81867c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758585, "uuid": "e9a2d1a6-5cb5-4e07-bfc4-959b022a6da4", "value": "d2735495ffcfe26fb40d983d8074a1ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08d4455-5f2d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639741065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639741065, "uuid": "8e6c8803-240a-4326-bf20-fab0ee78a58e", "comment": "Malware payload (RedLineStealer)", "value": "d46265306e3e8b12f1546ac33d11eb10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639741065, "uuid": "0c73aba6-df70-435e-94f8-f95ef8a5e904", "comment": "Malware payload (RedLineStealer)", "value": "ca44feadd83b38556f38eea47286eb5bac01574c10218f59b89c9fba12f7a07c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639741065, "uuid": "e754c0b1-ac71-4e62-bb9e-bca556941b61", "comment": "Malware payload (RedLineStealer)", "value": "1aec67bac61dc920a857baa5fb83b32a623db5e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639741065, "uuid": "cf5c391e-4a8f-49bb-90bd-b0ffd8ce09ff", "comment": "Malware payload (RedLineStealer)", "value": "228eed6a8ece6c5fa01f561a2da2daaf9f1adc3b2405fd5c24cae903d7141e759198083d0a98dd1af3dd326828b8b0eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639741065, "uuid": "71480ed6-10d7-4b99-ad23-449349ad0eb7", "value": "T12B1633433F9B054EFD3FB9742636EC84E71D4282534EBA998B96BFD3BCA24411528E50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639741065, "uuid": "18588248-9f61-4286-a8b0-9b697d2370f5", "value": "e48cc266501c282987b27f2c1f654e2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639741065, "uuid": "400b36e5-4a53-4b27-a83a-adef1155af92", "value": "98304:ibKWfY5So1cxtuERQd60/HaUdOaOOJwc0vK47tNsQAsCQkvl:H++SQcv+6cOavJtcd5dCQkvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639741065, "uuid": "1ea2f938-859c-41c6-8362-7943689c6084", "value": 4386816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639741065, "uuid": "26a4e94f-3b32-4325-8c13-3378ce1fd667", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639741065, "uuid": "ea3e7e92-f731-4c09-a93e-3019e2aab9f8", "value": "d46265306e3e8b12f1546ac33d11eb10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326ae192-5f52-11ec-9275-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1639756717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756717, "uuid": "0e398b43-f34d-47e6-8add-c1b5e6f03c57", "comment": "Malware payload (OskiStealer)", "value": "c43d068c4d5d5639bc78f512b21ffdb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756717, "uuid": "2f30b690-7395-46d4-a0cd-f28fdc9a1358", "comment": "Malware payload (OskiStealer)", "value": "cabe623befbaa25599e9c97bef6be8175332b29c6571a2c8e755c7a732beedbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756717, "uuid": "a9261d64-a0a4-4b3e-9400-0eea47907e46", "comment": "Malware payload (OskiStealer)", "value": "3ed1d8d84dad394f02215be758ffa44dd7369a87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756717, "uuid": "465f232a-94ad-49e9-96c7-c3940be3c987", "comment": "Malware payload (OskiStealer)", "value": "9f224d78473fa10f2a74c504a55be72f498f3da803154d6b8999ba59e7d04b12405020f19d84009b108bb02bd9d7ccce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756717, "uuid": "48a89965-055b-41c7-9a64-7a2a77417702", "value": "T18BB4129417B1CA0BC07A0BFB247561E1C7B426526613DF9F6E6EE2DFC826B811A107D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756717, "uuid": "8dd80699-d84b-4a70-ae55-3e500696362d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756717, "uuid": "9143cc48-6933-4d21-95e6-b49af16373ed", "value": "12288:mQuSK3pkQ5FkpAa1vj9vsN6cyyOXZhzzkmyyy1pWy2tGG:mzSK3pkQUPBvsN6yunzkdUGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639756717, "uuid": "8a6ef26a-bf22-4c3f-9ddf-802a0252b6b1", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639756717, "uuid": "e8f1e5d3-e0b5-4396-942a-634d252d7b28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756717, "uuid": "95cf6cc9-b372-46e5-90a6-fd12fe299e16", "value": "c43d068c4d5d5639bc78f512b21ffdb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d87898-5f71-11ec-9275-42010a9c0029", "comment": "Malware payload (Guildma)", "timestamp": 1639769984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639769984, "uuid": "42647714-9368-493b-aa9c-0369ea38ac06", "comment": "Malware payload (Guildma)", "value": "eb2672fadcab031a27efbf57c03da47c", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639769984, "uuid": "0220b0c0-6a67-4672-b436-dbba41598cbd", "comment": "Malware payload (Guildma)", "value": "caeaec9e27ed9fd3503d35b3c9fb8f6ca6a36ea6260c3dbd9492cda76c61bd59", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639769984, "uuid": "9345af17-17d9-46ae-9321-ed3726f66d3f", "comment": "Malware payload (Guildma)", "value": "bb58fdeff9da75d04e2ed5d849330be987ab5928", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639769984, "uuid": "ad6ccd2a-e47c-4ee6-a9aa-4f34ba51b236", "comment": "Malware payload (Guildma)", "value": "42afa36aed4d404fc6628b0e5c3e998e651f2e8860698884212c521a169f71d1dc94b2665826d5a518e84b5d1ef85589", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639769984, "uuid": "46c1ec49-7cd3-49d2-a3d1-7d3c531dc2c6", "value": "T14CF023940F585F80F1241676C0B5CE04C53EA86A8F8CFB35B2D01644946C0C0AFA76B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639769984, "uuid": "fdaa063d-ee8a-476b-8e6b-f0ce1a81026b", "value": "12:8DpOB+PlyWfOaEV75FAI9fpFrv8dQqddC24GrgSeYc:8HPlDTE9j8CqddCk4Yc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639769984, "uuid": "8b9682a4-2460-4956-ad91-a44223935ee8", "value": 538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639769984, "uuid": "937ef9b9-0016-4e57-bf48-c867e4d3418c", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639769984, "uuid": "ed4ed991-e549-4a4f-888e-7136a65c7ab4", "value": "eb2672fadcab031a27efbf57c03da47c.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d921ae2-5f35-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1639744281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639744281, "uuid": "34cc11b1-23e6-4c3c-ba25-2a7ccd18efb2", "comment": "Malware payload (QuasarRAT)", "value": "b9e97744e1d442427d01446515d63d6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639744281, "uuid": "1762dbe4-6a5a-40d8-ab6c-de0e92eac966", "comment": "Malware payload (QuasarRAT)", "value": "cb977f25e76c9a819f3c12ff2192e747b76b6578ccbed0a44c820a99081e4558", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639744281, "uuid": "e548c1e0-8eca-4e02-bd55-5f3418663011", "comment": "Malware payload (QuasarRAT)", "value": "31fa013d16110374a56c66eae92f6d0700943531", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639744281, "uuid": "0ba862c4-f308-41d2-b8dc-3c8fb4c8be33", "comment": "Malware payload (QuasarRAT)", "value": "fa0a4a7eab857c1e45d932bdff1ae500ba985afbd69c996b75bbf1733e99d0cb895a5a91cc600353b8d024198a594def", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639744281, "uuid": "34aec808-0d20-4a29-83a3-df07fa80243d", "value": "T11BD4394423A8751AD96E03F9A8F5042057F8F8C6A176F7DF6440BFE838667CA8D407A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639744281, "uuid": "e4e30300-4c1d-40a5-8095-a66dda95f0d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639744281, "uuid": "c36967ac-1ed3-4b35-adeb-10c9fcd81fac", "value": "6144:JTEgdc0YxXbZvdo6EsRwdyt4gie1EkgRs6bQscEFOb8F9W435YcTR3MR:JTEgdfYndo6RVidKsVpI4JYcdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639744281, "uuid": "994a259f-9dd7-4460-8367-8c3495c158aa", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639744281, "uuid": "96779cf6-a737-4470-a9d4-6a1ac0be9d9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639744281, "uuid": "ddabc417-f953-4af9-9766-5c0aef11a275", "value": "b9e97744e1d442427d01446515d63d6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0307160-5f5c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1639761250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761250, "uuid": "0b889ae6-f5da-4c5d-ac2d-b31910f9d3f8", "comment": "Malware payload (Heodo)", "value": "c785cdf1bbd765bcb8a4e51459624f47", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761250, "uuid": "7e808931-0203-4eab-8783-b35c835926db", "comment": "Malware payload (Heodo)", "value": "cbda92e115c8bf97ad3c34746c15e50fd9708b665bd47632573f04266746282d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761250, "uuid": "8ab56c44-b33c-4cdb-85a5-6eaa8ebee5b2", "comment": "Malware payload (Heodo)", "value": "34c4ef76a0533b403c169a4aa665598a8c5bc4b1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761250, "uuid": "0c4788fa-53c3-478e-8927-0c8acbb82904", "comment": "Malware payload (Heodo)", "value": "6dd6dbae2abf806c2de2dff742a10a99e37a6bbc4ba23934f20155613ed8d1715d65f7e7a805c8db9eff85f8850604de", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761250, "uuid": "5b910589-a10f-4031-ace8-20d2cfc18b5d", "value": "T1C8849E11B683D072D1BE05303978DA9A096D79318FB4CAEBB7D40A3E4E742C19B35E76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761250, "uuid": "9eaab091-18db-4cb7-b5a0-42c11807f6c9", "value": "d2a2f4c68a7903cc45764257f8ed7a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761250, "uuid": "e1e8ec19-d6f4-4b9b-9eac-7b6469fd191a", "value": "6144:+AriSO7B4gYcl/qjc5dQD8JCedcsqAOBCWOEGNhLdZ4iw:+AriSOG9c0jc5mDQxqfCR4iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639761250, "uuid": "07585685-8df1-4cf2-813d-bda801f3f45b", "value": 383118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639761250, "uuid": "7e0236d8-e830-406d-809c-22c2631ae188", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761250, "uuid": "fd9488cf-902d-4bf5-bccd-345103579ac7", "value": "emotet_exe_e5_cbda92e115c8bf97ad3c34746c15e50fd9708b665bd47632573f04266746282d_2021-12-17__171406.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f7a33e-5f2b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639740060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639740060, "uuid": "266b293c-e3f0-450f-a193-6c7c25cb49ba", "comment": "Malware payload (RedLineStealer)", "value": "712e06659c415e7c0713b1c5f56280ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639740060, "uuid": "25f7a3d4-32d9-4149-98f2-04216cd01be8", "comment": "Malware payload (RedLineStealer)", "value": "cc2f338306f88a416e0f4b4efd537a244a907275e2ca866ce176b7cd957bd0d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639740060, "uuid": "87c5c0da-aff9-4751-8661-3b95b7259353", "comment": "Malware payload (RedLineStealer)", "value": "fc0ff22edf30faf51b7115e4014ff974e37f0e65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639740060, "uuid": "d31c28ca-419e-4c7d-bae5-f636f76380b8", "comment": "Malware payload (RedLineStealer)", "value": "f10efb126c4b5b53609a335cb05efbbb6445e8ca1cb521e44e5df4c424080bff0d7367becfafca3d76622174b001a172", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639740060, "uuid": "3925d95c-0c97-4fb7-9028-ce62d4531ad5", "value": "T1638533C9E3021746C758983404F20F5596EE6DA9FC806906E626095FE630B7BBF1BBCD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639740060, "uuid": "10d6700e-b168-4486-a5d8-4948b9d986c9", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639740060, "uuid": "0b1451cc-cd62-4061-984d-0d4fc0b99353", "value": "49152:Og/5sUgPP0zMaQ9eyqGZFMbPs5e+I4bVFUNaPPQ:Ow5sVHQM1dZMPsM4VW8PQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639740060, "uuid": "b172eef7-371d-4a38-b174-555627243100", "value": 1735400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639740060, "uuid": "1b9fd4a1-7e7d-475b-b123-21ce3f7d43d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639740060, "uuid": "440f1b1b-3862-49b3-a052-ec62c0b7f077", "value": "cc2f338306f88a416e0f4b4efd537a244a907275e2ca8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa76ea42-5f4c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639754476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754476, "uuid": "6938e635-2335-442b-b0d8-11f05499689d", "comment": "Malware payload (Formbook)", "value": "1f39178c29ff3aa896ed3727c3d2b64a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754476, "uuid": "6bf0b3d9-8086-4cfb-b586-d6516e0ad28a", "comment": "Malware payload (Formbook)", "value": "ccc5b256bd8bd09fb241407caee97afda894f2a884b533f3634324e7b87da47e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754476, "uuid": "45468f24-bd7c-4f50-bd96-0c19831eeef2", "comment": "Malware payload (Formbook)", "value": "5e4b578b12ad2e64dcd70217d5cae9cf5a215bf1", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754476, "uuid": "cd3d6405-c4d6-4dd8-8c7c-4a4ddc4fe57c", "comment": "Malware payload (Formbook)", "value": "14fd6beb898eb2d22849682f9bb98f49f68a8925c26cf60ce4d9e182bc4602968668620fcaad839730c5efffd74e84fd", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754476, "uuid": "3b82cca2-c01b-4a4c-9558-3fa1cd06624d", "value": "T13335078525AD3B25FD7953F800AA6C94C3BA7D2A717EC68D4CC330E72973F924850A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754476, "uuid": "576e69ff-6c5a-4692-bbc1-99a3aa930334", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754476, "uuid": "27323e0f-3bd4-4fdc-b9b8-73b76b11d314", "value": "12288:RKc2qBrxam5UUUUUUUi1Bdz/z+AuSK3FoWntWxVedHPiHqhWm+aGih5Y8HRUUUUo:MVqrzNXCDSK3FoWnPVIQW1au8H+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639754476, "uuid": "35a5869e-6c13-426c-ac6f-fd3e25b91c10", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639754476, "uuid": "9d98a692-ee0a-42a6-a93c-05b6ec6a8fe2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754476, "uuid": "9ac8fa1e-058d-4811-99f8-fe2669310feb", "value": "Dhl notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9973491a-5f27-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639738422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738422, "uuid": "694f5e46-b148-4331-bfef-84a4c739d787", "comment": "Malware payload", "value": "6caa47c3ec16a50b30afe6fc41842b0e", "object_relation": "md5", "Tag": [ { "name": "8.142.8.91", "colour": "#DB9B9C", "exportable": true, "hide_tag": false }, { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738422, "uuid": "8d050aa0-a7b5-4e1d-8030-9510baaa41dd", "comment": "Malware payload", "value": "cd9077bf07eb4183aa5d7093cd32c9fddc43e2ecba91a682d666b041c39a4cd2", "object_relation": "sha256", "Tag": [ { "name": "8.142.8.91", "colour": "#DB9B9C", "exportable": true, "hide_tag": false }, { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738422, "uuid": "6555b690-5c42-4ecb-9065-6dd792eca4d2", "comment": "Malware payload", "value": "9acc819404fd6cde56b1f374515d62cde5659cb9", "object_relation": "sha1", "Tag": [ { "name": "8.142.8.91", "colour": "#DB9B9C", "exportable": true, "hide_tag": false }, { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738422, "uuid": "60425c9b-1911-4081-99e4-3ebacf231817", "comment": "Malware payload", "value": "41129af58f9af06cd4fdf0528c091e1cfcb0ba0a783bd8604e5b47f3eedfc597d4998941f5108b8d53203d229fe08da5", "object_relation": "sha3-384", "Tag": [ { "name": "8.142.8.91", "colour": "#DB9B9C", "exportable": true, "hide_tag": false }, { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738422, "uuid": "f1e40c83-7ba0-433a-b76d-8c6e577f6861", "value": "T140F53913FC9190E9C0AED230C96A93537AB57898073023D72B50AEB92F73BD49E79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738422, "uuid": "cff80472-2c6a-42fe-a4bf-108d5ddae31e", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738422, "uuid": "f7463136-d992-4174-a6df-7531cf55b220", "value": "49152:jclX5nnJVJrb/TAvO90dL3BmAFd4A64nsfJ6I7P7+RA51NwBa4gHWS+wAZRkvM5l:jcHnk47DOlzwAlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639738422, "uuid": "22940e8e-a03a-4749-bbc2-14fc057dd5e4", "value": 3342848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639738422, "uuid": "f879a0e8-c8cf-404e-a20d-108e8a9b6cd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738422, "uuid": "5cc4a13f-a157-4585-950c-0ee7b40d2b3d", "value": "log4j-windows-update-20211216.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02cec54a-5f4d-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1639754490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754490, "uuid": "03244676-b655-464a-bd2c-6137099aa289", "comment": "Malware payload (AveMariaRAT)", "value": "df23153cf0b141fa4eee441844931efa", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754490, "uuid": "43c22a1a-d6cf-4db4-b287-9573cdcb1d0c", "comment": "Malware payload (AveMariaRAT)", "value": "cda60055e8ef29779e34f62cf25b1b8ebb037141c9d81451794b20c04bbcc05a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754490, "uuid": "8cead99d-bef5-499f-8ef0-a024ad2127fd", "comment": "Malware payload (AveMariaRAT)", "value": "b180d54268ca1fb9de94807530dadac3b1b51f98", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754490, "uuid": "72479646-0807-4cd6-9bd4-58908c34726b", "comment": "Malware payload (AveMariaRAT)", "value": "16cf574a4f6e39174461e5d6067bedbbb7c145e734a7450e6c3219b7d55a0d8661996f2bf05275ef46fa6c0e3b6c51b4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754490, "uuid": "c1ea51be-77d9-4e83-bf45-33d40ebf64d2", "value": "T1C5B4D00032A9DB12D8B997F48C60A1E047B67C69E676E74E2CC13DEF36BAF504650B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754490, "uuid": "7e2e4458-286a-48f2-8323-e69e80179b98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754490, "uuid": "7cd589c0-e13f-4b3d-8ba3-a20f6a070e94", "value": "12288:p8PapPapPa69Mlidn6R1DujSeOJC7cQhV3huSK3:p8P8P8Pj9Mf7ujfOKl30SK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639754490, "uuid": "c1758517-019c-4942-a061-e8eb407f5bcd", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639754490, "uuid": "ae4c373f-b5fd-4c90-99ed-cc93d7634dc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754490, "uuid": "2b3dc765-1e83-40b7-b3a8-d79e7a7b72d0", "value": "DHL_Shipment number 51015370367858.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7cfb953-5f06-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639724326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724326, "uuid": "2c21eae5-6640-4498-84cc-73b28deffdc8", "comment": "Malware payload (AgentTesla)", "value": "934c006bbf830f2e09d4dd6d884ada32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724326, "uuid": "70e524c9-6f78-4ff5-b541-5813700573a0", "comment": "Malware payload (AgentTesla)", "value": "cee5582b4af927b831da68eccc7211c60ca77dc85fd773ec48d96d6758298654", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724326, "uuid": "60261c92-955a-4715-953a-d5b2757bb1ae", "comment": "Malware payload (AgentTesla)", "value": "cff5f0331162a2b5f8216513303d89ae891d5da9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724326, "uuid": "5df15d30-a93f-46aa-bbcf-4d17a545b04e", "comment": "Malware payload (AgentTesla)", "value": "12616784e0321dbcff36ecf542be0625a1af7e37c39d32f1fee5eadd5c397ecea7f82b61d8800ae1ec406cd3cd68deeb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639724326, "uuid": "29452962-38a1-4937-b6e9-9725d14e3e93", "value": "T171942322155FBB1E920245B743FD6338E0FAC92D6599CB57E1604D370232F5F1B2AA2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639724326, "uuid": "90c998fb-8982-421f-ba42-85289f884440", "value": "12288:LsqP95v3l6O3Ryai2D7V0fxjVnWc9LW+LVmv+kqx72SrU1:hnN61atD7CtRNU+JsWqYU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639724326, "uuid": "91f9365a-7cd5-4c39-90d7-1b215f24ddd9", "value": 440808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639724326, "uuid": "1d41cebe-0e5f-4d15-b64f-514a16b8bde3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639724326, "uuid": "2e73dea6-e179-45a9-9505-b7b492cc7da3", "value": "TT SWIFT COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c4d7af-5f53-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1639757367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757367, "uuid": "f58e0a1c-09bd-44b8-95f9-ab733ad598a8", "comment": "Malware payload (Smoke Loader)", "value": "147db3e33f7fcc55b05f3c172cd14a4e", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757367, "uuid": "1d1a1a28-cedd-4b63-863c-7bd87577469c", "comment": "Malware payload (Smoke Loader)", "value": "d150e4f58b5e1705c4d7fb576534015a42f5ae34fd653a6dadb18088159f1c5d", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757367, "uuid": "c1484318-9981-4e77-8a56-cc34aaa49584", "comment": "Malware payload (Smoke Loader)", "value": "03dbc146612ac7f68d074e9b5ae23ef1f4098e42", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757367, "uuid": "0e54afd1-9b2a-485e-9fe5-7ec6913676af", "comment": "Malware payload (Smoke Loader)", "value": "15cd2698dd829bbca839dec54388fc74ef58993b155bd374ebca1d8a6fae80a77669fbaa525d9e0c9a252c3f7ebe1cee", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757367, "uuid": "42f195e4-4803-42a7-b152-d322eef5bda1", "value": "T1D974AE10A7E0C035F1B756F84AB693BDA93E7AA1673491CF13D52AEA56346D0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757367, "uuid": "5b96db0c-747a-4b35-93a7-4ddf42a91d5d", "value": "1371983aeb683ec0dda1a6e9e2e0f707", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757367, "uuid": "0543c2b4-5977-4a34-8af1-c3125ee8cb3e", "value": "6144:SxZYLf4xB6D3j5C0kmD7jgTewwsVQ2aG3xj0iS:SnC3jc0kmDvgTHwsVQI3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639757367, "uuid": "7796b6eb-f0b7-48bd-b662-c71844ce1c41", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639757367, "uuid": "77e548af-2c88-41e8-94b8-878d821123d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757367, "uuid": "e60f2907-2848-43c3-9ab8-3258acf84182", "value": "147db3e33f7fcc55b05f3c172cd14a4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04fae223-5f63-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639763943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763943, "uuid": "d08fc845-e83f-40e2-bfab-96e8d95cca76", "comment": "Malware payload (Mirai)", "value": "4bc0b20b1fcb4554f10d769ed4ca7c61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763943, "uuid": "16f1d8df-325b-4f67-96ed-900c8695f45f", "comment": "Malware payload (Mirai)", "value": "d21c01a1fe8e9b8a86437dfb7bef13c8bd8b7c9904fd76c0c80b1cce4aba13c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763943, "uuid": "b9997746-2b1d-4f31-8120-6d1c017a2279", "comment": "Malware payload (Mirai)", "value": "3d558ef14eacf1f9d86342b137d6af34ccc1520e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763943, "uuid": "e5854172-f4b3-46f6-8364-8428485e7102", "comment": "Malware payload (Mirai)", "value": "86f5bebd651a4df30039a644b52c5d20a52b025ff9d984e907a55ac110ae44345113e32564f89784c4a5ada6fa599fe3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763943, "uuid": "8ab36b64-88ec-4ce5-91fc-49155aed5145", "value": "T1E341ED8E1F715EF8F559E93C87374B3927AA924843C04289E1ACDA101FC430D49AEBE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763943, "uuid": "02a49d71-d2e2-4f77-8ac3-9fce98765ae9", "value": "48:eSegpEuQ2HNAe1EKDD/9LuEpk5nn2LWxMM:qgpTHN1NvMEpk9nVMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639763943, "uuid": "0aaf2373-c7ee-4699-86d5-72458a64edbf", "value": 1984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639763943, "uuid": "d602d1bb-2b4d-41c3-988f-64f39407fffa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763943, "uuid": "b1495f3b-1d92-4e7e-8d73-0574a3254866", "value": "4bc0b20b1fcb4554f10d769ed4ca7c61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9b80e5-5f0d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639727237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727237, "uuid": "2c897295-f4cf-4285-b1f7-9ccee4daa781", "comment": "Malware payload (RedLineStealer)", "value": "1df4ccf5a3b6623d6bf476b05b817388", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727237, "uuid": "6ac869c6-7747-426d-b948-3a0155b95d7c", "comment": "Malware payload (RedLineStealer)", "value": "d25d9f082b1bbb64de38158bf1508f6ad98f41392f1428666b835f78f1406f50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727237, "uuid": "8fd87047-7c6a-4b38-819c-6bf36a44a048", "comment": "Malware payload (RedLineStealer)", "value": "93930e6c9d04fea1fd256967c81fc9b4f87b97c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727237, "uuid": "80e724fe-4f7d-47ed-ae6c-3c87d9ec1571", "comment": "Malware payload (RedLineStealer)", "value": "feeeb4e17fba7a9bcd3b7cf6e5467d24adc2456c8e684cece81902d88cb250d0411714d99f0b7390aa8655f22263ae2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727237, "uuid": "d68c8adb-a2fb-4352-84ff-7d2045a9488c", "value": "T11AB53384B72BBA4DD7858430F262DC4A69BE1F39DDA22E79916636CD3304474E3768C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727237, "uuid": "ff54ff8b-1e2a-4744-baca-f6f34b54194b", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727237, "uuid": "51938834-7873-43ec-93da-bd80f9cc2bac", "value": "49152:ls2cdfjIIbub17rSmLfAxQbIePD+h69g4l9irNe+NggrNa0UNld:lfCPbC1q0M9uV9gs9ixeWhald", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639727237, "uuid": "cf07575e-645f-46b0-9139-3cb12ee81393", "value": 2370048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639727237, "uuid": "3950985a-8165-454d-82c6-2a3c82f6f99e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727237, "uuid": "64fcf8a3-1a48-4dcb-ba08-9440a47c6000", "value": "1df4ccf5a3b6623d6bf476b05b817388", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88282c91-5efe-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639720784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639720784, "uuid": "f07f2be1-48dc-4048-ba08-ddc96c76990d", "comment": "Malware payload (Quakbot)", "value": "bb17bf13123596ba3065efc74d625a3c", "object_relation": "md5", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639720784, "uuid": "cb0e0c80-d7d0-4f01-8870-be8d59ff90fa", "comment": "Malware payload (Quakbot)", "value": "d302a473d8f19884d38147d13ce87f54b897dad51fdc6490467bca62cc7ae937", "object_relation": "sha256", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639720784, "uuid": "6acfa4de-e6c6-4f72-83e6-f86596a65a01", "comment": "Malware payload (Quakbot)", "value": "b589b0dee84e30e205f242a8d429b1e231b5ec5b", "object_relation": "sha1", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639720784, "uuid": "729e60cc-7c9d-4bcf-a1a8-35cce5933728", "comment": "Malware payload (Quakbot)", "value": "c91abe191a324acc0735f2f57e117e3797c9f7290d7654c20112d9a237b71e508caee1171806fa85992fc44ff3e486a5", "object_relation": "sha3-384", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639720784, "uuid": "bacf9588-f3b1-4b45-b949-0171cf30b13f", "value": "T1E625A628DE25766CFA1374F34972228D0F85049B17E3BAEBE37C6A48A441707DE5B583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639720784, "uuid": "0b6b7d60-7a8c-4ea6-b767-7e2769e76980", "value": "9e7612a813f039fbaabdb52fb0c18662", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639720784, "uuid": "030ebe0d-4fd5-4470-b522-dbf849298931", "value": "6144:NLI3eP+dmQ3TW0NREgFiRZh4McUTubCApkw0AE:cHw0NJwHh4M7TubCA30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639720784, "uuid": "c8863bac-1810-40c7-9552-de72139cb619", "value": 967909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639720784, "uuid": "b63e4047-3530-4f24-a26f-81e00f6270e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639720784, "uuid": "ccc52de7-ce6d-4af1-b67c-ccd6bceb73e0", "value": "latin.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6360fe8f-5f79-11ec-9275-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639773550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773550, "uuid": "5e3469d1-25cb-4448-b2ba-c26367d53747", "comment": "Malware payload (Dridex)", "value": "672c09fca3367742d7026e8ab9040bc4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773550, "uuid": "dd30acec-76d7-4424-9ebf-e903069163ee", "comment": "Malware payload (Dridex)", "value": "d3550092442ef0151dfd4be717ba00c9738a897ffbce52dfb68e20e652fa664b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773550, "uuid": "5b35ce90-4ab3-454f-b2da-d01498517db6", "comment": "Malware payload (Dridex)", "value": "644e32500f1a982926a0d7ad87d606fc02501f87", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773550, "uuid": "2a7d4bbf-2a4c-4319-8600-1dffb1d211a6", "comment": "Malware payload (Dridex)", "value": "247978422f193f54944d1e1508dfdbe70d132bc3d39f6537f3feb41931a6e7b30d88a7584a167ef3480bb1269ee415b7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773550, "uuid": "f7d3a954-aa84-4507-b1e9-01cdf1dcc2dd", "value": "T11AB4BFAFC65E1478C7E31870159143B12EA640C6097ADEAF6B2FFA9C149634C227DB7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773550, "uuid": "91319dd4-92f3-4134-b787-1c852a5905cb", "value": "1d03489a888f9eb61ae369ecc7b0879f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773550, "uuid": "a32932f8-da24-4301-833f-e6cffe513609", "value": "6144:IlkqY8IIaCme+UOwOYEKdvfrlEe/ply5ovxlbL6B4Q02Y:83BdvlDx5ODY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639773550, "uuid": "037a70eb-f423-4fa8-b508-ec7f4ad15177", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639773550, "uuid": "f073dd35-0931-437d-aa87-d91d324cffb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773550, "uuid": "bd2fcc4e-c4cd-40f2-b22c-15038d362905", "value": "SecuriteInfo.com.W32.AIDetect.malware1.1528.24450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19a4079-5f27-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639738436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738436, "uuid": "02f969ab-6e37-44d1-994b-9ce84a67d1e1", "comment": "Malware payload", "value": "2faa6d1e6edb15aa606753746033c18c", "object_relation": "md5", "Tag": [ { "name": "8.142.8.91", "colour": "#DB9B9C", "exportable": true, "hide_tag": false }, { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738436, "uuid": "f10973f0-9f63-4ace-b76e-83bfb3a20ceb", "comment": "Malware payload", "value": "d63ca1f88d5ae76ad6685bab53594a2b2f396f8d4bfd2adde8cb6563d2fc6d29", "object_relation": "sha256", "Tag": [ { "name": "8.142.8.91", "colour": "#DB9B9C", "exportable": true, "hide_tag": false }, { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738436, "uuid": "19e538ca-8485-41ee-a677-d18884f51181", "comment": "Malware payload", "value": "645512d97c8beb72db4444f6811ce3fa4f8b4c73", "object_relation": "sha1", "Tag": [ { "name": "8.142.8.91", "colour": "#DB9B9C", "exportable": true, "hide_tag": false }, { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738436, "uuid": "0aabb6a0-c78c-43a0-972d-3f20daeba56b", "comment": "Malware payload", "value": "4115aab3329b7dd8125ffb1c873c97644ec4b2b52b90cf7b1e8cf95ad5bd716fc77da21e6a035886f80bc92a75ce8ebf", "object_relation": "sha3-384", "Tag": [ { "name": "8.142.8.91", "colour": "#DB9B9C", "exportable": true, "hide_tag": false }, { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738436, "uuid": "2426d7b3-d489-43c2-9e57-6932145b9fd1", "value": "T1A5063A16F8A604FAC1BEF13185559322BA713CB943317BD31F84AA6E1665FE46E3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738436, "uuid": "01d6de15-9664-4bb4-8d93-d209468ffe33", "value": "93a138801d9601e4c36e6274c8b9d111", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738436, "uuid": "3ed86dd4-4bfa-4b23-b640-e4a9b541eaad", "value": "49152:y7Bm6DczkDOUvi+lpUm4wiJE2JZ9KvaSKWM7pit7m9EU7FS5ZsM:y7hg4DOEph/AtJZwCWIedsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639738436, "uuid": "e751245e-1be9-4d2a-b459-ef4d11a6d828", "value": 3694080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639738436, "uuid": "7073d705-f1cc-4b8f-b951-628a9a465757", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738436, "uuid": "d2195399-6f4c-4fb3-b00a-e5f9ca3e39be", "value": "d63ca1f88d5ae76ad6685bab53594a2b2f396f8d4bfd2adde8cb6563d2fc6d29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69cf6ff8-5f0f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639728034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639728034, "uuid": "50c30e4c-4c90-450e-8ab4-5767ed0876b9", "comment": "Malware payload (RedLineStealer)", "value": "7c4e9c8669464598e01b67bac7d1329a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639728034, "uuid": "c8a99f42-4ede-4fb3-9000-445ac6af47e7", "comment": "Malware payload (RedLineStealer)", "value": "d64b097aa7ae529d88f3ea5438deb1630aa57ebf7d7135203ed322ee591997c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639728034, "uuid": "ec221493-24ee-4a86-a643-c73090f621bf", "comment": "Malware payload (RedLineStealer)", "value": "06dcfa0019551cf3b8552fe60ee7f1d57172a7d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639728034, "uuid": "eed23b7a-548d-4015-b109-156672ab26ce", "comment": "Malware payload (RedLineStealer)", "value": "773825321d7bf54ee256751bf34305b0835c05db80058f8013e25b701b8d939d2fb849b5bcf18843d2c231aa8563ac36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639728034, "uuid": "8ace94e5-e13d-460b-a9b3-c25c63e20ea9", "value": "T16154F13179FCC972C5A71A700868C7D65AFEB8211270528B3F68176E5F60EEC46E631E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639728034, "uuid": "a8d9b144-de82-4b5c-b5e1-32f9c5d8b71e", "value": "7494e044e12fc05147041dc0d8480ad1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639728034, "uuid": "3e0a93fb-07da-4b25-aef1-4df843deb2b9", "value": "6144:r9L201JctyFamXEQLQPVLaKlPXKpsyzxnfDJscFibqz8uzbgwuw/B:r9C01JjM9OKFgbJhSunnL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639728034, "uuid": "45d0b6b1-a399-4c6d-b88d-778e252f9e6c", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639728034, "uuid": "e9149d9e-bc00-441f-8cb7-0ffff5064eb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639728034, "uuid": "1f5a1d81-6f5e-4478-9035-14cbc23380f0", "value": "d64b097aa7ae529d88f3ea5438deb1630aa57ebf7d713.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8591a23f-5f22-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1639736241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736241, "uuid": "0fd7c1ae-e5e1-4c25-95f9-1a4d001a0d0a", "comment": "Malware payload (SnakeKeylogger)", "value": "820aeff6266bde50f16e837c9a48c4e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736241, "uuid": "32bd4164-b99e-4c1f-afbd-6d0935bcb4af", "comment": "Malware payload (SnakeKeylogger)", "value": "d65f61619424a2312e304aa96179790ba96d9412edebb89ab937728977f6af5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736241, "uuid": "4b3293ea-2a96-4f98-bb21-f17179db1f92", "comment": "Malware payload (SnakeKeylogger)", "value": "5847d04d36b052d6bd29b602ef43c1a8bca4e2c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736241, "uuid": "5d2b6e61-c7ca-4e41-90eb-3e7b3fd9d9d1", "comment": "Malware payload (SnakeKeylogger)", "value": "3de1edf8880632fada160efc8ab3bb279fe43c974a6ad6823fe8a8af3d8d15af4b136f03dbd99a48a98d761fffd7e486", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736241, "uuid": "5df3083c-14f1-4cc5-984c-c1c3102e1538", "value": "T15E35F78525AD3B25FD7993F800AA6C94C7BA7D2A717EC68D4CC330D72973F924850A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736241, "uuid": "8d9f4eef-99c4-4943-81af-80a4996805bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736241, "uuid": "439f6bae-3208-432b-bd3a-0675ebe0ac34", "value": "12288:sKc2qjrmGUUUUUUUi1B1z/z+AuSK3olJC87w/kWlXisvHqDyaMWMT6fdpWUUUUUt:jVqjyajCDSK3o/CdMWlX/iDJffdp31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639736241, "uuid": "56014f14-e306-4a7e-868d-0c52ae482b3e", "value": 1073664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639736241, "uuid": "708339a0-6420-4192-8e38-da85d66f6a3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736241, "uuid": "633bf7f0-19c3-4fe5-894f-817ee52269bd", "value": "Request for specification_6363736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d2152d-5f4a-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1639753497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753497, "uuid": "ca34ea09-f36a-42c0-bba5-ad41d13c2e77", "comment": "Malware payload (ArkeiStealer)", "value": "537cbe051fa9d59e154a98ee65325037", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753497, "uuid": "653963fd-2058-4206-8ccf-4516c1b9ae40", "comment": "Malware payload (ArkeiStealer)", "value": "d6b713a7c073f1148c5d62c7d6b041fa604c61fc1386a2726eadbfd580a32dd7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753497, "uuid": "13931b51-368c-4d36-bf7a-0cef4443a696", "comment": "Malware payload (ArkeiStealer)", "value": "1c844b334d95859ffd0a69684f1504a1fa35999e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753497, "uuid": "0a97be92-63bc-4d9b-a36a-0133647628f1", "comment": "Malware payload (ArkeiStealer)", "value": "764bb45bacd411e60462eb3976e288fb5c7895b144dbab294b23e68c1492eb9e98960ea9d0212fd38e8da5109333462c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753497, "uuid": "9a71d5b9-8893-462f-8da2-1e1647c0bb81", "value": "T1FE14C03979EDC1B2C5A309B048F0CA955A7ABC721F65514B3BAC076E1E30EDC4AE631D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753497, "uuid": "c2def6dc-60ae-4e3e-9a2f-6dc4279ab8f5", "value": "995d859dc5c5cdfbe9d72008a77e5890", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753497, "uuid": "ea89f1c4-78bf-457b-9ca3-5bba31f99890", "value": "3072:Q8LCurEleGkjIFHMLMqlzOlBHYBJuwiW2nGqjYQIjhkk1jZWrxpzbgqruFpsbB:Q8LgYGksKIllBHYBJ/1qjYrnuzbgwukB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639753497, "uuid": "c6c28070-edee-4ceb-aab0-d9b43d524cec", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639753497, "uuid": "6183c01f-eddf-4c16-a63f-ab5bff83d225", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753497, "uuid": "6c068bb1-74f5-4c40-a577-8e1ff831b484", "value": "537cbe051fa9d59e154a98ee65325037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf042eb-5f55-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639758077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758077, "uuid": "381a9980-a61a-43a2-b408-fafb885e4c72", "comment": "Malware payload (Gafgyt)", "value": "a42dd132ca845d6b0ca2a8a0008c74e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758077, "uuid": "38b7b799-a607-4b72-a9c9-a3f41758227e", "comment": "Malware payload (Gafgyt)", "value": "d70091de38f371b028837fd87ab813b0c4dfa84990eac4d24823c0ad42fdef28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758077, "uuid": "d1a9c62d-1f14-4e7e-b57f-99ab779ee906", "comment": "Malware payload (Gafgyt)", "value": "1e9bf09eb1d6cfadf985faf2261587bb748a7d3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758077, "uuid": "46e633f8-0526-4f93-b556-272a37d9c963", "comment": "Malware payload (Gafgyt)", "value": "1ffc530bdc0b83278ca0b93a174c4059b58d3a11402fd2f086f7466696caadd49d9f097023e8ae129126162473d70a00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758077, "uuid": "ac07fa0d-9843-42b2-985d-a99c6fb1e94c", "value": "T187E34B09F6408B53C0D32776B68F534537239BA5A3DB33069928AFF43FC27A94E22955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758077, "uuid": "8c8eb9b5-e22b-42fc-b687-d25304570a51", "value": "3072:tdntU2haO5H1XacBoGmh9H5C5hDiGRvEM/9f9T637m5wTsL/Qpyn:ntVhaO5H1qEc9H85hDiGRcM/9l+7m5wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639758077, "uuid": "2e137c41-cdda-4625-b89b-b7b369c97856", "value": 156296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639758077, "uuid": "3ec9e2d8-ed13-4402-909a-be7cebcfd081", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758077, "uuid": "c53c771b-0d40-498b-b9e7-86edbbb1a70f", "value": "a42dd132ca845d6b0ca2a8a0008c74e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f132987-5f56-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639758591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758591, "uuid": "6847b8a1-a56d-4a1f-9037-9dd33659aa6c", "comment": "Malware payload (Gafgyt)", "value": "b0ceb920769aaf82f6efa0de6ad3fcaa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758591, "uuid": "5b2589af-2619-4a49-ad93-7c5da1f6046b", "comment": "Malware payload (Gafgyt)", "value": "d840d87f547b9585bb1ce984e1cbc9eccddd71728fed2127ed26529bc8c5b454", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758591, "uuid": "594f332d-0ba9-453c-91c7-ca622bc2616b", "comment": "Malware payload (Gafgyt)", "value": "d44426cb9f59b17abc89d8a52a00cbfc7fe21c24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758591, "uuid": "5806cacb-ad85-4d6a-8624-67a37c932122", "comment": "Malware payload (Gafgyt)", "value": "ad067b80bbc52633db0e13f3054120246c3590f441ed9515e5cf72b5332dd7f795e9ccd1439eb6879eacd951c54987b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758591, "uuid": "a082ccc1-5e7f-41ef-98ab-c222a378d2c9", "value": "T1B7934C06F8419713C1C327B6B7CF47093B3667B957EB33026A386FB02BC67991A25A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758591, "uuid": "05bf12fe-4397-4278-a2b0-c347a2749981", "value": "1536:ZvgGLI1gX3JGQxPuwjxtOZyW5hXNKV6T/Fo2kjvVqQEqn/lJXCPe:tIHQjj65hXNKV6T/cjvVqQEqn9JXCPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639758591, "uuid": "59112e46-92da-4d65-9f43-a89ac3a4b1c7", "value": 96620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639758591, "uuid": "c058a2c0-f50e-4b2a-9ec4-214fc99064c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758591, "uuid": "50bdc707-7ac7-41a2-aadf-ee805e728532", "value": "b0ceb920769aaf82f6efa0de6ad3fcaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "357d1fd9-5f52-11ec-9275-42010a9c0029", "comment": "Malware payload (Lucifer)", "timestamp": 1639756723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756723, "uuid": "b728de40-c16a-4cd2-a58d-84b3142bce7a", "comment": "Malware payload (Lucifer)", "value": "0f9cbdee74c892a2884241a4742bac1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756723, "uuid": "21aac5b0-922b-48a8-b27c-5c614307b1f1", "comment": "Malware payload (Lucifer)", "value": "d897afb2317de3c5d3165430d51b8ff297b9972a1a00ed1c97c232695a4e982d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756723, "uuid": "22f4af2d-4696-487f-b9bc-dc1f7706d608", "comment": "Malware payload (Lucifer)", "value": "aae3e48ee79e2e3354c6d33cbc6ee1201d25c9c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756723, "uuid": "68cdbba6-6c50-4d42-8d17-7cf68d663e9a", "comment": "Malware payload (Lucifer)", "value": "f061ea7fef12793e6493a4bae2a1e2544b45bccbf58df762ea593a1fcd8816100ccceafca28b1467e6d6c29bfe7da475", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756723, "uuid": "2d380b6e-e911-4326-9ac6-f2ecdffa8871", "value": "T13CC46A0223FC4BA5E5FE2B31A631424543F6FD46657AE70D1D80E6EA4C777829E203A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756723, "uuid": "d1b23210-d40a-4850-a01e-aa0077c03adb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756723, "uuid": "502a85be-b1fd-4724-8086-6d7a00a4830c", "value": "6144:X+BWmtpZQYS2PjCLfjSCpkALDUbr0tJ0nzbWdG/Wow7+JJUk:OPw2PjCLe3a6Q70zbYow60k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639756723, "uuid": "879873c6-4bde-48a9-9742-6d972642d5ed", "value": 549420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639756723, "uuid": "1b5b4a7a-f766-4d00-be3f-29e84d5fa4b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756723, "uuid": "7f39f274-5c47-400f-a382-6d67846e164d", "value": "0f9cbdee74c892a2884241a4742bac1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61a28bc-5f5b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639760777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639760777, "uuid": "4a193e28-e356-4269-97fa-ee126b1dba9c", "comment": "Malware payload (RedLineStealer)", "value": "7ec4074c52da2e1fa76e4918a8488508", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639760777, "uuid": "153c66b0-dd8a-49e3-9b53-3acace3dad64", "comment": "Malware payload (RedLineStealer)", "value": "d8ebb2b291c120ae567cf71ee42e02fb68874f91ea939aad30ceea33fb2637ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639760777, "uuid": "9dbf14ca-9f45-4aa2-bbe3-248d9be89e7d", "comment": "Malware payload (RedLineStealer)", "value": "7524a07c26f23657b8d52b8a90039bb3614c2efe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639760777, "uuid": "5205fdea-cb0f-422e-ba5a-2aec48b711fe", "comment": "Malware payload (RedLineStealer)", "value": "458b495d12eb606593a0f5b9b4c0ff36ab24f64a897275698cc590daed9cdb8c69308120ffd605708053c81c41a2323e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639760777, "uuid": "0b9c362e-0eb5-49b9-8012-24887560276c", "value": "T13D453612A1658C75F5D0E2733BBBA63270E48FF69DD8B7851BE17A621E3F54E0422234", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639760777, "uuid": "a595ac61-dfa9-48c2-90db-b425e8316a7c", "value": "7a4c283b844b9cac0e1495931c23b3ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639760777, "uuid": "ec189cc6-e528-4f3d-bcbf-b69540dd4a01", "value": "24576:k73xb1EkHxMJ0MXRRAf7yQqKFEGSMrm46g/:kCOIhRi7yQK9MC46g/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639760777, "uuid": "4ba317d5-c487-4107-94f5-424ddf4947f3", "value": 1224640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639760777, "uuid": "415abae1-ec06-4898-9bfd-9142fd7bbd41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639760777, "uuid": "c9b25be3-877d-44f6-a836-fdfc21631620", "value": "7ec4074c52da2e1fa76e4918a8488508", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c373789e-5f16-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639731191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731191, "uuid": "2e49b645-ec28-43d9-8ff6-6bc6a65a43de", "comment": "Malware payload", "value": "1b83dfdea45c71cb9ea07ee2142b853f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731191, "uuid": "cb058759-0005-446b-be62-67302917f98c", "comment": "Malware payload", "value": "da020c6ff91f04ebce4b822df3668228d644f1ce7d362b52d249757485c00a20", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731191, "uuid": "b2f22c09-a3ed-4bca-8476-075684b32998", "comment": "Malware payload", "value": "f652cdd09eb13b777d0f7ad0f2eeaf4b624ed6f5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731191, "uuid": "f5edd3d3-1de6-4d27-b64b-f1cb96632b9b", "comment": "Malware payload", "value": "cdd5d88d31ec1c9b4967d04cf2714785781df5c559d370696ef0caaca2aa6725ee01beea82f06b49363139e86456d5df", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731191, "uuid": "7d60dd40-fc81-4820-a53e-084ed4b6df03", "value": "T1194184F51433C8C6222D168709A4753ECF4CE297635BAE19DE5E68147F8C8B6B8C0369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731191, "uuid": "9b95aef5-5917-45a7-9f5b-bccd3eb37f17", "value": "48:SMhZ2rK6MOSp50riBREYX0yW6eRW5BtU8T0vEZb5:SEZKMzhdT0u5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639731191, "uuid": "4488336d-8fee-42af-82be-0d6a78dacb90", "value": 2231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639731191, "uuid": "0f24271a-720f-44eb-a712-67d8774401bc", "value": "application/csv", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731191, "uuid": "ad941d55-9627-4bf5-8d97-56fe373ab341", "value": "AER920BZXOPMQW.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d108e062-5ef6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639717470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639717470, "uuid": "30207d4d-75e5-4b1a-ac19-909aa4094d6d", "comment": "Malware payload", "value": "8c1e79369630535b85a9d3208cc47374", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639717470, "uuid": "562136b1-673b-46fb-93f0-68c7c81d8f04", "comment": "Malware payload", "value": "da9b8fb5c26e81fb3aed3b0bc95d855339fced303aae2af281daf0f1a873e585", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639717470, "uuid": "0f099ce8-a458-4e0a-beb2-00e37762f379", "comment": "Malware payload", "value": "b8c44ee4ad7f056867e39d45d86a47da2ec8e682", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639717470, "uuid": "cd597c44-5b77-4e2b-841c-8fbff995e55d", "comment": "Malware payload", "value": "b66a411dd12ef6832e9835f97fd5a9117558cf92ab3d779f0ff2ec308c6b749618806c63fcb01ae5823d2e948d2ae35b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639717470, "uuid": "7369a262-0744-4c3b-8c45-c2706be55a39", "value": "T1F4363A06F89125E6D1BEE13086919362BA717CB5873037E39F90FA6A1A35FD06E3D701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639717470, "uuid": "ff03dd19-6fdf-4464-b53f-e39c25a6b23c", "value": "49152:elLomJ0roTKC9PAqLiDEPFahZ+12qvqVxnGAuq1svnTQ2+LgBWYzV1:GdrTX9P/Lztd2YqVxnHuqIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639717470, "uuid": "092c4bc0-df4e-44d0-83c3-1f3730ef66ca", "value": 5009408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639717470, "uuid": "a553dc4f-132b-43e0-a190-a095a6bd7b91", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639717470, "uuid": "ffdc80f3-d138-403f-befc-8e235c32773a", "value": "index", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdc7526-5ee0-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639707987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639707987, "uuid": "fcc668e1-5767-4795-9651-40924f6029c1", "comment": "Malware payload (AsyncRAT)", "value": "b3c1b54a9085ba5696a9a8770827f908", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639707987, "uuid": "d3e6f609-6dc1-4478-bfb4-ae26537b3c41", "comment": "Malware payload (AsyncRAT)", "value": "daff09e7c2422769ee94d911316aa55b00438031df7fb1faee7ad0856f3f6f53", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639707987, "uuid": "80b5480b-3b40-48c7-bb7c-22187b6e16aa", "comment": "Malware payload (AsyncRAT)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639707987, "uuid": "f0f44b83-7ba0-4da5-a6af-4f6fee3d17c0", "comment": "Malware payload (AsyncRAT)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639707987, "uuid": "d8c9b253-d577-4ce5-999b-4b03e2aaa9b2", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639707987, "uuid": "38cdc1fa-efa3-452f-93b3-a29746e92b97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639707987, "uuid": "4f37abd2-4ab6-47c0-abf4-2b81c94fc827", "value": "b3c1b54a9085ba5696a9a8770827f908.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a0af9e-5f06-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639724267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724267, "uuid": "c0ed96d6-b5cf-47a5-99c3-092bff8d0b6c", "comment": "Malware payload (AgentTesla)", "value": "932c94f776e7f52e5baaf592e954a6a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724267, "uuid": "170ef62d-5cca-4fae-8fab-918f1459c6c1", "comment": "Malware payload (AgentTesla)", "value": "dd48a5eed5e383cf3e8a5d3ff3ebc8ba97459e137de05c360699dade3a0660da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724267, "uuid": "9fa37010-9764-4cd3-b929-26ce2d82029c", "comment": "Malware payload (AgentTesla)", "value": "22a7fb5ae94e3dc085d2332b606cf1346b5bafc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724267, "uuid": "c690319b-d315-4be2-9724-9b72877378d2", "comment": "Malware payload (AgentTesla)", "value": "1345d00b79b1692cdd18fb6f8a7f0cadf2b04e0a1229107907bc77850f1a8a6016987cd9411674087d8d49eb0916d796", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639724267, "uuid": "d2713c5a-da20-4ff1-815c-e01094a4662f", "value": "T1B58423D0D48C6C09E81F7972B43AA2A12876947F9CD17EE1F53A86863D546523B38F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639724267, "uuid": "70255a05-3acf-4cf5-98a4-405532f77669", "value": "6144:oJFCsDkevheliIHQET98oIbfOEpqLbDmRa5nNOw2oN650d0KRE9lcFS3EI+kiW7x:oisDrhANwEpxifOEpybDwe31NZYDH9+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639724267, "uuid": "ddc93da7-7b31-4e65-a298-2c8e27c477ca", "value": 388775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639724267, "uuid": "a00db629-fa52-43b0-a248-dfcb47dd6316", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639724267, "uuid": "ddbebc81-f79e-492f-b94b-e3b74655965c", "value": "invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c9a178-5f53-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639757235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757235, "uuid": "5671cc42-682b-4e63-999d-8694ed97dd28", "comment": "Malware payload (Formbook)", "value": "1191cfd52ed6e404ec7ab6cbd4629432", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757235, "uuid": "ed336de6-6c41-4fa2-ba32-d9a956b784d0", "comment": "Malware payload (Formbook)", "value": "de6dc334531211ab3bd0fff645bbe531e73619848f364de4d82519a757b27df5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757235, "uuid": "63062105-f56c-49ee-8a56-66cc42a7b666", "comment": "Malware payload (Formbook)", "value": "9f3f228c03ebe51a0b0342a1eca66c1c30b9003a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757235, "uuid": "76b8ab72-b2d9-486c-9d93-e83614bc6f3b", "comment": "Malware payload (Formbook)", "value": "f9596b4aab50d5714afe1949d5537b2e37afaaf40a32649b84d4fe42951f1c742b50521d0ab3d7ef27845f9a9778f586", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757235, "uuid": "6339ff0f-ecbe-4bb1-8732-f630c07b10f4", "value": "T1BF94BCBB7281D16EC373C5BD9001E528BE279E170CF5861A5BD83BFE1172A507AB0B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757235, "uuid": "5ecc0aa3-7ab1-4022-9698-daa22f274f30", "value": "12288:iLR93QAugS7tFOwo13Shcyq1zVBxuPpve7:iFGCShcyqPuBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639757235, "uuid": "f3fba213-bb9e-4484-804a-b8d2fb2bd7e4", "value": 434115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639757235, "uuid": "edec917f-1400-4549-9d88-e9fa5e6bfba1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757235, "uuid": "48277fd8-a78f-44f6-9e8d-ec31f1b1bd70", "value": "1191cfd52ed6e404ec7ab6cbd4629432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed37e100-5f87-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639779794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779794, "uuid": "38e72319-2b5e-49a8-a3c0-cc932b212a72", "comment": "Malware payload", "value": "19b4af0e76dcba225a3fdec3f115edb0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama146", "colour": "#C26761", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779794, "uuid": "75280fd1-510b-46a7-a78d-503c7715cf3a", "comment": "Malware payload", "value": "de9738c0910931b2b5e1f68841637a25301d17ab3860cd6e2cc1cbef9af1f5dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama146", "colour": "#C26761", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779794, "uuid": "b997e02e-a97a-4933-ab4c-f135e389bb4a", "comment": "Malware payload", "value": "8d37491e61d524bb4e2485443a8428bb4eeb2e4e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama146", "colour": "#C26761", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779794, "uuid": "ef339267-3671-41c9-8658-b718cfc00fd7", "comment": "Malware payload", "value": "c2c048f0adb6804fcdedcad79620f0f16e8db04a93765f6aefd0749fa6885aea52dde12d7fa6b2aea381baa9368fd276", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama146", "colour": "#C26761", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779794, "uuid": "8f431647-7f8a-4a51-b383-f13cab3eee4d", "value": "T14AD56D15FA934CF2DAE712314046F23B56306B2DC263ABB7FF4469BCBA726404D1B259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779794, "uuid": "ebf7592b-a1f4-4523-82cd-a9298675db52", "value": "2ac7a340a3aa040cc3a8e404720833a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779794, "uuid": "1129d37a-a61e-4b62-b1e9-6fe518006307", "value": "49152:yVUZMcNCu/aXwvg7CfUCOyzw4LxNPpOcQdRckhdIfTRfWGf9mjT4R:yVgMsD+woufx1fWGlmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639779794, "uuid": "7ebf4975-ee11-4110-903c-b9b7436a99bc", "value": 2951664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639779794, "uuid": "6b7972f6-7321-4c30-a89c-c37db8611f79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779794, "uuid": "fe97828a-fa9c-47ef-a14e-527b94e73a1f", "value": "de9738c0910931b2b5e1f68841637a25301d17ab3860cd6e2cc1cbef9af1f5dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5259f17-5f4b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639753930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753930, "uuid": "3addb718-a4ae-4ea9-a3a0-65c378222726", "comment": "Malware payload (Formbook)", "value": "6c7ab01eeaa7e956e606b7cfa22c7815", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753930, "uuid": "7af00bd6-7f37-4234-aff7-dc2f8b657262", "comment": "Malware payload (Formbook)", "value": "df36a587e3598ff7c8353c733bd57f177749a45358b419427cb3d168a42b1bd2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753930, "uuid": "50840a04-35f5-4540-a9e9-065b5902a107", "comment": "Malware payload (Formbook)", "value": "df54b8d6f0bca65a7f7d1c877ee63c7ae9ec2e75", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639753930, "uuid": "9b29ff4c-40a7-4d40-a935-c4fc1c689651", "comment": "Malware payload (Formbook)", "value": "5bb2326aae7e1ab9ea42cc865cd11fd6cdb863c546d543b8cf8d6a340888615df46b6a90f617bbf2862544a2e2efe300", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753930, "uuid": "4cc941e2-f93d-4f55-847b-f8fbd185b77e", "value": "T18592617DD04706A88F46A7B8A71B2F06014C766DF789953336BCAB7167E2C7A452283C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753930, "uuid": "d9c5b4ba-15ab-414d-89c5-12f9315a94da", "value": "384:dxWH22IywK439E99eH5Oqupl57d7BQoDqf0Po54VIrn8R:dx622Ie432Zf5haSmB8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639753930, "uuid": "471a8621-a9dd-4739-96ce-e76add9ce509", "value": 19634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639753930, "uuid": "365be30f-899d-4fbb-8c3b-4ca0c1e8a83a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639753930, "uuid": "d3944f8c-9e09-4187-a871-b64673b3d79b", "value": "_swftcopy16122021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69266e64-5f79-11ec-9275-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639773560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773560, "uuid": "8757d173-366d-487b-8b5d-b778015830b2", "comment": "Malware payload (Dridex)", "value": "d676f07901fadcb518350795ad6e8bcb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773560, "uuid": "280f70a7-560f-47c8-9246-6ade99f65963", "comment": "Malware payload (Dridex)", "value": "e00dc545e5e75f7d3d2464846c69cba30ea7f0e86ad7960501c392e19285de7e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773560, "uuid": "a683281f-577c-4d72-b16b-1a778d3ed92a", "comment": "Malware payload (Dridex)", "value": "d2f2fdbfd948a633d5f90dcfb2feadd377615474", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773560, "uuid": "86bd89d6-5939-4c38-8c90-b14b5cab3755", "comment": "Malware payload (Dridex)", "value": "09d79267948b6c06a052ef06e4ca1ddd027a557da1cab9352a942872a206f6238bae839ba792be4235c9b3e951f396e4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773560, "uuid": "311c1f2f-f1fd-47f6-a2da-b81c3c6697ab", "value": "T179B4BFAFC65E1478C7E31870159143B12EA640C6097ADEAF6B2FFA9C149634C227DB7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773560, "uuid": "e1eed839-11fa-4a72-918a-5b932bd9f389", "value": "1d03489a888f9eb61ae369ecc7b0879f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773560, "uuid": "1e42e7a7-eafe-476d-865c-c7bf9d92f33c", "value": "6144:6lkqY8IIaCme+UOwOYEKdvfrlEe/ply5ovxlbL6B4Q0/Y:O3BdvlDx5OSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639773560, "uuid": "56d8f713-d7e4-4521-9228-5c2eea884bad", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639773560, "uuid": "119f5e69-1c9c-4963-94d5-5c07223d7aeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773560, "uuid": "166af9d3-1969-4287-b1c2-a70954cc6611", "value": "SecuriteInfo.com.W32.AIDetect.malware1.12281.17554", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed08b17-5f87-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639779582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779582, "uuid": "3cf5eef8-8b69-4a07-8071-5dd272af317e", "comment": "Malware payload (Formbook)", "value": "c438a205d0a5c285ac98f558ee669dfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779582, "uuid": "27332454-3633-4f88-9e39-202f08551d9f", "comment": "Malware payload (Formbook)", "value": "e04c2819db3610dc0498ae022644d1b2ab06927cc4fadf23b200af70b551d6d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779582, "uuid": "271a5def-d9bb-44d5-ba41-bae0051b79a0", "comment": "Malware payload (Formbook)", "value": "1c11cdda027a795b929d4876d04cc2c27c89219b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639779582, "uuid": "25cd1755-7324-4110-accd-5e007316ae43", "comment": "Malware payload (Formbook)", "value": "74d01a70dd7feddca44a38841829316e222b95e3fc890091d9c5503857357d122542f41def6d2d6c3afab619af96a868", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779582, "uuid": "47139155-91a3-481e-ae20-118e8f698dd2", "value": "T132D48D907084B99BF42338F1986FEA20B05B669F5468810D315BBB2E55E731210ABF6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779582, "uuid": "244c4f5b-28e2-4c29-a84b-21c01f0eec4f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779582, "uuid": "fac31625-fb9a-4708-a385-dc9bd0725f54", "value": "12288:KUNPWZCOO2120vc6r9o/gvb5zWeLlor+d7UuB45iEbgXP:KUNap7E6poIvdWeh5j45iP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639779582, "uuid": "3e903a50-8b43-4e5c-8881-8ce45f8dd0d9", "value": 645635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639779582, "uuid": "d99fd55b-b644-4f03-823b-5b17b3925cdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639779582, "uuid": "7d25ba48-c34b-4563-aa7d-1bd1d0ae73c1", "value": "7084_00_WPG_20211716.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3f7aaf-5f16-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1639731182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731182, "uuid": "4b1f07df-9a6e-4906-9bbe-cbf1ba86f2d3", "comment": "Malware payload (Vjw0rm)", "value": "299e8af9cce953ee2750818f7cea2563", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731182, "uuid": "91486292-2ece-45cc-a065-ee0b799304ab", "comment": "Malware payload (Vjw0rm)", "value": "e051971136e18efd26174bd5641abfd2c687865c6790c9a9ea1582288b8f956b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731182, "uuid": "6aa4403c-92cb-46b8-ac2d-b27a86c9d067", "comment": "Malware payload (Vjw0rm)", "value": "a00478a0927d2b61d1693b6002e6c1a88abe8252", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731182, "uuid": "c19e7492-4c92-4415-b941-46acb95d2dbe", "comment": "Malware payload (Vjw0rm)", "value": "d67563934f9154c9addc608d63244360e3d494aac20233f836805521628bcd4a3cfd4cdef911a666a9e797969bb967b0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731182, "uuid": "4c6c35c0-150e-4176-94cb-32cb56e0814a", "value": "T1E2433FC16FC1E885129B6F7B7B15B0F0EB1A1D9871C44D5EE000B860F09DAAEF9E9274", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731182, "uuid": "79b5f402-85da-4464-b6f8-0457074f588f", "value": "768:8TLIKPkYNazYwEhxYKM+3sryf0p6O8eO0FKMuYY9IHWaNBrOfpoWQV/svOvns4yt:PnvK13Xa0KhYae+thGEUZH8Azn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639731182, "uuid": "6b00a12a-3b89-4291-b5e1-b4cddcfb725a", "value": 55583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639731182, "uuid": "214e62f1-f013-4d19-9b62-eafda4491008", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731182, "uuid": "e32dd711-94f9-434d-94ea-7659f0d0aaa3", "value": "UW802KASIOPSDUW.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4f30cb-5f8e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639782450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639782450, "uuid": "3ee079af-0f54-4fee-bb03-5e507f506063", "comment": "Malware payload", "value": "700b431b0ed383e238d98418fa5c54ce", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639782450, "uuid": "31315cae-2114-4043-9b99-21bf2d286d99", "comment": "Malware payload", "value": "e19ae4ea423a7210e27c0c58deb9ae5a77d1d9c8a4020051210290c53e69bebf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639782450, "uuid": "7d189c7d-7dd8-41b4-ad3a-bb089c0e7b5e", "comment": "Malware payload", "value": "af025887a6b5f60d60ea239a61c1f900797316c6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639782450, "uuid": "cce16ba7-b626-49d8-828a-daf05d8c993f", "comment": "Malware payload", "value": "644162e96c6a0f3f1b2e48c53a00f1f749f1c2eac3ec248a86f794442d985eec033dc125ccfc71a9c19ec88d96984dcb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639782450, "uuid": "76acc822-0e7c-4b05-9baa-38afea45d2c8", "value": "T190B4BFAFC65E1478C7E31870159143B12EA640C6097ADEAF6B2FFA9C149634C227DB7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639782450, "uuid": "c7ef5036-685e-4c71-88b8-4f0a2d4c7138", "value": "1d03489a888f9eb61ae369ecc7b0879f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639782450, "uuid": "55f76c4a-c9f8-47a5-907d-0512f1f720d9", "value": "6144:elkqY8IIaCme+UOwOYEKdvfrlEe/ply5ovxlbL6B4Q0UY:y3BdvlDx5OFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639782450, "uuid": "e8064675-ca99-4e14-84a1-a9e5e3f24f1b", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639782450, "uuid": "05d55ce8-edb7-451a-a064-0126c3968dac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639782450, "uuid": "e2ac7aa1-7f43-4668-b0b2-43cc4507a473", "value": "SecuriteInfo.com.W32.AIDetect.malware1.3909.11015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4396d3c7-5f22-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639736130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736130, "uuid": "0cc26019-8052-43b3-a09d-cfddfe2684ec", "comment": "Malware payload (RedLineStealer)", "value": "1c905c63b7e5b3b0786041f3fd5919ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736130, "uuid": "2f5833c4-53c5-4dc4-85af-e0ad653ee915", "comment": "Malware payload (RedLineStealer)", "value": "e35f88152d28829a3219f8223dc0160e5dd8e506a87e6d33ed60ae6b80c2d264", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736130, "uuid": "6eaf58b5-71fe-4bb9-ac33-afb723604b18", "comment": "Malware payload (RedLineStealer)", "value": "595b068cd1dc76df690e728bf7403bf554d9ec5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736130, "uuid": "eed53618-ccff-4928-bcd7-47a18c0e2e60", "comment": "Malware payload (RedLineStealer)", "value": "5ea6c458146c951960307a4c6b81dff39ca5876d065b8d4e6b270ea97d76d819d15b14d39f5f18e3a23febad918cacb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736130, "uuid": "ea147781-58b3-4409-bf9d-9ab9d10e9c5e", "value": "T14354F13178BCC972C95306759860DBD95F3FB8121A60508F3B681A6A6FA0FCC57E235D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736130, "uuid": "a6777648-a960-4784-950a-2f560d1c2ee9", "value": "44c00401a20ce3d35e55418765dd0985", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736130, "uuid": "a3d840a7-d1a4-4182-a171-3d85ac1509a3", "value": "6144:NvLEcL+DgJ/N7RM+nvGDGdCB83em3piHouzbgwuuB:NvHL+DgJ/5RZvOGIB8NjunnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639736130, "uuid": "194062d8-93a8-498d-8645-7608902587f7", "value": 303653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639736130, "uuid": "15d48259-4adf-4d56-ad1e-b7efeb2fb2db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736130, "uuid": "d1ea9ffe-020d-4344-a7a2-da8b55b645df", "value": "1c905c63b7e5b3b0786041f3fd5919ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf5e176e-5f20-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639735506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735506, "uuid": "50ad912d-2231-4da4-ad13-b07c5a5d5075", "comment": "Malware payload (Mirai)", "value": "956d32c1ad26e84195db6351d72d5dc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735506, "uuid": "0e69d2ec-8c5a-4d32-995f-7a418c80627e", "comment": "Malware payload (Mirai)", "value": "e3973277ffe656750bf9bddccb0f70a6ca9375d4122ee5e608fce36a63f69618", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735506, "uuid": "9e929544-9369-4d6b-ae5b-63854ec47dac", "comment": "Malware payload (Mirai)", "value": "0f4c497aee3d4df49eeddd9288ff1f143ccc0687", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735506, "uuid": "fd8638d7-ab63-4239-b4f7-89efa1d839a5", "comment": "Malware payload (Mirai)", "value": "50df016ae3bcf1776b3ec352777019f9d5c58583e5757bf636a5f1e2996f4cae3bf0d997bb0c23dcee8620558626d0fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735506, "uuid": "95e9fe97-8856-404e-8fa6-76fa5f43aad9", "value": "T18B93E896B8C28E15C5D423BBF92E00CD331667A8E2DF72129D106F2477CA92F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735506, "uuid": "c85b5af8-9896-4d5a-b208-f94c7a746853", "value": "1536:FwNn21vn1P0YAvT7C+P7V2o6Ahb0rkHP8U6jWX/w6M1uxCwU85u//5+FYcpITiQi:FFP1sYu7JPZ2oP0r+0U6jWvXMAHHqVCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639735506, "uuid": "910187d7-103c-4794-9607-6a8996c559b8", "value": 91440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639735506, "uuid": "6322c68e-968b-431b-a729-0073f7b2cf85", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735506, "uuid": "4e9f5ec8-db6c-40db-a72c-ffd0e606b5c1", "value": "956d32c1ad26e84195db6351d72d5dc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558ff146-5f0e-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1639727571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727571, "uuid": "c69204e1-7c69-43d0-8749-bd1937afe8b3", "comment": "Malware payload (njrat)", "value": "fc878a1e87addcfc819a738f2f4b58f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727571, "uuid": "7a31feff-7750-4e51-9b73-c09bde63788a", "comment": "Malware payload (njrat)", "value": "e414709eff086bf9652b2990488603a5346b60b8936c51c364e1130e5a5def0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727571, "uuid": "c4bd5c08-5f03-4966-bb04-502fff219108", "comment": "Malware payload (njrat)", "value": "3fe62a9844037951adda9aab5ce952b941033288", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727571, "uuid": "88ee7f56-c060-4b47-ae8b-d74870199049", "comment": "Malware payload (njrat)", "value": "d1a180e3ab7a54342ce1abd4d684bd3cd84e907b6c420947690cac83a165316d4517e870986118468653bdb587e8bb65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727571, "uuid": "ad28994f-170e-445c-b150-894e99c0016b", "value": "T1CA9623E722E226AEC259C0F5C253B47F8B9FF067572AB1C38995B690E913CC47538B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727571, "uuid": "3a1555f5-486b-4021-b7da-46e8de5a84c3", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727571, "uuid": "80ed3dab-02f4-4519-8f41-520df685bdab", "value": "196608:5CqNJ49yWeb201ZHXH59yw7QdD4How3+OnTj2eitSzNtvxpAR:5C64982c3Z9yw7QdDQmOmeQSptvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639727571, "uuid": "313df821-26f8-4646-ab20-6a431e006e38", "value": 8853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639727571, "uuid": "a9225f5a-b536-46a7-940e-f50023ee97f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727571, "uuid": "19322314-ecaf-4a0c-9d95-0a6fb6adf209", "value": "fc878a1e87addcfc819a738f2f4b58f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6e09ea-5f0b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639726426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726426, "uuid": "8b5ad6a4-5b02-4e20-b4bc-1506d5635831", "comment": "Malware payload (Formbook)", "value": "f75bf4648b7b96495982fa920475dfbe", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726426, "uuid": "cfe7ec72-27a4-47db-b00f-c4a74ba8a634", "comment": "Malware payload (Formbook)", "value": "e47c9d823b2d914b0ec891b6ce77703371687304181762f20d017e8f2ab18ce0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726426, "uuid": "f4f0291c-42e1-4f7d-b114-bdccc4dd6b42", "comment": "Malware payload (Formbook)", "value": "d6f031b52aeeed7b18486ab52aebce0a6ac1b860", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726426, "uuid": "fd40ca10-bab9-418d-8e8d-8656b1787c07", "comment": "Malware payload (Formbook)", "value": "c1733f93c96858ef6d3b406835297c7db4ac3c89d6d1cae32ad391e6c0a818c8a633e6172deacbb158a9c2d3870f8744", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726426, "uuid": "cd0d2abb-1092-445b-9e1c-bb10ef76d01d", "value": "T1DF64124335049A05F4FF4A78D8A5DF4A39A5FE0E8342B19E44147209863DFB718A3ABF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726426, "uuid": "d968c894-a73f-4084-a442-73b0bebf6129", "value": "6144:2aKA4K52RanC9pBGZKZr0E8CSUqOzyQzaaaaaaaaaaaaaaaPYB5CC/hdwzlABHUa:eA4NBdZoE8CdH6YB5CiqlgUuoLuIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639726426, "uuid": "c18524c6-f730-42d7-a0c5-b8b9a98e5e4a", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639726426, "uuid": "d45f0401-2729-464e-8eb3-b5224d31a85b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726426, "uuid": "4f215a84-3b07-4488-8910-806236630a17", "value": "PO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc51e7b2-5f1f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639735071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735071, "uuid": "38011ad3-badc-40bb-ad7a-c00ea85549c2", "comment": "Malware payload (Mirai)", "value": "8e5211d61dd7d3909ba1b0765679d14e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735071, "uuid": "45ca023c-4ac2-4e92-9827-dcc2afbb7082", "comment": "Malware payload (Mirai)", "value": "e48dd517d1e92a3c091726b6eb333da8c43f9af23aa78bfa40ab35ec4a982608", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735071, "uuid": "b90f704e-8a21-4f94-baf8-b4e1a9a08f91", "comment": "Malware payload (Mirai)", "value": "8fc56f521e3b41ff9dfede5f8ae3e5de9afac57e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639735071, "uuid": "2ddf317d-9ef6-4a05-800b-205d461788d5", "comment": "Malware payload (Mirai)", "value": "da9b8d5f80837d2f58b9710405abfee7e03960e78633fe72821375c34c6051bdd5e331207194ffe5f9499c459f69de6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735071, "uuid": "f5f555c8-1d30-4480-abbc-2fe12cb2f229", "value": "T1FEA3C516BF310FF7E8ABCD3719A51705198C650A22F97B35BA34D818F64B25F1AE3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735071, "uuid": "f711d4c3-a5a5-42f9-8148-ea1a2dd203bd", "value": "1536:sP8a8N3hXrPpjLUQDW271SvCq61iJ6Z46fgG1ZfpD6FF:sP8a8N3hXrPpLTWY18Czg3G1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639735071, "uuid": "05d7dd76-1c95-491f-9af6-60b45bceff48", "value": 105132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639735071, "uuid": "90ae8fb0-370b-4115-9217-e68c5a5e3709", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639735071, "uuid": "7192b5d3-1410-46b4-aaca-94c41129be6a", "value": "8e5211d61dd7d3909ba1b0765679d14e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e82be93-5f52-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639756738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756738, "uuid": "50d2178c-0e62-4ef9-8ec2-4dceb28788f5", "comment": "Malware payload (AsyncRAT)", "value": "05153d4b5266551ecf94ec4bb937cfed", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756738, "uuid": "ee179401-51b7-4f45-aa7a-b3fa81222e80", "comment": "Malware payload (AsyncRAT)", "value": "e635607848d3a7b2b37cbe0c77d7d06d60bfa5bbb4615437147e68fbf81cbb8b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756738, "uuid": "2a9a91ce-3135-487e-a7b7-623e5cb750ff", "comment": "Malware payload (AsyncRAT)", "value": "9b7ed64b775194e11dd5f04522e39850a773fda4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639756738, "uuid": "469883fb-2c48-4aff-bd00-582ae48c005a", "comment": "Malware payload (AsyncRAT)", "value": "45fdd1b705001fa3d9148b3c4784b10c9c751a1fbf295412645730b7adb12c6fd9e1ad6247547f850983a682b15b628f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756738, "uuid": "25e5f1cd-4bde-403b-9cd9-1cb949ff497a", "value": "T1B5A46B5936CCEB58F47FE7B94CB1204087F5F5C2D211E9CDFED424CA5961F848A2AA22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756738, "uuid": "27ddbad7-8dc4-4934-822f-a4a3020ef05c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756738, "uuid": "93465fd2-ffd4-403d-a1aa-73c4b807ddb8", "value": "12288:/RkcMI0Q2HLL8mPlme3F7DGBmb3oT5B0j1Zb/STiW:/he1vUm8707TxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639756738, "uuid": "f536c07d-a40e-4b76-bc94-b3e9a3add9ad", "value": 449024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639756738, "uuid": "dd90a06a-d04d-4dea-8d0c-7f77495f3f49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639756738, "uuid": "f0402db7-0ca0-4054-b290-5e70f768cfba", "value": "05153d4b5266551ecf94ec4bb937cfed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d408f2-5f1e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639734607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734607, "uuid": "f1841692-1e98-4cba-becb-5bf5a05f9b8b", "comment": "Malware payload (Mirai)", "value": "c66cde4e25035c3d58bfe1fad7ba66bb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734607, "uuid": "b3bf1f0f-21a2-48ca-96b5-21c95d15fcc6", "comment": "Malware payload (Mirai)", "value": "e8c4d9a2c35516814658d962ed2d9cbb0a9eb9a5a64d18a16876f515ce260a50", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734607, "uuid": "40ed90ab-704f-46c1-b604-0fa0e2c0f71e", "comment": "Malware payload (Mirai)", "value": "0a444d2eb993ac6f4775a4ddeb231899d54fcc60", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639734607, "uuid": "7474b296-ba27-4b85-a02d-5382d6b025a6", "comment": "Malware payload (Mirai)", "value": "2e08cd4b180bfe2e34db9d4f74c32ca9775132b522d0e359d6a16dec93448014a8ddb56113fefab8aecbae3693a7fa09", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734607, "uuid": "a9a32cb5-0713-4af3-ab13-f36d89eb5dc0", "value": "T13F53E9627C926A2AC5E063BAF6BE518D332167B8D1DF3217CC212B057BC551F0DA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734607, "uuid": "70ef1f07-8ab9-43c8-b65b-a49655b7083c", "value": "1536:omHfUXVywKHMIeVOeKSs2KlkaLFgiZu6Kjoh+tTnS:omHfUl1IFM6KEhqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639734607, "uuid": "aafd4e39-e906-4fcf-bd75-75fe06a9bcc7", "value": 62700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639734607, "uuid": "6e5c4c47-6b65-49b4-9c30-2386e10b7d71", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639734607, "uuid": "1124d024-1ec9-4b90-aa20-b6e99dd3a7bf", "value": "UnHAnaAW.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd66246-5ee6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639710542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639710542, "uuid": "a760caf7-ff56-4eee-b387-4ce870abbf07", "comment": "Malware payload (AgentTesla)", "value": "e85ca41d6d87cab1706f8d4b628336ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639710542, "uuid": "7509db8a-0945-4f5f-8acb-45fb819159a4", "comment": "Malware payload (AgentTesla)", "value": "ea07a10007663fb5675e3db484f540305d3eb3039018527a6a8c49f1fa0ff97b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639710542, "uuid": "9ca8df62-c980-419f-b43f-4884b35a6e38", "comment": "Malware payload (AgentTesla)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639710542, "uuid": "b827a1e3-9497-48ce-b857-4242243c5c25", "comment": "Malware payload (AgentTesla)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639710542, "uuid": "6bc2dd7d-5194-4fe6-969c-742fadc3c19e", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639710542, "uuid": "78ebd936-9de2-4053-9517-afa0a428403c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639710542, "uuid": "961b76c9-5efe-40e4-a402-632776da65b6", "value": "Pedido urgente.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9165f299-5f22-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639736261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736261, "uuid": "78a5e23c-38db-4200-b5e5-8f41d68811f9", "comment": "Malware payload", "value": "16b362efdd4e6a3e9b558ae440bb86ef", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736261, "uuid": "6c108408-86f4-4f3d-9b30-7945bfd4a662", "comment": "Malware payload", "value": "ea6793e52d123e1381764d06e53d0fa77ef9172c16488090660bcf5bce1df03b", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736261, "uuid": "75197f7e-1922-4f97-8d2b-40b9c3f94e68", "comment": "Malware payload", "value": "677cb51cb8707ec826f937343a2d52d3543cac2b", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639736261, "uuid": "bb4f39f8-48c8-4115-b6c3-8846a5555762", "comment": "Malware payload", "value": "5f103aea9bd02df52769ff8da03218c678e0afd8fd14b3aa62878ef24869977f0f16c253bc43e54bb6dbb003c64b840f", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736261, "uuid": "da331bc0-3308-47d4-9ccf-fd67e6ac1a9f", "value": "T1E225AE22B2E88536D47B41709D3A8A5BC635BC640B62C2DF03E49E1E1F73BD15E39B61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736261, "uuid": "9d71039e-1460-43e6-8e87-0cd612a1acba", "value": "12288:FWC0fY8owv43bqKlRH1Vq9iyXiAqiBHN7fcL5g7KJz5g7F5g7KJz5g7y:FWCsY8owvitjVqoAiAIa0VaTa0Vay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639736261, "uuid": "f95d9297-03f0-4b4b-a709-2d540a6008cb", "value": 985808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639736261, "uuid": "fe197869-0fe2-4123-8b84-c30c65dfcdb0", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639736261, "uuid": "cc68802e-297e-485f-b8aa-5cae6c320cea", "value": "NotaFiscal.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b975add4-5f16-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639731174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731174, "uuid": "07c20894-b368-4741-8608-41f6aa743d3b", "comment": "Malware payload (Loki)", "value": "6b638f2123fc5104cc5759d738ea64f9", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731174, "uuid": "055432c3-493b-42a0-987f-d1a03a8f4263", "comment": "Malware payload (Loki)", "value": "eb81da485c7151cd88f8952fa3f9f4cbbbf158e1feb3fd2b583b17a10ebfb92b", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731174, "uuid": "4f304f72-6b50-4bc5-b25e-89fafd3cb30f", "comment": "Malware payload (Loki)", "value": "31dc8e04fcacea36c4417418e7ec9f6e69bb6474", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731174, "uuid": "abc189d0-953d-4a16-9e1b-fe66dad5d223", "comment": "Malware payload (Loki)", "value": "e59943d5c94339f9cc2a23b0480be86a4d110605bef46fa89d334623d3aef485380de0619c9da4f44ed7c3bea78d37bb", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731174, "uuid": "bec92256-2701-46d1-92c4-5b1ca5db991b", "value": "T112641226AC7E8143F1428FB51B8E267D5FC2DDF1463AD1518C69FC0E94BABDAA114328", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731174, "uuid": "c001fefe-3b5c-48d5-84d6-f34837ae56f9", "value": "6144:Jo0SF3gTqj4F7lF4ncK+RDrXElm1a3/zOhL+2z8aKxpu+PGUn/Tds:q0OiqURMBlz7Ohi2z8I+PGyBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639731174, "uuid": "cb30ef48-971b-41d6-ae37-2dc666429a25", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639731174, "uuid": "e145f7e4-8d46-44e0-a1fa-cf3b5d074022", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731174, "uuid": "7b2416ce-cfbb-471d-ac53-3773d7cf4e0f", "value": "MV NAVIGATOR PHOENIX - NFX1218P0028.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6daedde-5f4b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639754041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754041, "uuid": "65b573a1-db0f-41ed-91f7-fe0460e6a5de", "comment": "Malware payload", "value": "b8933291d64d22060f2a5dfb21f2bc85", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754041, "uuid": "259497af-0f4b-45e7-a74e-b4a9937bf840", "comment": "Malware payload", "value": "ec693ce2e7927cd9b723212d2cc5d8b9d90dbcd7249f53583c4dd9e128ee05e4", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754041, "uuid": "31e933d6-d505-4d20-b94c-4356f24d039d", "comment": "Malware payload", "value": "d532efd2f3773b43e118d6414288ea8ef3f26731", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754041, "uuid": "df8fbd84-403d-464b-a854-b50969f2db69", "comment": "Malware payload", "value": "63e68f3cfaaa1a8c75e6c58f43f40de4d72d07d851fef004d53a3f1e2a3e5d8145fa3b5bf37da2bb17df5d02ec776059", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754041, "uuid": "d483cbe7-8bce-4b54-8b26-96a7b8102d3a", "value": "T147641395EDCA5B49F1F712F95B1BE10888AECE28E247C56C3C1EB4E210B27F054E1993", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754041, "uuid": "8713e391-10c2-4154-a9ba-880b60fbfe34", "value": "6144:5mXtw8+W3OlVimQ/zmMXYPb3zja4FnNvyf6OU5C/wnetfSp6xrn3EFdd+jSV17M5:5m+x1Q/z3ITa4JNQfSgrn3GlzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639754041, "uuid": "796fff89-f0d8-4e6f-aa3a-e986bc8e36fa", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639754041, "uuid": "ae19b4f4-e189-4e9a-b536-3ec558d1c77c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754041, "uuid": "0dcb8a8e-e842-4d6c-bece-58941bf6edb0", "value": "10.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a3bf7d-5f25-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639737604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639737604, "uuid": "a73bb7d6-901c-419f-91e0-f0d86f5d3b7d", "comment": "Malware payload (Quakbot)", "value": "124dbf71eec74a20be323d4016580c94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639737604, "uuid": "b890ca98-340f-4329-9559-fd2ee140a7c9", "comment": "Malware payload (Quakbot)", "value": "eccc43d18bcf4f718c23bd1fde73570661ee71749ba96ba89327a89b3d3e57a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639737604, "uuid": "86afc801-d013-4e79-afe1-7fcbf2d19926", "comment": "Malware payload (Quakbot)", "value": "b48d1f12a01d36b5199e6cf7b1e35e9e0efa34dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639737604, "uuid": "d2af9451-10b8-4018-b931-f7bdc9fd44bb", "comment": "Malware payload (Quakbot)", "value": "004525d564cdffb9f1ee33c1394f1584a97bc641a0049b22af3dc3188d6d5cb64c3f1af991f4239324e0856258169084", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639737604, "uuid": "9a4d2591-41fe-48de-ac25-fa9f07915dd1", "value": "T1B42594F622246307EEC391746E02C73514445E4B02F518FE6BD7B2BE0D727266B9AE2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639737604, "uuid": "68cb1f76-9d90-4463-98d9-c9728ececb62", "value": "fcb54e41e8df228eeaa37df1acecde64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639737604, "uuid": "be139b10-1fc8-4f09-8738-00b0059783e1", "value": "6144:kZ3vSB/TRhm3jMF9v+VDzThWlb4sr8UQw8Mz1+:kJm98TS9uMVPr8UQw8Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639737604, "uuid": "6d69ae5d-63f6-4d55-882c-0e67cb085569", "value": 1007079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639737604, "uuid": "6de3cab8-76bb-4ceb-ac70-585fd05e3268", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639737604, "uuid": "30368517-cf09-42ae-8552-dad4c748f26b", "value": "7MxD0YvPT3GMI70f3nNXBmHucXSbqWuokyeomz0_V6A.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af4d846-5f02-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639722318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639722318, "uuid": "73cbe7f3-22e3-4947-9720-137569c213df", "comment": "Malware payload (Quakbot)", "value": "c26eed2d38d3a15335598c0b170cd8d6", "object_relation": "md5", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639722318, "uuid": "f1f80dce-3324-4afa-8110-23a75e8e81ed", "comment": "Malware payload (Quakbot)", "value": "ecee63b6a0b8a9daba189462a03c0373928c84ed737a1e34f2e1830f64b177ad", "object_relation": "sha256", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639722318, "uuid": "d8d54024-67a6-41b3-b434-a0e40b1fc3b1", "comment": "Malware payload (Quakbot)", "value": "22e94754c78ca22912c16eea29d778d48bb5bbd5", "object_relation": "sha1", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639722318, "uuid": "c479fae7-c018-43e4-a8a1-cf7ba3a8b683", "comment": "Malware payload (Quakbot)", "value": "1c30d583c751f559656cf44d64aa9d1e0ea8a563c29e9286156f1a72cb6a634f9645bebdfb81296a469d39fe8803a194", "object_relation": "sha3-384", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639722318, "uuid": "1ac5dbbf-1985-4495-b824-0f02a012472f", "value": "T184D39D47EC090683D8648BB9BD0B1D3CBF2D192DA9E123FD14260DCB6EA52675D9F04E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639722318, "uuid": "a04561ec-7704-4de4-bb04-1ef216e5e05c", "value": "3072:nzJxZK/FGOztQNL0cBLJUq1dJZvPpz7+fp7Kj:nznQ/0OzSNLJNUydJZvPZC1Kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639722318, "uuid": "c34970f9-cbc9-4650-8200-579dbdc4ac28", "value": 138848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639722318, "uuid": "db7824ef-b0ab-4a9a-b893-b207eb48f9d8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639722318, "uuid": "a3b12ef4-9c5e-41ad-88b1-f8344fdd1922", "value": "cullinan_loader.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6ef9fa-5f0c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639726594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726594, "uuid": "579080b7-ab5a-4837-a208-28bc881184df", "comment": "Malware payload (RedLineStealer)", "value": "94087ef47a0a2697c181d17293bc1c32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726594, "uuid": "a63ee73f-7f11-4b14-9bdb-d2dcb9824c8e", "comment": "Malware payload (RedLineStealer)", "value": "ed3b91ec20184139f90c2432c7d90567dc9c47afc45a87bb4d72fa4a6c64edd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726594, "uuid": "a68a92a5-a445-46fb-a942-6d59e5f10cee", "comment": "Malware payload (RedLineStealer)", "value": "eec0aa59dc5837ee40321ad8dc76ad46eb71c2b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639726594, "uuid": "448ef5c7-dea1-4e7f-acbc-aa229c6acc88", "comment": "Malware payload (RedLineStealer)", "value": "0842fd7598539d219b9e8e4564e48586e1fd1cc09fc283c9c64569360b2f45a081dcb240ed2bc8ebc4281ad8c2d526f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726594, "uuid": "75da9f2d-7ecc-4e49-8f1d-bd3b476fdb93", "value": "T17D6533E76001D573C8DEEEB6B7F29554FF222F112080ED22B8ACB20476606A9D577336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726594, "uuid": "97a7a5f6-b877-4a1c-b1c1-00aeb945cc87", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726594, "uuid": "372eef3f-16fb-4ca0-b760-f0bddc74fb13", "value": "24576:hGy54iaSQN+WyefPsXys8gkX4XJ+Her5WUftBnzUd+96NWkEaHNYK3Kaket:wy5DQN0eo9A4XcHuWAdgm64NaQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639726594, "uuid": "a7788b62-0a43-4c3c-8889-828274e89b9c", "value": 1542600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639726594, "uuid": "b799cc18-1e51-45c0-92ca-dd1197b32b83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639726594, "uuid": "a06c284b-4727-4281-8afc-466a4eff5ba2", "value": "94087ef47a0a2697c181d17293bc1c32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab552af-5f4d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639754503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754503, "uuid": "55fe36c7-bdf6-4de8-8eef-c2cc257fa5ba", "comment": "Malware payload (AgentTesla)", "value": "e624f8c3de98aa016fa887395704370a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754503, "uuid": "182e357e-3130-4c3b-9acf-26e1608003ee", "comment": "Malware payload (AgentTesla)", "value": "ed51e22a86d8d6433f2659aee3e13bdba7815026d180478146a30ddca56476fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754503, "uuid": "41a325d8-fd2e-45ee-a186-2943883e62b3", "comment": "Malware payload (AgentTesla)", "value": "7040fa7c6316c33301a48d41822366f34268fd19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754503, "uuid": "6f77c658-36c3-4bd5-9d1a-a8eef0534776", "comment": "Malware payload (AgentTesla)", "value": "7abbe7ddc1fa46ed5f11bdd5e6218d80a045f8666d92285bc9af466f71f803f617edab69031d4e9da74ff2bdc036b5f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754503, "uuid": "76cc824e-9b2e-43fa-a570-c37a2091eb97", "value": "T15F35231072DDCA86C55D2F7B1AB1E1202A3A6647AE23EB4FB4DC30DC462BF990055B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754503, "uuid": "e67d200b-0d05-4b8d-87ab-e04a0a30a791", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754503, "uuid": "fac36bc8-b02e-4152-9cd0-b4eaae23772b", "value": "24576:sIvFMl2BEKwB+1ufizkAb217xIO1z/bTRjP:pFMlYEKwBy9zVb2JuozjTRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639754503, "uuid": "27beb6fc-9df1-4c20-a29e-56ea55acc6f8", "value": 1155072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639754503, "uuid": "606bd305-2b5b-4693-870a-38f88d599ad6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754503, "uuid": "d9d68836-3174-4c78-97a8-11a6bb0e1354", "value": "DHL-AWB 2228282098-12132021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ce3d52-5f17-11ec-9275-42010a9c0029", "comment": "Malware payload (BlackOut)", "timestamp": 1639731332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731332, "uuid": "bd4270ee-9a1a-49a0-8d2b-0d2604128a73", "comment": "Malware payload (BlackOut)", "value": "f4928b5365a0bd6db2e9d654a77308d7", "object_relation": "md5", "Tag": [ { "name": "BlackOut", "colour": "#8F7A6E", "exportable": true, "hide_tag": false }, { "name": "Diavol", "colour": "#99FB38", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731332, "uuid": "f0e26585-6408-4dd5-84a4-b3dcf414a755", "comment": "Malware payload (BlackOut)", "value": "ee13d59ae3601c948bd10560188447e6faaeef5336dcd605b52ee558ff2a8588", "object_relation": "sha256", "Tag": [ { "name": "BlackOut", "colour": "#8F7A6E", "exportable": true, "hide_tag": false }, { "name": "Diavol", "colour": "#99FB38", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731332, "uuid": "88285a0a-9c51-4aa3-b680-0eb1f2b1a8f2", "comment": "Malware payload (BlackOut)", "value": "8ee0749f4d4ccee6cc3d62b27b73c08f5e1925b9", "object_relation": "sha1", "Tag": [ { "name": "BlackOut", "colour": "#8F7A6E", "exportable": true, "hide_tag": false }, { "name": "Diavol", "colour": "#99FB38", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639731332, "uuid": "589e9398-164a-4d42-be32-36125cb8ff8c", "comment": "Malware payload (BlackOut)", "value": "d4c287f4da251052d4a022321a60035a5085aacb9b75c752fd3d15a51e45f8e5a573cf06e73d62063922adb5346c38d7", "object_relation": "sha3-384", "Tag": [ { "name": "BlackOut", "colour": "#8F7A6E", "exportable": true, "hide_tag": false }, { "name": "Diavol", "colour": "#99FB38", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731332, "uuid": "afd4a643-d736-4cf2-ac92-338d50174b41", "value": "T1DAE35C02B3F991FCE063D534DAB29D13EB757C4A513A531E8B5047A61F22F50AEAB321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731332, "uuid": "0ec79c2f-839d-4cd4-900c-7260177a5af7", "value": "13d08009b6065a20763b6720d6db23c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731332, "uuid": "3aa4f40e-5e56-4df6-b427-cb1b59b7bd93", "value": "3072:WwyN3+agCaCcaTHuMOaZDMsMPdgyag1U2Hk+hvwz1B:WwYuMTOMOa1MsMlpB3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639731332, "uuid": "bbae531c-3aa8-48b1-baf6-1f642eacee75", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639731332, "uuid": "64658b2d-c941-429c-bbc5-065a42546fef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639731332, "uuid": "2d1bd809-18de-4993-bcb2-556161c0aca1", "value": "full_diavol.mal_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bffd7132-5f31-11ec-9275-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1639742782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639742782, "uuid": "323c35ef-c7e3-4d41-ae22-86b6bc8949fb", "comment": "Malware payload (IcedID)", "value": "b921af2bf97c13f13b4af7274b321d6a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639742782, "uuid": "29213f30-57d5-41c8-bfef-602c48be6960", "comment": "Malware payload (IcedID)", "value": "ee23c428b222722444fafe6bffcfc77283f3fecfa0946a44e35041ca732fa78f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639742782, "uuid": "c51662eb-d3d4-4c6d-96a6-127927c92160", "comment": "Malware payload (IcedID)", "value": "2ec19be1a176a2a1b8ab4556a25b16dc283673ea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639742782, "uuid": "ace9bbdb-e5d9-4d53-be28-90321c0ec3e5", "comment": "Malware payload (IcedID)", "value": "4292d57ae96880dd0c8a3f4b94c0efa20ebac671c9350c8f4b0d0bfa08aa11eb29ec694773149b9b2bca9e0bb6e8174f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639742782, "uuid": "8d258d4b-3444-475d-9ff5-2936f44ea02f", "value": "T10CC31210989449A8CE5B0A797FFF4E9A173312859277739F629E82B142E107DB28C35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639742782, "uuid": "84c9f787-5b70-421c-b1bc-925f7b8e7c28", "value": "5c5735bb1bc466b2e59e346ac51bcb4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639742782, "uuid": "cde4559d-1439-4176-88ab-87632e1b4015", "value": "3072:7naAwA5OOLCkF4ppkv5xojIEwRnxPtsmf:raEO3Jppc5+j2Zs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639742782, "uuid": "5b0c83e2-3d88-4959-8382-a28b1668db0e", "value": 118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639742782, "uuid": "cbba2620-8e29-4df5-bb33-9b5454b685c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639742782, "uuid": "5139e252-275a-4822-aff3-3973114133b3", "value": "ee23c428b222722444fafe6bffcfc77283f3fecfa0946.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9d8cb5-5f19-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639732466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732466, "uuid": "746d3636-880c-4b35-a5c5-1df5d68fa458", "comment": "Malware payload (RedLineStealer)", "value": "66e3c71bcd364eb5cf19cb820683ef0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732466, "uuid": "5272eb3d-f393-4dc5-b191-42f76737ca32", "comment": "Malware payload (RedLineStealer)", "value": "ee23fa71bea1f05017e21b38e7592db6334a0fc4e9e44bb48452b40a4ddf0677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732466, "uuid": "c8123eb3-5114-42dc-9a06-ba8e2809b227", "comment": "Malware payload (RedLineStealer)", "value": "a51f002e800d652c14b2de10a63bbb80d276a33b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639732466, "uuid": "cdfa712e-26d6-4ecd-a190-59d70b591918", "comment": "Malware payload (RedLineStealer)", "value": "3873a67f6cdded06ceb18c5fcce3a7b1db6eee6eeda479413f91d88f71e93764f2f9704cf6b46e1c08ed05da00bc7226", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732466, "uuid": "92d6522e-f6e4-464b-b6df-0a1a7d323462", "value": "T1FF93E060A764D467D4F2423029769B3B9FFAD82522B49F4703102F2C7D63BD2E61E762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732466, "uuid": "adb70be0-acd8-4874-8919-2a17814072d0", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732466, "uuid": "3ee4273e-b2d8-4ca4-82e4-ff23e10ec50b", "value": "1536:C/T2X/jN2vxZz0DTHUpouMJbKxE+1COGa5Cq1IpBN+mzFGFDGBXTgpMu:CbG7N2kDTHUpouMJbKPCOHPKpjZcFiBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639732466, "uuid": "8a23c208-2a29-4cda-a0d8-62ca8dc9631e", "value": 94872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639732466, "uuid": "8cda45a4-88b1-4e13-80fb-b6c146e3039a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639732466, "uuid": "fd71cc88-ee4d-453d-9681-7b9f9cdf002f", "value": "mixfive_20211216-221155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91368bb7-5ef1-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1639715215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639715215, "uuid": "c6b941bf-c613-4adc-adae-2a14d5065370", "comment": "Malware payload (AsyncRAT)", "value": "d8a2bb3e4ae281055bd0c53cb33fd029", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639715215, "uuid": "f7c7eff6-212b-4a02-bfdd-ea55307205b1", "comment": "Malware payload (AsyncRAT)", "value": "eebbf05f0df6451a40320b095bd5eb74cb7c15aaed02a24903f43c3f1e470b8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639715215, "uuid": "ad744da4-5c01-4afc-beb4-3991b6dbf1bf", "comment": "Malware payload (AsyncRAT)", "value": "e64e1a5b9d0dd307767434c092e41aae0b061de6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639715215, "uuid": "2bab8698-89e4-48eb-84a8-426dade35aeb", "comment": "Malware payload (AsyncRAT)", "value": "147cdf63576c3ac3c730b6cd2f4aed3bf31333f4ca2e6b33f5cd75470d29caa7a7ee9d306bbee67861f0f5907fe143e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639715215, "uuid": "39b895e7-27e2-436c-ac7f-7ee1402f75ac", "value": "T15024E085731495B4D5AC0E72CC6BCF6006793CA29C21672F3196BBCE6CB23706A4799E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639715215, "uuid": "41f08978-27d9-47a2-a8a7-850870b0b71c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639715215, "uuid": "2884d2fd-325c-425f-9548-f11e3f52b03b", "value": "3072:bkjNw3kwUpPcN47V1FOds2Vlt3hg7rXZQG0cg7JOkLNCIei3EnTGD2cS5s2/:nI6uFz2LJGRg4kLNnei36cw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639715215, "uuid": "fddd37b2-1fcc-46d6-ad0c-4d0aba4cce61", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639715215, "uuid": "2384a185-cd96-462e-9d3a-580388b6b203", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639715215, "uuid": "6d1d9f44-1165-42db-bfe5-3c662c29319e", "value": "d8a2bb3e4ae281055bd0c53cb33fd029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48afd193-5f28-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1639738716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738716, "uuid": "dfc843ca-1054-4ded-8378-e403c17baef1", "comment": "Malware payload (CoinMiner)", "value": "46601603424607b1a98b0b364be7590d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738716, "uuid": "b7e210d0-4148-4050-98a9-b3ee36e4cf52", "comment": "Malware payload (CoinMiner)", "value": "eed732af6c91e1bbfb35f1f71aba4c3327d2b3815cbd51d10422ee4f8e5e3a04", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738716, "uuid": "1c9de25f-371a-4d99-91a5-5fd58fbf61da", "comment": "Malware payload (CoinMiner)", "value": "8a2a40cecb393f633910948c0a380d208e0cf63d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639738716, "uuid": "6b69cbd0-fcde-45a9-8f49-1edc692bcced", "comment": "Malware payload (CoinMiner)", "value": "77deb5ed69fe84cbe2c08ee1b6b8e9d4434dec6a7e419c80041fa391967d8d8320e3ee79549525754d277d3f2c6968dd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738716, "uuid": "b5f75a8a-5896-4788-8a5b-6636834d8c7f", "value": "T1EA6622FA6244371CC41AC8308427BD89F1F2151D4EEE8ABAB5EBBEC07B9B811D516F15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738716, "uuid": "a5c7754c-8410-4a04-8336-07659510da84", "value": "889336afd01a952ba79d1e90fb751739", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738716, "uuid": "48fe1ceb-ebb7-478d-81ef-1356b62a37fc", "value": "196608:w6HMIme9Z0xuEA4CvvFevF6K/xXTZefu:w1I3Z07A7vvFylFTZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639738716, "uuid": "fb1e415a-0460-49a2-a671-4855cb70f9f5", "value": 6981632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639738716, "uuid": "8722a971-ea66-4fac-9dd2-97f5efa8da81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639738716, "uuid": "5ed4e05d-9b89-4b04-88ed-79d0ba52a044", "value": "SecuriteInfo.com.Trojan.MulDrop19.15713.5147.4474", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918fc37a-5f56-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639758595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758595, "uuid": "c44f7209-0a16-4e6d-ab7b-e39c4206336b", "comment": "Malware payload (Gafgyt)", "value": "877c922a8c87fa998eb84fe56ef2303d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758595, "uuid": "71444fc6-8ab3-4d90-95b7-462fa41a72f0", "comment": "Malware payload (Gafgyt)", "value": "ef4d59d9d0c4ef1ad0807efda2ffd0f73ae99e20ab7da2f867263661f9a66e49", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758595, "uuid": "362a1b7b-2998-41d0-834a-7984fcb47956", "comment": "Malware payload (Gafgyt)", "value": "536daff8fbc660a4fe04c1c2e6932c0e2e365195", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758595, "uuid": "ab74ca31-34a6-4dc5-b47a-e2e7a0cb7847", "comment": "Malware payload (Gafgyt)", "value": "62c22a826bbea350079e01f5fcd0377e78eda454ab0b56affd230fc05f6fe084adb2d81c604a1536b2d7d179dc010d10", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758595, "uuid": "3795e66b-a277-4698-a001-2444f241e936", "value": "T1B6934A17B653C6BAC0874BF41BDB9A314923B8BD0B227206B3D4BCE67F165A61D19F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758595, "uuid": "0ae4832d-acbd-409a-a19f-86b9eb17a737", "value": "1536:p7rHXokXsWFVSzkfLEkZAT5ipG5v36phauH/SPNlDDUg6I9um2Xj5YZb0e:pcCPOkfQfNipGd6phaE/AVog99um2XFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639758595, "uuid": "f25faf3f-16f1-4ae4-8a31-0f95497415c4", "value": 94012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639758595, "uuid": "91a6cd74-cb0e-43e6-9d73-7105035a9a75", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758595, "uuid": "c67e62ea-6931-4055-b382-dbd26cb3625a", "value": "877c922a8c87fa998eb84fe56ef2303d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e2418e-5f89-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639780525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639780525, "uuid": "58626721-df08-4ed5-a755-91460fbd8adc", "comment": "Malware payload", "value": "ecd2137d877e8dc118703e966d54f389", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639780525, "uuid": "71f2f755-11db-44f1-b2e2-3744231fbb86", "comment": "Malware payload", "value": "efa22ab0015899c95aa6582cc90314de8d4cf2f52d3267eba50482b75d060ac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639780525, "uuid": "27474d89-8363-457f-afa5-48a1ff9ff5db", "comment": "Malware payload", "value": "dd7197b70c0fb2e6d2ebeb604f63c74ad0ac8a03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639780525, "uuid": "26e963b4-7b8e-4eee-9748-4e35aa89ca0d", "comment": "Malware payload", "value": "e6cc67bfbbe6f23c2ef16497de0d7fa7974c350f20b7d35c275c182254e821f6acd73faab91a8193332bdb3165cef82b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639780525, "uuid": "2905e113-45bf-4596-abe7-f0f5efe2a38d", "value": "T1AB26DF83BC9168F9C9A9D272C9B592913731B4690B31E7C72F54A6FB2E637C01E34394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639780525, "uuid": "57f18890-f650-4811-a15b-5bd9846bc1f7", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639780525, "uuid": "7d8b360c-0ab1-4782-98f6-bf2b062571da", "value": "49152:ZSf8EmO8JmVHv3rb/TevO90dL3BmAFd4A64nsfJ/3TCCy3OdW1dn8uHtrAc+/0zc:MfTHvdD/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639780525, "uuid": "2edf3fd1-1660-467a-b891-4b93131d1ba7", "value": 4802560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639780525, "uuid": "fd7286ea-be69-4b39-a48b-d6b125c88ac4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639780525, "uuid": "e73532e2-1836-4595-82da-31f0949bf162", "value": "ecd2137d877e8dc118703e966d54f389", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32620f92-5f53-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639757147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757147, "uuid": "e9915f38-95c0-45a3-a546-c373992bffe3", "comment": "Malware payload (Formbook)", "value": "d970cdf1e39fb69c591ac0f3de86e98d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757147, "uuid": "e0bdf8ab-ec82-42ee-af1d-330d0b3ee58c", "comment": "Malware payload (Formbook)", "value": "efaa4527b761b2acb19d40051d303867ce0798ea1e32cf72b4408898d01b463b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757147, "uuid": "45eb2525-48bf-42bc-ab7e-50250e3ce077", "comment": "Malware payload (Formbook)", "value": "8b8e2bedb97d1d130593085dc98b396786c062bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757147, "uuid": "3a0cb140-efa9-450c-9c0e-b2a45bc9d650", "comment": "Malware payload (Formbook)", "value": "8b2268a4802a0202cfbfd876184adb2a00ae379d78515d9c3e3a9b1da205d25afc53b957d26bbecd070f5e1f1bd8b8a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757147, "uuid": "d4018843-7184-4a52-b955-1f254f053da2", "value": "T1ED35078525AD3B25FD7853F800AA6C94C7BA7D6A717EC68D8CC330D72973F924850A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757147, "uuid": "a69f43f3-b20e-4ed5-807a-4d681f7a87f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757147, "uuid": "ee1e5add-60ca-41ff-96f5-034603fe6f33", "value": "12288:2Kc2qL0VOmeUUUUUUUi1Buz/z+gcgLrISeb403lhaaFnAZzABuSK3VUUUUUUUUU1:NVqL0VPScCDKEb4w6aFFUSK361", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639757147, "uuid": "46005ece-09e3-4aa0-875a-e64b17f7d127", "value": 1107968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639757147, "uuid": "f286132b-2eb0-46ea-9608-c96153228e57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757147, "uuid": "a305f026-e4e5-4334-aec5-d5196b2167c2", "value": "d970cdf1e39fb69c591ac0f3de86e98d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2abe923e-5f4d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639754557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754557, "uuid": "c0b23200-c3ec-435c-9f94-70b7c6a1cf2a", "comment": "Malware payload (Formbook)", "value": "4a305365acbe1cb9d900acce05885abd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754557, "uuid": "aa2299a2-9f65-4b02-8db4-b639fe617171", "comment": "Malware payload (Formbook)", "value": "f0213644212eba0669c54c6e0fd1659be4a7b7be17dd3cc1716de69cfcab1561", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754557, "uuid": "6d63c19c-490d-4310-898c-0778dea041ee", "comment": "Malware payload (Formbook)", "value": "0aee4602308040b4efc35ae634d12ec72e7f34de", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754557, "uuid": "c62375f1-23b3-4846-81e0-4a27a3622f12", "comment": "Malware payload (Formbook)", "value": "8eb40900a009c9a87f203414b370016d66c53d0244adae8feff42dcbaa467845d7a889aea558924834fa6a58a6725b4f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754557, "uuid": "a74679e3-8eb7-423a-995e-05932c82a98e", "value": "T180A55EADE08F14F2D76F94356BEFBA9440A73247D3CB3D2506D9D5A6C329AD32A1801C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754557, "uuid": "ffbfa18e-1db0-4bd9-8aa5-8ccfd5b2fb1b", "value": "12288:Jqd6GxJWCeLh2Sue6OGrX8JZfLkqWfkAlVZny432A+EcNYGR:k64JW1X6OGAJZfK8qVZny4mA+EMZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639754557, "uuid": "7ed1b264-d37a-4345-8cfa-6e00d5cef84d", "value": 2146444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639754557, "uuid": "854e912d-cf38-4fe1-bb4a-8d34f1ad186f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754557, "uuid": "f553eb4a-38fa-467e-88a0-cd4538f4bddc", "value": "swiftslip.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0846014e-5f63-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639763948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763948, "uuid": "7c31f486-1c3e-4a7a-9b01-4ddf71bda146", "comment": "Malware payload (Mirai)", "value": "673624a42eadca639784378b1bbe4f20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763948, "uuid": "b591cfc5-6e81-4ca6-9004-64e574ac4d1a", "comment": "Malware payload (Mirai)", "value": "f07244e2ca294e4ac8e8aed7f8088a4501ef12a27017b5cd0a77c743e3579e89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763948, "uuid": "95d7be12-ea3e-4e92-89e4-014036f377ce", "comment": "Malware payload (Mirai)", "value": "c90888095f299d7882b0e0ea32c4eb00f67f8c51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763948, "uuid": "eb38fe90-22d2-49d7-908d-75e6550425a7", "comment": "Malware payload (Mirai)", "value": "95f6f304b1fe3c75b8054d456ffbb00071f92aba4dc4f1987562ee21e71fc96eeb4fe1f3a238b3c6c428fbd0fdcb9631", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763948, "uuid": "de326aca-c6c0-43c0-bcab-104c8912a938", "value": "T1B22121A6A2E8F933DB6100BA1286BF4B13A4CE95245BFF0FCE555412DC3A5C0D132378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763948, "uuid": "849efa30-5a27-4c44-9e22-aea99046e184", "value": "24:FlC2/M4SeFHxgxLWlSZa6KZBI0Tlzf95stGu8zWruQKNfJB:fC2/ZSUSWl0a6cK05l5stYzCHKNxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639763948, "uuid": "ddd6d40a-28d6-487b-a23e-f2b76cda4168", "value": 1164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639763948, "uuid": "7f0e12b2-2651-4e05-8dd0-871676169a41", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763948, "uuid": "92965b8b-b73d-4fbf-b5dc-a15695185321", "value": "673624a42eadca639784378b1bbe4f20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd6fcea-5f69-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639766914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639766914, "uuid": "2dd0afce-0087-406f-a7e1-491b4b0987ac", "comment": "Malware payload (Mirai)", "value": "8919125f9310865648fb41a4221e8468", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639766914, "uuid": "9086dbd3-47a1-48e2-8841-ca788ad7bca4", "comment": "Malware payload (Mirai)", "value": "f07bb746a35199b6390c3877d8ecf7bf718db3c0727448744a2116c5ce6529e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639766914, "uuid": "a77d76ef-0983-4765-82d2-7a7394916170", "comment": "Malware payload (Mirai)", "value": "2be04974264521f2cbf169d16b064933462bb2c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639766914, "uuid": "c5a1f799-9d51-4aba-aacb-c426ca633f31", "comment": "Malware payload (Mirai)", "value": "9e5a647e83b82911ae07a2f4eb35d849c81bb242853e2c6059a38911bfe7b755e9cbc1d3f318f01d3277aef421ab9792", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639766914, "uuid": "3ef45de9-c2ac-4491-b001-f9e18d49ba28", "value": "T1AA734B0233280B07D5661EF42D3F17E483BEF99122E4F689690FDB664635E37508AF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639766914, "uuid": "4aa15b89-5aa1-4b7d-a0cf-4a77cf5c2d97", "value": "1536:v03VpoE8/BNNJl1jYKc9CvZl5xjL7sgwd42+RdaV3t:v0rQoCvFVsh3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639766914, "uuid": "0678d3e5-5dd1-4639-b56b-fde005c47163", "value": 79668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639766914, "uuid": "004741a4-e6f7-4146-8b28-d792ee6128ed", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639766914, "uuid": "2cbf7f2f-37a2-4541-9327-2930e0731f33", "value": "8919125f9310865648fb41a4221e8468", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b059c4d-5ef9-11ec-9275-42010a9c0029", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1639718426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639718426, "uuid": "5f4b3426-fe05-4b18-99b3-c187be79e79c", "comment": "Malware payload (ParallaxRAT)", "value": "65a0ec476aaefcf6aeb328ac1641ed29", "object_relation": "md5", "Tag": [ { "name": "Affairs-case s.r.o.", "colour": "#5BDCCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639718426, "uuid": "6b70ac0b-c871-4afc-8f5b-3c437691c65e", "comment": "Malware payload (ParallaxRAT)", "value": "f0b3b36086e58964bf4b9d655568ab5c7f798bd89e7a8581069e65f8189c0b79", "object_relation": "sha256", "Tag": [ { "name": "Affairs-case s.r.o.", "colour": "#5BDCCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639718426, "uuid": "7f7da026-ed12-4927-97b6-bd61b1c93ed1", "comment": "Malware payload (ParallaxRAT)", "value": "38d23c5f5cce4ef14a6eb29615494044027adb89", "object_relation": "sha1", "Tag": [ { "name": "Affairs-case s.r.o.", "colour": "#5BDCCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639718426, "uuid": "3642dc80-2085-472f-b2dd-4a7bf650c5d4", "comment": "Malware payload (ParallaxRAT)", "value": "39f60eb7a016886e82c2e5177ade6b6eeb78358f3ad2da3377a0037c5899efadf5d898d24b7698e73460c6d6cbae73cb", "object_relation": "sha3-384", "Tag": [ { "name": "Affairs-case s.r.o.", "colour": "#5BDCCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639718426, "uuid": "82d0e5fe-e663-4282-ac55-72ddf49551ac", "value": "T1F8F57B2239444076CD6306309E15F3F5A6EEAD604B3941E7D29CFA392D7ECD24A2D36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639718426, "uuid": "023d67c5-d616-4d57-a49d-644d39b586bc", "value": "d16e5b8c43a69e9350542aaf46938ace", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639718426, "uuid": "31daa4fb-9740-4033-8855-5f9a8292a5dd", "value": "98304:yfnUVtjhW699lMh6CMiEgWQ/kuFV2EOAJATGbLtMi:yfnUVt9diE+ATGbmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639718426, "uuid": "3e3590ca-c17a-4587-a13e-4baa221bebbc", "value": 3500208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639718426, "uuid": "5e168427-f61a-4bdd-a041-e6c722c0a700", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639718426, "uuid": "cd1a98fc-b6ea-4872-b043-df31c5cfe221", "value": "f0b3b36086e58964bf4b9d655568ab5c7f798bd89e7a8581069e65f8189c0b79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4695dfd8-5f7e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639775649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775649, "uuid": "007c6199-b63a-437c-8cf1-08077ac5e0ca", "comment": "Malware payload (RedLineStealer)", "value": "bf20327f7b8a2632872249511efe28f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775649, "uuid": "0f9913dc-dbe0-4707-9c44-8f342aa08362", "comment": "Malware payload (RedLineStealer)", "value": "f21f15e4aabfecb16b4379315f02746a940088f466ebb463ccddf7d478d25ca4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775649, "uuid": "17f456b8-15e8-4d75-8c94-2cfd7172a75d", "comment": "Malware payload (RedLineStealer)", "value": "b26f09e6ec6796033ff25cf3ba8f7fd7a4137d11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639775649, "uuid": "1443eb45-d02c-4f41-9577-206e624f2f3a", "comment": "Malware payload (RedLineStealer)", "value": "3d72df9830a1656a37cb9408953d9b4a8b3adabf773a4e090747ed029acc7ab99494271fc54c8d1e3f6c9b043db9338c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775649, "uuid": "196ade5e-331d-4b82-b171-e5cfaaa8bb10", "value": "T172C4F63839FA5019F2B3EF759AE8B49ADA6FF7633703A45E205103464A13A80DDD163D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775649, "uuid": "f9e49570-c303-4731-8a54-e1e9391ad16b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775649, "uuid": "7c1b73ea-03e9-4021-bdd2-e0d0d4573049", "value": "12288:BphqkwgXEStlOdRSfuJmQ8ESqSi3wJG16aP0OPcIsm8lq+oB72:BpoHWES3HJwJcIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639775649, "uuid": "acfbfccf-3ace-486b-8dbe-4beb6a09402f", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639775649, "uuid": "0f299c83-1091-450a-9b0a-3392d352f8b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639775649, "uuid": "ebfb886f-124a-41de-b39c-99ecaa43482b", "value": "bf20327f7b8a2632872249511efe28f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654572a6-5f79-11ec-9275-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639773553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773553, "uuid": "0fb1fa1d-f084-41f8-9777-cb16a5f7c0c7", "comment": "Malware payload (Dridex)", "value": "50a363f636dd996a8aa99a571ad08ead", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773553, "uuid": "6a134627-6fe2-4a16-ba07-f780b14d1181", "comment": "Malware payload (Dridex)", "value": "f23745be4a29f0b56b0fbaaf198aabdbf564f3e94c07307bb95210f5f031f56b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773553, "uuid": "763c5c8f-6969-448e-b6a1-48eb167f519f", "comment": "Malware payload (Dridex)", "value": "3f2c1808c81ca0658f817a426641ecec3a1c41da", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773553, "uuid": "ca8ef87e-e065-468c-bb2b-37f643904763", "comment": "Malware payload (Dridex)", "value": "e67b5a79e768334309025d77e22a267c85dfdbe382bd75f7672ba6fff5dd084819e29c7dc203d9551bdf3d16d18c2a46", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773553, "uuid": "90f5c16c-de09-433a-b91d-cada64c551e6", "value": "T148B4BFAFC65E1478C7E31470159143B12EA640C6097ADEAF6B2FFA9C149634C227DB7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773553, "uuid": "f8717294-bffc-4f2c-a502-bc8689b70f20", "value": "1d03489a888f9eb61ae369ecc7b0879f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773553, "uuid": "c9c0cd10-e060-4a47-9d71-775a5410b844", "value": "6144:glkqY8IIaCme+UOwOYEKdvfrlEe/ply5ovxlbL6B4Q0XY:E3BdvlDx5OOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639773553, "uuid": "726e1f82-f3f5-4ec1-b457-7508a73e7955", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639773553, "uuid": "529202f6-d684-4d33-a018-dad361ae24b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773553, "uuid": "581b38ad-0ea8-4bb5-be41-e53202e4f535", "value": "SecuriteInfo.com.W32.Dridex.GB.genEldorado.2680.23711", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6e9155-5f09-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639725490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725490, "uuid": "a243012b-2776-4c36-b9b4-59dfd0993161", "comment": "Malware payload (Formbook)", "value": "6e2ecf9936a86ee946e48264d385f6f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725490, "uuid": "b70e62ef-e337-443f-8235-334a5231bfaf", "comment": "Malware payload (Formbook)", "value": "f26c8230582080acd9756af444ae80bc874e3a2268c207cf69fb57f06720b63d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725490, "uuid": "63036a41-a277-40df-9542-bccd4ee58838", "comment": "Malware payload (Formbook)", "value": "85abc6674d21b0ae9f3831a629e6159a7c0988f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725490, "uuid": "c3788f4a-c0ff-4ac7-8174-7b1bc1eda306", "comment": "Malware payload (Formbook)", "value": "c617b1402b79be8ce33b4f96fa5c643f5d82327595b55ddd85e7c6f9289f0a02543e7d08a1e63803c7bca5bea7f6cb65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725490, "uuid": "bf625644-8255-4e85-8dc1-329dd2cdc332", "value": "T1BCA402C5F154969DF0AB03BB60E44995DBF115A32803DF4A05793FD6BE223841FA1B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725490, "uuid": "ddcf5c92-464e-4cbe-8748-df2f119dbfe7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725490, "uuid": "8cafe756-1869-4714-9df2-36da827aabd9", "value": "12288:3D4jcFtoU8nZ4mvh2Rd4HS25WxJ5jKpCTauSK3vkmyyy1pWyi:3D4uFmvhIkmLxSK3vkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639725490, "uuid": "48ca3522-337a-4c49-9a05-7ba08ec8ef94", "value": 481280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639725490, "uuid": "1230f8c4-359e-4f44-bc3b-417f4a91887e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725490, "uuid": "455b1b9f-47c2-4e58-a86a-ee8e553e85d1", "value": "DHL_119040 Dokumenteneingang,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba2d2d4-5f53-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1639757297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757297, "uuid": "da58066f-4e19-41ab-88a2-676f786099db", "comment": "Malware payload (QuasarRAT)", "value": "5f64ee11c60213e80205504607b8e5e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757297, "uuid": "ff7bf442-b42b-445e-a417-9fbe23b81338", "comment": "Malware payload (QuasarRAT)", "value": "f2a12d86d8af81d201cc5d17cc40615163dc0c62878fb7984eba06255ce3ec55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757297, "uuid": "99afdcfb-97eb-4d39-b8ec-be7d27b77e1e", "comment": "Malware payload (QuasarRAT)", "value": "819f17fb04c7a5484ca7afd08da7ac9645ad6ee7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757297, "uuid": "87a14e2a-3cb9-4677-9393-5eef70e32477", "comment": "Malware payload (QuasarRAT)", "value": "dffe4f4cc83490d50c5d4a51b859e5097db0ae14c01c92d013f43de389dc7ef7388e970908c31589ff74bd290d3a6c16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757297, "uuid": "c83b1171-83db-4864-8998-66d7b410f8a7", "value": "T154943AD2E284D98DC41B0277CC3AD9716417AEAE8574861E246E7D2B76F7383206BD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757297, "uuid": "b8d4e7bf-0ea0-4aa3-a6c5-9479c0932560", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757297, "uuid": "b7ac2947-ea28-4142-83b6-cded50d9b916", "value": "6144:/RGGGGGGGGGGxGwCpb/OAA0o5GGGGGGGGGGbGGGGGGGGGGhGG/DGXxvXJG85PmWK:b5K/O+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639757297, "uuid": "94670d0d-74a1-44b7-a98b-dce90233d353", "value": 430592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639757297, "uuid": "40d55e81-823d-493d-bbab-be6cca004d86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757297, "uuid": "233a4130-5533-46e1-a3bd-481e5ccde6c2", "value": "5f64ee11c60213e80205504607b8e5e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79abdba-5f5c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639761209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761209, "uuid": "62113019-4d14-4e94-822c-414dc9b80082", "comment": "Malware payload (Mirai)", "value": "51629b52442f261caac56b8ff63c11fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761209, "uuid": "321f1b54-3522-4be0-b379-8faf840bee96", "comment": "Malware payload (Mirai)", "value": "f2edb87a0a584767e16a95ad495159d3c5907f9f3dd02efc1b486884e9ce673c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761209, "uuid": "9f116162-200d-4be1-8e2a-786d2b3084ed", "comment": "Malware payload (Mirai)", "value": "b34ae281162198fd5557a81a1894fe319c61fd46", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639761209, "uuid": "5aafcd8c-b059-4b7b-8e05-244da841399a", "comment": "Malware payload (Mirai)", "value": "da9402b4dadaf96937020dba06df9e14e99d7d66406af3954ec43aece31543e4c0d233ee377e285d4ba497d1f2137fea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761209, "uuid": "ec966295-c35e-46da-8800-04e11dbbd61f", "value": "T16883954D2E219F7DFFAC823987B79A21960533AA27E1C5C4D05CEA022E7034E745FB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761209, "uuid": "d50ad553-54ae-4e02-8a52-4f7636a567e5", "value": "1536:y2MI3DAoc6Qncq90vLEKN3TgPnEDg4iPK2PQ++tB:qkD+0T7NanEDg4iPK2PF6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639761209, "uuid": "7fb0c1ac-2346-45ab-81d0-4c9a2babe7e2", "value": 88000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639761209, "uuid": "8366fd20-3637-4046-87a5-ff941fd559ee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639761209, "uuid": "184300ca-2d42-41a4-97a2-e7e521a489db", "value": "pandora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac64bcb-5f62-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1639763926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763926, "uuid": "3c808e61-2dbc-40f8-869b-1bb36e35c4fa", "comment": "Malware payload (Mirai)", "value": "47c865457b3ddad22667796b66890660", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763926, "uuid": "edf04255-2aa7-448a-a81e-849b194d81d6", "comment": "Malware payload (Mirai)", "value": "f4615d1e75064d8532be59861be11febd35720e6f020e1ca43d48bbe0fed5feb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763926, "uuid": "9f030de7-3441-4ab4-8cae-549ed2a3e29a", "comment": "Malware payload (Mirai)", "value": "51185d880dde3845bd11b5d215de47d28612f47a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639763926, "uuid": "cf5ef7b8-8c17-4354-b76c-205c03e38ddd", "comment": "Malware payload (Mirai)", "value": "bf75fc4e1f1a342873f5a2035dfc29c291aeeff19c13fd23b661068dd51366e515291e7b00a4e361e192fa75ee2d3342", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763926, "uuid": "3d51a9ca-a1f3-4934-83e7-383d8b6baf23", "value": "T10753AFB7C4A89D98DE255578F21088399723E008A5A73DF6EA46C656D05BEECF00C7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763926, "uuid": "66bc7178-90da-4963-819b-0543e582e786", "value": "1536:I/xN6GOJeaUV7Y3bQIf2sOqsqX4sUEfs3C+/sMDr3d3C0Kxi:IJNsYjY3bQIgqsqXlf+/Lrt3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639763926, "uuid": "b52eb043-4c7e-487a-a256-f227449f3401", "value": 64344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639763926, "uuid": "d00b4f17-c2f1-4aad-98b2-e4c4bb6f68a3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639763926, "uuid": "c3f19e30-45b9-4862-88af-9587a27732e9", "value": "47c865457b3ddad22667796b66890660", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815169a7-5f08-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639725067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725067, "uuid": "e9e9e1a2-8f21-44e5-8f58-e773f0f1b821", "comment": "Malware payload (Loki)", "value": "45893bf388efbe3c3efadfad3ee44ac7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725067, "uuid": "5082d3a3-2238-4584-a363-b0eac721e66d", "comment": "Malware payload (Loki)", "value": "f6025e0045801cd340199a6b8716b4a81855b0a5e1a45b9b99c44995b6bc744a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725067, "uuid": "dbde04e6-9dd9-43f2-9a1a-767b3517fca7", "comment": "Malware payload (Loki)", "value": "98cbd40b1a9c3dc475f855a0063dbfaf53a467ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639725067, "uuid": "8d390cab-eb0b-4e56-80f6-67bed1e474e0", "comment": "Malware payload (Loki)", "value": "e847df79a5b293716ed3e9490147d4f24ba939b5e649b6e2aa9417c21faeb6020b5ac85283f212b710a557d77e8848cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725067, "uuid": "26a8c967-f191-454a-83a4-a97719d072d1", "value": "T17BE4D063668B4B93E2A3427951C5B30D363CE5E30797D36770189A112CAAFD84B8EC7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725067, "uuid": "10b5eda1-a3a8-4f25-8538-4dca6b65ffda", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725067, "uuid": "76c8aa05-cdaa-4c94-a2d1-30c553031e67", "value": "12288:0HoQMD6eaB+KQz73ENzfBJgbumRleh8Rhkl+GrD+qizgCqAEUfrD:0IQM+z+zMfBCbuAO889iP1rD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639725067, "uuid": "ce658dc0-f6e0-4328-a677-afba16e60ee1", "value": 679094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639725067, "uuid": "f75da4fe-25bf-4989-9181-6be030cef9a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639725067, "uuid": "a3df83b8-9b69-4c15-85d2-5bc6bca32e2d", "value": "NNEW PURCHASE ORDER NO 109807645893024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98070e7c-5f0d-11ec-9275-42010a9c0029", "comment": "Malware payload (DanaBot)", "timestamp": 1639727253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727253, "uuid": "4831d3bf-efac-47d9-b09b-a4a23fcd339c", "comment": "Malware payload (DanaBot)", "value": "8f1a74f261b78c3df1a66ddc46cfab10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727253, "uuid": "73babf6f-0ae3-4d96-9743-b34a7abfb082", "comment": "Malware payload (DanaBot)", "value": "f60d2c6bda016a6fd0d165a5ee38ed4dceb39c9835ce0dfb6d5b1ddf31dd6f5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727253, "uuid": "567b15e5-8d0d-46f3-a068-d9e196437c9e", "comment": "Malware payload (DanaBot)", "value": "938c767a5b123fcf4491ad1bbfd98038aa8800fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639727253, "uuid": "fcaead28-e842-4f6e-a700-c690406e56f2", "comment": "Malware payload (DanaBot)", "value": "e9725df810d7f876a1eceb80539950828cedfc61ccbaa6ecee7752fc23b23608f4e4f3fd47c57c22633b24774b13f233", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727253, "uuid": "cbba96d6-6f93-4eca-9c3f-431fbcb6e3bc", "value": "T19485237769ABD6B1CBDB6BB16E189BA5D93F26315A2145933600133E1E31EAC40F370C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727253, "uuid": "0bff80f8-2ac1-4856-8aa5-2b000a20fd6a", "value": "44c00401a20ce3d35e55418765dd0985", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727253, "uuid": "311e9d44-b82a-48e4-861f-49a09498a546", "value": "49152:d9c0qngHhvW+Jzdl5Y5TwLWbj0tD3QerfxI:3cfngBvW+JBwwS/0tDQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639727253, "uuid": "e9103aad-152d-4ccf-b047-37c03d5fc52c", "value": 1764352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639727253, "uuid": "8b7eefff-f01b-4751-bfe5-b09441a19dc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639727253, "uuid": "34ce13cd-e9d8-460d-9cbf-940b826b6f3a", "value": "8f1a74f261b78c3df1a66ddc46cfab10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8489b575-5f53-11ec-9275-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639757285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757285, "uuid": "9b3c2100-3a45-49ce-a89b-a8cbbb48c1bd", "comment": "Malware payload (Dridex)", "value": "8dfd6666aa33aa2e603c3b7ac36d110e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757285, "uuid": "f75e5a58-1c70-481d-b11b-6e1618abac25", "comment": "Malware payload (Dridex)", "value": "f7ad83f244477c4ca18f0c0d6965dfd062110e6b022d4446627218f30778c4b4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757285, "uuid": "cda255f6-eee1-4515-b4b2-9d44242d59ad", "comment": "Malware payload (Dridex)", "value": "dc140918146696f1fb8fcac68e2144bb72e4bf9c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639757285, "uuid": "06a72a4a-483e-405e-b8c2-7ca52605e5df", "comment": "Malware payload (Dridex)", "value": "c203b735124833e303ab5257c484046fe5dc3d2c1d503be1bbadd9b5d1d41b06a496f260127381dcdb3cb247bb72e42b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757285, "uuid": "4e6398f3-8257-4df7-9d28-a952c89a2297", "value": "T1D2B49FD8BCD83B58E513C23BE3B1786B39DAC632360D4F9876B476E6409990407E52A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757285, "uuid": "4de1d037-2e87-406d-84f1-8cb7ce12c3fe", "value": "7952cba754ea16e45d9a81dbc9bfeb9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757285, "uuid": "7c398332-c5fb-4a11-8415-15e3bec95cf9", "value": "12288:qRMksDQdUDsdAvsH4XKZOrqFg1oGAtlwbELxn/:GM1Ce+y+SiQqar3gF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639757285, "uuid": "276e9dc5-f779-4a99-ba40-d235258aa616", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639757285, "uuid": "16aae08b-a5b6-490e-b187-7a167dec5e26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639757285, "uuid": "9e441c26-d241-4a2f-98c4-a82161b1bffe", "value": "8dfd6666aa33aa2e603c3b7ac36d110e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff546d8-5f4c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1639754485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754485, "uuid": "74e8cc47-d0dd-410d-a69f-b7fde4272e01", "comment": "Malware payload (Formbook)", "value": "1da139b5621f919bfbe5c64cbbbce516", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754485, "uuid": "d48d6b68-2766-4ff2-a326-26423edde3c3", "comment": "Malware payload (Formbook)", "value": "f84146281b8ffffdc316796c59ed29892f5f8b0c0d3127d4be22084abb103bee", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754485, "uuid": "9eb97c09-abe2-470f-887d-415904156b35", "comment": "Malware payload (Formbook)", "value": "bf0ada4024741f1de5f9780119bdd3536b4a1efc", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754485, "uuid": "c3756054-41e6-45ce-9c8e-e8dc59df1a45", "comment": "Malware payload (Formbook)", "value": "28b4eb02fb4e786d0647a1c721e4d8efb95a0e75f65b008600606e62534b0fa019298d3781057f3283cf09aaef24b3a0", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754485, "uuid": "ae7db01b-06d5-4708-9356-6c701068679e", "value": "T1C3C4D05172A8DB16D8BD67F88C60A0A003B67C6AA675E74F1CC07DEB35B5F9046A0F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754485, "uuid": "1400707e-d194-45a4-9a8f-bd0595b7a448", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754485, "uuid": "f8b1aad9-8ffc-458c-aba8-c25e998ff33c", "value": "12288:D8PapPapParWZDONRTPdUZFKMYE1LZ6dFdiGbcuSK3gy1:D8P8P8Ps7VMYaLZKFsG7SK3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639754485, "uuid": "d785ee63-8058-490c-9e4a-9cd538972214", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639754485, "uuid": "6d6e9799-2fc4-4735-b8d3-2c2a56dcff94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754485, "uuid": "85b36ce4-57f1-4fa9-b36e-974985f0f51c", "value": "DHL_119040 documentos de recibo,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088ccc40-5f4d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639754500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754500, "uuid": "4d4e8d67-17f8-4e40-9e17-dc63cd906dc1", "comment": "Malware payload (AgentTesla)", "value": "1b197e01fd887672df67280e198e708a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754500, "uuid": "642b3dbf-95ef-47f7-a15d-77b2df57c6c6", "comment": "Malware payload (AgentTesla)", "value": "f904aa6824dae1480255d180c30cc1e7a651f767a03cabd87d7c6da818a61723", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754500, "uuid": "6cc758c4-6cce-409b-8044-7f90857188c8", "comment": "Malware payload (AgentTesla)", "value": "b7e97763148f2c6bd468404d5a73a9577aaa578d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639754500, "uuid": "ad5b01e1-2e6f-49ec-bad3-aaf4a944bc2c", "comment": "Malware payload (AgentTesla)", "value": "8d930d42fbfed00a6169f35d910ac3edfde346aff5df3ac9cf68ab578a70fb04b7f068423a425f89f6f49061ae8aa945", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754500, "uuid": "dc74871f-bc59-4d36-a5de-e78fb5e7c3e2", "value": "T1F3658B0E33BCC6ABE5BE5234F235073786ADBD43A665E74D597182AEDC4B7C408103A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754500, "uuid": "2ac6bb67-b324-4827-9dec-32b66fe4ac8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754500, "uuid": "52e5e51d-a038-44c3-9c4d-9ce28f194952", "value": "24576:XVgtwoi556fXaLq00dOMFHVrPJy37mMjSkd0Ntxo8HV1OAi:cTi5QfKLq00dOErPJfW2xHV1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639754500, "uuid": "74c2e416-14e4-410c-affe-82c389b56ab3", "value": 1411584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639754500, "uuid": "9cef2cfc-27fe-4d39-a5f9-893c0429ad96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639754500, "uuid": "352452ed-ad33-4291-85fd-200cdfdb9452", "value": "DHL_AWB_NO#907853880911000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6731c3bb-5f55-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639758094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758094, "uuid": "4075fe47-66e3-4c42-bee4-9d0ee2eaae7b", "comment": "Malware payload (Gafgyt)", "value": "25581e3c9ad944c717452e597928803d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758094, "uuid": "0b8a4128-e85b-48c0-8dae-cea801091c56", "comment": "Malware payload (Gafgyt)", "value": "f909230fb1e104d467902cf4d9d8d41f833ff2100436e2df4e689d94e19a291e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758094, "uuid": "796a49c4-d11c-4ad2-a1e6-7b1266f04f5b", "comment": "Malware payload (Gafgyt)", "value": "2509f13cffd9a39dab698a5a66e6d1ec5132d394", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758094, "uuid": "115cca84-a216-4df2-b433-11c612daa50a", "comment": "Malware payload (Gafgyt)", "value": "359cc510f5431712c3f554ce5d9bc18d63d17c9997f75defb50cc08f6228f52a527aa7991c00b38f93be235fa1ebc6df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758094, "uuid": "fe6c10a5-3043-427d-8bde-6cbd90f52343", "value": "T1F3B3E857FB11CEB3C85FDD730AA68A01108DA99746D57B6BB3B4DA5CE74684B08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758094, "uuid": "9c2c216d-7a12-44e4-b58f-900e0d5d909b", "value": "1536:Tgz/qzNLW/fMiZIX98U0I/QwErQNOy5hVwbfKdwwjF9GhCPR1Ae:Tgz/5f5g8utgO5hVwjKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639758094, "uuid": "da85fb6b-f96a-42b3-86ac-b008fb111356", "value": 116647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639758094, "uuid": "5bbf8fe7-31f2-4259-b055-de8d45dfabbe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758094, "uuid": "e361f2cc-902b-41a9-aca7-726760e95a97", "value": "25581e3c9ad944c717452e597928803d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4057be9-5ed6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1639703704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639703704, "uuid": "7ad5d6f5-a2b9-434d-aacd-d4ffa389af80", "comment": "Malware payload (RedLineStealer)", "value": "2a8b3839b5b915912d5802cdd4fbbd3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639703704, "uuid": "8d6dfff1-5de0-4172-bf8a-c13600b4182e", "comment": "Malware payload (RedLineStealer)", "value": "f98e925c1ccab5e997e6e4e2349c4a31dcdfabebbf267d1bbf7943f35f0d4b57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639703704, "uuid": "66fc77e4-cd42-4358-b5f1-31419d0d61ee", "comment": "Malware payload (RedLineStealer)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639703704, "uuid": "39053cc1-009c-4d0d-aa59-38932ebf6ebb", "comment": "Malware payload (RedLineStealer)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639703704, "uuid": "947ace1e-c85d-4a7b-bd94-32827daf6fa8", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639703704, "uuid": "7843de71-de35-4815-a496-e3d59997e5b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639703704, "uuid": "5fc75364-d2d3-408f-aaea-2f719f9094dc", "value": "2a8b3839b5b915912d5802cdd4fbbd3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d52b1a5-5f50-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1639755823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639755823, "uuid": "5d9f3cfd-244b-4655-ac0e-b01d83bd1a90", "comment": "Malware payload (Quakbot)", "value": "ffa95ac26838fd8f26dec613343173a2", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639755823, "uuid": "d2c6cb45-2794-4ba8-8d90-c571745ca339", "comment": "Malware payload (Quakbot)", "value": "f9ac16f1e70bc00b1a6fe9adcd8bc1e36c2dcd143b1003f65d8bd39487bdf8c0", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639755823, "uuid": "b4af1ddc-e931-4746-a34c-76ab4162e313", "comment": "Malware payload (Quakbot)", "value": "fc4c129126311fc7d3bd6175e541c72e3b6bd22f", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639755823, "uuid": "43d6b239-3898-4715-bc71-a30410e98c59", "comment": "Malware payload (Quakbot)", "value": "fb067916f92979834b3c1ef37a1e4a9432c7029c34c1bb579c4e0a7c0f4ad531ac23822301f4711923e5b70f196bf06d", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639755823, "uuid": "6699cd02-ce4a-4e5e-91cd-b1e4811a4b84", "value": "T1A8140209783CE8DFCB2B2532D608BFA7821B5060D9C17C2DA5C9784C5E51EBE7A8D58D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639755823, "uuid": "8209ed19-bcdd-492c-adc0-4289e1ee0bf5", "value": "3072:uFcfEIz6t8weEGc33rk590Du99wpFlUz7o8NXKRlzpG7/UQXIqdtKcmIDYPIZE8o:uFcfEw6R9537k5WSOeME6rGj/m/58DDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639755823, "uuid": "cb2331ca-fc43-48b3-9ee8-372252aee7b7", "value": 207249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639755823, "uuid": "0be2a7d3-6c5d-4752-9971-1ea0bd1693e7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639755823, "uuid": "699e47c8-287d-4e9b-ab6a-62c724696c11", "value": "BH-1272827655.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629a3146-5f55-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1639758087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758087, "uuid": "1430b195-a60b-4f1e-8d40-a145ea6148b1", "comment": "Malware payload", "value": "fdaef08a61aa068722fc5a544ffe10be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758087, "uuid": "f5eca13d-fad6-4b7a-9c30-d54681f9125d", "comment": "Malware payload", "value": "fa20666ddef2dcc581feec3be79cd35b4d9f44e2dc713ee0eaeae73673b83b0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758087, "uuid": "67659951-a35a-41c0-96e0-8c1677787e10", "comment": "Malware payload", "value": "82a4cafc6a2593fea5e9c4b84ddb11d7db3734cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758087, "uuid": "a48e4c71-c25f-447a-851d-d85d0e867b37", "comment": "Malware payload", "value": "218b53b86f2ef7ed1ce77560dea6834753471d0a666026203392662b3a8a9301fb8cef0c646267c30ff1a874a338f047", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758087, "uuid": "30206ce9-3825-4494-83a3-e2114c2f2f2c", "value": "T176C4DF0072A8DB12D4BDA7F84C6064B443B57CAAA52AE70F2CC17DEF75B6F804690B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758087, "uuid": "2016efbc-77e8-4191-b314-c3479dfa2231", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758087, "uuid": "d31241c6-5895-4599-945b-b575e11df7ce", "value": "12288:wd8PapPapPaOURugAqVRykT+weaLp0MdYRj/S2SuSK3:u8P8P8PnUsPqzy6X9Gk2xSK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639758087, "uuid": "4932d965-d209-4ad1-ba36-eb3ffb464a15", "value": 553472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639758087, "uuid": "d3f07e50-b30f-4d02-9e88-0af4f0e3d20c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758087, "uuid": "d39295b5-dc15-4bf9-89ee-c0c29f5549fb", "value": "fdaef08a61aa068722fc5a544ffe10be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640f0d2e-5f79-11ec-9275-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1639773551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773551, "uuid": "b6feb767-863a-46f7-be34-27adcd8ba83b", "comment": "Malware payload (Dridex)", "value": "5fac1b8056262ad62f063f15a634767d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773551, "uuid": "07583178-bd3b-43b6-ac36-789b333978e7", "comment": "Malware payload (Dridex)", "value": "fa6c655808971ccaccc20df19ea71ad73cc93d369e7939dc8eda4db581d19cfc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773551, "uuid": "287ddaaf-7c76-4be0-b678-b5b8387200a6", "comment": "Malware payload (Dridex)", "value": "3363deba225b0f8fffc3617d83ac690910da3e06", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639773551, "uuid": "88827f00-559b-4832-a9d1-d33ef455e3ce", "comment": "Malware payload (Dridex)", "value": "c3bf2be1fe84dde69094166efefe5c34b1b3bd7c2f76a5bb91444626fb0b959cc162b1c4f223a853010e4eb0a5d06291", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773551, "uuid": "0004de80-83df-4d4f-b8ba-0a04f0cd42c8", "value": "T1BBB4BFAFC65E1478C7E32470159143B12EA640C6097ADEAF6B2FFA9C149634C227DB7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773551, "uuid": "56ae203f-a5f2-45c7-8c41-4813ca45c6ea", "value": "1d03489a888f9eb61ae369ecc7b0879f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773551, "uuid": "e90fe921-4c17-445a-a86e-a8f6d67a2959", "value": "6144:GlkqY8IIaCme+UOwOYEKdvfrlEe/ply5ovxlbL6B4Q0HY:q3BdvlDx5OCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639773551, "uuid": "d2217b9c-e6c0-4e31-b337-51662993ad9c", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639773551, "uuid": "6989cf06-0b57-4bd0-baa2-a90b3385d317", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639773551, "uuid": "52512662-ba62-4128-aabf-fc685ee66355", "value": "SecuriteInfo.com.W32.AIDetect.malware1.30871.16461", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386af443-5f1d-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1639733964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733964, "uuid": "c92e912a-16cc-4ba3-b3d4-b34cd2913651", "comment": "Malware payload (Loki)", "value": "ba84b502d9c662cbedb233191291acc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733964, "uuid": "45c3fffa-7127-4f46-be42-6786f4f94462", "comment": "Malware payload (Loki)", "value": "fb39c88395968ad6f5c44e979d98ceae4b1df9c0fd927c7ce8dbed38b7c96182", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733964, "uuid": "8ee2facf-d192-4447-9f50-59df92a5d235", "comment": "Malware payload (Loki)", "value": "3b23e72d68267e468a762498e27b51b5e2981397", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639733964, "uuid": "d04f540f-9e93-48cf-9b3e-2666805a1126", "comment": "Malware payload (Loki)", "value": "a8aea2f34278b961d9b5b9ccd539d631755228ad6d7bfc07c9ff7a3e7ffdd1738c5ed591f61bfbb46113a84a31287283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639733964, "uuid": "7ee430fc-f210-4b55-8ec4-19cdf9750536", "value": "T112A4230775D38EABC9B88176017BC7B8D3F1C98D8087474B77D81DAE0F69A55070E1AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639733964, "uuid": "58bb32bf-da45-4613-8729-c682df1df22d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639733964, "uuid": "49906166-3c51-4ed1-b364-f4f15b4d2dba", "value": "12288:pfi9IYuh8QeoFugJixM8KQUgZF7Vy9JRP2rQ:Zibuh89V0ie8fF7Vy9JMrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639733964, "uuid": "9068ac4b-0f39-42a0-bdbf-31bf4ca5a7cd", "value": 480260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639733964, "uuid": "0ac93b30-a231-4b63-91f0-7882f6ab90aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639733964, "uuid": "c106acef-464c-4e0a-907b-5aba2a9dbba1", "value": "facturas pagadas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f517e79-5f55-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1639758108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758108, "uuid": "e63153a8-8989-4575-adca-b5a7d54eb8d2", "comment": "Malware payload (Gafgyt)", "value": "7df57fdc729effe595f1429e05375767", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758108, "uuid": "85ffd80d-28d9-4c01-896f-218592c17626", "comment": "Malware payload (Gafgyt)", "value": "fc78126509a8c4a795e1c522ca26819453149e73946eca1aab56d25a326efdce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758108, "uuid": "8d01a1f0-0a62-4d0f-83f1-fad09bd26627", "comment": "Malware payload (Gafgyt)", "value": "d014eb19c2316dea072cb68662a93f7ca061a5b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639758108, "uuid": "d8b330f8-c0bf-4c88-9ce7-d668eecd5069", "comment": "Malware payload (Gafgyt)", "value": "cd50174b51c526095d3ddacfbc34fecfb93a72e1dd264ee02c4eef38b2c92b1e9aad6434aeced1eb5a1b33a0208a588d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758108, "uuid": "9d5f6286-9bc2-444f-841e-8f568b3f6b11", "value": "T121A33A37BB130A23C0CA547212E30731BBB5D3D928FA5247BAA16DEC6F166803526FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758108, "uuid": "37fb91ce-b96d-425f-948e-b8a39b3cab9e", "value": "1536:xfRuqNM5h7t/RiRt4nlphaQoRKzO6F6OXj6ufeRTe:OqN8jRiRmphaQoRKzO6F6OXGufcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639758108, "uuid": "b5b53718-95da-4c10-ad96-737efa8a7efc", "value": 102442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639758108, "uuid": "17490729-6435-40e9-9efb-55970f6d4fab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639758108, "uuid": "0059437b-122e-4a2b-93bd-47ab3a14d918", "value": "7df57fdc729effe595f1429e05375767", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bff82f-5f07-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1639724643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724643, "uuid": "d0a09917-88c7-4f95-b1b0-ee15b60533ac", "comment": "Malware payload (AgentTesla)", "value": "0ad4b44c19ead0b1a9a1927bfe6f1002", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724643, "uuid": "26c2a996-b635-498d-89b1-666ec2ad474f", "comment": "Malware payload (AgentTesla)", "value": "ff7a9a6fada63c365115951dc67d07b3ef1f6c1897e44083463fd9f0651bc3bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724643, "uuid": "6f99b4e0-0fb1-4526-b3bc-84ca0ad9720a", "comment": "Malware payload (AgentTesla)", "value": "bfd99e5ce743bb41fd47917a36a8351f2a3a24b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1639724643, "uuid": "e2356356-d4f4-4134-a0fa-ebc665be0def", "comment": "Malware payload (AgentTesla)", "value": "fe8c41c33b803d735cec338e119119b49875768e68bf7b982ab2535a8d6910aaa2fab3ed566576a65917c75f845b729f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1639724643, "uuid": "d6f76133-1354-4c65-8288-46a9db77aef7", "value": "T104B44BE2D2494996E85543BA8472CD3A1267BEA99974D62A10DF7C3FFB733C30463807", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1639724643, "uuid": "eea65610-96fe-4131-9e3c-bd916ae73ac8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1639724643, "uuid": "2f2f0bd9-685c-41b7-bbb4-1a8057281b06", "value": "6144:WImbjcjWk8u/Y/FnEIfmDXXcWjHXl5JbU/O7rhbHv9A/EDRtaL:WlkXYtEIfmDXXTNCMhjF7R6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1639724643, "uuid": "4723c2d3-bd79-4890-a2ef-62aa0234ea26", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1639724643, "uuid": "d2e68fc3-21c4-41d7-b297-5f6dac876897", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1639724643, "uuid": "720bf409-d16a-406e-8de8-bbf97737304e", "value": "order_view.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }